Age Privacy is an Illusion: How Social Graphs Leak Your Birth Year

TL;DR

Think hiding your birthday on Facebook keeps it private? Think again. This study demonstrates that by using an iterative algorithm and analyzing the "public" data of your friends, researchers can estimate your birth year with an average error of just 2.71 years. Even if you hide your friend list, a technique called Reverse Friend Lookup can reconstruct your social circle and expose your data.

The "Privacy Paradox" in OSNs

In the world of Online Social Networks (OSNs), users like "Alice" often believe that setting an attribute to "Private" makes it invisible to third parties. However, researchers from NYU and Peking University have proven that Alice's age is not just hers—it is encoded in the collective data of her social graph.

The core challenge is that while Alice may be privacy-conscious, her friends might not be. This study highlights a systemic vulnerability: Relational Privacy Leakage. By gathering data from over 1.47 million NYC users, the authors found that only 1.5% of users specify their age publicly—yet almost everyone's age can be derived.

Methodology: The Three-Step Inference Pipeline

The researchers didn't rely on complex AI; they used the logic of social structures. The estimation follows a cascading logic:

1. Direct Correlation: If a user hides their birth year but shows their high school graduation year (HSY), a simple linear regression ($BY=0.9368imesHSY+108.2107$) predicts their age with an MAE of 1.11 years.
2. Social Grouping: If Alice hides both, but 6 of her friends belong to the "Class of 2005" at the same high school, Alice is statistically likely to be from that same class.
3. Iterative Propagation: For users with no direct or group indicators, the authors designed an iterative algorithm. This treats the social network as a graph where age "flows" from known nodes to unknown ones.

Fig 1: Overall accuracy increases as the algorithm incorporates more social structural data.

The Secret Weapon: Reverse Friend Lookup

What if you hide your friend list? The researchers used Reverse Friend Lookup. Since "friendship" is a bidirectional link, if Bob lists Alice as a friend and Bob's list is public, we now know Alice is friends with Bob. The study showed that for 46.3% of users hiding their lists, they could identify at least 15 friends through other people's public profiles.

Fig 2: Distribution of friends recovered via reverse lookup for private accounts.

Key Results & Experimental Validation

Using a "ground truth" dataset of users who had previously made their birth years public during Facebook's "regional network" era, the authors validated their methods:

• High Accuracy: For 57.5% of users, the error was a mere 1.5 years.
• Extensive Reach: The iterative method assigned ages to over 500,000 additional users who initially appeared to have no age-related data.
• Robustness: Even for "Highly Private" users, the MAE was roughly 2.8 years.

Critical Insight: The "Structural" Vulnerability

The most striking takeaway is that privacy is no longer an individual choice; it is a collective one. As long as your friends provide metadata (like where they went to school) and the social platform permits "Reverse Lookups," your private attributes are mathematically decipherable.

The Suggestion to Platforms: The authors propose a simple but radical fix. If a user chooses to hide their friend list, the platform should automatically remove their name from their friends' public lists as well. Until such "Mutual Privacy" policies are implemented, our digital shadows will continue to speak louder than our privacy settings.

Conclusion

This paper serves as a landmark study in OSN privacy, shifting the focus from "what you say" to "who you know." It demonstrates that with simple linear regression and graph iterations, an attacker can bypass almost all current privacy controls. For researchers, it sets a high bar for large-scale attribute inference, and for users, it provides a sobering reminder: on social media, you are who you know.