Stephen T’s Blog Spot

You pull a table from a federal statistical agency, or download a public microdata file, and you analyze it as though it were the unvarnished truth. It is not, and the gap is deliberate. Before that data reached you, someone changed it to protect the people in it. They may have suppressed small cells, swapped records between places, rounded or capped extreme values, or added carefully calibrated random noise. This is not carelessness. It is disclosure avoidance, and it is a legal obligation. But if you do not know it happened, you will misread what the numbers can and cannot tell you.

The reason agencies do this is not the obvious one. The threat is rarely someone reading a name off a table, because names are already gone. The real danger is re-identification: combining a released table or file with outside information to single out an individual. A cell containing one household, or a person with a rare combination of attributes in a small area, can be exposed even with no name attached. And as agencies publish more detailed statistics that hew ever closer to the underlying records, the risk that someone can reconstruct those records and re-identify people grows. Confidentiality is required by law, so before release, the data is altered to blur the individuals inside it.

The techniques are a family, and each one buys privacy by spending accuracy. Suppression blanks out cells too small to be safe. Top-coding caps extreme values, so every income above some threshold becomes the same number. Swapping exchanges the records of similar households between areas, deliberately introducing location error to hide the households most at risk of standing out. And noise injection adds random perturbation to the counts themselves. There is no method that protects privacy for free. Every one of them trades some analytic fidelity for some protection, which is the essential fact to hold onto.

The most recent chapter makes this tradeoff explicit and quantifiable. For the 2020 Census, the Bureau adopted differential privacy, a mathematical framework that adds calibrated noise so the published statistics would look nearly the same whether or not any single person had been included, which bounds what anyone can learn about an individual. Its central knob is a privacy budget, denoted epsilon, that sets the exchange rate: more privacy means more noise means less accuracy. The move set off a serious debate, because the added noise visibly distorted counts for small geographies and small population groups. Both sides are making legitimate points: the protection is real and increasingly necessary, and so is the concern about accuracy for small areas. That is the privacy-utility tradeoff, no longer hidden inside an agency but out in the open.

For analysis, the crucial point is that the distortion is not spread evenly. It lands hardest exactly where your data is already thin: small geographies, small demographic groups, rare combinations. Those are the most disclosive cells, so they receive the most protection, and they also have the least signal to begin with. The estimate you most want, a small subgroup in a small place, is often the one most altered before you ever see it. Treat a noisy or suppressed small-cell number as exact, and you will report a precision that was deliberately removed, and you may find or miss differences that are artifacts of the protection rather than facts about the world. This is the small-sample fragility problem this series has raised before, now baked into the data before it arrives.

The discipline is to treat disclosure avoidance as part of how the data was made, not a footnote. Read what method the agency applied and with what parameters. Be most skeptical of small cells and small-area estimates. Use the margins of error and minimum-reliable-size guidance the agency provides, because they exist precisely for this. And if you publish your own tables from confidential microdata, remember that the obligation, and the tradeoff, are now yours too.

So here is my question. When you use published statistics or microdata, do you ask what was done to protect confidentiality and how it affects your smallest and most important cells, or do you treat the numbers as untouched?