As the article states, customer A and B could simple put the information they each have about identity XYZ together. Without KISSmetrics having to be involved any further than in providing and maintaining the unique identity to each customer separately.
Even if it was not the intent of KISSmetrics for this to be possible (which I've a hard time believing), the chosen implementation makes it possible.
"These services are using practically every known method to circumvent user attempts to protect their privacy (Cookies, Flash Cookies, HTML5, CSS, Cache Cookies/Etags…)"
They may not share information about specific users, but doesn't mean they don't use it to sell information in some aggregate form.
but if they change their mind, there is no way I can stop them - right?
I'm highly suspicious of that claim. The only site I have whitelisted is reddit, and I found the i.kissmetrics.com cookie in with the rest. That's not to say reddit isn't using them, but I'd be surprised given their very cautious approach to advertising.
Well, I guess you can always maintain a hosts file but that's the only way I can think of.
Compare with spam. Technological solutions have reduced the problem, but to virtually eliminate it requires global law enforcement.