They could still do that in a secure way, client-side, if they wanted: when content is displayed in-browser, javascript could parse it, send home relevant words (on an encrypted channel), and receive relevant ads. The server would have to ensure that data is not saved, or it's anonymously aggregated right away -- you'll have to trust their word on that, but that'll always be the case.

Computationally expensive, maybe, but it's 2013 and browsers can take a bit of abuse. It wouldn't cover people using POP/IMAP, but Joe Average doesn't bother with that geekery anymore. Obviously it would take some time to implement, but it could be done.