Industry Reference | Telco

The anchor vertical and the hardest anonymization problem. Detailed treatment — use this as the reference model for other verticals. Part of the industry reference. Restructured from the telco deep dive for quick lookup.

Abbreviations: MSISDN = subscriber phone number; IMSI = SIM card identifier; IMEI = device identifier; CDR = Call Detail Record; HMAC = keyed-hash message authentication code; FPE = format-preserving encryption; DDM = dynamic data masking; SDP = Sensitive Data Protection.

For technique details (HMAC, FPE, deterministic encryption), see the techniques reference. For the full CDR zone architecture, see the architecture patterns reference.

Identifier treatment table

Identifier	Domain size	Recommended technique	Rationale
MSISDN	~10⁷–10⁸ per country	FPE or HMAC-keyed hash	Finite domain makes plain hashing trivially reversible via rainbow table
IMSI	~10¹⁵	Deterministic encryption or HMAC	Correlates to MSISDN; used for roaming joins
IMEI	~10¹⁵	HMAC or suppression	Device-level; typically no re-identification need
Cell ID	Thousands per operator	Generalization to cluster	Location quasi-identifier; precision directly impacts re-ID risk
IP address	Dynamic, NAT-shared	FPE (IPv4) or truncation to /24	May be direct or indirect depending on NAT configuration

Data categories

Category	Volume	Sensitivity	Key anonymization concern
CDRs	Billions/day for large operators	Very high — spatio-temporal behavioral record	4 points → 95% unique; identifier substitution alone is insufficient
Network events	10–100× CDR volume	High — network-layer metadata	Volume makes per-record review impractical; automated classification required
Location data	Continuous	Critical — most sensitive telco data type	Explicit consent required for value-added services processing (ePrivacy Art. 9); no legitimate-interest fallback for that purpose. Traffic data containing location follows Art. 6 rules (billing/interconnection exceptions apply).
Subscriber profiles	Slowly changing	High — direct identifiers + demographics	Standard pseudonymization; generalization of quasi-identifiers
Billing/usage	Monthly aggregates	Medium–high	Aggregation reduces risk; temporal patterns still informative
Customer interactions	Unstructured (call recordings, chat)	High — free-text PII	NLP-based detection (Presidio/SDP); high false-negative risk

ePrivacy pipeline implications

Data type	ePrivacy requirement	Pipeline impact
Traffic data	Erase or anonymize when no longer needed for transmission or billing. Retention permitted for: billing (limited period), interconnection charges, consented value-added services, legal obligations.	Zone 0 retention: days to weeks depending on purpose; billing-related fields may be retained longer
Location data	Explicit consent for value-added services; no legitimate-interest fallback	Must track consent per subscriber; consent-gated pipeline branch
Content data	Cannot be processed for marketing	Suppress or redact in all zones beyond Zone 0
Subscriber data	Can be processed for billing; consent for marketing	Purpose-specific zone access with IAM

See the telco deep dive for the full ePrivacy treatment.

Common client starting position

Legacy dictionary-based pseudonymization with four systemic weaknesses:

1. Single point of compromise — dictionary file/table is the only protection; if exfiltrated, all pseudonyms reverse
2. No structural privacy — quasi-identifiers (timestamps, cell IDs, durations) untouched
3. Scale brittleness — dictionary grows linearly with subscriber base; no key rotation
4. No formal privacy model — no measured re-identification risk; no ε budget

Modernization path: Three layers — (1) identifier pseudonymization (HMAC/FPE), (2) structural privacy (k-anonymity on quasi-identifiers), (3) access control (zone-based IAM + DDM).

CDR anonymization cookbook

Step-by-step treatment for a CDR pipeline from raw ingestion to DP-protected analytics output:

Step	Action	Zone transition	GCP service
1	Ingest raw CDRs	→ Zone 0	Pub/Sub, Dataflow
2	Pseudonymize MSISDN (HMAC), IMSI (det. encryption), IMEI (HMAC)	Zone 0 → Zone 1	SDP de-identification templates + Cloud KMS
3	Generalize Cell ID to cluster, bucket timestamps to 15min/hourly	Zone 1 → Zone 2	Dataflow transforms, ARX for batch
4	Apply k-anonymity (k ≥ 50) on generalized CDR attributes	Within Zone 2	ARX
5	Apply l-diversity on sensitive attributes (call duration, data volume)	Within Zone 2	ARX
6	Aggregate for analytics; apply DP on aggregate outputs	Zone 1 → Zone 3	Privacy on Beam, BigQuery DIFFERENTIAL_PRIVACY
7	Enable SDP discovery for schema drift detection	All zones	SDP inspection jobs
8	Configure Cloud Audit Logs for pipeline operations	All zones	Cloud Logging