An aggregate is a summary of many people’s answers, such as a count, a share, an average, or a ranking, that does not show any individual’s answer. Aggregates are how surveys, censuses, and civic systems report results. But aggregation alone does not guarantee privacy: small groups and many overlapping statistics can reveal individuals, so My Vote Forward requires a documented privacy review before any real aggregate is released.
Definition
The site glossary defines an aggregate as a summary of many people’s answers that does not show any individual’s answer, and adds that small groups can still reveal individuals, so aggregates need minimum group sizes and a documented privacy review before release (see the short entry in the glossary). Every aggregate has a denominator, the group it summarizes, and a method, the rule used to combine answers. An aggregate without both cannot be interpreted.
Origin and history
Statistical agencies have long published aggregates while protecting the people behind them. The UN Fundamental Principles of Official Statistics state that individual data collected for statistics “are to be strictly confidential and used exclusively for statistical purposes”.1 Agencies learned that this requires more than summing. The U.S. Census Bureau states that since the 1990 Census it has added “noise,” variations from the actual count, to the collected data.2 Reconstruction research the Bureau links on the 2010 Census reported: “We perfectly reconstruct 2010 Census records for 97 million people”,2 meaning published tables could be used to rebuild individual-level records.
NIST SP 800-226 summarizes the general lesson: “even aggregate statistics can inadvertently leak information from individual data points,” and there are mathematical results showing “that publishing enough statistics will always result in accurate reconstruction attacks”.3
How aggregates are produced and protected
Three risks shape how aggregates are released.
- Small cells. A count of one reveals that person’s answer to anyone who knows they are in the group. NIST gives an example from census data in which “the true population count for American Indian” in one district “is exactly 1,” and notes that “it is fundamentally impossible to both accurately convey this information and adequately protect the data of all individuals”.3
- Differencing and reconstruction. Two overlapping tables can be subtracted to isolate a person; many tables can be solved together.
- Linkage. Aggregates combined with outside data can narrow down individuals.
Common responses include minimum group sizes (suppressing cells below a threshold), coarsening categories, limiting the number of tables, and adding calibrated noise under differential privacy. Each costs some accuracy, and small groups lose the most.
Common confusions and neighboring terms
- Aggregate vs. anonymous data. Removing names from records produces de-identified microdata, not an aggregate, and is vulnerable to linkage. See k-anonymity.
- Aggregate vs. representative estimate. An aggregate of participants describes participants. Estimating the whole public requires a sampling design or weighting.
- Aggregate vs. published release. The release is the reviewed package that delivers aggregates with methods and versions.
- Aggregate vs. synthetic data. Synthetic data presents artificial records; an aggregate presents summaries.
How My Vote Forward uses the term
My Vote Forward releases only aggregates, and only through scheduled published releases. Before any release of real respondent data, a documented privacy design must set statistical methods and minimum group sizes; until then, demo aggregates are synthetic. The framework’s Measurement and Privacy chapters explain why aggregates of self-selected participants cannot be presented as public opinion. Collective priorities are the one result type the framework expects to show on the site, and only as released.
What My Vote Forward can and cannot do here
My Vote Forward can refuse to release individual answers, report denominators and methods, and require privacy review. It cannot guarantee that no combination of releases and outside data will ever reveal anything about anyone; the reconstruction research above shows that no aggregation method offers that by itself. It cannot make participant aggregates representative.
Unresolved questions
- What minimum group size is appropriate for small districts, where suppression may hide whole communities?
- Should the framework adopt differential privacy for priority aggregates, accepting the accuracy cost for small groups?
- How many releases about the same population can be made before reconstruction risk becomes unacceptable?
Sources
- United Nations Statistics Division, “Fundamental Principles of Official Statistics.” unstats.un.org/fpos
- U.S. Census Bureau, “Differential Privacy” (Disclosure Avoidance, 2020 Census), page last revised June 18, 2026. census.gov/…
- Joseph P. Near, David Darais, Naomi Lefkovitz, and Gary S. Howarth, NIST SP 800-226, Guidelines for Evaluating Differential Privacy Guarantees, March 2025. nvlpubs.nist.gov/…
