  Differential privacy is becoming a gold standard for privacy research; it
offers a guaranteed bound on loss of privacy due to release of query results,
even under worst-case assumptions. The theory of differential privacy is an
active research area, and there are now differentially private algorithms for a
wide range of interesting problems.
  However, the question of when differential privacy works in practice has
received relatively little attention. In particular, there is still no rigorous
method for choosing the key parameter $\epsilon$, which controls the crucial
tradeoff between the strength of the privacy guarantee and the accuracy of the
published results.
  In this paper, we examine the role that these parameters play in concrete
applications, identifying the key questions that must be addressed when
choosing specific values. This choice requires balancing the interests of two
different parties: the data analyst and the prospective participant, who must
decide whether to allow their data to be included in the analysis. We propose a
simple model that expresses this balance as formulas over a handful of
parameters, and we use our model to choose $\epsilon$ on a series of simple
statistical studies. We also explore a surprising insight: in some
circumstances, a differentially private study can be more accurate than a
non-private study for the same cost, under our model. Finally, we discuss the
simplifying assumptions in our model and outline a research agenda for possible
refinements.
