News & Media
The articles you open become the profile: readers are sorted into audience groups, and the email you log in with is scrambled into a code and handed to advertising firms, which the policies call anonymous. The subscription is priced as the alternative to consenting.
The read at a glance
A subscription ties every article you open to your name.
A leak exposes what you read, which can imply your politics and beliefs.
Subscription and reading history is kept for years; the advertising profile stays until you object.
A subscription needs payment; ID is not asked.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
A reading history records what you were curious about, and a list of headlines cannot tell curiosity from belief. Your politics, your diagnosis, your faith: all inferred, none declared, and none of it explainable after the fact.
What repeats in the policies
The articles you read become the profile
Nobody asks what you are interested in. The articles you open are analysed to guess, and many policies say plainly that they sort readers into audience groups by what they read. A reading list gives a lot away: your politics, health worries, faith and money can be inferred from the stories you choose.
Your login email follows you off the site
The email you use to log in or sign up for a newsletter is scrambled into a code and handed to outside advertising firms. The policies call the code anonymous, then say what it is for: to recognise you across your devices and on other companies' sites. One US policy admits the email may not be scrambled at all when it is shared.
Leaving does not clear the record
Closing your account rarely deletes you. Most policies set no number and keep your data as long as they judge necessary. The rare one that gives figures holds reading activity for years, and some records far longer. Unsubscribe from marketing and some keep your email anyway, on a list with no stated end. What they call deletion is sometimes stripping out the obvious identifiers instead.
The fee is priced as the alternative to your data
Free reading is paid for by the profile built from it, and the alternative offered is a subscription. European regulators have said that a bare choice between consenting to ad profiling and paying is usually not valid consent, which is why these offers borrow the official wording about an equivalent alternative. What works here is an objection to the profiling, since you may have no account to delete.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Political views Likely
What you read is a direct signal of your leanings.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
A do-not-contact record They set it kept indefinitely, by design
A minimal note kept on purpose so they do not contact you or re-add you.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Who wants this data
News sites carry more outside trackers than any other kind of website, a study of a million sites found. Your reading is matched into cross-site advertising systems through the email you logged in with, and brokers sell demographics back to sharpen the picture. One US publisher disclosed more than 13 million do-not-sell signals in a single year.
Sold or shared Likely
Reading habits are strong political and interest signals for advertisers.
AI training Moderate
What you read trains recommendation models.
Even anonymised, this can still be you
A reading history is sparse and distinctive, the same shape of data that re-identified people in a released ratings dataset (Narayanan and Shmatikov, 2008).
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Payment patterns Typical
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Browsing fingerprint Typical
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“for the purposes of journalism”
Refusing or narrowing your deletion, objection and access requests wherever the data touches editorial work. One publisher stretches it to reader comments, kept after a deletion request in case it faces a libel claim over them, so your old posts are held as someone else's evidence.
The move A request puts the exemption to the test.
“in hashed, pseudonymous form”
Your email is turned into a code and passed to cross-site advertising firms. The word pseudonymous is meant to reassure, while the code's stated purpose is to recognise you across your devices and on other companies' sites. It is a key that stays the same.
The move A request covers the code made from your email and who received it: named partners in the UK and EU, categories only in the US.
“lookalike audiences”
The profile built from your reading becomes a template for targeting strangers who resemble you. Advertisers also match their own customer lists against the site's readers to reach you, and the wording for this repeats almost word for word across publishers.
The move A request covers the audience groups built from your reading and used to model others.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.