Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for preserving user privacy when selecting content are described. In some aspects, a method includes receiving a data element identifying a set of candidate digital components and, for each candidate digital component, a set of distribution parameters for the candidate digital component. For each candidate digital component, encrypted selection data for the candidate digital component is provided as input to a cryptographic analysis application running in a trusted hardware module of a client device. The encrypted selection data represents the set of distribution parameters for the candidate digital component and is encrypted using a zero-knowledge proof protocol. The cryptographic analysis application is configured to determine a measure of match between the selection data and user attributes of a user of the client device.