It is challenging to measure and understand privacy in complex systems (particularly when users’ choices affect the privacy of both themselves and other participants), and a systematic framework for reasoning about privacy in decentralized, multi-actor systems is needed for evaluating proposed changes to protocols and applications.