Perhaps this offers the opportunity for a product, in the short term: Is anyone offering credit cards which promise not to sell your purchase history? I'd be game for that.
It looks to me like a form of homomorphic encryption where both the aggregate consumer transactions (people bought X at merchant M), and the aggregate Google ad information (people saw ad for X at merchant M) are encrypted and the set intersection is computed on the ciphertext revealing only the aggregate number of purchases, not the individuals.
Now granted, there could be a security hole in this scheme as with any crypto-protocol, so it does need peer review, but the design, as stated in that YouTube presentation, is not to reveal to Google personal purchasing information, nor reveal to merchants, personal profile information. No personal financial data or purchasing information is supposedly transmitted.
The problem with this kind of technology is that it is really difficult to explain to the public, and easily demagogued.
I guess this complaint from this article is asking the FTC to get more information on this process, or get Google to explain how it works, or something.
Upvote for the explanation.
I've worked on a similar problem, and some very large retailers we worked with wanted to measure ROAS. They turned off all adspend in a certain large metropolitan area, while we turned on in that area. Measuring the sales lift/drop, gave an idea of the platform's effectiveness.
Any other demographic data point could also be used, not just geo. You don't necessarily need to link people directly.
I do not know of any work in homomorphic encryption that claims to provide privacy guarantees in the face of side-channels from other sources (in this case, the side-channels could be phone location information for brick-and-mortar purchases, or web browsing activity timestamps for online purchases). It's not surprising that such work is hard to find, since merely computing correct query results breaks most reasonably privacy guarantees.
Also, the field of homomorphic encryption encourages people to use horrible cipher-modes like code-book, so guilt-by-association makes me highly suspicious of stuff in that space: https://en.m.wikipedia.org/wiki/Block_cipher_mode_of_operati...
The closest thing I know of that is workable is differential privacy, which (in laymans terms) introduces enough noise to make sure that overly-specific queries return random (but representative) garbage. Apple says they use differential privacy to train models on data that's stored on iPhones without actually giving themselves access to that data. Cool stuff.