Potential privacy issues of not showing suggestions in certain contexts

[ For context around Suggested Tiles, please read http://ed.agadak.net/2015/04/whys-and-hows-of-suggested-tiles ]

An important feature for some brands who would want to provide content in the new tab page is to not be shown in the context of certain sites. For example, a suggestion for an upcoming movie trailer wouldn't want to be shown next to a tile for illegal file sharing.

We're planning on supporting this feature, but it has some privacy nuances.

Similar to how Firefox has enough data to decide that it's appropriate to show a movie trailer suggestion to users who tend to visit movie related sites, Firefox could have enough data to decide when it's inappropriate. If a given Firefox instance does *not* report back that the movie trailer suggestion was shown, one could try to infer that it was because the user had a visible illegal file sharing site in the new tab page.

Another approach is to temporarily hide the illegal file sharing site so that it's acceptable to show the movie trailer. Once the suggestion no longer needs to be shown, the hidden tile can reappear. However, even in this situation, Firefox reports back the structure of the new tab page (but no URLs), and there could be enough data to infer something was hidden then shown again.

To be clear on both potential privacy leaks, we have aggressive data deletion policies and don't keep any unique identifiers that can be associated with our users. But this ability could be used by malicious entities to learn information about users.

Do people have thoughts on the privacy issues raised here and potential solutions?

Ed Lee