Since Monero outputs go to dual-key stealth addresses, outputs are effectively paid to a random 256-bit "address". So if you use a mixin of 50, in a transaction with 1 input, an external observer can say "this illicit transaction spends funds from 1 of 50 possible transactions", but then you need to go to those 50 and work your way back till eventually you find a needle, in a very large haystack, that you can actually identify.
Because of this, the anonymityset grows exponentially the further up the tx chain from an identifiable transaction (eg. a withdrawal from a KYC / AML exchange) you are.
The major advantage here is that every Monero transaction adds to this anonymityset, since privacy is compulsory.
On the other hand, ZCash's privacy is nearly unusable. Using it requires 8gb+ of RAM, and takes over a minute on a Xeon processor. Because of its unusability you end up being "1 of X people", where X is very tiny - it's limited to the people moving from traceable addresses to z-addresses who haven't identifiably moved ~the same amount out.
ZCash is useless at best, dangerous privacy theatre at worst.