Privacy-Preserving User Profiling Using MLP-Based Data Generalization

Abstract

The rapid growth in Internet-based services has increased the demand for user data to enable personalized and adaptive digital experiences. These services typically require users to disclose various types of personal information, which are organized into user profiles and used to tailor content, recommendations, and accessibility settings. However, achieving an effective balance between personalization accuracy and user data protection remains a persistent and complex challenge. Excessive data disclosure raises the risk of re-identification and privacy breaches, while excessive anonymization can significantly diminish personalization and overall service quality. In this paper, we address this trade-off by proposing a context-aware learning-based data generalization framework that preserves user privacy while maintaining the functional usefulness of personal data. We first conduct a systematic classification of user data commonly collected into five main categories: demographic, location, accessibility, preference, and behavior data. To generalize these data categories dynamically and adaptively, we use a Multi-Layer Perceptron (MLP) model that learns patterns across heterogeneous data types. Unlike traditional rule-based generalization techniques, the MLP-based approach captures nonlinear relationships, adapts to heterogeneous data distributions, and scales efficiently with large datasets. The proposed MLP-based generalization method reduces the granularity of personal data, preserving privacy without significantly compromising information usefulness. Experimental results show that the proposed method reduces the risk of re-identification to approximately 35%, compared to non-anonymized data, where the re-identification risk is about 80–90%. These findings highlight the potential of learning-based data generalization as a strategy for privacy-preserving personalization in modern Internet services. They also show how the proposed generalization method can be applied in practice to transform user data while maintaining both utility and confidentiality.

1. Introduction

Internet services routinely collect large amounts of user data to create detailed user profiles, primarily to improve the user experience through personalization, adaptive interfaces, and targeted advertising. These data include demographic attributes, behavioral patterns, accessibility-related information, location data, and explicit or implicit user preferences. While these practices aim to deliver more relevant content and services, in many cases, all available data are collected indiscriminately, without clear evidence that broader data collection consistently leads to better personalization outcomes. This raises the question of whether collecting all available user data is justified, particularly when the benefits for users remain unclear. At the same time, increased data collection inevitably amplifies privacy risks and raises concerns about user trust, transparency, and data misuse.

User data may be provided explicitly or collected implicitly through interactions with various Internet services such as company websites, mobile applications, online surveys, social media platforms, marketing campaigns, and other digital channels. Implicit collection often includes extracting browser or device parameters, monitoring user behavior, and tracking interactions across platforms. With the rapid growth in data-driven technologies and artificial intelligence, organizations across domains, including e-commerce, healthcare, social networks, and public administration, increasingly rely on user data to optimize services, predict behavior, and tailor user experiences. However, even when direct identifiers are removed, individuals can often be re-identified through correlations or cross-referencing with auxiliary datasets. This illustrates that privacy risks persist beyond simple identifier removal and emphasizes the limitations of simplistic anonymization strategies [1].

Traditional anonymization methods, such as k-anonymity, l-diversity, and t-closeness, have been widely adopted to address privacy risks associated with data sharing and analysis. These approaches aim to protect individuals by generalizing or suppressing quasi-identifiers so that records cannot be uniquely identified. Although they provide formal privacy guarantees, they often rely on static rules and assume independence between attributes. As a result, they may significantly reduce data utility and fail to preserve the fine-grained patterns required for machine learning, personalization, and decision-support tasks. In practice, uniform application of these techniques frequently leads to over-generalization, reduced analytical accuracy, and weakened representativeness of anonymized datasets. Recent studies emphasize that privacy preservation should not be treated as an isolated technical step, but as a fundamental component of trustworthy artificial intelligence systems [2]. In this context, privacy is closely linked with other trust dimensions such as fairness, robustness, and accountability. Studies on trustworthy AI stress the importance of addressing privacy throughout the entire lifecycle of data-driven systems, from data collection and preprocessing to model development, deployment, and continuous monitoring [2]. Managing the interdependencies between these dimensions introduces complex trade-offs, particularly between privacy protection and data utility, which remain insufficiently resolved by many existing anonymization frameworks.

A key limitation of current anonymization approaches lies in the assumption that all data attributes require uniform treatment. In practice, different types of user data differ in sensitivity, contextual relevance, and analytical importance. For example, demographic attributes, behavioral patterns, and accessibility-related data pose different privacy risks and contribute differently to model performance and personalization quality. Few frameworks offer systematic strategies to categorize data by sensitivity and apply tailored anonymization, often resulting in either excessive loss of information or insufficient protection. Addressing this gap requires structured methods that integrate data categorization with adaptive anonymization while aligning with broader trustworthiness principles. Many existing solutions replace attribute values with predefined generalized representations. For example, an exact age such as “34” may be generalized to the range “30–40,” or a city name such as “Zagreb” may be generalized to a broader region like “Croatia.” While this provides basic privacy protection, it often ignores differences in attribute sensitivity and can significantly reduce data utility, highlighting the limitations of simple, uniform generalization. These challenges reinforce the need for privacy-preserving techniques that account for attribute correlations, sensitivity levels, and trade-offs with analytical accuracy, as emphasized in research advocating structured, lifecycle-aware, and context-sensitive privacy frameworks. To address these issues, we propose first categorizing the data, recognizing that not all data types share the same characteristics or privacy risks, and then performing generalization within each category. Applying generalization independently enables abstraction levels that reflect the specific nature and sensitivity of each data category, preserve more useful information for analysis, and reduce unnecessary information loss compared with uniform generalization. Treating all data identically can lead to excessive information loss or insufficient privacy protection, whereas category-specific generalization provides a more effective balance between privacy and utility, resulting in improved anonymization outcomes and better analytical performance.

The proposed approach was implemented using an MLP model trained on representative datasets for each data category. The MLP learns patterns, relationships, and distributions within the data, enabling it to determine suitable abstraction levels dynamically rather than relying on fixed rules. By processing categories independently, the model can apply context-specific transformations that generalize sensitive attributes while preserving essential analytical patterns. This learning-based method supports adaptive, scalable, and fine-grained generalization that better balances privacy protection with utility, although the effectiveness of an MLP still depends on the specific structure and characteristics of the dataset. Categorizing data prior to generalization also enables techniques such as sensitivity-based weighting or applying differential privacy per category, which are not feasible in a uniform generalization process. As a result, the method can offer stronger privacy guarantees while retaining greater analytical value across heterogeneous datasets. For example, functional usefulness and analytical value are maintained by applying bounded 10-year age intervals instead of extreme generalization, preserving meaningful demographic structure in the 2500-record dataset. This enables valid aggregate analyses, such as age-group comparisons and other users’ data, while still significantly reducing re-identification risk. The groupings of specific parameters are presented for illustrative purposes, and different applications may require alternative trade-offs between utility and privacy. Therefore, the proposed approach can be adapted to different scenarios, enabling systematic adjustment of the privacy-utility balance to accommodate specific requirements.

Despite extensive research on data anonymization, many existing anonymization methods treat heterogeneous user attributes uniformly and fail to adapt granularity across data categories. To address this gap, the paper investigates the following research questions:

• RQ1: Does category-aware generalization reduce re-identification risk compared to uniform generalization strategies?
• RQ2: Does an MLP-based approach improve adaptability and data utility relative to rule-based generalization hierarchies?

In this context, the paper proposes a category-aware anonymization framework and evaluates its feasibility through experimental analysis. The proposed approach should be interpreted as a conceptual framework rather than a validated anonymization algorithm.

The rest of the paper is organized as follows. Section 2 provides an overview of related anonymization methods. Section 3 presents the theoretical background, introducing the key concepts and definitions underlying the proposed approach. Section 4 presents the methodology approach. Section 5 reports experimental results and evaluates the impact of anonymization. Section 6 discusses the findings with respect to user re-identification risks and attribute disclosure. Section 7 concludes the paper and outlines directions for future research.

2. Related Work

Over the past decade, extensive research has focused on protecting privacy in data collection and processing. Approaches range from cryptographic mechanisms to anonymization techniques, each aiming to reduce disclosure and re-identification risks while supporting data-driven services. Despite significant progress, existing methods still face limitations. Cryptographic techniques provide strong guarantees but introduce high computational overhead and limited scalability in real-time or large-scale applications [3]. Traditional anonymization methods, such as k-anonymity and generalization, often reduce data utility and struggle with the dynamic and contextual nature of modern data environments [4]. In contrast, the proposed MLP-based generalization framework offers very good computational efficiency, introducing minimal overhead due to its lightweight architecture and the fact that model training is performed in advance, enabling efficient and scalable deployment. At the same time, its adaptive abstraction mechanism supports data minimization, controlled disclosure, and privacy-by-design principles, aligning the method with privacy regulations such as GDPR and HIPAA [5].

Understanding users’ preferences, interests, and behaviors remains essential for personalized and context-aware services, creating a persistent need to balance personalization with privacy. Many studies treat privacy and utility as conflicting objectives, without offering adaptive or context-sensitive solutions. These challenges underscore the need for methods that maintain utility while providing flexible, intelligent privacy protection.

