A statistics team wants to publish counts from a sensitive dataset under differential privacy. Working from the way the US Census Bureau ran its 2020 disclosure avoidance system, estimate how the privacy budget constrains what can be published and which choice dominates the accuracy you end up with.

The assumptions, stated

• A single global budget covers the entire publication, not each query. Composition is the whole point: every statistic released from the same data consumes part of it, and once spent it cannot be recovered by rephrasing the question.
• Noise per statistic scales inversely with the share of budget allocated to it. Halving the allocation roughly doubles the noise on that statistic.
• Error matters relative to the count. Noise of ±20 is negligible on a population of 500,000 and destroys a count of 15.

The arithmetic, and the published anchor

The Census Bureau's demonstration products published in April 2021 used global epsilon values of 4.5 and 12.2 for the person-level data, which gives a sense of the scale at which a national statistical agency settled after extensive consultation — not a universal recommendation, but a real number chosen under real scrutiny. Their accuracy target was stated in operational terms rather than in epsilon: the largest racial or ethnic group in any geography of 500 or more people should be within 5 percentage points of the enumerated value at least 95% of the time.

That is the useful move to copy. Rather than arguing about epsilon in the abstract, state the accuracy requirement for the statistics that matter, then solve for the budget that delivers it. If the required accuracy needs more budget than the privacy posture allows, the release does not shrink gracefully — one of the two requirements has to give, and saying so early is the whole value of doing the arithmetic.

Which assumption dominates the error

The number of statistics you intend to publish, and the size of the smallest geography or group in them. Both work against you at once: more statistics divide the budget, and smaller cells need less absolute noise to remain useful. A publication covering 50 tables down to a neighbourhood level is a fundamentally different problem from ten national aggregates, and teams routinely scope the first while budgeting for the second.

The secondary dominating factor is post-processing. Enforcing consistency — non-negative counts, totals that add up across a hierarchy — is permitted and does not consume budget, but it redistributes error in ways that hit small cells hardest, which is why the Census results were contested most strongly by users of small-area data.

What the number rules in and out

It rules in national and regional aggregates comfortably: at any plausible budget, noise on counts in the hundreds of thousands is a rounding detail.

It rules out small-cell publication at useful accuracy, and that is the decision to face explicitly rather than discover. If the use case depends on counts of 10 to 50 people, differential privacy will either fail the use case or fail the guarantee, and the right response is a different access model — a controlled environment where researchers query the real data under agreement, rather than a public release.

When this is over-engineering

For internal analytics inside a controlled environment, where the data never leaves and access is logged and contractual, the ceremony rarely pays: access control and purpose limitation deliver more for less. Differential privacy earns its complexity where output leaves the trust boundary and cannot be recalled — a public release, a shared dataset, a model or statistic published to partners. That irreversibility is what justifies a formal bound rather than a review.