The large scale adoption of adaptive services in pervasive and mobile computing is likely to be conditioned to the availability of reliable privacy-preserving technologies. Unfortunately, the research in this field can still be considered in its infancy. This paper considers a specific pervasive computing scenario, and shows that the application of state-of-the-art techniques for the anonymization of service requests is insufficient to protect the privacy of users. A specific class of attacks, called shadow attacks, is formally defined and a set of defense techniques is proposed. These techniques are validated through the use of a simulator and an extensive set of experiments.