Early research on data anonymization focused on rule-based techniques such as suppression and generalization. Influential models like k-anonymity, l-diversity, and t-closeness [6] protect quasi-identifiers by ensuring they cannot be distinguished within a dataset. While interpretable and suitable for regulatory contexts and smaller applications, these models suffer major information loss in high-dimensional datasets [7]. Perturbation and randomization add statistical noise to sensitive attributes but remain vulnerable to linkage attacks and often struggle to preserve analytical value [8]. Overall, traditional methods provide a solid theoretical foundation but fail to address the complexity and heterogeneity of modern user data.

With increasingly large and diverse datasets, machine learning has emerged as a promising direction. Cluster-based approaches, which group datasets into clusters to hide individual identities, preserve statistical properties at the group level but enforce rigid groupings that reduce data granularity and utility [9]. Neural network-based methods, particularly MLPs, have been explored for learning non-linear transformations that generalize demographic or behavioral attributes [10]. These methods offer more adaptability than clustering but are still limited by their focus on numerical attributes and lack of category-specific anonymization frameworks.

Variational Autoencoders (VAEs) have been applied to privacy-preserving data generation [11], effectively handling continuous or sensor-based data through latent-space transformations. However, VAEs struggle with discrete or sparse categorical attributes, are sensitive to hyperparameter tuning and dataset size, and underperform on structured user profile data dominated by categorical inputs [12].

Adversarial approaches such as Generative Adversarial Networks (GANs) and privacy-game formulations rely on adversarial training between a generator and a discriminator, aiming to reduce re-identification risk by modeling an attacker during training [13]. Although promising, they require large, diverse datasets, substantial computational resources, and well-designed threat models, making them difficult to generalize across domains.

Recent advances in the field emphasize the need to balance personalization with privacy, improve scalability for heterogeneous datasets, and support multi-category user data. Learning-based methods introduce flexibility, but also additional complexity, and no method eliminates re-identification risk. Generative models such as VAEs and GANs are mainly designed for data generation and distribution learning, relying on adversarial training. Although effective, these approaches can be unstable, difficult to interpret, and may preserve sensitive relationships in the data, especially when working with small-to-medium datasets and categorical features [12,13]. In contrast, an MLP-based generalization method learns deterministic, feature-level abstractions without generating new data. This makes it more stable, easier to interpret, and better suited for controlled anonymization of categorical and mixed-type user profiles. Our goal is to design an anonymization approach that effectively generalizes categorical and mixed-type user profile data while maintaining stability and interpretability throughout the process. The method operates by learning deterministic feature-level mappings that transform detailed user attributes into controlled abstraction levels, rather than reconstructing or synthesizing individual records. Thus, the choice of an MLP is not merely about simplicity but about architectural suitability for the structure, scale, and constraints of the anonymization problem addressed in this paper.

Modern privacy-preserving systems must address inference attacks, balance utility and privacy, and comply with regulatory requirements such as GDPR and HIPAA. In response to these challenges, researchers have proposed privacy-preserving models that balance personalized services with robust data protection [14]. Traditional anonymization methods typically use suppression, generalization, and perturbation to protect sensitive attributes, but these often reduce analytical value. Deep learning approaches, including MLPs, help mitigate these limitations by modeling complex attribute relationships. Although online platforms collect large amounts of user data for profiling, studies show that indiscriminate collection does not always improve user experience.

Our previous work [15] emphasized the importance of data relevance and sensitivity by proposing an anonymization method for accessibility-related information. By categorizing disabilities into predefined sensitivity groups, the method protected highly sensitive attributes and demonstrated how classic generalization can be applied to different data types. This highlighted the need to extend anonymization beyond demographic and behavioral data to areas such as accessibility.

Location privacy studies, such as [16], use clustering-based approaches to improve the privacy of user location data in telecommunication services. They employ self-organizing maps (SOM) to perform location generalization through scalable abstraction. Similarly, Blinder [17] uses a VAE-based federated framework to anonymize sensor data through encoder–decoder representations and adversarial training, enabling privacy at the device level. While these methods demonstrate strong trade-offs between utility and privacy, they focus on distribution-level personalization or domain-specific data, whereas our model provides attribute-level anonymization integrated into identity systems like Keycloak.

Adversarial MLP-based frameworks such as [18] learn anonymized representations by optimizing a latent space that preserves task-relevant information while suppressing sensitive attributes. The authors in [19] addressed privacy issues in human activity recognition by anonymizing wearable sensor data using VAE-based transformations to preserve activity recognition performance while reducing the risk of re-identification. This approach runs efficiently on edge devices and balances privacy and utility. A comprehensive overview of anonymization techniques in tabular data is provided in [20], which outlines suppression, generalization, micro-aggregation, and perturbation, and highlights the importance of aligning technical methods with legal frameworks.

Table 1 summarizes representative anonymization methods. These approaches differ in anonymization strategies, inclusion of neural network architectures, data attributes considered, and their main contributions to the field. The aim is to show how different methods, from classical clustering techniques to advanced neural network models, address the trade-off between data utility and privacy, especially in contexts involving user-related data such as accessibility, health data, location, or behavioral patterns.

Table 1. Comparison of related work on different anonymization methods.

Reference	Anonymization Strategy	Data attributes Covered	Key Contribution	Limitations
[14]	Sensitivity data classification and anonymization via generalization.	Accessibility data, location data	Introduces sensitivity grouping for accessibility and location data	Limited to accessibility/location; no scalability analysis, and only synthetic examples used
[16]	Location generalization via Self-Organizing Maps (SOM)	Location data	Uses SOM to blur location data when precision is unnecessary in telecom services	Focused only on location; not suitable for multi-attribute anonymization
[17]	Federated VAE with adversarial training to anonymize distributed sensor data	Sensor signals, personalized user patterns	Combines federated learning and adversarial training for personalized, edge-local anonymization	Computationally heavy; requires distributed infrastructure; limited to sensor data
[18]	MLP encoder trained adversarial to suppress sensitive attributes from latent space	Identity, gender and user behavior data	Learns anonymized representations via adversarial objective, preserving utility while obfuscating privacy	Relies on adversarial balance; limited explainability; no validation on large real-world datasets
[19]	Use a VAE (a type of deep learning model) to encode sensor data, then apply deterministic or probabilistic latent-space transformations to mask private attributes	Accelerometer/Gyroscope (Activity vs. Identity/Gender)	Real-time anonymization on edge devices	Domain-specific (wearable); does not generalize to categorical/tabular data
[20]	Overview of methods for tabular data: k-anonymity, l-diversity, t-closeness, suppression, generalization, micro-aggregation, perturbation	Tabular data: Direct identifiers, Quasi-identifiers, Sensitive attributes	Legal/technical synthesis; GDPR alignment	Static rules only; high information loss; limited adaptability
This work	Category-based generalization approach combined with MLP-based dynamic abstraction mechanism	Demographic, location, accessibility, preference, and behavior data	This paper contributes to privacy-aware personalization in Internet services by (i) structuring user attributes for systematic generalization, (ii) providing an adaptive MLP-based mechanism for context-aware data abstraction, and (iii) demonstrating the approach’s feasibility on real-world data	The study is limited by a small dataset, which restricts generalizability, and using synthetic or manually curated attributes, which may not fully reflect real-world correlations.

The critical gap among existing methods is their inability to effectively handle heterogeneous, categorical user profiles. Traditional methods are too rigid, clustering is too coarse, VAEs do not perform well on categorical attributes, and adversarial training is often impractical. None of these approaches offer flexible, category-specific anonymization that balances privacy protection with data utility across different domains.

Personalized services rely on user data, but existing anonymization techniques struggle to balance utility and privacy in large, dynamic datasets. Additionally, most current models do not adapt to changes in data distribution or user behavior. A flexible, context-aware anonymization approach is needed to ensure data privacy while preserving analytical value. MLPs offer architectural flexibility, supporting the customization of model structure and training procedures for different data types and generalization objectives. This enhances applicability in domains such as healthcare, e-commerce, and digital platforms, where both privacy and analytical performance are essential.

The proposed approach addresses this gap through category-specific anonymization using an MLP architecture, enabling flexible handling of heterogeneous user attributes. Demographic data, behavioral preferences, and access-related information can be generalized to preserve privacy while maintaining analytical value. This positions our method as a novel solution to the limitations of clustering-based, VAE-based, and adversarial techniques.

The main contributions of this paper are as follows:

• Category-based generalization approach: Groups attributes into categories to enable effective and structured anonymization, enhancing privacy protection while accounting for attribute relationships.
• MLP-based dynamic abstraction mechanism: Provides adaptive data generalization that balances privacy preservation with the retention of data utility for downstream tasks.
• Experimental validation: Demonstrates the framework’s applicability and effectiveness using the Netflix dataset, highlighting its potential for real-world deployment.

