A computer-implemented process for creating a privacy-preserving data structure to provide personalization for online services without user tracking, comprising: encoding (202; 302) a user profile into a data structure using a Bloom filter; and injecting (204; 304) noise into the data structure to create the privacy-preserving data structure that allows personalized online services to be provided to a user while maintaining a specified level of user privacy; wherein the noise injected into the personalization profile to create the privacy-preserving data structure is automated to allow for a tradeoff between a level of personalization and a level of privacy; and wherein the automation comprises: building a personalization prediction model by computing a loss of personalization using online histories for a set of users by independently varying a number of hash functions and an amount of noise used to build the privacy-preserving data structure representing an obfuscated user profile; building a privacy prediction model using the online histories by computing similarity of each user's profile in the set of users over time and grouping the users' profiles into categories based on similarity values; receiving a privacy goal and a personalization goal from a user; computing a similarity value for the user; comparing the similarity value for the user to the categories of users' profiles based on similarity values; and automatically determining an amount of noise and a number of hash functions for encoding a privacy-preserving data structure representing an obfuscated user profile that meets the privacy goal and the personalization goal received from the user. encoding (202; 302) a user profile into a data structure using a Bloom filter; and injecting (204; 304) noise into the data structure to create the privacy-preserving data structure that allows personalized online services to be provided to a user while maintaining a specified level of user privacy; wherein the noise injected into the personalization profile to create the privacy-preserving data structure is automated to allow for a tradeoff between a level of personalization and a level of privacy; and wherein the automation comprises: building a personalization prediction model by computing a loss of personalization using online histories for a set of users by independently varying a number of hash functions and an amount of noise used to build the privacy-preserving data structure representing an obfuscated user profile; building a privacy prediction model using the online histories by computing similarity of each user's profile in the set of users over time and grouping the users' profiles into categories based on similarity values; receiving a privacy goal and a personalization goal from a user; computing a similarity value for the user; comparing the similarity value for the user to the categories of users' profiles based on similarity values; and automatically determining an amount of noise and a number of hash functions for encoding a privacy-preserving data structure representing an obfuscated user profile that meets the privacy goal and the personalization goal received from the user. building a personalization prediction model by computing a loss of personalization using online histories for a set of users by independently varying a number of hash functions and an amount of noise used to build the privacy-preserving data structure representing an obfuscated user profile; building a privacy prediction model using the online histories by computing similarity of each user's profile in the set of users over time and grouping the users' profiles into categories based on similarity values; receiving a privacy goal and a personalization goal from a user; computing a similarity value for the user; comparing the similarity value for the user to the categories of users' profiles based on similarity values; and automatically determining an amount of noise and a number of hash functions for encoding a privacy-preserving data structure representing an obfuscated user profile that meets the privacy goal and the personalization goal received from the user.