How To Break Anonymity of the Netflix Prize Dataset

In October 2006 Netflix launched a $1 million prize for better movie recommendations and released 100,480,507 ratings by 480,189 subscribers, with dates, from December 1999 to December 2005. Customer identifiers were replaced with random numbers. The prize FAQ said that even someone who knew all their own ratings probably could not find them reliably, because only a sample was released and it had been perturbed.

Narayanan and Shmatikov show that this reasoning fails for data of this shape. Each subscriber's record is a sparse row across thousands of movies, and preferences have a long tail: most people have rated at least a few films that few others rated. In such data, a record rarely has a close neighbor. So a handful of approximately known facts about one person, such as a few movies, rough ratings and rough dates, matches only one record in the whole release.

Their method scores every released record against what the outsider knows, gives more weight to rare movies, tolerates errors in ratings and dates, and declares a match only when the best score stands well above the second best, measured in standard deviations of all the scores. That last test also lets it say "this person is not in the sample", which matters because Netflix released about one-eighth of its subscribers.

The results: 8 ratings with dates within 14 days, 2 of them wrong, identified 99% of records; 2 ratings with dates within 3 days identified 68%. Without any dates, 84% were identified from 6 correct out of 8 movies outside the 500 most popular. Comparing the public IMDb ratings of a few dozen users with the release found two matches far above any other candidate, revealing those users' full Netflix histories and, from them, apparent political and religious leanings. The paper argues that splitting data into "personal" and "non-personal" fields is a false dichotomy for records like these.

Removing names does not make behavioral data anonymous. Purchase histories, support-ticket topics, clickstreams, location traces and app usage are all sparse and long-tailed, like movie ratings. If a customer wants to share such data with a vendor, a partner or your team "because it is anonymized", this paper is the reason to slow down.

The outsider's knowledge is the real variable. Identification needed only what a colleague, a public profile or a review site might reveal. In a privacy review, ask what a motivated outsider could plausibly know about one person, not which columns are labeled as identifiers.

Dates are the most identifying field. In our simulation, two known items with dates within 14 days identified 96% of users, against 30% with ratings alone and 2% with items alone. Coarsening or dropping timestamps is the first step, and it is still not enough by itself.

Suppression works only by gutting the data. Our simulation removed items rated by fewer than 400 users, which threw away 45% of ratings and 91% of the catalog, before four known items stopped identifying anyone. Twelve known items still identified a quarter of the remaining users. Utility and anonymity pull directly against each other in this kind of data.

This shapes AI projects too. Fine-tuning or retrieval over customer behavior logs, sharing evaluation sets with a vendor, or publishing a benchmark from production data all create a release. Prefer aggregates, synthetic data checked for leakage, access-controlled environments over copies, or formal methods such as differential privacy when individual-level data must leave.