  The discovery of heavy hitters (most frequent items) in user-generated data
streams drives improvements in the app and web ecosystems, but can incur
substantial privacy risks if not done with care. To address these risks, we
propose a distributed and privacy-preserving algorithm for discovering the
heavy hitters in a population of user-generated data streams. We leverage the
sampling and thresholding properties of our distributed algorithm to prove that
it is inherently differentially private, without requiring additional noise. We
also examine the trade-off between privacy and utility, and show that our
algorithm provides excellent utility while also achieving strong privacy
guarantees. A significant advantage of this approach is that it eliminates the
need to centralize raw data while also avoiding the significant loss in utility
incurred by local differential privacy. We validate our findings both
theoretically, using worst-case analyses, and practically, using a Twitter
dataset with 1.6M tweets and over 650k users. Finally, we carefully compare our
approach to Apple's local differential privacy method for discovering heavy
hitters.
