How the technology works
Learn how you're tracked.
Modern life generates an extraordinary amount of information about us. Much of it is collected quietly, through technologies most people never see.
01It starts with an ordinary moment
Four things that happen every day.
None of these feels like surveillance. Each of them is a data-collection event, and each one produces a record that will outlive the moment.
A website
can communicate information about your visit to other companies before the page has finished loading.
A television
can recognize what appears on its screen and report what you watch.
An app
can collect information about your device and your activity, on and off the app.
Location data
can reveal where you live, work, worship, shop, and seek medical care.
02What actually gets collected
Each source produces several kinds of data at once.
A single moment rarely yields a single fact. A website visit produces identifiers for your browser, a record of what you did, a rough location, and often the content of what you typed. The ledger below shows how the categories stack up.
| Source | Identifiers | Activity | Location | Content | Sensitive | Examples |
|---|---|---|---|---|---|---|
| WebsiteBrowser and the trackers on the page | Cookie IDs, pages viewed, clicks, searches, form entries, IP-derived city | |||||
| TelevisionSmart TV and streaming devices | Device ID, everything shown on screen, viewing times, household IP | |||||
| AppMobile apps and the software kits inside them | Advertising ID, taps and sessions, precise GPS, contacts, health and fitness inputs | |||||
| LocationPhone, Wi-Fi, Bluetooth, vehicle | Timestamped coordinates, dwell time, routes, visits to clinics or places of worship | |||||
| PurchasesCards, receipts, loyalty programs | Loyalty number, items bought, store and time, spend patterns | |||||
| VehicleConnected-car systems | Vehicle ID, trips, speed and braking, in-car app use |
Categories are generalized. What any particular company collects depends on its products, its partners, and the disclosures it has made.
03The keys that tie it together
A handful of identifiers follow you from source to source.
On their own, these records are fragments held by different companies. What makes them dangerous is that each fragment carries an identifier, and the same identifiers show up again and again. An identifier does not need your name to be about you.
_ga=GA1.2.1948217341.16Cookie and browser IDs
Set by websites and the trackers on them. Different companies set different cookies, then "sync" them so each knows the other's ID for the same browser.
Websites
6D92078A-8246-4BA4-AE5BMobile advertising ID
A single ID assigned to your phone and shared with every app that asks. It lets activity in one app be joined to activity in another.
Apps · Location
203.0.113.42IP address
Assigned to your home connection. Every device on your Wi-Fi shares it, which is how a phone, a laptop, and a television are recognized as one household.
Everything on your network
sha256: 9f86d081884c7d659a2fHashed email and phone
Your email address or phone number, scrambled into a fixed code. The scrambling is the same everywhere, so two companies holding the same code know they hold the same person.
Logins · Loyalty · Purchases
ACR-TV · VIN · loyalty #Device and account IDs
Your television, your car, and your loyalty accounts each carry a permanent ID that ties their data to the same household or person over years.
TV · Vehicle · Purchases
Doe, J. · 30326 · 1984-06-14Name, address, and date of birth
The offline anchors. Public records, purchases, and account sign-ups tie every digital identifier above to a real person at a real address.
Data brokers · Records
04Identity resolution
The fragments are matched into one graph, with you at the center.
The industry calls this an identity graph. Specialized companies collect records from thousands of sources and match them on shared identifiers, deterministically where the same hashed email or phone appears, and probabilistically where a shared IP address and consistent timing make a match likely enough. The result is a single node representing you, connected to every device, account, and place you have touched.
Collect fragments
A browser cookie from a news site, an advertising ID from a weather app, a viewing log from a television, a loyalty number from a grocery store.
Match on shared keys
The phone and the television share a home IP address. The loyalty account and the app login share a hashed email. Each shared key is an edge in the graph.
Resolve to a person
A name and mailing address from public records or a purchase anchor the whole cluster to one individual and one household.
Infer and score
With the graph assembled, models fill in what was never disclosed: income bracket, health interests, life events, likelihood to buy, to churn, to vote.
05The profile
The output is a file about you that you have never seen.
Once the graph resolves to a person, it is packaged into segments and scores that can be bought, sold, and matched by anyone with one of your identifiers. Much of the file is inference rather than fact, and inferences can be wrong in ways that still affect you.
Resolved profile
IllustrativeSegments assigned
Segment names are representative of categories commonly offered in the data marketplace. This is not a real person.
What the file is used for
Targeting
Deciding which ads, offers, and messages you see, across every device in the graph, not just the one you were using.
Pricing
Setting the price, premium, or interest rate you are shown based on who the profile says you are.
Screening
Informing decisions about housing, employment, insurance, and credit, sometimes through scores you will never be shown.
Influence
Shaping the news, political messaging, and recommendations you encounter, tuned to inferred beliefs and vulnerabilities.
Resale
Sold onward to data brokers, marketers, and sometimes government agencies, where it is combined again with other files.
The technology is complicated.
The principle isn’t: Information about your life has value. You should know when it is being collected, who receives it, and what they are doing with it.
Want to know when we find something? Sign up for updates