In this case, it's not through secure code though, it's through the nature of the data being sent itself. Differential privacy is meant to ensure you _can't_ us

In this case, it's not through secure code though, it's through the nature of the data being sent itself. Differential privacy is meant to ensure you _can't_ use the data to make any sort of inferences about individual users; only about users as a whole. That's kinda beside the point here though, as the GP seemed to be against collecting this data _regardless_ of whether or not it's anonymized or not. I'm interested in hearing why.