3. Theoretical Background

In recent years, the need for methods that protect user privacy while enabling data analysis has grown significantly, especially with the increasing use of personal data in research, digital services, and Internet of Things (IoT) ecosystems. Protecting user privacy requires methods that prevent the identification of individuals while maintaining the utility of the data for analysis. Traditionally, this has been achieved through anonymization techniques such as k-anonymity, which ensure that each record is indistinguishable from at least k-1 others based on selected quasi-identifiers (e.g., age, gender, postcode) [21]. Over time, extensions such as I-diversity and t-closeness were introduced to mitigate the risk of attribute disclosure by enforcing diversity within equivalence classes or ensuring that the sensitive data distributions of each group resemble those of the overall population. While effective for basic generalization, these traditional methods rely on static rules and uniform grouping, which can lead to substantial information loss and limit adaptability across diverse data types.

In contrast, Artificial Neural Network (ANN), and particularly MLP-based methods, can learn complex relationships between attributes, dynamically adjust generalization levels, and better preserve the essential structure within the data. By leveraging these properties, MLPs offer a promising approach for transforming data in a way that aims to reduce the risk of disclosing sensitive information.

Therefore, this section focuses on the concept of data generalization through a supervised machine learning approach, specifically using an MLP-based model. An MLP is a feedforward artificial neural network composed of at least three types of layers: an input layer, one or more hidden layers, and an output layer. Each layer consists of interconnected neurons that propagate information to subsequent layers, enabling the network to capture and model complex feature relationships, as illustrated in later sections. The primary goal of using an MLP for anonymization is to convert potentially identifiable data into broader categories or value ranges, a process often referred to as “blurring”. This reduces the accuracy of the original data, helping protect user privacy while preserving patterns necessary for meaningful analysis. The input layer receives data, which could be user features extracted from dataset samples. Each neuron in the input layer represents one dimension of the input vector, such as age, gender, postcode, session duration, or device type. How input data is encoded is crucial, as proper representation ensures that the MLP can effectively learn feature relationships, whereas poor encoding may lead to inaccurate generalization and reduced performance.

Hidden layers are at the core of the learning and transformation process. In each hidden layer, every neuron receives input from all neurons in the preceding layer, with each input multiplied by its associated weight W. As with all MLP-based methods, the weights are not calculated directly; instead, they are randomly initialized and then learned and updated during the training process through the backpropagation algorithm. To simplify, backpropagation is a learning method the network uses to learn from mistakes during training, and it looks at the errors in its predictions and adjusts its internal settings to improve future accuracy [22]. The weights determine how strongly the output of a neuron influences the next layer. Larger weights mean greater influence, while smaller weights reduce the influence. The output layer then combines these weighted signals to create the final prediction or classification of the network, representing the mapping of inputs to desired outputs learned by the model.

MLPs use supervised learning, which requires a dataset with defined inputs and corresponding target outputs. During training, the model adjusts its parameters to minimize the error between the predicted outputs and the actual targets by learning to associate each input with the correct generalized output. After training, the MLP processes new, unknown inputs by categorizing them according to the patterns learned from the training data. Instead of memorizing exact input-output mappings, it captures general structures and relationships, enabling it to assign new inputs to the most appropriate generalized category. This process allows the model to make accurate and meaningful categorizations even for data it has not seen before.

When implemented in real-world systems, MLP-based generalization can be combined with other privacy-preserving mechanisms to enhance protection. For example, the generalized output of the MLP can be further processed with differential privacy to introduce statistical noise or integrated into secure multi-party computation pipelines for distributed data analysis. This layered approach ensures that the risk of re-identification is minimized even if one layer of protection is compromised. The assessment of such systems usually involves two important measures: preservation of utility and privacy protection. By balancing these objectives, MLP-driven generalization can be fine-tuned to meet specific privacy regulations (e.g., GDPR) while maintaining operational efficiency. Because MLPs can be retrained as data distributions change, they also provide long-term adaptability for dynamic environments such as Internet services and IoT ecosystems [23].

4. Methodology

This section presents the proposed methodology for privacy-aware attribute generalization, describing how detailed user data are transformed into controlled abstractions for downstream services. The methodology ensures transparency, reproducibility, and consistency by defining attribute categorization, sensitivity quantification, disclosure granularity, and learning-based generalization without relying on predefined groupings.

The approach separates design-time decisions from run-time generalization. At design time, permissible generalization categories and their relative sensitivity levels are defined based on domain knowledge, regulations, and service requirements, representing acceptable abstraction levels rather than actual data clusters. At run time, the MLP learns a probabilistic mapping from heterogeneous user attributes to this abstraction space, enabling consistent handling of ambiguity and complex attribute interactions.

Machine learning-based generalization provides a flexible and adaptable alternative to traditional anonymization techniques, capable of identifying and capturing abstract patterns across different data types. The perspective clarifies why MLPs can effectively support privacy-preserving data processing in domains such as federated identity systems, profiling, and user behavior analysis [24]. The MLP model is trained on structured input data, where each feature represents a user attribute. During training, the network learns to map these detailed inputs to abstract outputs, such as user types or regions instead of exact coordinates, or age groups instead of precise values. The generalization-based anonymization approach preserves the statistical and behavioral patterns needed for downstream tasks such as analysis, personalization, or access control, while reducing the risk of revealing sensitive individual details.

Figure 1 illustrates the general connectivity and data flow of the MLP used in the proposed methodology. Each input node represents a detailed user attribute, which is encoded in a machine-readable format. These inputs are processed through one or more hidden layers, where non-linear transformations capture abstract patterns and complex interactions between attributes. On the other hand, the output layer generates generalized data categories, representing abstract forms of the original attributes. Specific examples of these output categories for each attribute type are provided in a later section, illustrating how detailed user data is systematically transformed into privacy-compliant abstractions.

Figure 1. Visual representation of MLP layer connectivity and data flow [22].

Sensitivity is defined externally at the category level, ensuring that attributes are never exposed more specifically than allowed. Based on this concept, minimum necessary granularity is formalized as the highest level of data abstraction that balances service utility with sensitivity constraints, thereby enforcing data minimization. The learning model enforces these constraints by mapping detailed inputs directly to output data categories, preventing unintended information leakage.

Importantly, the MLP is not intended to discover or optimize category structures. Instead, it functions as a generalization operator that implements stable, non-linear projection from high-dimensional personal data to a controlled, privacy-compliant output space. By separating taxonomy definition from generalization execution, the methodology avoids circularity in label construction and ensures that the learning component supports, rather than defines, the privacy-utility trade-off.

The following subsections describe each stage of the methodology in detail, starting with a dataset description, including attribute encoding, category definition, and sensitivity assignment. Initially, the dataset is preprocessed to encode attributes in a machine-readable format, distinguishing between numeric and categorical variables. Each attribute is then assigned to a semantic category, such as demographic, behavioral, preference data, etc., based on its intrinsic meaning and potential contribution to re-identification risk. For attributes that could belong to multiple categories, a deterministic rule is applied to select the primary category, ensuring reproducibility and avoiding ambiguity. This structured approach allows the methodology to systematically balance utility and privacy across diverse attribute types while providing reproducible and auditable results.

4.1. Dataset Description

The experimental evaluation of the proposed category-based anonymization framework uses the publicly available Netflix Userbase dataset from Kaggle. This dataset contains 2500 user records and 10 attributes, serving as a synthetic snapshot of a streaming platform’s subscriber base by capturing demographic information, subscription characteristics, and basic behavioral indicators. Each record represents a single Netflix user and is uniquely identified by a numeric User ID, which is removed during preprocessing because it is a direct identifier and not relevant for anonymization. The dataset includes the following attributes:

• Subscription type—categorical indicator of service tier (Basic, Standard, Premium).
• Monthly revenue—numeric value representing the user’s monthly subscription cost.
• Join date and last payment date—temporal attributes.
• Country—user’s country of residence.
• Age and gender—primary demographic descriptors.
• Device—main device used for streaming (e.g., smartphone, smart TV, laptop).
• Plan duration—length of the active subscription period (typically 1 month).

These attributes form the basis for the demographic, behavioral, and preference categories used in the proposed anonymization framework. For attributes and data types not present in the original dataset, additional synthetic variables are generated using realistic but non-identifying distributions. These synthetic attributes are integrated with the Netflix Userbase records to construct a unified, multi-category dataset that enables systematic testing of the proposed category-aware anonymization framework while avoiding the disclosure of sensitive real-world impairment data. The details of how each category is preprocessed and generalized are discussed in the corresponding subsections below.

