Differential Privacy Budget Depletion Planner

Model how quickly your differential privacy program burns through its annual epsilon allowance. Provide the annual budget, epsilon consumed per release, planned release cadence, and an optional governance horizon to see monthly consumption, depletion timing, remaining or excess epsilon at your checkpoint, and the per-release epsilon target needed for both a 12-month runway and the horizon you choose.

Total epsilon allocation available for the policy year under your privacy policy.
Average privacy loss contributed by each published analysis or release.
Average number of differential privacy releases expected each month (use decimals for partial months).
Optional — defaults to 12 months. Enter your audit, regulatory, or steering-committee cadence if different.

Planning utility only. Coordinate final epsilon allocations, composition methods, and audit documentation with your privacy engineering and legal teams.

Examples

  • Scenario 1 – Rapid experimentation program: 4.00 annual budget, 0.20 epsilon per release, 6 releases/month, 6-month horizon ⇒ Monthly epsilon consumption: 1.20 ε. Budget lasts 3.33 months before exhaustion. Overruns the budget by 3.20 ε by month 6. Target epsilon per release: 0.06 ε for a 12-month runway, or 0.11 ε to stay within 6 months.
  • Scenario 2 – Mature program with spare capacity: 6.50 annual budget, 0.12 epsilon per release, 3 releases/month, default horizon ⇒ Monthly epsilon consumption: 0.36 ε. Budget lasts 18.06 months before exhaustion. Remaining epsilon after 12 months: 2.18 ε. Target epsilon per release: 0.18 ε for a 12-month runway, or 0.18 ε to stay within 12 months.

FAQ

What does the monthly epsilon consumption tell me?

It multiplies epsilon per release by your monthly cadence to show how quickly privacy loss accumulates. Use it to compare planned output against annual limits and to flag when additional approvals or privacy budget re-allocations are required.

How should I pick the review horizon?

Set the horizon to the cadence of your privacy committee, regulator reporting, or internal audit (for example, quarterly or semiannual). The calculator then reports remaining epsilon or the overrun at that checkpoint so you can plan throttling or additional allowance requests.

Can this handle advanced composition or privacy loss accounting libraries?

The planner assumes simple additive composition. If you rely on advanced composition or moments accountant techniques, adjust the epsilon per release input to reflect the discounted privacy loss your tooling produces, or add a buffer to the annual budget.

How do I reserve budget for high-risk analyses?

Subtract the epsilon you intend to hold back and enter the reduced annual budget. You can also rerun the calculation with a higher epsilon per release to stress test worst-case launches before approving them, ensuring the program still clears your governance checkpoints.

How can I reflect a delta or zCDP privacy budget?

This tool tracks epsilon only. If you manage a (ε, δ)-DP or zero-concentrated DP program, convert your planned activities into an epsilon-equivalent budget using your accountant or tooling, then enter that epsilon value here for quick runway sizing.

Additional Information

  • Monthly consumption equals epsilon per release multiplied by planned releases each month.
  • Months to depletion divides the annual budget by monthly epsilon use and assumes simple composition.
  • Horizon remaining epsilon subtracts monthly use times the review horizon; negative values indicate an overrun.
  • Recommended per-release epsilon values show the targets needed for a 12-month runway and for the chosen review horizon.
  • Results assume epsilon inputs share the same privacy accounting convention used by your governance policy.
  • All results are displayed in epsilon units (ε) so you can easily transpose them into privacy budget documentation.

Related calculators