Anonymous, transparent data-gathering perhaps? If Apple stripped data of any kind of personally-identifying information and allowed users to view all of the data that was being sent, it could be a good middle ground. However, the problem with that solution is that it's already possible (not easy) to identify users with very little information. Stripping out identifying information doesn't necessarily mean that the information wouldn't be useful at all in the right hands (say, the government) to identify someone.
Apple talked last year about their approach here, which IIRC is basically to introduce random noise into the data they collect. This way, data at the individual level may be wildly inaccurate (and therefore not suitable for actually identifying specific people), but in the aggregate it still produces the same results.
Of course I may be completely misrepresenting this. I encourage you to go look up the relevant info from WWDC 2016 (I believe that's where they talked about it).
