Differential Privacy Budget
The cumulative privacy loss permitted across all queries against a dataset, which must be tracked and exhausted rather than applied per query.
Differential privacy adds calibrated noise to query results so that the presence or absence of any single individual cannot be inferred. The guarantee is mathematical rather than heuristic, which distinguishes it from anonymisation techniques that rely on judgement.
The parameter controlling it — commonly written epsilon — quantifies the privacy loss, and the property that determines how it must be operated is that loss composes. Each query against the same data spends some of the budget, and a sufficient number of noisy answers can be averaged to recover the true value. So the budget is a finite resource for the dataset's lifetime, tracked centrally, and once exhausted no further queries may be answered.
That is the operational difficulty. It requires a query interface that mediates all access and maintains the accounting, and it means analysts eventually run out — a constraint that is hard to explain and harder to accept.
The trade is between utility and privacy and it is sharp: strong guarantees inject enough noise to make small-population analysis meaningless. The technique fits large-population aggregate statistics — usage telemetry, census-style reporting — and does not fit analysis that must be accurate for small groups, which is frequently the analysis people want.