Generated by Claude Opus 4.7 on April 22, 2026.
When a vendor says "we don't collect any personally identifiable information," what did they actually build? The honest answer, across two decades of deployed systems, ranges from "nothing at all, they just stripped the obvious identifiers" to "a multi-party cryptographic protocol with published epsilon budgets and open-source code running in trusted enclaves." This survey is a field guide to the territory between those extremes — the deployed systems you will run into by name, and the formal guarantee types that those systems do or do not meet.
Three things make this landscape hard for a newcomer. First, the same marketing words — "anonymous," "aggregated," "privacy-preserving" — get used for mechanisms that differ by many orders of magnitude in strength. Second, the strongest guarantees are conditional on assumptions (non-collusion, trusted hardware, crypto hardness, client hones
