Protecting privacy in audience data

A computer-implemented method, comprising:

• receiving a query request including an audience specification, wherein the audience specification specifies one or more criterion for identifying audience members of an audience that accessed media content;
• identifying a plurality of audience member identifiers corresponding to the audience members that meet the audience specification, each of the plurality of audience member identifiers corresponding to a unique one of the audience members;
• for each of the identified audience member identifiers:
• generating a respective random number for the audience member identifier;
• and
• generating a random weight value for the identified audience member identifier based on a function of the respective random number and the audience member identifier;
• and
• obfuscating results data describing the identified audience member identifiers in a query result value responsive to the query request based on the random weight values for the identified audience member identifiers;
• wherein:
• receiving a query request including an audience specification comprises receiving the query request at one of a plurality of query shards;
• at each query shard, the respective random weight values are based on output of a random number generator using a seed initialization value that is the same for each query received at the query shard;
• and
• the seed initialization value is dependent on the query shard at which the query request is received so that each shard may have a different seed initialization value for each query.

A system comprising:

• a front end interface configured to receive an audience specification, wherein the audience specification specifies one or more criterion for identifying audience members of an audience that accessed media content;
• an audience data store storing a plurality of audience data records for the audience members;
• a query processor comprising one or more data processors and configured to search the audience data store to identify records that match the audience specification, wherein each of the identified records corresponds to a unique one of the audience members;
• and
• a privacy filter configured:
• for each of the identified records, to assign a random weight to the identified record based on a function of a respective random number and an audience member identifier corresponding to the identified record, and
• to obfuscate results data describing the identified records in a query result value based on the random weights;
• wherein:
• the privacy filter is configured to assign a random weight to the identified record by:
• generating, for each of the identified audience member identifiers, the respective random number for the audience member identifier comprises initializing a random number generator to a same seed value for each query request;
• sorting each identified record in an order based on a value of an audience member identifier of the record and for each identified record:
• multiplying the audience member identifier by the random number output by a random number generator to create a product, wherein the sequence of random numbers output by the random number generator is the same for each query based on the same seed value;
• converting the product to a decimal number between two integers;
• and
• generating the random weight value by performing a function on the decimal number.

A system comprising:

• a user interface device;
• and
• an audience data reporting system comprising one or more data processors and configured to:
• generate a count of audience members matching an audience specification received from the user interface device, wherein the audience specification specifies one or more criterion for identifying the audience members that accessed media content and each of the audience members corresponds to a unique one of an audience matching the audience specification;
• for each audience member:
• generate a respective random number for the audience member;
• and
• generate a weight for the audience member based on a function of the respective random number and a unique identifier for the audience member;
• mask individual audience member behavior in the count by assigning the respective weight to each audience member in the count;
• and
• return a value to the user interface device based on the assigned weights;
• wherein:
• a plurality of query shards that each process the audience specification, wherein:
• at each query shard, the respective random weight values are based on output of a random number generator using an a seed initialization value that is the same for each audience specification received at the query shard;
• and
• the seed initialization value is dependent on the query shard at which the audience specification is received so that each shard may have a different seed initialization value for each audience specification.