Ok, so maybe we are talking about the same field of science, but it seems that, from what they say there is two very distinct approach.

1.Collect personal data, send them to mainframe, use them to profile and deliver custom tailored services. When sharing hash so that individual records can't be extrapolated

2.Collect personal data, use them locally sometimes using mainframe provided 'models'. Return to mainframe hashed records to improve models.

Google is clearly using 1. while Apple claim to target 2. (I don't think it's actually the case now because I though Siri actually store some personal data on the cloud so far)

How would the cookie from the work get to the phone?

You don't need to rely on cookies anymore to identify someone online: https://en.wikipedia.org/wiki/Device_fingerprint

Sure, but that's not cross device.

I must have been connected to the same Gmail or Facebook account at some point on both devices. However as I said I purposely never stay logged in to google services. Yeah, I can flush all cookies (thus annoyingly resetting all legit cookies as well).

But this is not how privacy should work, cause there is a lot of people out there that don't read HN and only recently found out that there is a lot pastry inside their computers.

Your browser (Firefox, Chrome, Safari) most likely uses Google SafeSearch. That phones home with a super cookie every 30 minutes.