E-commerce
Every sale hands your details to an independent seller the platform says it does not answer for, and your browsing and purchase history is what the ads run on. Policies that say they do not sell your data concede in the same paragraph that the same flow may count as a sale under some laws.
The read at a glance
Order history builds a picture of your household and your spending.
A leak exposes your address, your card, and a detailed record of what you buy.
Order and tax records are kept for years; marketing profiles linger until you object.
Checkout needs payment and address; ID is rare unless fraud is flagged.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
What leaks is a list of things you never said out loud: what you bought, when, and the address it went to. Purchases imply diagnoses, pregnancies and beliefs you never declared. Gifts you sent put other people's homes in the file too.
What repeats in the policies
Every sale hands your details to someone else
Buy something, and your name, delivery address, email and often your phone go to an independent seller whose conduct the platform commonly says it does not answer for. Sell and take payment, and the marketplace becomes a financial institution: government ID, date of birth, bank details, and, where the law requires, a tax file reported to the authorities.
Your purchase history is what the ads run on
What you browse and buy feeds targeted ads. Several policies say plainly that they do not sell your data, then concede that the same flow may count as a sale under US state law. Marketplaces also hand a scrambled version of your email and your device ID to ad platforms, to find you, or people like you, off the site.
Kept as long as they judge necessary
Most policies keep your data "as long as necessary," or for the life of the account, with reasons stacked so one always applies, and almost none put a number on it. Fraud prevention is the exception that survives leaving: a banned account's records are kept precisely to stop you signing up again.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Money and net worth Likely
What and how often you buy estimates your spending power.
Health Possible
Purchases can imply conditions, pregnancy, or medication.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
Fraud-prevention markers They set it about 2 to 6 years
To flag suspected fraud, often on a shared industry database you cannot reach through the company.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Who wants this data
The ad market behind these sites is enormous: one marketplace's own cookie banner lists nearly 800 partners it shares hashed emails and device IDs with, and some buy profiles from data brokers too. The files are a proven target: a regulator penalised one marketplace group after finding it had stored card numbers in plain text and played down a breach of tens of millions of accounts.
Sold or shared Highly likely
Purchase history is prime targeting and resale data.
AI training Moderate
Buying patterns train recommendation and pricing models.
Even anonymised, this can still be you
Purchase histories are highly distinctive: four card transactions identify 90% of people (de Montjoye et al., Science, 2015).
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Payment patterns Typical
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
How you write Sometimes
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
Browsing fingerprint Typical
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“this policy does not apply to the practices of our sellers”
The platform passes your name, address, email and phone to an independent seller, then steps back from what that seller does with them. Where a platform sets a reuse rule instead of this disclaimer, that rule, not any technical limit, is all that stands between your contact record and a marketing list.
The move The platform answers for its own copy of your data; the seller answers separately for theirs.
“we do not sell your information as that term is generally understood, though it may be considered a sale or sharing under certain laws”
Purchase-history identifiers are routed to ad partners while the word "sale" is treated as a technicality. The clause admits the flow, because a required opt-out depends on admitting it, and denies its plain meaning in the same sentence.
The move The opt-out sits in that same paragraph; using it in writing draws the line going forward.
“a code derived from applying irreversible cryptography to information like your email address”
Your email is turned into a code and handed to ad platforms to match you, or people like you, off the site. The code is offered as anonymity, but a match is the whole purpose of the operation.
The move An access request covers which identifiers left and where they went. Under UK and EU law you can ask for the recipients by name, not only by category.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.