Linkage Resistance: A Design Principle That Assumes Breaches and Makes Leaked Information Inconsistent

Small companies and apps sometimes collect more personal information than necessary, such as dates of birth, gender, and unneeded phone numbers. When such data leaks, it can be combined with other lists (record linkage), making it easier to identify a person’s residence and behavior. This paper assumes that information will eventually leak, and proposes “Linkage Resistance,” a design principle that makes leaked records inconsistent with one another so that the accuracy of linkage-based identification is reduced. The foundation is to split identifiers such as e-mail addresses into per-service aliases and to minimize the attributes given to each service, which users can do on their own. On top of this, we consider the following as proposals for further study: (a) a basic version in which a user’s smartphone is left overnight in a dedicated locker at a station or convenience store, and an extended version in which a drone carries it to a separate box; and (b) delivery to pickup points, and the handling of contracts that require a real address through paper-based procedures and offline storage. Communication means that do not use the internet, such as low-power medium-wave (AM) radio, face constraints of range, regulation, and dedicated hardware, so we compare candidates and leave feasibility testing as future work. These measures aim to coarsen the accuracy of estimating a person’s home from nighttime stationary coordinates, from street-address level to station-catchment level, and thereby to reduce the value of leaked information. Current laws and radio regulations were not designed with such combinations of network and physical infrastructure in mind. Rather than making demands, this paper organizes points for discussion on how a design that raises linkage resistance can coexist with legal systems, using Japan and Germany (EU) as test cases. Areas where identity verification is legally required, such as banking, are respected and left out of scope. This is a conceptual proposal; no implementation or quantitative evaluation has been carried out. Status: not peer reviewed. Parts of the statements about facts and legal systems rely on secondary sources; points not confirmed against primary sources are marked as such in the text. This paper is not legal advice. Use of generative AI: The concept and design decisions are the author’s. Google’s Gemini (Gemini 3 Pro / Gemini 3.1 Pro, October 2026) organized an initial draft, and Anthropic’s Claude (Claude Sonnet 5.5, October 2026) was used for structuring, drafting, research assistance, and formatting. The author is responsible for the content. Generative AI is not listed as an author. A Japanese version of this paper is attached as a separate file.