The rule Nothing published below the k-anonymity floor.
A benchmark drawn from two hosts is not a benchmark, and in a small market it can identify them. The floor counts ACCOUNTS, not rows: one operator with twelve identical cars is one account and stays suppressed, which is the case a row-counting floor gets wrong in exactly the situation where privacy matters most. Ten is not enough if one account owns most of the cars, because the median is then that host’s own number with nine others standing nearby: a group where one account supplies more than 30% of its vehicles is withheld whole, not trimmed or reweighted, since trimming would publish an estimate of the figure we declined to measure. The ten is checked again by the database itself, which refuses to store a group of fewer. A suppressed group says it is withheld rather than reading as “no such car”, and is never replaced by an estimate.
Enforced by test/benchmark-cohorts.test.js
- ✓a cohort with fewer than 10 accounts returns nothing
- ✓the group publishes at exactly ten distinct accounts
- ✓one account with twelve cars is one account, not a cohort
- ✓the floor is counted per metric, so a field only some accounts share stays suppressed
- ✓no single account can contribute more than 30% of a cohort
- ✓exactly 30% is allowed, anything above is not
- ✓a dominated cohort is suppressed, not trimmed to an estimate
7 of 14 passing assertions in this file are cited above.
Enforced by test/benchmark-rls.test.js
- ✓the aggregate table refuses a cohort below ten accounts at the database level
1 of 6 passing assertions in this file are cited above.
Enforced by test/network-intelligence.test.js
- ✓one host with six identical cars is ONE host, and stays suppressed
- ✓the default floor is the one cohort floor, ten distinct accounts
- ✓a suppressed model explains itself instead of reading as "no such car"
3 of 25 passing assertions in this file are cited above.