Directional data often conveys particularly sensitive information, such as user location. To protect user privacy, directional data is replaced with modified directional data that is selected based on the actual directional data, a privacy parameter, and a probability distribution on an n-sphere. In this way, the modified directional data value is useful when aggregated with other modified directional data values, but does not infringe the privacy of the directional data of the user.