  The rapid growth of GPS technology and mobile devices has led to a massive
accumulation of location data, bringing considerable benefits to individuals
and society. One of the major usages of such data is travel time prediction, a
typical service provided by GPS navigation devices and apps. Meanwhile, the
constant collection and analysis of the individual location data also pose
unprecedented privacy threats. We leverage the notion of
geo-indistinguishability (GI), an extension of differential privacy to the
location privacy setting, and propose a procedure for privacy-preserving travel
time prediction without collecting actual individual GPS trace data. We propose
new concepts to examine the impact of the GI sanitization on the usefulness of
GPS traces, and provide analytical and experimental utility analysis of the
privacy-preserving travel time reliability analysis. We also propose new
metrics to measure the adversary error in learning individual GPS traces from
the collected sanitized data. Our experiment results suggest that the proposed
procedure provides travel time analysis with satisfactory accuracy at
reasonably small privacy costs.
