On an ongoing basis? Probably can't. Differential privacy may work OK for one-off measurements, but it's known to leak when doing ongoing measurements of data t

On an ongoing basis? Probably can't. Differential privacy may work OK for one-off measurements, but it's known to leak when doing ongoing measurements of data that's somewhat correlated over time such as emoji use. It's not clear there's any way around this.