As the privacy engineer who worked on the 2020 DAS deployment at Tumult Labs, Desfontaines argues the Bureau is abandoning the only release method with a published, auditable epsilon budget in favor of swapping, which has no formal guarantee. He notes the 2018 reconstruction attack — which successfully recovered 46% of 2010 microdata — was run against the very swap-and-suppress regime the Bureau is now reverting to, making the new approach formally worse than what it replaces.
The editorial frames the swap-back as a regression hidden behind political rhetoric about 'accuracy.' Swapping is itself a noise mechanism, but one whose parameters the Bureau has historically refused to disclose because disclosure would weaken protection — meaning the public gets neither accuracy nor a provable privacy floor.
Desfontaines points out that data swapping is also a noise-injection mechanism — the noise is just buried inside undisclosed parameters rather than expressed as an explicit epsilon. The political narrative that DP was uniquely lossy ignores that the swap method distorts the data too, while offering no mathematical guarantee in exchange.
The submitter titled the post 'US bans differential privacy in Census data,' framing the decision as a policy ban rather than a technical evaluation. The 775-point score and 481 comments suggest the HN audience broadly agreed the move was driven by politics rather than statistical merit.
He emphasizes that swap rates can be published, but the mapping from swap rate to actual disclosure risk is empirical — you can only run reconstruction attacks and observe outcomes, never prove a theorem. This eliminates the central accountability property DP provided: a number every researcher, journalist, and respondent could point to and verify.
The editorial highlights that the 2020 Census was the only government deployment with a published, audited privacy-loss budget for every release. Reverting to swapping erases that auditability and returns the Bureau to a regime where the public must simply trust unpublished internal parameters.
The U.S. Census Bureau will not use differential privacy for the 2030 Decennial Census. Damien Desfontaines — the privacy engineer who worked at Tumult Labs on the 2020 deployment — published the technical post-mortem on his blog under the title *Banning Noise*. It hit 775 on Hacker News inside a day.
The 2020 Census shipped the Disclosure Avoidance System (DAS), built on Tumult Labs' platform, with formally specified epsilon budgets. It was the largest public deployment of differential privacy ever attempted by a government statistical agency, and the only one with a published, audited privacy-loss budget for every release. For 2030, the Bureau is reverting to data swapping — the method used from 1990 through 2010, in which a small percentage of household records are exchanged between geographic units.
Data swapping has no epsilon. There is no budget, no formal guarantee, and no way to audit how much privacy any individual household actually got. The Bureau will publish swap rates, but the relationship between swap rate and disclosure risk is empirical, not mathematical. You cannot prove a theorem about it. You can only run attacks and see what comes out.
The political framing — "we removed the noise so the numbers are accurate again" — is wrong in two directions. First, data swapping is itself a noise mechanism; it just hides the noise inside opaque parameters that the Bureau historically refused to disclose at all, on the grounds that disclosing them would weaken the protection. Second, published attacks on swap-based releases reconstructed sensitive attributes at higher rates than against DP-protected releases at reasonable epsilon values. The 2018 Census reconstruction attack — the experiment that motivated the original DAS shift — was run against the swap-and-suppress regime. It worked. The Bureau publicly acknowledged it had reconstructed 46% of the 2010 microdata. That's why they moved to DP in the first place. The 2030 plan walks back to the regime that demonstrably failed.
The political fight that killed DAS was not about accuracy. The objection from redistricting researchers and small-county litigants was that block-level totals for small subpopulations — children of a particular race in a sparsely populated tract — bounced between releases of the same underlying data because the noise mechanism reshuffled per release. Swapping does the same thing. It just doesn't tell you it's doing it. The complaint wasn't that the numbers were wrong; the complaint was that the wrongness was legible.
This matters because the case against DP at Census was largely a fight over explainability, not technical merit. Statisticians could not explain epsilon to congressional staffers and state demographers, and a coalition of users who liked the old numbers because they were familiar — not because they were correct — won the political fight. Desfontaines' framing is uncharacteristically blunt for a privacy engineer: a measurable guarantee was traded for an unmeasurable one, and most of the public reporting has it backward. The HN thread, with comments from people who actually work in privacy engineering, ran the same direction.
For industry, the news cycle will overcorrect. Expect "differential privacy is dead" takes. They will be wrong. Apple has shipped local differential privacy in iOS since 2017 for emoji and typing telemetry. Google ships RAPPOR in Chrome and uses DP for Maps mobility releases. Microsoft uses it in Windows telemetry. Meta uses DP for the URL collection step in its Ad Conversion measurement system. LinkedIn ships DP-protected audience insights. None of those deployments are going anywhere. The OpenDP project just cut 0.13. Tumult Analytics is still on PyPI, still in production at the IRS, the Israeli Ministry of Health, and several state agencies operating below the congressional spotlight. The Census was the most visible deployment, not the most consequential one.
If you ship privacy tech for compliance — HIPAA, GDPR, the EU AI Act data-governance provisions, the upcoming U.S. state privacy laws — the precedent matters in a specific way. Regulators read the Federal Register. They will see the world's most-watched statistical agency abandon a method that the European DPAs and the UK ICO have both endorsed in their formal guidance. Expect privacy auditors to start asking harder questions about why you chose DP if 'even the Census couldn't make it work.' The honest answer — they could make it work, they just couldn't explain it to politicians — is technically right and operationally useless. Prepare the response now: a one-page memo with your epsilon budget, your composition theorem, and a concrete example of the worst-case disclosure your system permits. If you can't write that page, you don't have a defensible DP deployment in the first place.
The deeper lesson for anyone shipping a privacy-preserving system: build the budget dashboard before you build the algorithm. The reason DAS lost was not the math. It was that statisticians showed up to redistricting hearings with epsilon values and couldn't make them concrete. Build a UI that shows, for every release, what the budget bought and what it cost in expected error on the queries your users actually run. Make the tradeoff legible the way a quota dashboard is legible. If your privacy budget is invisible to non-experts, it will lose every fight against an opaque alternative that no one understands well enough to object to. Data swapping is the entropy fallback — "we did something, trust us" — and every privacy regime drifts toward that if the formal version is too hard to explain.
For teams running internal analytics on customer data and weighing DP versus k-anonymity versus secure aggregation: the technical case for DP at the epsilon values most product teams use is still strong. The Census ran DAS at total epsilon around 17–19 across all queries — orders of magnitude looser than the epsilon < 1 that academic threat models assume. The 2030 walkback says nothing about epsilon = 0.5 on a mobile telemetry pipeline, or epsilon = 2 on an internal A/B experimentation platform. If anything, it's an argument for *more* DP in places where the explainability budget is lower than the U.S. Congress.
The vacuum is the story for the next decade. The Census was the only government statistical agency running formal DP at scale on a flagship product. Statistics Canada, Eurostat, the UK ONS, and the Australian Bureau of Statistics have all been watching, and each had pilot programs. Each will now slow down. The next major public-statistics deployment of formal privacy is probably no longer in 2030; it's whoever moves first in the late 2020s with a vendor that can ship both the algorithm and the explainer. That market is wide open, Tumult is the only serious player, and whoever shows up with a polished disclosure-budget dashboard wins the next agency — and the decade after that.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.