A fundamental flaw in this, is it still involves user data, even if “anonymized”. You can advertise without any user data.

Right. The reassurance is supposed to be: "don't worry, no personalized data is retained." So, ideally, no individual record of you, with your likes, your behaviors, your browser fingerprint, aggregated together with whatever third party provider data might be purchased, and machine learning inferences can be derived from that. Instead, there's a layer of abstraction, or several layers. Like "people who watch Breaking Bad also like Parks and Rec and are 12% more likely to be first generation home buyers". Several abstracted identity types can be developed and refined.

Okay, but who ordered that? Why is that something that we think satisfies us that privacy is retained? You're still going to try and associate me with an abstract machine learned identity that, to your best efforts, closely approximates what you think I like and what is most persuasive to me. I don't think people who are interested in privacy feel reassured at anonymized repurposing of data.

It's the model itself, it's the incentives inherent in advertising as an economic model, at the end of the day. I don't know that there's a piecemeal negotiation that is supposed to stand in for our interests to reassure us, or whose idea was that this third way was going to be fine.

Thats a good point, those ads are far less profitable though, and as a result if mozilla offered that kind of service nobody would use it