privacy-safe measurement