A computer system includes a database configured to receive a query and to produce a list of User IDs and an anonymization module. The anonymization module is configured to receive a list of user IDs in response to a query, the list of user IDs defining a true user count, generate a noisy user count of the list of user IDs, compare the true user count to a first threshold value stored in memory, compare the noisy user count to a second threshold value stored in memory, and output the noisy user count only if the true user count is greater than the first threshold value and the noisy user count is greater then the second threshold.