In addition to Differential Privacy, Secure Multiparty Computation is another way to maintain privacy, while allowing computation across multiple users.

https://en.m.wikipedia.org/wiki/Secure_multi-party_computati...

The benefit of this is that you can get an exact computation, whereas with differential privacy the output is rougher.

The benefit of differential privacy is that it does not rely on the trust of a majority of other users; you can theoretically verify that a certain percent of the time your device sends out a wrong answer.