I propose that we add an optional field event_level_epsilon to event-level source registration. This field would replace the existing randomized response epsilon vendor-specific value, and replace that with something like a “maximum randomized response epsilon”, which event_level_epsilon could not exceed without the source failing to register. The default event_level_epsilon will be this maximum vendor-specific value.

The benefit of this approach is that:

• it allows API callers to experiment with different privacy levels
• it allows privacy-conscious API callers to optionally deploy more private versions of the API
• it allows callers to invoke the API consistently across multiple interoperable implementations, even if each implementation chooses a different maximum epsilon
• it aligns with the design of the aggregation service, which allows specifying an epsilon up to a maximum