This is something I think would be the best solution. It seems like the best possible tradeoff between user privacy, and actual effectiveness.