Some interesting previous discussion regarding the limitations of Apple's differential privacy can be found here: https://news.ycombinator.com/item?id=15224312

Differential Privacy and anonymous-but-unique identifiers are disjoint methods of protecting privacy. Per TFA, they appear to be using the latter.

And WRT differential privacy, if enough data is captured and associated with a single identifier, then it's sufficient to get a pretty good idea what the user actually does. That's the point of differential privacy in the first place, since it indicates that a statistically meaningful amount of the data is valid.

For example, if my user id has five visits out of 1000 DP recorded visits to google.com, it's unlikely that I actually visited google.com. However, if there are 200 recorded visits, it can be safely said that yeah, I intentionally visit google.com.