Privacy-Preserving Signals

A signal is privacy‐preserving with respect to a collection of privacy sets if the posterior probability assigned to every privacy set remains unchanged conditional on any signal realization. We characterize the privacy‐preserving signals for arbitrary state space and arbitrary privacy sets. A signal is privacy‐preserving if and only if it is a garbling of a reordered quantile signal. Furthermore, distributions of posterior means induced by privacy‐preserving signals are exactly mean‐preserving contractions of that induced by the quantile signal. We discuss the economic implications of our characterization for statistical discrimination, the revelation of sensitive information in auctions and price discrimination.