[braiamp]

How can Mozilla guarantee some privacy? Well, they would be using separation of content and the source. The content is "broad categories" of search queries. They take your query, match it to a category (this is important, because it has to be local matching to make sense), encrypt it with the public key and send it to a broker. The broker knows where it is coming from, but not what it says. The broker then forward to Mozilla, which decrypts it with their private key.

I don't see a problem as long as there's not enough bytes of information that can infer a person. Aggregating the data in the client would allow this, so I see some kind of time shifting to protect the activity patterns.