Privacy at scale