Aspects of the invention include receiving, using a processing system, an actual user location trajectory that includes a plurality of geographic locations of places visited by a user. It is determined that at least one of the plurality of places visited by the user has been identified as a sensitive place. An obfuscated user location trajectory is created that preserves the privacy of the sensitive places that is consistent with the actual user location trajectory that conforms to a valid street route on a map, preserves spatiotemporal correlation between geographic locations, and is consistent with geographic locations visited by the user in the past. Contents of the obfuscated user location trajectory are output to an application in place of contents of the actual user location trajectory.