Apple talked last year about their approach here, which IIRC is basically to introduce random noise into the data they collect. This way, data at the individual level may be wildly inaccurate (and therefore not suitable for actually identifying specific people), but in the aggregate it still produces the same results.

Of course I may be completely misrepresenting this. I encourage you to go look up the relevant info from WWDC 2016 (I believe that's where they talked about it).