privacy-cost trade-off