I think it means permissions work if the app owner is not participating in the ad-buy market, but if they are, then certain permissions (any covering data provided to bidders) are skirted by google.

And by that, who is not participating in the ad-buy market. It's nearly impossible to use the internet today without being forced into it.