###### Abstract  
Mobility data plays a crucial role in modern location-based services (LBSs), yet it poses significant privacy risks, as it can reveal highly sensitive information such as home locations and behavioral patterns. This paper focuses on the anonymization of mobility data by obfuscating mobility heat maps and combining this with a local differential privacy method, which generates synthetic mobility traces. Using the San Francisco Cabspotting dataset, we compare the effectiveness of the combined approach against reidentification attacks. Our results show that mobility traces treated with both a heat map obfuscation and local differential privacy are less likely to be reidentified than those anonymized solely with Heat Map Confusion. This two-tiered anonymization process balances the trade-off between privacy and data utility, providing a robust defense against reidentification while preserving data accuracy for practical applications. The findings suggest that the integration of synthetic trace generation with heat map-based obfuscation can significantly enhance the protection of mobility data, offering a stronger solution for privacy-preserving data sharing.  
m +
Footnote †: 2025: 15, 8065  
maps, capturing both frequently visited locations and overall movement patterns. HMC protects against reidentification attacks by modifying user profiles to resemble, but not replicate, the profiles of other users. Using these altered heat maps, HMC ensures a balance between maintaining data utility and enhancing privacy protection. The integration of local differential privacy (LDP) [7; 8; 9] through LDPTrace, as defined in the trajectory synthesis framework [4; 8], enhances the ability of HMC to protect against reidentification attacks.  
Heat maps have been used for many years [10] and are currently used [11] to visualize geospatial data in the best possible way and improve the performance of algorithms. The use of heat maps to anonymize individual geospatial mobility data and at the same time maintain its usefulness has increased [1; 2; 12] with increasing regulatory requirements, e.g., the EU General Data Protection Regulation [13].  
This paper compares the effectiveness of HMC alone and in combination with LDPTrace (HMC plus LDPTrace) against an Aggregate Privacy Attack (AP-Attack) scenario, as defined in Section 5. An AP-Attack tries to uncover personal information by analyzing patterns in combined mobility data, like heat maps.  
While HMC focuses on obfuscating mobility patterns through heat map alterations, LDP adds a layer of differential privacy by introducing controlled randomness, ensuring that individual data points remain unidentifiable even in aggregated datasets. There are other locally differentiable privacy methods, i.e., NGRAM, proposed in [14]. However, LDPTrace proves to be more efficient and faster--see [4]--which is critical when performing LDP on a user's edge device.  
Using the San Francisco Cabspotting dataset, which includes detailed taxi movement records, we evaluate both HMC and HMC plus LDPTrace, assessing their ability to protect user privacy without sacrificing the quality and utility of the data.  
This paper provides new insights into how combined anonymization methods can address the increasing challenges of privacy protection in mobility data:  
* It utilizes a combined approach using HMC and LDP to address vulnerabilities in mobility data anonymization, which has not been explored together before.
* It integrates LDP through LDPTrace to enhance HMC's resistance against Aggregate Privacy (AP-Attacks), a novel improvement over using HMC alone.
* The approach emphasizes preserving both individual privacy and the utility of aggregate mobility data, achieving a balance not previously demonstrated in comparable methods.