Over/under on when someone is able to de-aggregate an identity down to an individual user?

I’ve got it on less than 6 months.

6 weeks would be optimistic

how do de-aggregation attacks or whatever you'd call this work?

One of the easiest methods is to find a different data source with overlap and use that to map real people to anonymized lists. Big tech companies find this super easy to do because of all the internal data they already have on everyone

More like 15 minutes.