Impact statement: We have provided a thorough analysis of the privacy and utility properties of the discrete Gaussian and the practicality of sampling it. The impact of this work is that it makes the real-world deployment of differential privacy more practical and secure. In particular, we bridge the gap between the theory (which considers continuous distributions) and the practice (where precision is finite and numerical errors can cause a dramatic privacy failures). We hope that the discrete Gaussian will be used in practice and, further, that our work is critical to enabling these real-world deployments. The positive impact of this work is clear: Differential privacy provides a principled and quantitative way to balance rigorous privacy guarantees and statistical utility in data analysis. If this technology is adopted, it can provide untrusted third parties controlled access to data (e.g., to enable scientific research), while affording the data subjects (i.e., the general public) an adequate level of privacy protection. In any case, our methods are better than using flawed methods (i.e., naïve floating-point implementations of continuous distributions) that inject noise without actually protecting privacy or using methods (such as rounding or discrete Laplace) that offer a worse privacy-utility tradeoff. The negative impact of this work is less clear. All technologies can be misused. For example, an organization may be able to deceptively claim that their system protects privacy on the basis that it is differentially private, when, in reality, it is not private at all, because their privacy parameter is enormous (e.g., ε = 10 6 ). One needs to be careful and critical about promises made by such companies, and educate the general audience about what differential privacy does provide, what it does not, and when guarantees end up being meaningless. However, we must acknowledge that there is a small – but vocal – group of people who do not want differential privacy to be deployed in practice. In particular, the US Census Bureau’s planned adoption of differential privacy for the 2020 US Census has met staunch opposition from some social scientists. We cannot speak for the opponents of differential privacy; many of their objections do not make sense to us and thus it would be inappropriate for us to try summarizing them. However, there is a salient point that needs to be discussed: Differential privacy provides a principled and quantitative way to balance rigorous privacy guarantees and statistical utility in data analysis. This is good, in theory, but, in practice, privacy versus utility is a heated and muddy debate. On one hand, data users (such as social scientists) want unfettered access to the raw data. On the other hand, privacy advocates want the data locked up or never collected in the first place. The technology of differential privacy offers a vehicle for compromise. Yet, some parties are not interested in compromise. In particular, users of census data users are accustomed to largely unrestricted data access. From a privacy perspective, this is unsustainable – the development of reconstruction attacks and the availability of large auxiliary datasets for linking/re-identification has shown that census data needs more robust protections. Understandably, those who rely on census data are deeply concerned about anything that may compromise their ability to conduct research. The adoption of differential privacy has prompted uncomfortable (but necessary) discussions about the value of providing data access relative to the privacy cost. In particular, it is necessary to decide how to allocate the privacy budget – which statistics are most important to release accurately? Another dimension of the privacy-versus-utility debate is how it affects small communities, such as racial/ethnic minorities or rural populations. Smaller populations inherently suffer a harsher privacy- utility tradeoff. Differential privacy is almost always defined so that it provides every person with an equal level of privacy. Consequently, differentially private statistics for smaller populations (e.g., Native Americans in a small settlement) will be less accurate than for larger populations (e.g., Whites in a large US city). More precisely, noise addition methods like ours offer the same absolute accuracy on all populations, but the relative accuracy will be worse when the denominator (i.e., population size) is smaller. The only alternative is to offer small communities weaker privacy protections. We stress that this issue is not specific to differential privacy. For example, if we rely on anonymity or de-identification, then we must grapple with the fact that minorities are more easily re-identified, since, by definition, minorities are more unique. This is a fundamental tradeoff that needs to be carefully considered with input from the minorities and communities concerned. Ultimately, computer scientists can only provide tools and it is up to policymakers in government and other organizations to decide how to use them. This work, along with the broader literature on differential privacy, provides such tools. However, the research community also has a responsibility to provide instructions for how these tools should and should not be used.