"The basic insight behind Prio is that for most purposes we don’t need to collect individual data, but rather only aggregates. [Prio] does this by having the browser break the data up into two “shares”, each of which is sent to a different server. Individually the shares don’t tell you anything about the data being reported, but together they do... Over the next few months we’ll be doing further testing..."
https://hacks.mozilla.org/2018/10/testing-privacy-preserving-telemetry-with-prio/