4.2. Anonymization of Location Data

A variety of methods can generalize location data to reduce sensitivity, including models that automatically transform precise information into less identifiable forms, often using neural networks that adapt to different data types. Because precise GPS coordinates can enable re-identification of individuals or linkage to other datasets, they are commonly replaced with broader geographic units such as city, region, or administrative area. In this work, a geocoding/reverse-geocoding service (Google’s Geocoding API in our prototype implementation) maps raw coordinates into standardized, human-readable units, which can then be generalized to the minimum necessary granularity (e.g., city → region → country). This preprocessing step is not an alternative to the proposed framework, but an implementation detail that supports applying the same generalization principle to location attributes. For datasets involving geographic information, Google’s Geocoding API is used to translate human-readable addresses into geographic coordinates (latitude and longitude) and vice versa. The API enables bidirectional transformation between textual, human-readable address descriptions, such as street names, city names, or portal codes, and their corresponding geographic coordinates. Therefore, the service performs both standard and reverse geocoding to support the transformation of raw coordinates into higher-level categories, such as city or region, that are more appropriate for privacy-preserving data processing [25].

The integration ensures that location attributes are managed to align with anonymization goals while maintaining utility for downstream analysis. When geographic coordinates are submitted, the Geocoding API performs reverse geocoding using Google’s global location database, which combines map layers, satellite imagery, and administrative boundaries to identify the most accurate location. The service translates coordinates into human-readable addresses, producing structured JSON outputs that can be integrated into data-processing pipelines for automated anonymization. Some services, such as weather forecasts, work well with generalized locations, while others, like online deliveries, require higher precision. In this work, defining the minimum necessary granularity is the responsibility of the service providers, while users retain control over how much personal information they share in exchange for personalization [26].

4.3. Anonymization of Demographic Data

Demographic data, like other personal information, can be generalized to prevent the disclosure of individual identities. This section demonstrates how an MLP-based model transforms user input data into structured feature patterns for this purpose. The model was trained on a dataset that combines synthetic demographic data—such as education level, marital status, employment sector, and weekly working hours—with selected real-world attributes from the Netflix user base, including gender, age, and country of residence [27]. The Netflix dataset includes demographic information as well as preference-related attributes and location data (e.g., country). For training the MLP model, only the real demographic variables, such as age and gender, were used from the original dataset, while the remaining data were generated synthetically using generative AI.

By combining synthetic and real demographic data, the model learns generalization patterns across different user profiles, improving its ability to anonymize while maintaining similarities between groups. To ensure consistent processing across heterogeneous demographic attributes, all variables are converted into fixed-length one-hot or binary embeddings before being input into the MLP model.

All encoded demographic attributes are grouped into a single input vector $X$ ∈ ${\mathrm{R}}^d$, as shown in Table 2, which is fed into an MLP model composed of multiple fully connected hidden layers with a SoftMax activation function. In a neural network, the SoftMax function is a way to turn the list of numbers into probabilities, showing which option the network thinks is most likely [28]. In this case, this activation function transforms a vector of numbers into a probability distribution, where each value represents a specific class. Each output value is between 0 and 1, and the sum of all output values equals 1. This property makes the SoftMax activation function ideal for scenarios where each output neuron represents the probability of a distinct class.

Table 2. Presenting encoded demographic attributes grouped into a single input vector.

Demographic Attributes	Category	Vector Position
Age	Young	$x_0$
	Middle-aged	$x_1$
	Retired	$x_2$
Gender	Female	$x_0$
	Male	$x_1$
Education level	High school	$x_0$
	Bachelor’s degree	$x_1$
	Master’s degree	$x_2$
Labor sector	Education	$x_0$
	Health	$x_1$
	IT	$x_2$
	Other	$x_3$
Weekly working hours	0–10	$x_0$
	11–20	$x_1$
	21–39	$x_2$
	≥40	$x_3$

For the configuration described, the length of the input vector in this example is d = 3 + 3 + 1 + 4 = 11. The generalization of demographic data is performed using a fully connected MLP model. This model consists of an input layer of dimension d, which is 11 in this case, followed by two hidden layers and a final output layer with 3 neurons representing the desired generalized demographic categories. Assume there are three generalized demographic classes to which users may belong. In this example, the proposed MLP model receives an 11-dimensional input vector constructed from four attribute groups: age [0, 1, 0], education level [0, 1, 0], gender [1], and working sector [0, 0, 1, 0]. This vector represents a middle-aged, bachelor-educated, male user working in the IT sector. The three classes correspond to generalized categories learned from the training dataset over 1000 epochs. In this example, there are three classes, although the actual number of classes can vary depending on the application. Their human-readable names are determined by how the training data was grouped. For instance, class 1 could represent “middle-aged male IT workers,” class 2 could represent “young female education sector workers,” and class 3 could represent “older male healthcare workers.” The MLP does not know these names internally; it simply learns patterns that map input vectors to these classes. After passing through two hidden layers, the network outputs three raw activation scores (logits), which quantify the model’s internal evidence for each class. Applying the SoftMax function converts the raw activation scores into a probability distribution across the three classes. The class with the highest probability is selected as the generalized representation of the input. For example, if the logits are [2.3, 0.5, 1.2], the corresponding SoftMax probabilities are approximately [0.667, 0.110, 0.222]. Since the first probability (0.667, or 67%) is the largest, the input is assigned to class 1. Therefore, the MLP compresses the detailed 11-neuron demographic encoding into a single abstract category while preserving the essential relationships among the input attributes, effectively generalizing the user’s profile.

The transformation shown in Figure 2 involves two main steps: exponentiation and normalization. First, each logit is exponentiated to produce positive values. For example, a logit of 2.3 becomes 9.97 after exponentiation. Next, all exponentiated values are summed, and each value is divided by this sum to generate normalized probabilities. This ensures that all output values are between 0 and 1 and together sum to one, allowing them to be interpreted as probabilities. Through this process, the network assigns a probability to each class, and in this example, the highest probability corresponds to class 1, representing “middle-aged male IT workers”.

Figure 2. An illustrative example of a binary-encoded demographic vector and an applied activation function.

4.4. Anonymization of Accessibility Data

As discussed earlier, in addition to traditional privacy-preserving methods such as categorization and anonymization, more advanced machine learning techniques, such as MLP, can also be used to generalize accessibility-related data. In this context, MLPs can be trained to detect and differentiate between various types of cognitive impairments, including learning disabilities, developmental disorders, memory impairments, and brain injuries. The training process follows a systematic procedure in which each data instance is linked to a unique identifier (ID) that denotes a specific type of impairment. The unique identifier is then converted into a binary vector, whose values serve as input for the MLP model.

Table 3 provides an overview of the cognitive impairments considered in this study, along with their corresponding identifiers and binary activation values. The binary encoding scheme uses a structured representation in which the digit “1” denotes the presence of a specific impairment, while “0” indicates its absence. In the illustrative example, a user presents four active impairments—Dyslexia, Dyscalculia, Memory Impairment, and Stroke—each marked with a binary “1,” while all remaining impairments are inactive and encoded as “0”.

Table 3. Examples of cognitive impairments and their mapped categories.

Category	Cognitive Impairment	Vector Position
Learning disability	Dyslexia	$x_0$
	Dysgraphia	$x_1$
	Dyscalculia	$x_2$
	Intellectual disability	$x_3$
Development disorder	ADHD	$x_0$
	Autism	$x_1$
	Development delay	$x_2$
Memory impairment	Memory impairment	$x_0$
	Alzheimer’s disease	$x_1$
Brain injury	Traumatic brain injury	$x_0$
	Stroke	$x_1$
Other disabilities	Other	$x_0$

The binary vector serves as the initial input to the MLP model, allowing the network to learn patterns associated with different impairment profiles. The network receives a 12-dimensional input vector that represents fine-grained impairment indicators. For training targets, these indicators can be mapped to a higher-level one-hot vector of length 5, corresponding to broader impairment categories. However, the MLP model always uses the full 12-dimensional vector as its input, while the 5-dimensional representation is used only for output classification.

In this scenario, the neural network is trained to classify each data instance into one of the following five impairment categories:

• Learning disability—[1, 0, 0, 0, 0].
• Development disorder—[0, 1, 0, 0, 0].
• Memory impairment—[0, 0, 1, 0, 0].
• Brain injury—[0, 0, 0, 1, 0].
• Other disabilities—[0, 0, 0, 0, 1].

After the input vector is processed through the hidden layers, the output layer produces a set of unnormalized activation values, or logits, each corresponding to one of the generalized impairment categories. As with demographic data classification, the logits produced by the network are transformed into interpretable probability values using the SoftMax activation function. This function exponentiates each logit and normalizes the results, ensuring the outputs form a valid probability distribution across all categories. In this case, the model may assign the highest probability to the “learning disability” category [1, 0, 0, 0, 0], reflecting the presence of multiple impairments (dyslexia and dyscalculia) that fall within this group. At the same time, smaller but still meaningful probabilities may be assigned to categories such as “development disorder” [0, 1, 0, 0, 0], “memory impairment” [0, 0, 1, 0, 0], or “brain injury” [0, 0, 0, 1, 0], because the input also contains impairments belonging to these groups. The binary encoding and generalization process can be represented in tabular form or as a sequential vector, as shown in Figure 3 below.

