  Federated analytics seeks to compute accurate statistics from data
distributed across users' devices while providing a suitable privacy guarantee
and being practically feasible to implement and scale. In this paper, we show
how a strong $(\epsilon, \delta)$-Differential Privacy (DP) guarantee can be
achieved for the fundamental problem of histogram generation in a federated
setting, via a highly practical sampling-based procedure that does not add
noise to disclosed data. Given the ubiquity of sampling in practice, we thus
obtain a DP guarantee almost for free, avoid over-estimating histogram counts,
and allow easy reasoning about how privacy guarantees may obscure minorities
and outliers. Using such histograms, related problems such as heavy hitters and
quantiles can be answered with provable error and privacy guarantees.
Experimental results show that our sample-and-threshold approach is accurate
and scalable.
