The Price of Knowing Where Everyone Is

My daughter stopped me before I could apologize. She had spent the afternoon at a polling place helping people register to vote, and I was late to pick her up.

My phone buzzed.

"I know." she texted. "You're at Trader Joe's."

She was right, but I hadn't mentioned Trader Joe's. How did she know?

Then I remembered: months earlier I had agreed to share my location with my family. On her screen, I was a blue dot miles away near a familiar parking lot.

I drove home wondering who else knew where I was.

The question took me back to 2019. For most of a decade I worked for Los Angeles County Metro, and one of my jobs was to study how millions of people moved through the county. My best intentions aside, I was the person on the other end of the blue dot.

The instrument

At Metro we learned to see the city in two ways at once. The first was the farecard, each tap a record of someone's journey. The second was a commercial location dataset of twenty-two million anonymous devices moving through five counties around Los Angeles. Together they provide information about where people go that rider surveys could never provide.

Our queries were practical. Which short trips lose to the car because the walk and the wait eat the trip? Which corridors bus and rail actually win, and by how much against driving? Where the frequent riders live, strung along the rail lines, and how much of each district's travel does Metro capture? And, from the bought map, the big one: how the whole county fills and drains across a weekday.

To answer them, every comparison ran through a routing engine I had helped to build based on OpenTripPlanner (OTP). This is the same trip planner that, on a rider's phone, said Take the westbound 704, arriving in seven minutes. I had spent years teaching a machine to answer one person's question: How do I get there? Now the same machine helped answer a city's: Where is everyone going?

We didn't build the dataset. We bought it.

There were no names in our data, and we didn't need them. Each rider became an ID, each ID dissolved into aggregates, into flows and pressures and the shape of a morning. That was the point of the work, and, I told myself, its mercy.

We bought four months of commercial location data the way you might buy any product from a vendor. The surprise is not that a transit agency studied movement. Transit is movement. The surprise is that our citizens' movements were for sale at all - that somewhere a company had already gathered the comings and goings of twenty-two million devices, cleaned the data, and offered it as a product.

The farecard data were different. We didn't buy them. Every boarding left a tap. Over four months, those boarding taps accumulated into one hundred thirty-three million records. At the time, though, they revealed only origins. Metro did not begin requiring exit taps until 2025, so in 2018 and 2019 riders' destinations were invisible to us until we bought commercial location data.

Outlines of a life

Neither dataset knew my name. It knew only a persistent pattern of movement. A device sleeps here. It spends its weekdays there. It leaves at the same hour every morning and comes home after dark. It travels beside the same few other devices, day after day. The name is missing, but the outline of a life is already there.

One day of that tells you where someone was. Four months of it tells you who they are.

Time is information.

Home falls out of a simple rule: the place where a device rests on weeknights, between evening and morning. Add a workplace, a gym, a church, the school run, and a person's week resolves out of the noise like a face emerging from static.

The farecard data did the same for riders. Its heuristics identified each card's home and up to three "regular" places it returned to. The authors would not call any of those places work. A regular stop could be a job or it could be a campus, and you cannot tell a commuter from a student by the shape of a week. That care matters, and I am glad we took it. It does not change the larger picture. Careful or careless, the data still drew the outline of a life.

The patterns held tight because people do. The top five percent of riders accounted for more than sixty percent of the trips. We are creatures of route. Most of what a system can know about you, you repeat.

A life in motion singles you out faster than a fingerprint

How anonymous is anonymous? Less than the word promises.

Those simple rules that turn a phone's movements into likely places - home, work, the grocery store, the school run - didn't come from me. They come from work by the Belgian computer scientist Yves-Alexandre de Montjoye. In 2013 he asked a deceptively simple question. Strip every name from fifteen months of movement records for one and a half million people. How little of someone's routine does it take before only one person fits?

The answer was four. Four places at four times: a Tuesday night at home, a Wednesday morning at work, a coffee shop you like, the street where a friend lives. These four stops will identify you with 95% certainty. Two points are all that's needed identify you with better than even odds.

That is why time is information. Every additional day is another chance for the pattern to separate itself from every other pattern. A moving life becomes distinctive simply by being lived.
The trail stays anonymous only until you introduce something that bears your name: a credit-card purchase, a geotagged photograph, an address on a form. Match the two, and every earlier and later movement becomes yours, for as long as someone keeps a copy.

The silence, and who wrote it

Read the paper now - a 2019 study of Metro's farecard data, with my name sixth among the authors - and you notice what is missing. Page after page explains how we analyzed farecard records: how we stitched taps into trips, inferred the missing end of a journey, and weighted the sample to represent the county. The commercial location data that made the citywide comparison possible receives a single paragraph. For the methods, the paper sends the reader elsewhere: "See NCHRP Report 868."

