A user's data is represented by a Gaussian random variable. Given a linear function of the data, a querier is required to recover, with at least a prescribed accuracy level, the function value based on a query response provided by the user. The user devises the query response, subject to the recoverability requirement, so as to maximize privacy of the data from the querier. Recoverability and privacy are both measured by $\ell_2$-distance criteria. An exact characterization is provided of maximum user data privacy under the recoverability condition. An explicit optimal achievability scheme for the user is given whose privacy is shown to match a converse upper bound.