@denschub It doesn't matter if I can, at this moment, find a deanonymization attack on Firefox PPA. It matters if marketing firms or nation-states can find one. If they do find one, they won't be sending you a nice email telling you about it.
Given all this I feel "privacy-preserving" is a deeply dishonest descriptor, and differential privacy—made of advanced math, something most consumers are not good at—creates in the consumers' mind a perception of certainty that you cannot actually provide.
@mcc @denschub calling something "privacy-preserving" because it prevents individual re-identification is misleading, because most privacy issues are group level and most privacy harms are perpetrated by classifying someone as a member of a group
DP is great for browser telemetry when you want to know that someone's browser crashed doing some specific thing but you actively don't want to know who it was—but it's not a good fit when the recipient of the message has a motivation to discriminate