Sending data by itself isn't commonly seen as an attack vector with things like TLS in place and working, as far as we know. At least, Google has been sending browsing history with no additional encryption as part of Chrome Sync since its inception and there we don't know of data leaks during send so far either.

And at the server where it's sent to, it gets disconnected from the IP address and intermixed with other people's browsing history. So, it's not stored in personally identifiable form and therefore not vulnerable there either.

Mozilla has also made an official statement that neither they nor Cliqz store personally identifiable information as part of this, so doing it anyways would be misleading of consumers, i.e. breaking the law.

Not to mention that it would violate German privacy laws (which is where it's currently being tested), if they collected personally identifiable information without clearly notifying the user and at least some checkbox that the user has to tick.

It's easy to spin this, so that it sounds like Mozilla is doing pure evil here, but it's just not the case.

I don't know much about that. I'm talking about Firefox in particular.

Edit: Ah, this is a part of Firefox. It looks like they're using some crypto/privacy features such that "aggregation is not technically feasible".

Strongly blinding stuff that way isn't new; e.g. the safe browsing stuff uses differential privacy.

Cliqz isn't (pure) telemetry, it's more like the suggestions at the top of the page on Google. It reads what you're typing in the address bar and tries to give you clever info based on what it thinks you're looking for.