What’s wrong with using cloud without sending any user id with the request?
How many stories have you heard about breaches due to accidentally mis-configured logging in web services? Also in the news lately was Twitter misusing 2fa phone numbers for advertising purposes.
I'm sure cloud processing is better in many ways. But if this is "good enough" I'd rather just do it all locally.