Re: "opt-out was probably the best choice"
"if you have enough non-PII data on someone, then you can identify the person who generated it. And it's been shown repeatedly that "enough" such data is a shockingly small amount."
well, the definition of "identify" there is somewhat subtle, isn't it? You can *fingerprint* them, yes - in that if you see the same data profile again, you know it's the same person. But you don't actually know *who they are*, in the sense of 'this is Joe Bloggs of 41 Lark Terrace'. All you know is it's the same person (or, rather, the same computer) that sent the same profile before.
The bar to actually *figure out where that computer is and who owns it* is somewhat higher. Facebook and Google can do it, of course. I can't see how Canonical possibly could, from this data.
Biting the hand that feeds IT