Figure 3. An illustrative example of a binary-encoded accessibility vector and an applied activation function.

This data category was trained for 1000 epochs using an MLP model with 12 hidden layers, and the outputs are represented across 5 output neurons. The vector z = {z1, z2, z3, z4, z5} represents the logits, or unnormalized output scores, corresponding to each of the five generalized categories. Raw scores, or logits, are produced by learned weights and biases, which are optimized via backpropagation on the training set. As the results show, the model assigns the highest probability (~83%) to the first category, “learning disability,” because it contains two matching impairments from this class. Since dyslexia and dyscalculia fall under the “learning disability” category, inputs containing these impairments yield higher activation for this group.

A separate issue arises when an input vector contains an equal number of impairments from two or more categories, resulting in ambiguity. In these cases, the model relies on the learned weights to produce logits for each category, which are then passed through the activation function. Even if two categories are equally represented in the input vector, the network may still produce slightly different logits due to subtle variations in how it learned from the training data. These differences are then reflected in the activation function output. This behavior confirms that the model can technically handle ambiguous input data, but it also demonstrates why a more representative dataset with more varied training examples is needed to reflect a broader and more realistic structure of impairment patterns.

In practical machine learning scenarios, achieving 100% accuracy is uncommon. Real-world disability data exhibits substantial heterogeneity, overlapping characteristics, and noise, which typically prevent perfect classification.

For example, each case can be represented by a unique binary vector, where the presence of a disability in a particular category is labeled by a “1” in the corresponding position, while all other positions are set to “0.” If the input vector is encoded as [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], the model interprets this as a person belonging to the first category, i.e., a user with a learning disability. If the input vector is encoded as [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], the user is again classified as belonging to the first category, “learning disability” (e.g., dysgraphia). The neural network assigns users to category 1 whenever the input vector contains a “1” in any of the first four positions, since these four cognitive impairments are grouped under the same category. In such cases, the corresponding output neuron is activated with a value of “1,” indicating that the user is correctly classified within the learning disability group. Similarly, users are categorized in the second category if positions 5, 6, and 7 of the input vectors contain a value of “1,” such as [0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0], while all other positions remain “0.” It is also important to note that even if only one of these positions has a value of “1,” while all others remain “0,” the user will still be classified into this category. These positions correspond to cognitive impairments categorized as developmental disorders. A similar process is used for the remaining categories, where users are assigned to their respective groups based on the values in the input vector.

However, an additional question may arise when the model receives input vectors with more complex combinations of ‘1s’ and ‘0s’, such as those represented by input vector IDs 13 and 14 in Table 3, which differ from the simpler, single-category patterns described above. In these cases, the classification outcome depends on the number of ‘1s’ present within each category. The network evaluates how many impairments from each category are activated in the input vector and assigns the user to that category accordingly. This mechanism allows the model to categorize not only simple, single-impairment cases but also any combination of impairments, allowing it to generalize effectively across diverse user profiles. If this mapping logic is not followed, the network will not function correctly and will be unable to assign users to the appropriate categories, affecting both the reliability of the classification process and the validity of the results. Table 3 presents 12 representative examples from the training dataset arranged by their respective categories as defined previously, along with 2 additional examples selected in arbitrary order. These latter cases reflect combinations that may occur in real-life scenarios and are included to demonstrate the effectiveness of the proposed model in categorizing users when faced with diverse input data. This comparison highlights the model’s ability to generalize beyond strictly predefined cases and confirms its suitability as a proof of concept for handling real-world data.

In some cases, an individual may exhibit characteristics of multiple impairments simultaneously or all possible disabilities. Rather than assigning such a user to every possible disability group, the model explicitly classifies the individual into a single representative category. This strategy is adopted to enable effective generalization, ensuring that the neural network provides consistent and interpretable categorization. While this approach may result in some loss of detailed information about the user, it preserves the model’s overall ability to categorize individuals systematically, which is essential for both practical applicability and proof-of-concept validation.

Anonymization Approach for Motor Impairment Parameter

Motor impairments differ from other accessibility parameters because they directly affect how users physically interact with the interface. For this reason, they are often addressed separately during the anonymization process. Although such impairments can be considered user preferences in terms of comfort and usability, they still require a structured and privacy-preserving representation. Traditional rule-based methods remain effective for this parameter because certain interaction patterns, such as hand preference or the need for simplified navigation, follow predictable relationships. However, this does not preclude the use of MLP-based generalization. Instead, the rule-based structure provides a foundation for generating representative training data for an MLP model.

To develop accessible web applications for users with motor impairments, it is important to understand their challenges and the assistive technologies they use, such as mouth sticks, trackball mice, headrests, alternative keyboards, single switches, sip-and-puff devices, eye-tracking systems, and speech recognition tools. To support users with different motor impairments, the user interface design should be adapted when creating control groups. Grouping controls by motor impairment ensures that web applications remain accessible regardless of the severity of the impairment. For example, menus and navigation bars can be placed in the bottom right corner for right-handed users and in the bottom left corner for left-handed users. For severe impairments, larger buttons and simplified navigation improve usability. This information enhances accessibility by tailoring the interface to the user’s specific needs, improving usability, and reducing interaction difficulty. This logic can be generalized to other interface elements, making the system responsive to diverse physical capabilities and ensuring that users with motor impairments can interact more comfortably and efficiently.

To enable MLP-based anonymization, motor impairment attributes are transformed into binary features, as shown for previous accessibility parameters, which are then mapped to generalized layout configurations. Table 4 presents domain-informed rule-based mappings that are used as an initial guideline to annotate and structure the training dataset. These mappings do not represent the final decision logic of the proposed system. Instead, they are used to introduce predefined domain rules and to guide the MLP during the training process. It defines these mappings using four binary inputs (right-handed, left-handed, severe impairment, profound impairment) and one generalized output label representing the recommended menu configuration. Each row represents a possible MLP input configuration:

Table 4. Rule-based mapping from motor impairment attributes to menu configuration.

Right Handed	Left Handed	Severe Impairments	Profound Impairments	Menu Configuration
1	0	0	0	Right_button_corner
0	1	0	0	Left_button_corner
0	1	1	0	Increase_button_size
1	1	0	1	Simplify_navigation

Note: 0 = absence, 1 = presence

• Binary-encoded hand preference (right-handed or left-handed)
• Severity levels of motor impairment (severe and profound)
• A generalized output label describing the appropriate UI layout adaptation (e.g., right-button-corner, simplify-navigation, etc.).

The user interface can be adapted to specific motor impairments to enhance usability and accessibility. The MLP training workflow for this parameter is as follows:

• Input encoding: Each user’s motor-related attributes are converted into a binary input vector X = [right, left, severe, profound].
• Target representation: Each vector is assigned a high-level category (e.g., right_button_corner, increase_button_size, simplify_navigation), encoded as a one-hot output vector.
• Model training: The MLP is trained on these rule-generated pairs to learn the corresponding relationships. For ambiguous or more complex scenarios not explicitly defined by these rules, the learned weights enable the model to infer the most appropriate category.
• Activation function for probability assignment: In the output layer, the SoftMax activation function converts the logits into probabilities, as with other accessibility parameters.

This allows the model to select the most suitable menu configuration even when multiple impairments are present. For example, if a user is left-handed and shows signs of severe impairment, the model assigns probabilities to all layout categories and selects the one with the highest probability, resolving ambiguity in a learned rather than rule-based manner.

Therefore, our approach produces smoother decision boundaries when impairment characteristics are noisy or incomplete. In contrast, deterministic or rule-based algorithms tend to create multiple separate groups for non-typical or multiple impairments, which can lead to fragmented and less generalizable classifications. By allowing the model to adapt to variability in the data, we can better capture complex patterns and ensure more robust handling of diverse impairment cases.

4.5. Anonymization of Preference Data

User preferences naturally evolve over time due to changes in age, interests, lifestyle, social context, and exposure to online content. Through browsing, searching, viewing, and interacting with digital platforms, users continually reveal these preferences, often unintentionally. As modern digital services increasingly rely on behavioral data for personalization, concerns about privacy, user tracking, and data protection become more significant. Preference data, ranging from spending patterns to media consumption habits, can disclose highly sensitive personal information; therefore, robust anonymization strategies are essential to ensure responsible data handling and regulatory compliance. To address this challenge, we extend the MLP-based anonymization method to preference data.

In this approach, the MLP serves as a supervised learning model that maps identifiable, fine-grained preference data to broader, less specific generalized categories. The model is trained on a hybrid dataset consisting of (i) synthetic preference records designed to represent realistic behavioral patterns and (ii) real data extracted from the Spotify platform, including subscription type, preferred content formats, favorite genres, and listening habits. Combining both types of data enables the network to learn generalization patterns that capture both controlled synthetic variations and authentic user behavior, enhancing its ability to handle heterogeneous preference profiles.

