One half watches you, the other buys you: the moment a page loads, details of your visit go out to the companies bidding to show you an ad. Opt-outs are commonly scoped to one device, and retention runs from a week to no limit at all.
A traded profile you never consented to. Keep the record.
Ad and broker profiles are kept and traded with no end date; "anonymised" segments never expire.
You never signed up: the profile is built from data collected elsewhere.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
A leak exposes an inference file: what you buy, what you earn, what you are worth targeting for. UK and US regulators found segments covering mental health, sexual health, substance use and politics, tied to precise location: conclusions you never stated.
You never signed up for this
Open an ordinary website or app and it quietly runs tracking code from advertising firms you never heard of. There is no account, no login and no sign-up. They collect your device, your IP address and the pages you open, and none of them is a company you chose.
One half watches you. The other buys you.
An ad platform learns you by being on the page: many policies say that the moment it loads, details of your visit go out to the companies bidding to show you an ad, and the UK's data regulator reported that a single request can reach hundreds of companies. A list compiler never goes near you, building its file from client companies, public registers and bought sources. The two meet in an identity graph, where a scrambled copy of your email address joins the browser to the offline record.
Deleted rarely means gone
How long the data lives is their claim, and it varies widely: some policies name a week, some thirteen months, several name no limit and hold it as long as they judge necessary. When a stated period ends, the common wording is de-identified or aggregated, not deleted. What was learned from you is kept, sometimes for years more.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Wealth brackets and spending power are core targeting data.
Segments explicitly model political leanings.
Inferred health conditions are sold as segments.
Orientation is an inferred and traded segment.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
A minimal note kept on purpose so they do not contact you or re-add you.
They treat it as no longer being about you, though such data can sometimes be re-identified.
To flag suspected fraud, often on a shared industry database you cannot reach through the company.
Tax and company law makes them keep billing and payment records.
They can keep records to defend a live or possible legal claim.
The data has a market, and most of it is mundane: advertisers buying intent, in-market segments, spending power. The edges are documented. The UK's ICO reported that the fields broadcast in a bid request can include categories like mental health, sexual health, substance abuse and politics. The US FTC banned one broker after it sold precise location tied to advertising IDs, enough to place a phone at a reproductive health clinic or a domestic abuse shelter. Other firms in this trade hold offline records down to a name, home address and social security number.
Selling and enriching your profile is the entire business.
Behavioural profiles train targeting and inference models.
Anonymised is their word, and their whole trade tests it: in 2024 the US Federal Trade Commission found a broker's location data "is not anonymized" and could match a person's device to the places they visited, and four location points single out 95% of people (de Montjoye et al., 2013).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)·FTC order prohibits data broker X-Mode Social and Outlogic from selling sensitive location data (US Federal Trade Commission, 2024)
Deleting here creates a file. Brokers and ad platforms honour a deletion by writing you to a suppression list and keeping it indefinitely, by design, so the next feed they buy does not re-import you. That is the mechanism working, and it means the smallest permanent record they hold on you is the one your own request creates. If a removal service filed it for you, it is a record you are paying a subscription to have created.
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“your consent, obtained for us by the operators of the sites that use our technology”
The firm never asks you anything. Its permission to track you arrives second-hand, through a cookie banner on a website you visited, and whether you were even asked, and on what basis, is that website's choice rather than theirs. The UK's data regulator reported that consent collected this way was not compliant.
THE MOVE Which basis they claim, and who collected it for them, is theirs to state. Their reply, or the silence, goes on your record.
“these opt outs are specific to the device or browser on which they are exercised”
The opt-out is a cookie or a device setting, not a record on an account, because you have no account here. Clear your cookies, switch browser or pick up a new phone and it is gone while the collection begins again. You repeat it for every company, on every device.
THE MOVE A request goes to the company itself, not to a cookie on one device. Their reply goes on your record.
“certain activities described here may constitute 'sharing', 'selling' or processing for 'targeted advertising'”
A quiet admission that the ordinary running of the platform counts as a sale of your personal data under US state privacy law. The conditional word, may, lets the same sentence carry the opt-out-of-sale link the law requires without stating the sale plainly anywhere else.
THE MOVE In the US you can direct them not to sell or share your data, and state law backs the request. Their reply goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →