As the other poster mentioned, this sounds much more like non-DP anonymization, which (as you note) is usually surprisingly vulnerable to deanonymization throug

As the other poster mentioned, this sounds much more like non-DP anonymization, which (as you note) is usually surprisingly vulnerable to deanonymization through various approaches. With Differential Privacy, you instead add randomness such that you can't tell whether the answer you got includes any individual person, for whatever question you're asking. IIUC, RAPPOR adds that randomness it to the original data; Leap Year (where I worked for a while) adds it to answers to specific queries. There are huge tradeoffs and they're suitable for very different settings. I am not sure which approach is taken here. Edited to add: Skimming the docs, it seems to be the latter - ask questions of the exact data, returning answers that are noisy. This requires ongoing trust of the entity holding the data (so it's most applicable to circumstances where they'd have that data regardless), but is much more flexible.