NabenHarb

For the case of RAPPOR (and for what Apple is doing), you do not need to trust the aggregator with your data. These algorithms operate in the "local" model of differential privacy, where all privatization occurs on the users' local machines before being sent to the aggregator.

Not many, certainly. Which is perhaps why it's better for this to be implemented (since differential privacy is a known, rigorous definition for privacy), rather than to leave it up to the larger majority of users who (by your implication) don't understand it and won't be bothered to understand it.

Except if you actually read and understood the link, points #1, 4, 5 aren't a concern. Moreover, points #2, 3, and 6 apply to just about every piece of software used.

Do you happen to know how the two books compare to each other?

You have essentially described differential privacy (https://en.wikipedia.org/wiki/Differential_privacy).

The main issue is that there is no reason for companies like Facebook to fully adopt it, since it doesn't benefit them and there is no outside pressure forcing them to do so.