We consider a cloud-based control framework in which individual clients own their local plants that must be controlled by a public authority. Individual clients desire to keep the local state information as private as possible, as long as the cloud-based controller can provide a given level of quality of service. Based on an axiomatic argument, we show that Kramer's notion of causally conditioned directed information from the state random variable to a random variable disclosed to the public authority is an appropriate measure of privacy loss. For a special case with the Linear-Quadratic-Gaussian (LQG) setting, we provide a procedure to construct a 'privacy filter' that attains the optimal trade-off between privacy loss and control quality.