I'm aware we can quantify privacy with ε-differential privacy (ε-DP). But when we apply DP, how do we actually select the value for ε ? Are there some rule-of-thumbs? Is it decided case-by-case basis? In general, how do we decide we've enough privacy when using some algorithm that satisfies ε-DP definition?


1 Answer 1


In the 2019 paper Differential Privacy in Practice: Expose Your Epsilons!, the authors Dwork, Kohli, Mulligan summarize the state of affairs thusly:

We found no clear consensus on how to choose ε, nor agreement on how to approach this and other key implementation decisions. Given the importance of these details there is a need for shared learning amongst the differential privacy community.

They propose an "Epsilon Registry" where applications of DP can specify their choice of ε. The closest to such a registry that I've been able to find is this list of real-world uses of DP by Damien Desfontaines, from Jan 2021.

I also found this very recent blog post from NIST which says "what, exactly, does ε mean, and how should we set it? Unfortunately, we still don’t have a consensus answer to this question", but then goes on to actually give some broad numerical guidance:

  • There is broad consensus that ε values in the low single digits (i.e. 0 < ε < 5) represent a conservative choice, and will provide strong privacy protection
  • Increasing experience with deployed systems suggests that larger ε values (i.e. 5 < ε < 20) also provide robust privacy protection in a variety of settings
  • In some contexts, even higher values of ε (i.e. ε > 20) may still provide meaningful privacy protection, but more experience is needed to understand this setting
  • $\begingroup$ Thank you! Very helpful resources. $\endgroup$
    – SpiderRico
    Commented Feb 7, 2022 at 23:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.