By the time we bought it, the collecting, cleaning, anonymizing, and packaging of millions of people's movements had already become an industry, mature enough that a public agency could treat it as a settled input and move on. We bought an instrument. We did not invent one.

I was an author of the sentence that waved the method away.

The same marketplace

Metro and Immigration and Customs Enforcement (ICE) were never buying the same answers. We wanted to understand a city. They wanted to find a person. But both answers came from the same marketplace.

This summer, the Department of Homeland Security moved to pay Thomson Reuters $125 million for access to its CLEAR investigative platform. Procurement documents describe continuous monitoring of millions of individuals and entities of interest, combining names, addresses, license plates, and geolocation in support of investigations into voter fraud and immigration fraud.

The movement is the same. So is the inference from routine. Only the question has changed.

I wrote once about how commercial, and increasingly public, websites quietly time how long you linger on a page. This is that story grown up: not the dwell of a visit but the shape of a year, and a buyer who wants it pointed at you by name. The customer changed. The marketplace did not.

Trails

None of this began with phones. An animal that moves leaves a trail and cannot help it. The deer packs a path down to water. A trail is how you find food and your way home. It is also how you are found. The line a deer follows to water is the same line a hunter learns to follow.

Gather enough of those trails and they turn into something no single animal intended. An ant colony settles on the shortest route to sugar because the better paths collect the most feet and the strongest scent, and the crowd leans toward them without any ant deciding. The aggregate computes what no individual knows. The data Metro bought read the colony, not the ant.

What has changed is not that we leave trails. It is that ours no longer fade.

Scent thins, grass lifts, a footprint fills with rain. A phone's trail is copied, kept, and sold. It waits. I read trails like these for years and never thought about the fade, because a trip planner cares only about the journey in front of it. I was counting on the forgetting, and the forgetting has stopped.

Getting out

I used to think the question had an answer. Turn off location sharing. Reset the advertising ID. Revoke the permissions that weather apps and games never needed. Do all of it; it helps at the edges. But the trail starts again as soon as the phone moves.

Your carrier still records which tower your phone reaches every time it wakes, because that's how the network finds you. That trail has no off switch, short of leaving the phone at home. In this decade, leaving the phone at home means leaving behind much of ordinary life.

Coda

When I worked at Metro I believed we were using a remarkable new instrument to understand a city. I still believe that. What I did not appreciate was that once an instrument capable of seeing a city exists, someone will eventually use it to look for individuals instead.

It did not become a watchtower. No one is bent over a screen watching you, and that is the point. It is a market: ambient, ordinary, assembled one convenience at a time from taps and permissions we granted without reading. Given enough data, it can single out any one of us on demand for whoever pays the fee. The surveillance we were taught to fear wore a uniform. This one sends a helpful notification.

My daughter's text was a small kindness, a daughter keeping track of a late father. It was also the whole thing in miniature. The trail was already there, and she knew how to read it.

Sources

The Metro study: Pragun Vinayak, Zeina Wafa, Conan Cheung, Stephen Tu, Anurag Komanduri, Jon Overman, and Douglas Goodwin, "Using Smart Farecard Data to Support Transit Network Restructuring: Findings from Los Angeles," Transportation Research Record (2019). doi:10.1177/0361198119845661.
The method behind the purchased location data: Cell Phone Location Data for Travel Behavior Analysis, NCHRP Research Report 868 (Washington, DC: The National Academies Press, 2018). doi:10.17226/25189.
Four points, ninety-five percent: Yves-Alexandre de Montjoye, César A. Hidalgo, Michel Verleysen, and Vincent D. Blondel, "Unique in the Crowd: The Privacy Bounds of Human Mobility," Scientific Reports 3:1376 (2013). doi:10.1038/srep01376.
The twelve-point fingerprint rule: Edmond Locard's fingerprint identification criteria, published 1914.
The rattlesnake's venom mark: Anthony J. Saviola, David Chiszar, Chardelle Busch, and Stephen P. Mackessy, "Molecular basis for prey relocation in viperid snakes," BMC Biology 11:20 (2013). doi:10.1186/1741-7007-11-20. The paper describes the mechanism as "a predator chemically tagging prey."
Cell-site simulators: Electronic Frontier Foundation, "Cell-Site Simulators / IMSI Catchers," Street-Level Surveillance (updated 2023).
The ICE contract: Joseph Cox, "ICE to Pay Thomson Reuters $125 Million to Find 'Voter Fraud'," 404 Media, July 17, 2026.
Dwell-tracking on public websites: Douglas Goodwin, "The Counter" (2026).

Figures: all are reproduced from NCHRP Research Report 868 (2018), which itself adapted several from earlier work — the phone-events diagram (Figure 4-1) originates with de Montjoye et al. (2013). Reuse runs through the National Academies and requires permission and a credit line before publication.