Before training, all attributes are converted into numerical representations suitable for neural network processing. Categorical features are encoded using one-hot representations, consistent with the demographic and accessibility parameters used earlier. For example, consider a user with the following attributes: medium expenditure level on digital services (550 Euro), local travel preferences, reading-oriented consumption behavior, tablet as the privacy device type, medium link engagement level, medium device size, a shopping-category browsing pattern, and a free subscription plan. Each attribute is encoded into its corresponding binary vector, resulting in a structured input representation composed of multiple one-hot and numerical components. These collectively form the input neurons of the MLP, as summarized in Table 5.

Table 5. An example of one-hot encoding of user preference attributes.

Category	Cognitive Impairment	Vector Position
Internet service spending level	Low	$x_0$
	Medium	$x_1$
	High	$x_2$
Travel preferences	None	$x_0$
	Local	$x_1$
	International	$x_2$
Subscription plan	Free	$x_0$
	Basic	$x_1$
	Premium	$x_2$
Browsing behavior	Explorer	$x_0$
	Reader	$x_1$
	Buyer	$x_2$
Device type	PC	$x_0$
	Tablet	$x_1$
	Smartphone	$x_2$
Link engagement	Low	$x_0$
	Medium	$x_1$
	High	$x_2$
Device size	Small	$x_0$
	Medium	$x_1$
	Large	$x_2$
Browsing category	Tech	$x_0$
	Shopping	$x_1$
	News	$x_2$
	Sport	$x_3$

The preference dataset described above produces a 25-dimensional feature vector, with each component representing a specific categorical attribute of the user, such as spending intensity, travel mode, subscription type, browsing history, device type, engagement level, device size, and browsing category. All attributes are encoded using standard one-hot encoding, where exactly one element in each categorical sub-vector is set to 1, and all others are set to 0. For example, a spending habit variable with three levels—{low, medium, high}—is encoded as [0, 1, 0], indicating the selection of the medium level.

Concatenating the one-hot representations of all attributes produces a high-dimensional binary vector that captures the preference profile of an individual user. The 25-dimensional input vector shown in Figure 4 is processed by the neural network during training, using a combination of encoded preference attributes. Once the MLP is trained on input-output pairs, it can generalize from known samples to unseen combinations by learning the statistical relationships between user attributes. The trained model in our prototype contains 25 input neurons, 12 hidden neurons, and 3 output neurons. It was trained on 30 manually generated samples for 150 epochs, which was sufficient for convergence on this proof-of-concept dataset. During training, the network iteratively adjusts its weights through backpropagation. Rather than relying on any single feature, the MLP extracts joint patterns across attributes such as device type, subscription plan, engagement level, browsing history, and travel preferences. These learned dependencies allow the network to classify the generalized output class from a multi-attribute preference profile.

Figure 4. A 25-dimensional input vector: example of preference data.

However, we acknowledge that training on a limited, manually curated dataset may lead to overfitting, but the architecture is intentionally designed to support further training on larger and more diverse datasets. Future work will include systematic analysis and empirical validation of this demonstration.

The numerical values, such as weights, logits, and probabilities, as shown in the illustration examples, are not manually selected; instead, these values are learned automatically by the MLP model during backpropagation. The model adjusts these parameters through backpropagation to minimize the loss function, which produces specific activation values for each input.

4.6. Anonymization of Behavior Data

As a continuation of the previously described generalization approach, the same MLP model is used here to anonymize behavioral data. Typical behavioral attributes include purchase behavior, session duration, click frequency, page views, mouse movements, scrolling activity, and various interaction metrics. Although these features are highly informative for profiling and service optimization, they pose privacy risks because individual users can potentially be re-identified when such data is linked with other sources. To mitigate this risk, the MLP model is trained to generalize raw behavioral patterns into a set of anonymized behavioral categories. The training dataset consists of two components:

• Synthetically generated behavioral data designed to emulate realistic user interaction patterns.
• Real behavioral metrics extracted from TikTok profile datasets, such as engagement score, comment rate, number of likes, and follower count.

Continuous behavioral variables (e.g., session duration and navigation time) are first discretized into categorical ranges and then encoded using one-hot vectors to produce fixed-length inputs for the MLP model. The following example illustrates this generalization process using common behavioral indicators such as session duration, click frequency, navigation time, page views, scroll depth, and engagement level, which characterize user interaction with digital platforms. Consider a user with the following behavioral characteristics:

• Session duration: 10 min.
• Click frequency: 20 clicks.
• Navigation time: 6 s per page.
• Page views: 12 pages.
• Scrolling depth: 75 percent.
• Content engagement level: High.

For example, session duration may be categorized as short (<5 min), medium (5–15 min), or long (>15 min). Similarly, click frequency may be classified as low (<15), medium (15–30), or high (>30). Each attribute is mapped to a corresponding one-hot vector, producing binary encodings suitable for the MLP model:

• Session duration: Medium → [0, 1, 0].
• Click frequency: Medium → [0, 1, 0].
• Navigation time: Medium → [0, 1, 0].
• Page views: Medium → [0, 1, 0].
• Scroll depth: High → [0, 0, 1].
• Content engagement level: High → [0, 0, 1].

Once each attribute is encoded, the resulting input vector has 18 dimensions, for example: [0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1]. This vector is then passed through the MLP, which maps detailed behavioral patterns to a generalized behavioral category such as passive, moderate, or highly engaged, represented as a one-hot vector. If the model classifies the user as highly engaged, it outputs [0, 0, 1], meaning the original detailed behavior is replaced by this general category.

In this setup, the 18 input neurons correspond to six behavioral attributes, each encoded with three categorical levels (low, medium, high), enabling the MLP to generalize behavior patterns while preventing re-identification. Figure 5 illustrates the MLP architecture described above, showing how the 18-dimensional behavioral input is processed through two hidden layers to produce a generalized, anonymized category.

Figure 5. MLP structure with 18-dimensional behavioral input and three output classes.

The architecture consisted of 18 input neurons, 12 hidden neurons, and 3 output neurons. This configuration enabled the network to capture correlations between behavioral attributes and their respective categories with high precision. The results indicate that the model can effectively generalize sensitive behavioral data while protecting user privacy and preserving analytical value. Additionally, the trained MLP model is not limited to the presented dataset and can be applied to a wide range of real-world behavioral data. In this way, the network learns underlying patterns and interactions that may not be apparent when examining the attributes individually. MLPs are particularly effective at analyzing different combinations of inputs to uncover implicit relationships between attributes.

This capability allows them to generalize beyond the original training data, adapt to new input scenarios, and support privacy-preserving analysis in practical applications.

5. Results and Impact of Data Anonymization

This section presents the results of the experimental evaluation and interprets their relevance to the research objectives. The findings are analyzed to assess both the effectiveness of the anonymization strategy and its impact on overall data utility. The discussion connects empirical observations to practical implications, highlighting the strengths of the proposed anonymization methodology and identifying potential areas for improvement in future work.

To obtain concrete results on the robustness of the anonymization process, the evaluation uses a real-world scenario with selected data from a Netflix dataset. This dataset, representing user interactions on a video-streaming platform, contains several types of information typically collected from users. The analysis focused primarily on the age attribute, which was anonymized using a 10-year interval generalization. For example, users aged 41 to 51 years were grouped into a single category in the anonymized dataset. To validate this generalization, we compared the original and anonymized datasets and assessed how effectively the transformed data prevents precise re-identification. The dataset includes user counts, combined with complementary attributes such as generalized location (country level), preference information (e.g., device type such as laptop), and synthetic access-pattern data. This combination enabled us to derive representative characteristics of user groups within the generalized categories. In total, the dataset contains 2500 users, of whom 1243 are females and 1257 are males. Ages range from 26–51 years.

Beyond individual illustrative examples, we evaluated aggregate privacy metrics across the dataset based on equivalence class sizes in order to quantitatively assess re-identification risk. The original dataset contains 2500 users with ages ranging from 26 to 51 years, corresponding to 26 distinct age values. When considering the age attribute without anonymization, this results in an average equivalence class size of approximately 96 users: ${Average class size}_{original}$ = ${\displaystyle \frac{2500}{26}}$ ≈ 96 users. After applying the proposed anonymization strategy based on a 10-year age interval generalization, the number of distinct age groups is reduced to three (26–35, 36—45, and 46–51). As a result, the average class equivalence size increases to approximately 833 users: ${Average class size}_{generalized}$ = ${\displaystyle \frac{2500}{3}}$ ≈ 833 users. This represents an increase of approximately 766% in average group size compared to the original dataset, indicating a substantial reduction in re-identification risk at the dataset level. From a scalability perspective, the proposed anonymization process relies on simple attribute generalization and equivalence class aggregation, which scale linearly with the number of records, making the approach suitable for larger datasets.

Overall, these quantitative results demonstrate that the proposed age generalization approach effectively reduces re-identification risk both at the individual and dataset levels, while preserving sufficiently large equivalence classes to support meaningful aggregate analysis.

