People are often able to get personally identifiable information from aggregated/anonymized data. At this point, I think people should be automatically skeptical that their personal habits are protected when a company claims they only collect/use/sell aggregated/anonymized data. In practice, it might not be protected at all.