Contextually Private Mechanisms

A mechanism designer uses a dynamic protocol to gradually learn agents' private information. A choice rule is \emph{contextually private} if it can be implemented with a protocol that reveals only the private information necessary for determining the outcome. We characterize contextual privacy through local properties of choice rules and construct maximally contextually private protocols through alternating phases of privacy violation and privacy preservation. If the designer can only query one agent at a time, the first-price auction and serial dictatorship are contextually private, while the second-price auction is not. In maximally contextually private implementations of the second-price auction, the designer trades off privacy violations for the winner and the losers.