Privacy-Preserving Data Fusion
Longxiu Tian, Dana Turjeman, Samuel Levy
Marketing Science · Wed
Abstract
Data fusion combines multiple data sets to improve inference, but it can inadvertently reveal user identities, even when data appear anonymous. We introduce a privacy-preserving data fusion (PPDF) methodology, combining an expressive multidata set variational autoencoder architecture and a differentially private training procedure. Additionally, to aid managerial interpretability, we develop a posterior reidentification metric to quantify individual-level reidentification risks under data fusion and formally derive the analytical bound to the heightened privacy risks posed by data fusion. We showcase PPDF’s abilities by fusing an anonymous customer satisfaction survey and a customer relationship management database of a large U.S. telecom provider. In a predictive churn-prevention campaign, PPDF achieves a 1.46% campaign lift without revealing any user identities compared with a 1.66% lift in a model without privacy guarantees, in which nearly 7% of users are reidentified. A heterogeneity analysis further reveals these individuals as outlier customers who exhibit persistently higher risk of reidentification, underscoring the nuanced trade-off between individual-level privacy guarantees and overall inference quality. More broadly, PPDF enables organizations to harness the full power of data fusion without violating user privacy—offering a practical solution for firms, governments, and researchers seeking to extract value from sensitive data while ensuring individual confidentiality. History: Olivier Toubia served as the senior editor. Funding: This research was supported by the Israel Science Foundation (ISF) [Grant 287/23]. Supplemental Material: The online appendix and data files are available at https://doi.org/10.1287/mksc.2023.0068 .
Keywords
differential privacy, data fusion, variational autoencoders, generative modeling, selection bias
Enable JavaScript for citation tools and additional paper interactions.