When examining users aged exactly 41, for example, only 114 out of 2500 users belong to this exact group. However, after applying the generalization method and grouping all users aged 41 to 51, the size of the anonymized age group expands substantially to 1070 users. Therefore, in the original dataset, a 41-year-old user appears in a group of only 114 individuals, which yields a relatively high linkability score, since the probability of linking this user to auxiliary information is inversely proportional to group size. After generalization into the 41–51 age interval, the corresponding group size increases to 1070 users, which significantly lowers the linkability value. Concretely, if linkability is expressed as $L$ = ${\displaystyle \frac{1}{\left|G\right|}}$, where $\left|G\right|$ denotes the size of the equivalence class, then the linkability decreases from $L_{original}$ = ${\displaystyle \frac{1}{114}}$ to $L_{generalized}$ = ${\displaystyle \frac{1}{1070}}$.

When the age attribute is generalized to the 41–51 interval and combined with anonymized location and device type, the resulting filtered group becomes significantly smaller. In our experiment, these three anonymized attributes narrow the group to just 16 users. Figure 6 demonstrates how applying combined anonymized parameters to the real dataset influences the size of the remaining user group.

Figure 6. Netflix Userbase scenario: anonymized parameters (age, location, and device type).

Adding another anonymized parameter from the accessibility category, such as screen-reader usage, further decreased the group size. For example, when filtering for users aged 41–51 who use a laptop, reside in the UK, and require a screen reader, the resulting group is reduced to only five users, as it is shown in Figure 7. Although introducing additional parameters increases the potential for uniqueness, applying appropriate generalization, such as replacing “screen reader” with a broader category like “accessibility need”, helps maintain larger groups, lowers the risk of linkage attacks, and avoids creating overly specific and easily re-identifiable profiles.

Figure 7. Netflix Userbase scenario: anonymized parameters (age, location, device type, and screen reader for accessibility).

On the other hand, we acknowledge that the presence of small anonymity groups (e.g., to 16 or 5 users) may appear alarming when viewed strictly through a privacy maximization perspective. However, we posit that these results represent a specific point on the privacy-utility trade-off curve. Our proposed method is designed with adaptivity as a core feature. In particular, the occurrence of smaller anonymity sets is a direct consequence of tuning the system toward high-fidelity service provision, where utility is prioritized. Our framework allows this trade-off to be tunable: when stronger privacy guarantees are required (larger k-anonymity sets), the method can apply more aggressive attribute generalization. This, however, unavoidably leads to a reduction in service quality, consistent with established trade-off dynamics in privacy-preserving data processing.

De-anonymization is considerably more challenging when only a single data category is available, but it becomes increasingly feasible as additional user information is combined. Conversely, when all data categories are appropriately anonymized, the possibility of identifying an individual is substantially reduced and may become practically impossible, even when multiple attributes are used together. This is the central point demonstrated in this section. For instance, querying for users who are exactly 41 years old yields 114 matches. When this attribute is generalized to the 41–51 age interval, the groups expand to 1070 users, illustrating how generalization enlarges equivalence classes and reduces individual distinctiveness. In this process, direct identifiers (e.g., names, national insurance numbers) are removed, and quasi-identifiers (e.g., age, location, device type, screen-reader usage) are generalized to further diminish uniqueness. By aggregating values into broader categories, the number of users represented in each group increases, thereby lowering the probability of re-identification.

The corresponding graph in Figure 8 illustrates how group size decreases as additional anonymized categories are combined, while re-identification remains difficult due to the anonymization applied at each step. Using a single anonymized category, such as an age interval, results in large groups with minimal identification risk. As more anonymized categories (e.g., age, country-level location, device type, accessibility needs) are intersected, the resulting group size naturally becomes smaller due to greater profile specificity. Nevertheless, because each attribute is generalized, the groups remain sufficiently large to preserve privacy, ensuring that the risk of de-anonymization remains low or negligible.

Figure 8. Impact of combining anonymized data categories on user group size in the Netflix dataset.

6. Discussion and Analysis

Building on the anonymization results presented in the previous section, our analysis confirms that combining multiple categories of user data typically increases the potential for re-identification. Generally, the more specific information available about an individual, the easier it is to isolate that user. However, when these data categories are provided in anonymized form, the identification process becomes substantially more difficult. This protective effect is amplified when anonymization is applied consistently across several attributes rather than within a single category. By integrating generalization and suppression across multiple dimensions, the risk of re-identification is significantly reduced, thereby strengthening overall user privacy and data protection.

In this study, our goal was to demonstrate that the proposed anonymization strategy continues to provide strong protection even when several quasi-identifiers are used in combination. This capability is crucial for real-world datasets, where attackers often have access to multiple attributes that could otherwise facilitate re-identification.

Attackers in general can have different capabilities: knowledge, experience, access to advanced analysis tools supported by machine learning and access to large, leaked datasets that might overlap with the anonymized datasets we are examining. Furthermore, attackers can also have different goals, either to identify a single person or to disclose attributes from the anonymized dataset that would allow them to link and identify using other, possibly non-anonymized, datasets. In our discussion, we put our focus on attackers who want to identify a specific person from our anonymized dataset. In this approach, we acknowledge our limitation that there might exist another dataset that overlaps with our anonymized dataset, and an attacker could identify a specific person using attribute disclosure and linkage to another dataset. However, this case, although valid and important, is out of the scope of our current research and will be addressed in future work.

Under realistic conditions, executing a successful de-anonymization attempt on such anonymized records becomes highly challenging and, in many cases, practically infeasible. To validate this, we conducted comprehensive evaluations using the anonymized attribute combinations and assessed their robustness against established de-anonymization methods, including linkage attacks. The standard mathematical formulation of likability, commonly used to quantify the probability of successful linkage and to evaluate the effectiveness of anonymization both theoretically and empirically, is defined as follows [29].

$$L (X, Y)={\displaystyle \frac{\left|X \cap Y\right|}{\left|X\right|}}$$

• $L (X, Y)$ denotes the linkability measure, expressing the probability or risk of linking records from dataset X (anonymized) to those in dataset Y (non-anonymized).
• $|\mathrm{X}\cap \mathrm{Y}|$ stands for the number of matching data records between the anonymized data set $X$ and the auxiliary data set $Y$.
• $\left|X\right|$ This is the total number of data records in the anonymized dataset (X). It serves as a normalization factor to express the number of matches as a fraction of the total anonymized data.

To reduce the degree of linkability $L(X,Y)$, robust anonymization techniques, such as generalization, should be employed to decrease the number of exact matches $\mid X\cap Y\mid$. The primary goal is to minimize this overlap, thereby enhancing user privacy. In linking attacks, adversaries attempt to re-identify anonymized data by correlating it with external datasets containing identifiable attributes. Any overlap between anonymized and external data facilitates matching anonymized entries to real identities. Recognizing this risk is essential for evaluating the effectiveness of generalization-based anonymization methods and for ensuring the security of sensitive information [30].

In this section, the results of the anonymization are discussed and partially validated using a real dataset. The results show that anonymization prevents the re-identification of users and increases the size of user groups within the relevant data categories. By detailing the methodology and dataset characteristics, our results provide a clearer view of the experimental process and its relevance. Furthermore, the approach can be extended to additional datasets in the future to strengthen the evaluation and demonstrate the robustness of the proposed anonymization strategy in diverse real-world contexts. This increased transparency improves the interpretability and credibility of our findings.

Figure 9 shows the effect of anonymization on three parameters: age, color contrast, and font size, using a Netflix dataset. While this comparison illustrates the expected reduction in re-identification risk relative to raw data, it does not by itself isolate the added value of the proposed MLP mechanism.

Figure 9. Anonymization of users’ data vs. risk of re-identification.

When filtering by the exact age of 30, only 116 users (≈5%) fall into this group, making re-identification relatively difficult. However, generalizing to the age range of 30–35 expands the group to 750 users (≈30%). From a generalization perspective, larger groups reduce the probability of correctly re-identifying an individual, which can be expressed as $1/n$, where n is the group size.

• For large groups (n high), $1/n$ is small, indicating a low risk of re-identification. Larger $n\to$ lower risk.
• For small groups (n low), $1/n$ increases, raising the risk of re-identification due to fewer individuals in the group.

When adding a non-anonymized attribute, such as color contrast, for users aged exactly 30, about 45% meet these criteria. The more attributes available, the easier it becomes to identify users, as shown by the blue line. An exception occurs when only a single attribute is used, since one parameter alone rarely allows for reliable re-identification.

The orange and dashed green lines show that age and color contrast generally occupy the same area, with differences resulting from the third parameter, font size. In the orange line, font size is not anonymized, while in the green line, it is anonymized, making re-identification more difficult.

6.1. Privacy Analysis: Re-Identification Risks Based on k-Anonymity Metrics

To provide a standard privacy-related analysis, we move beyond average equivalence class size, which often masks specific vulnerabilities. Instead, we focus on the minimum class size (k), which defines the worst-case re-identification risk and the distribution tails, indicating the prevalence of high groups within the Netflix dataset (2500 records).

