What Differential Privacy Actually Guarantees
“We use differential privacy” tells you almost nothing. Differential privacy is a mathematical guarantee with a dial on it. Where somebody sets that dial decides whether the guarantee protects anybody. Two questions turn the claim into information: what is the privacy parameter, and what counts as one person’s data.
NIST finalised SP 800-226, Guidelines for Evaluating Differential Privacy Guarantees, in March 2025. It exists because vendors make the claim and buyers cannot evaluate it.
What differential privacy promises
The guarantee compares two worlds. In one, your data is in the dataset. In the other, it is absent. Differential privacy bounds how different the published results can look between them.
That promise attaches to the algorithm rather than to the output. The computation adds noise, so an attacker who sees the result learns something about the population and very little about any individual in it.
NIST calls it “a rigorous and precise mathematical definition of privacy”. It also calls it “resistant to privacy attacks based on auxiliary data”. The guarantee holds even when the attacker turns up with a second dataset.
The dial called epsilon
Epsilon, written ε, is the privacy parameter. It governs how similar those two worlds have to look.
NIST puts the trade-off in one line: “Smaller ε means stronger privacy but lower accuracy. Larger ε means weaker privacy but higher accuracy.” No setting gives you both.
What counts as a reasonable epsilon
NIST declines to prescribe a value. Selecting privacy loss parameters “is challenging, and we offer no specific guidelines on their selection”. The document does give the range some shape. Values below 1.0 have counted as reasonable, and 0.1 offers strong protection. At the larger end of the 1 to 20 range NIST warns that experiments “have shown that ε values on the larger end of this scale do not always provide meaningful real-world privacy”.
A vendor claim with no epsilon in it says nothing about privacy. Ask for the number, then ask what it applies to.
The privacy unit decides what is protected
That second question does more damage than the first, and it gets asked less. The privacy unit defines what the guarantee treats as one person’s data.
Protect a single event and you have protected one transaction. Protect a user and you have protected everything that person ever contributed. NIST is direct: “user-level privacy provides stronger guarantees than attribute-level, user-day-level, or event-level privacy.”
Consider a location dataset where the unit is one ping. Someone who visits the same clinic weekly appears hundreds of times. Each appearance carries its own protection while the pattern survives intact. The epsilon looks respectable and the person is still exposed.
Central and local models
Where the noise goes in changes who has to be trusted.
In the central model the curator holds the raw data and applies differential privacy before releasing anything. The guarantee is stronger for a given epsilon. The curator, meanwhile, sees everything.
In the local model each contributor perturbs their own data before it leaves the device. No raw records ever reach the curator. That removes the trusted party and costs accuracy, which is why local deployments need far more data to say anything useful.
Why differential privacy is not de-identification
Removing identifiers is a different exercise with a different failure mode. NIST notes that de-identified data “nearly always contains some information that could be identifying”. The document then walks through linking attacks that re-identify people from data somebody had already declared safe.
Differential privacy makes no attempt to strip identifying information. It bounds what any released result can reveal about a single contributor, whatever the attacker already knows. The two approaches do not substitute for each other, and a privacy notice describing one while relying on the other misleads the reader.
Real deployments exist. NIST’s March 2025 announcement names the US Census Bureau among them. The Bureau confirms on its disclosure avoidance pages that it has added noise to published data since the 1990 census.
What the exam wants
The CIPT Body of Knowledge, the IAPP document listing what the exam can test, puts privacy-enhancing techniques in Domain II. Differential privacy sits there alongside anonymisation and pseudonymisation. Questions tend to describe a situation and ask which technique fits, or ask you to rank techniques by the strength of what they promise.
Two answers usually look available and only one is right. Pseudonymised data is still personal data. Differential privacy describes a release process rather than a dataset on a disk, so a question about a stored file is rarely describing it at all.
Keep the subject tied to the engineering objectives. Dissociability is the objective this technique serves, as the piece on the three privacy engineering objectives sets out, and spotting that link usually points you at the answer. There is a longer route through the material in the guide to studying for the CIPT.
Where the technical vocabulary costs you time rather than the concepts, the CIPT Exam Question Masterclass works through how these options get built.
