What a poll is allowed to publish about you

"We only publish aggregates" is the most common privacy claim in survey research, and on its own it is close to meaningless. Aggregates leak. They leak in ways that are well understood, reproducible, and entirely invisible to the person reading the chart.

Here is what we actually do about that.

A cell with three people in it is not an aggregate

Cross-tabs get thin fast. Party by region by age band, and suddenly a cell contains four people. Publish it and you have published four individuals with extra steps — anyone who knows one of them knows how they answered.

So a cell is published only when at least k = 50 people sit behind it, and 100 when the dimension is sensitive. Below the floor it is withheld, and shown as withheld — not filled with an estimate. A plausible number is indistinguishable from a real one to a reader, which makes quiet imputation worse than an honest gap.

Suppression has to cascade, too. Hide one cell but publish the row total and the hidden value is available by subtraction, so complementary cells go with it.

Exact counts leak even when they are large

Suppose a table is published today and again tomorrow, and in between exactly one person joins the panel. The difference between the two tables is that person. No threshold catches this, because every individual cell was comfortably above the floor.

The countermeasure is calibrated noise: published counts carry Laplace noise sized so that any single individual's presence or absence cannot change what a reader can conclude. Every release states the ε it spent, because a privacy claim without its parameter is not a claim you can check.

Noise alone is not enough either

Ask a noisy question enough times and the noise averages out. This is the failure mode that catches people who add differential privacy as a library call and consider the problem solved.

Each poll therefore carries a cumulative privacy budget, debited per query and enforced atomically so two simultaneous queries cannot both spend the last of it. When the budget is exhausted, further queries are refused — not served at a quietly weaker guarantee. An identical repeated query is answered from cache at zero cost, so the budget cannot be drained by asking the same thing twice.

The questions we refuse

Some queries are dangerous not in themselves but in combination with what has already been published. Those are refused by composition rules that track releases over time:

• A query whose population is a near-subset of an earlier release — the difference between the two is a handful of identifiable people.
• A repeated narrowing of a previously released population, which is the same attack spread across more steps.
• Anything touching a secret-ballot poll. Refused outright, at any aggregation. A ballot cast under a secrecy guarantee is never a row in an analytics table.

The structural fix: most attributes are simply not queryable

The rule we are most confident in is also the least clever. A verified profile may hold a great many attributes, but only a small, governance-frozen set of coarse dimensions can ever appear in a GROUP BY. Precinct, ZIP and date of birth are stored and are never queryable.

This kills the rare-combination attack structurally rather than hoping a threshold catches it after the fact. You cannot suppress your way out of a query language that lets someone ask for an intersection only one person occupies; the fix is to not offer the question.

Geography rolls up rather than vanishing

Geography is the sharpest re-identification lever in survey data, and also the most useful dimension in civic polling, so simply suppressing small states would gut the product. Instead a table rolls up to the finest geographic level that clears the floor — and does so uniformly, because mixing levels within one table produces a chart that silently compares different things.

What consent actually covers

Demographic cross-tabs come from an opt-in panel and never from binding elections. Joining states which attributes will be correlated and at what aggregation, consent is versioned so a change in terms does not silently carry old members into new releases, and revoking removes a member from future ones.

Verification collects data. Publication is governed separately and deliberately more narrowly. Treating those as one permission is the shortcut that turns a research panel into a surveillance product, and we would rather move slower than take it.