Technology
Filed here are the firms whose record of you did not begin with a sign-up. What holds the file together is the device rather than an account, so there may be nothing to log into and no delete button. The right to ask does not depend on having an account.
The read at a glance
The profile covers your habits across sites and devices, and it runs all the time.
A leak here exposes your accounts, your habits, and often the card behind them.
Once your data is called "anonymised" or "derived", most policies keep it with no end date.
Most sign-ups ask for nothing beyond an email; some add a face or ID check for high-value accounts.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
What leaks here is rarely dramatic on its own: an identifier, a device, a list of apps. The pieces are worth little apart and a great deal joined up, because they are what ties the rest of your record together.
What repeats in the policies
It started inside something else you chose
The record starts with a device you bought, an operating system that came with it, a login button you pressed on another site, or their software sitting inside somebody else's app. In each case the company was never the thing you chose.
The device is what holds the file together
Advertising IDs, install identifiers and device fingerprints hold a file like this together. None of them is a password you can change or an account you can close, and clearing your history does not touch them. The link survives because it was never anchored to your name.
There may be nothing to log into
Where the data arrived through a device or another company's app, there is often no profile page, no settings screen and no delete button. You can still ask: a written request needs no account, and the identifier they hold is enough for them to find you.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Where you go Likely
GPS and IP over time map where you live, work, and travel.
Money and net worth Possible
Purchase history and device tier hint at what you can spend.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
Anonymised, aggregated, or AI-trained data They set it often kept indefinitely
They treat it as no longer being about you, though such data can sometimes be re-identified.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Who wants this data
Device and app identifiers are the raw material of identity resolution, the trade of joining one person's activity across apps and sites that never shared an account. The joining is the product, and it works because the identifier outlives any single login.
Sold or shared Highly likely
Behaviour, purchases, and device data are the core of the ad and product-analytics economy.
AI training High
Content and usage data increasingly train the company's own models, with opt-outs that only work going forward.
Even anonymised, this can still be you
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and four location points single out 95% of people (de Montjoye et al., 2013), so taking your name off the file changes little.
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Location traces Typical
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Payment patterns Typical
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Face and voice Sometimes
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browsing fingerprint Typical
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“device identifiers and similar technologies”
A key tied to your hardware or your app install that survives sessions, accounts and sometimes a password change. It identifies a device, and a device is usually one person.
The move The identifier is data about you, and an access request covers what is held against it.
“we collect information when you use apps and websites that use our tools”
Data reaching them through other companies' products, with no account, no sign-up and no notice at the point it was taken. You meet the company for the first time when you go looking for it.
The move A request does not depend on having an account with them.
“we share information across our family of companies”
One file assembled across every product the group owns, including ones you have never used. The brand you dealt with is one part of it.
The move A request aimed at the group rather than the product reaches the whole file.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.