  AI-based face recognition, i.e., the re-identification of individuals within
images, is an already well established technology for video surveillance, for
user authentication, for tagging photos of friends, etc. This paper
demonstrates that similar techniques can be applied to successfully re-identify
individuals purely based on their behavioral patterns. In contrast to
de-anonymization attacks based on record linkage, these methods do not require
any overlap in data points between a released dataset and an identified
auxiliary dataset. The mere resemblance of behavioral patterns between records
is sufficient to correctly attribute behavioral data to identified individuals.
Further, we can demonstrate that data perturbation does not provide protection,
unless a significant share of data utility is being destroyed. These findings
call for sincere cautions when sharing actual behavioral data with third
parties, as modern-day privacy regulations, like the GDPR, define their scope
based on the ability to re-identify. This has also strong implications for the
Marketing domain, when dealing with potentially re-identify-able data sources
like shopping behavior, clickstream data or cockies. We also demonstrate how
synthetic data can offer a viable alternative, that is shown to be resilient
against our introduced AI-based re-identification attacks.
