Plausible obfuscation of user location trajectories

A computer-implemented method comprising:

• receiving, using a processing system, an actual user location trajectory that includes a plurality of geographic locations of places visited by a user;
• determining that at least one of the plurality of places visited by the user has been identified as a sensitive place, wherein the determining is performed automatically by the processing system based at least in part on a similarity of the sensitive place to a previously identified sensitive place;
• modifying the actual user location trajectory to create an obfuscated user location trajectory that includes a substitute place instead of the sensitive place, is consistent with the actual user location trajectory, conforms to a valid street route on a map, preserves spatiotemporal correlation between geographic locations, and is consistent with geographic locations visited by the user in the past;
• and
• outputting, to an application, contents of the obfuscated user location trajectory in place of contents of the actual user location trajectory.