  Human mobility is highly predictable. Individuals tend to only visit a few
locations with high frequency, and to move among them in a certain sequence
reflecting their habits and daily routine. This predictability has to be taken
into account in the design of location privacy preserving mechanisms (LPPMs) in
order to effectively protect users when they continuously expose their position
to location-based services (LBSs). In this paper, we describe a method for
creating LPPMs that are customized for a user's mobility profile taking into
account privacy and quality of service requirements. By construction, our LPPMs
take into account the sequential correlation across the user's exposed
locations, providing the maximum possible trajectory privacy, i.e., privacy for
the user's present location, as well as past and expected future locations.
Moreover, our LPPMs are optimal against a strategic adversary, i.e., an
attacker that implements the strongest inference attack knowing both the LPPM
operation and the user's mobility profile. The optimality of the LPPMs in the
context of trajectory privacy is a novel contribution, and it is achieved by
formulating the LPPM design problem as a Bayesian Stackelberg game between the
user and the adversary. An additional benefit of our formal approach is that
the design parameters of the LPPM are chosen by the optimization algorithm.
