  Large-scale collection of human behavioral data by companies raises serious
privacy concerns. We show that behavior captured in the form of application
usage data collected from smartphones is highly unique even in very large
datasets encompassing millions of individuals. This makes behavior-based
re-identification of users across datasets possible. We study 12 months of data
from 3.5 million users and show that four apps are enough to uniquely
re-identify 91.2% of users using a simple strategy based on public information.
Furthermore, we show that there is seasonal variability in uniqueness and that
application usage fingerprints drift over time at an average constant rate.
