  Limiting online data collection to the minimum required for specific purposes
is mandated by modern privacy legislation such as the General Data Protection
Regulation (GDPR) and the California Consumer Protection Act. This is
particularly true in online services where broad collection of personal
information represents an obvious concern for privacy. We challenge the view
that broad personal data collection is required to provide personalised
services. By first developing formal models of privacy and utility, we show how
users can obtain personalised content, while retaining an ability to plausibly
deny their interests in topics they regard as sensitive using a system of
proxy, group identities we call 3PS. Through extensive experiment on a
prototype implementation, using openly accessible data sources, we show that
3PS provides personalised content to individual users over 98% of the time in
our tests, while protecting plausible deniability effectively in the face of
worst-case threats from a variety of attack types.