The minimum class size (k) is a critical parameter that directly influences the effectiveness of the anonymization strategy. Larger values of k reduce the risk of re-identification, as each record is indistinguishable from a greater number of peers, thereby increasing resistance to de-anonymization attacks. Smaller k values may result in rare or “tail” groups in the data, which are more vulnerable to re-identification [31]. In this section, we discuss three scenarios based on varying k values from our anonymized dataset and how these values affect the de-anonymization process.

Scenario 1: (k = 5) (low anonymity)—In this scenario, we identified a group of five users who share an identical combination of attributes, such as age range, device type, country, and screen reader usage, thus forming a small equivalence class with uniform characteristics across these dimensions. This presents the highest risk because the unique characteristics of the tail are visible. Once the attacker identifies this group, the challenge of distinguishing the target user from the remaining four is significantly reduced. Instead of having to search through the entire dataset (2500 records in total), the attacker only needs to differentiate between five individuals who are otherwise indistinguishable based on our anonymized dataset. However, this equivalence class of five users represents a negligible fraction of the total user population in our dataset and therefore has a minimal impact on the aggregate distribution.

Scenario 2: (k = 16) (moderate anonymity)—In this scenario, we identified a group of sixteen users who share an identical combination of attributes, such as age range, device type (e.g., laptop), and country. In this group, users share one less common attribute compared to Scenario 1, where screen reader usage was also included as a defining characteristic for identifying those users. Therefore, this level effectively smooths the distribution tail, resulting in a substantially lower re-identification risk compared to Scenario 1. In this relation, increasing the group size raises uncertainty for an attacker, as identifying a specific individual becomes much less likely when the number of possible candidates within the group increases. While the smaller groups in these scenarios retain some vulnerability due to their limited size, they represent only the distribution tail in our Netflix dataset. Statistically, these high-risk outliers account for a minor portion of the total user base.

Scenario 3: (k > 100) (high anonymity)—Our anonymized results indicate that most users belong to equivalence classes larger than 100. In this setting, anonymity is substantially strengthened, as higher values of k significantly reduce the feasibility of re-identification. Relative to the previous scenarios, in the Netflix dataset comprising 2500 users, excluding the individuals from the two identified cases leads to 2479 users being assigned to an equivalence class larger than 100. Consequently, these 2479 users account for exactly 99.16% of the total user population, indicating that most of them are grouped into large, highly non-distinct classes under this scenario. This extensive grouping diminishes individual distinctiveness across most of the dataset, thereby making targeted identification by an attacker highly challenging.

The distribution tail represents the portion of the dataset comprising small equivalence classes. Analyzing this tail is critical, as it reveals the volume of users most vulnerable to de-anonymization. In the context of our Netflix dataset, a heavy-tailed distribution implies a high frequency of small groups (matching Scenario 1, $k=5$). This occurs when rare attribute combinations, such as specific devices or unique subscription tiers, prevent users from being merged effectively, leaving them exposed to targeted attacks. In our dataset, we can determine that this mostly happens with users with very specific accessibility requirements, unfortunately making them the easiest targets for re-identification. Conversely, a light-tailed distribution indicates that most users are aggregated into large classes (Scenario 3, $k>100$). This structure substantially reduces risk by ensuring that even ‘unique’ users are absorbed into broad, indistinguishable crowds, preventing attackers from isolating individuals.

6.2. Privacy Analysis—Attribute Disclosure

To evaluate the risks associated with our anonymization scenarios, we define an adversary model characterized by specific capabilities and goals. We assume an attacker possesses access to the full anonymized release and holds external auxiliary knowledge regarding a target’s Quasi-Identifiers (QIs), specifically demographic and location attributes such as age, device type, and country. The attacker’s objective could be twofold: identity linkage (mapping a specific user to a record) and attribute disclosure (inferring the value of a sensitive attribute, such as subscription type or viewing history, without necessarily identifying the specific record). While k-anonymity primarily addresses identity linkage, it does not inherently prevent attribute disclosure if the sensitive values within a group lack diversity.

We illustrate this distinction using Scenario 2, where an equivalence class of 16 users is established based on the QIs: age: 41–51, device: laptop, country: UK} {k = 16}. Under a standard k-anonymity model, the probability of re-identifying a target within this group is 1/16 = 6.25%, which suggests a reasonable level of protection against identity linkage. However, this metric can be misleading regarding attribute disclosure. If, for instance, all 16 users in this cluster share the same sensitive attribute (e.g., subscription: premium), an attacker does not need to identify the specific record to know the target’s subscription status. This vulnerability, known as the homogeneity attack, demonstrates that larger $k$-values do not guarantee privacy if the distribution of sensitive attributes within the group is uniform.

Furthermore, we must consider an attacker with enhanced background knowledge. Returning to our group of 16 users, suppose an attacker knows an additional attribute about the target that was not part of the initial QI set (e.g., the target’s precise city). By cross-referencing this with external knowledge, the attacker might filter the 16 users down to a subset of only 5 who match this granular location data. While the attacker has successfully narrowed the search space (increasing identity risk to $1/5$ or $20\mathrm{\%}$), attribute disclosure depends entirely on the diversity within this reduced subset. If these 5 remaining users possess different subscription types, the attacker cannot confidently infer the target’s sensitive information. Therefore, our analysis highlights that while reducing the group size (from 16 to 5) increases the risk of linkage, the risk of attribute inference is dynamic and depends on the l-diversity (variety of sensitive values) present within the targeted subset.

7. Conclusions and Future Work

This paper makes three core contributions toward privacy-aware personalization in Internet services: (i) a structured, category-based view of user attributes to support systematic generalization, (ii) an adaptive MLP-based mechanism for learning context-aware data abstraction, and (iii) an experimental evaluation demonstrating the feasibility of the proposed approach on real-world data. Together, these contributions demonstrate a deployable, learning-based generalization mechanism that can be integrated into real-world applications. This integration enables adaptive privacy protection while maintaining service-level utility, thereby advancing practical privacy-preserving technologies.

Building on these contributions, this study investigated the ongoing challenges of achieving a meaningful balance between personalization and privacy protection in modern Internet services. By systematically categorizing user data into five major groups: demographic, location, accessibility, preference, and behavioral data, we illustrated the complexity and heterogeneity of attributes typically collected by Internet platforms. Building on this understanding, we proposed a context-aware generalization method supported by a multilayer perceptron (MLP), showing that machine learning–driven generalization can effectively reduce the risk of re-identification while preserving the utility required for personalized services.

The experimental evaluation provides several important insights. First, MLP-based generalization can learn latent relationships across heterogeneous data types, allowing it to outperform static and rule-based anonymization strategies. Second, our approach successfully reduces data granularity in a controlled manner, improving privacy without noticeably degrading personalization quality. Third, the method scales efficiently to large datasets and adjusts to evolving user information, making it practical for real-world digital ecosystems. These findings collectively underscore the value of integrating machine learning techniques into privacy-preserving data pipelines and contribute to a more flexible framework for privacy-aware personalization.

Despite these promising results, several opportunities remain for further exploration. As part of our future work, we plan to conduct more extensive empirical comparisons across a wider range of neural network models to better understand how different architectures perform on the same datasets. Such comparisons will allow us to identify strengths, limitations, and optimal use cases for alternative models, broadening the scope of our approach. Additionally, we will train our method on significantly larger and more diverse datasets to strengthen evidence regarding its ability to generalize across real-world scenarios and different data environments.

The current study has three primary limitations. First, the evaluation relies on a relatively small dataset (Netflix Userbase with 2500 records), which limits how strongly we can generalize the reported privacy-utility behavior across domains and populations. Second, for attributes not present in the original dataset, we introduce synthetic variables and, in some cases, rely on small manually curated examples. While this is useful for prototyping, it may not fully reflect real-world correlations. To address these limitations, we will evaluate the framework on larger and more diverse real-world datasets and reduce reliance on synthetic augmentation by using datasets that contain richer attribute sets and by conducting broader comparative studies across model variants. Third, to address the current lack of empirical utility testing, future work will explicitly define concrete utility tasks, such as training machine learning models for user segmentation or recommendation systems, using the generalized data. We aim to measure the performance gap between models trained on original versus generalized data and calculate the specific information loss metrics. This will allow for a quantitative analysis of the privacy-utility trade-off, ensuring that the applied privacy protections do not render the data unsuitable for practical analytical applications.

Beyond the algorithmic evaluation, we plan to develop a privacy framework in which services receive only the minimum set of user attributes required for operation, relying on explicit user consent. To enable this, we will propose a middleware layer for fine-grained and selective attribute sharing. The architecture will combine a Keycloak-based identity manager, a custom Identity Provider (IdP), and a consent platform that mediates between users and services. Together, these components will define how attributes are requested, filtered, generalized, or anonymized before release, increasing transparency, trust, and compliance with modern privacy regulations.