  Privately learning statistics of events on devices can enable improved user
experience. Differentially private algorithms for such problems can benefit
significantly from interactivity. We argue that an aggregation protocol can
enable an interactive private federated statistics system where user's devices
maintain control of the privacy assurance. We describe the architecture of such
a system, and analyze its security properties.
