The articles you open become the profile: readers are sorted into audience groups, and the login email is hashed and handed to advertising firms as a code the policies call anonymous. The paywall choice is priced as the alternative to consenting.
A political-interest profile. Worth keeping on the list.
Subscription and reading history is kept for years; profiles linger until you object.
A subscription needs payment; ID is not asked.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
A reading history records what you were curious about, and a list of headlines cannot tell curiosity from belief. Your politics, your diagnosis, your faith: all inferred, none declared, and none of it explainable after the fact.
The articles you read become the profile
You never fill in an interests form. The articles you open are analysed to guess what you like, and many policies say plainly they sort readers into audience groups by what they read. A news reading list is unusually revealing: your politics, health worries, faith and money can be read off the stories you choose, by inference and with no name attached.
Your login email follows you off the site
The email you use to log in or sign up for a newsletter is scrambled into a code and handed to outside advertising firms. The policies call that code anonymous. Many state its real job in plain words: to recognise you across your devices and on other companies' sites. One US policy admits the email may not be scrambled at all when it is shared.
Leaving does not clear the record
Closing your account rarely deletes you. Most policies set no number and keep your data for as long as they judge it necessary; the rare one that gives figures holds reading activity for years and some records far longer. Unsubscribe from marketing, and some keep your email anyway, on a list with no stated end. Deletion, where it happens, is sometimes swapped for stripping out the obvious identifiers rather than erasing.
The fee is priced as the alternative to your data
Free reading is funded by the profile built from it, and the alternative offered is a subscription. European regulators have said a bare choice between consenting to ad profiling and paying is usually not valid consent, which is why these offers borrow the same official language about an equivalent alternative. The request that bites is a limit on the profiling, not a deletion of an account you may not have.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
What you read is a direct signal of your leanings.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
A minimal note kept on purpose so they do not contact you or re-add you.
They can keep records to defend a live or possible legal claim.
Tax and company law makes them keep billing and payment records.
News sites carry more outside trackers than any other kind of website, a study of a million sites found. The stories you open feed advertising markets: your reading is matched into cross-site systems through the email you logged in with, and brokers sell demographics back to sharpen the picture. One US publisher disclosed more than 13 million do-not-sell signals in a single year.
Reading habits are strong political and interest signals for advertisers.
What you read trains recommendation models.
Anonymised is their word. A reading history is sparse and distinctive, the same shape of data that re-identified people in a released ratings dataset (Narayanan and Shmatikov, 2008).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“for the purposes of journalism”
Refusing or narrowing your deletion, objection and access requests wherever the data touches editorial work. One publisher stretches it to reader comments, kept after a deletion request because it may face libel claims over them: your old posts held as someone else's court evidence.
THE MOVE A request puts the exemption to the test. Their answer, or their silence, goes on your record.
“in hashed, pseudonymous form”
Your email is turned into a code and passed to cross-site advertising firms. The word pseudonymous is meant to reassure, but the code's stated purpose is to recognise you across your devices and on other companies' sites: it is a stable key, not anonymity.
THE MOVE A request covers the code made from your email and who received it: named partners in the UK and EU, categories only in the US. Their reply goes on your record.
“lookalike audiences”
Your reading-built profile becomes a template to target strangers who resemble you. Advertisers also match their own customer lists against the site's readers to reach you, and the wording for this repeats almost word for word across publishers.
THE MOVE A request covers the audience groups built from your reading and used to model others. Their reply goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →