Image by Author

Epsilon is the parameter that defines how much privacy protection a system provides. It sits at the center of every differential privacy guarantee, and understanding what it means, how it’s set, and what its value implies is essential for interpreting any privacy claim made under this framework. For broader context on the problem these tools are designed to solve, this introduction to data anonymization is a useful starting point.

Key Definitions

Differential privacy is a mathematical definition of privacy with a specific guarantee: the output of an analysis should look nearly the same whether or not any single individual’s data is included. If removing one person from a dataset doesn’t meaningfully change the results, those results don’t reveal much about that person.

Epsilon, written as the Greek letter ε, is the parameter that controls how “nearly the same” the outputs must be. It measures the maximum amount by which the probability of any given output can change when one individual’s data is added or removed. A smaller epsilon means the outputs must be more similar with or without any given individual, which means stronger privacy protection.

Noise is the mechanism through which differential privacy enforces its guarantee. To prevent outputs from being too precisely tied to any individual’s data, controlled random noise is added to results before they’re released. Epsilon governs how much noise is required. Smaller epsilon means more noise, and more noise means less precise results.

Sensitivity is the maximum amount a query’s output could change due to a single individual’s data. A query asking for the total income of all employees in a department is highly sensitive if one employee earns significantly more than all others. Sensitivity and epsilon together determine how much noise needs to be added to maintain the privacy guarantee.

How Epsilon Works

Epsilon is easier to understand through what it bounds than through its formula.

Imagine a dataset of patient records. A researcher wants to know how many patients have a particular diagnosis. Differential privacy says: the probability of observing any given answer to that query should not change by more than a factor of e raised to the power of epsilon, depending on whether any specific individual is or is not in the dataset.

When epsilon is very small, say 0.1, that factor is close to 1, meaning the outputs are nearly indistinguishable with or without any single person’s data. An attacker observing the output gains almost nothing about whether a specific individual is in the dataset. When epsilon is large, say 10, the outputs can differ more substantially, and the privacy guarantee weakens accordingly.

This is why epsilon is sometimes described as a privacy loss parameter. It doesn’t measure how much information has been revealed in absolute terms. It measures the worst-case ratio between what an attacker could infer about an individual from the output versus what they could infer without the output at all. A smaller epsilon means that ratio is tighter, and the individual is better protected.

The connection to privacy budgets is direct. Every time a differentially private query is answered, some amount of epsilon is consumed. The privacy budget, introduced in the previous article, is a cap on the total epsilon that can be spent across all queries on a dataset. Once that cap is reached, the dataset is considered exhausted for disclosure purposes.

What Epsilon Values Mean in Practice

Epsilon is a unitless number, and there’s no universal answer for what value is acceptable. It depends on the sensitivity of the data, the nature of the disclosures, and the level of risk an organization is willing to accept.

That said, certain reference points have emerged from research and deployment experience.

An epsilon below 1 is generally considered strong protection. The outputs are so similar with and without any individual that very little can be inferred. An epsilon between 1 and 10 is a common working range in applied settings, balancing usable accuracy with meaningful privacy protection. An epsilon above 10 is considered weak by most privacy researchers, offering limited protection against a determined attacker.

The U.S. Census Bureau used differential privacy with a target epsilon of around 19.61 when producing data from the 2020 Decennial Census, a decision that generated significant debate because many researchers considered that value too large to provide strong individual-level protection. The episode illustrated how consequential the choice of epsilon is, and how contested it can be in practice.

There is no value of epsilon that eliminates privacy risk entirely. Even at very small epsilon, differential privacy provides a probabilistic bound, not an absolute guarantee. What it does provide is a transparent, auditable, and mathematically grounded commitment, which is considerably stronger than informal assurances.

Conclusion

Epsilon is the number that gives a privacy budget its meaning. It translates the abstract goal of protecting individuals into a measurable, enforceable constraint on what any analysis is allowed to reveal.

The three concepts covered on Statology form a coherent framework for thinking about statistical privacy. Re-identification risk names the problem. Privacy budgets provide the structure for managing it. Epsilon provides the unit of measurement that makes that management precise. Each builds on the last, and together they reflect a shift in how data privacy is approached: away from informal anonymization and toward quantifiable guarantees.