What Your Profile Looks Like at a Data Broker

How a profile with a permanent ID is assembled from scattered traces. Let us start with a simple question. Why does advertising for trainers chase you across three different sites after you looked at them once in a store? You did not give these sites permission. You did not even register with them. But the advertising knows who you are. Here is how it works from the inside.

The architecture of the system

There are three levels that most people do not see.

Level 1 — Publishers

This is any site with advertising. A news portal. Weather. Recipes. A forum. The site’s owner wants to earn on advertising but does not want to look for advertisers themselves. They connect to the system.

Level 2 — Ad Exchanges

These are automatic markets where auctions take place in milliseconds. When you open a page — at the moment of loading your browser sends a signal to the exchange. The exchange announces an auction: «There is a user. Here is their profile. Who pays more to show advertising?» The auction ends before the page has loaded. You notice nothing.

Level 3 — Data Brokers

These are the main invisible players. Their task — to know everything about you. They do not show advertising. They do not sell goods. They sell only one thing: information about you to advertisers and exchanges.

Where brokers get the data

This is the most important part. There are many sources and they work simultaneously.

• Cookies and trackers on sites. Every time you visit a site — it loads dozens of invisible third-party scripts. It is not the site tracking you. It is the brokers who embedded their code in the site and track through it. The site’s owner receives money for this connection.
• Pixels. An invisible image of 1×1 pixel embedded in a page or a letter. When you open the page — the pixel loads and sends a signal: this person is here, at this time, from this device. You opened a letter — the broker knows.
• Fingerprinting. Even without cookies. Your browser has unique characteristics — version, fonts, screen resolution, installed plugins, graphics-processor behaviour. The combination of these parameters is unique like a fingerprint. Changing cookies is pointless if the fingerprint stays the same. Buying data from apps. Most free apps earn not on you — they earn from you. By selling data about your behaviour to brokers. Your weather, flashlight, game — all of these are potential sources of data. Data from payment systems. Some brokers have partnerships with payment processors. They know what you bought, where and when. Not the card details — the pattern of behaviour. Public sources. Social networks, public registers, open databases. Everything you ever published publicly.

How your profile is built

The broker takes all these sources and runs a process called identity resolution. Your email from one site. Your phone from another. Your IP address. Your fingerprint. Your cookies. All of these are different identifiers that at first glance are unconnected. But the algorithm finds intersections. The same IP appears in different places. The same fingerprint on different sites. The email matches a database from a leak. And so the scattered dots come together into a single profile with a permanent ID — which does not change even if you changed the browser, cleared cookies or turned on a VPN. This ID — is you. Your digital copy. It exists regardless of whether you know about it or not:

There are more formats; the main ones are shown here.

To whom and how it is sold

The profile is not sold as a file with your name. What is sold is access to an audience. The advertiser says to the exchange: «I want to show advertising to men aged 28–40, living in Estonia, interested in finance, recently searching for real estate.» The exchange finds all users matching this profile — including you — and sells the ad impression to precisely them. You are not sold by name. But you are sold by a combination of characteristics that describes only you. This is called programmatic advertising. The market size — hundreds of billions of dollars a year. The speed — milliseconds. The scale — billions of profiles simultaneously.

The main players

L******* — one of the largest identity-resolution brokers. Specialises precisely in linking scattered identifiers into a single profile. Works with thousands of partners simultaneously. A****** — has existed since 1969. One of the oldest and largest brokers. Stores profiles on billions of people. Sells data to banks, insurance companies, advertisers. E******* — a credit bureau. But in parallel — the largest broker of marketing data. The same data used for credit scoring — is used for advertising targeting. C****** — specialises in retargeting. It is precisely they who most often stand behind the fact that advertising for trainers pursues you across the whole internet after one view. T************ — a platform for advertisers. Buys access to an audience through dozens of exchanges simultaneously. Q*********, P*******, I*********, O**** — exchanges and intermediaries. The infrastructure through which the auctions pass.

What a broker knows about you

For each person there are more than three thousand entries — the main ones are below. This is a real list of categories that are sold on the open data market. This is not theory — these are the official taxonomies of the IAB advertising exchanges: Age and sex. Location — home, work, routes. Income — segment. Education. Marital status. The presence of children and their age. Type of housing — rented or owned. Political views — segment. Religious affiliation — segment. Health condition — interests and queries. Financial behaviour — loans, purchases, investments. Purchasing patterns. Media consumption. Political activity. Travel — destinations, frequency. Car — make, year. Pets. Each of these categories — an audience segment that can be bought for targeting.

Why this matters beyond advertising

Advertising is only the visible part. The same data and the same profiles are used for: Credit scoring. Banks buy data from brokers to assess risks. Your purchases, behaviour on the internet, social connections influence the loan decision. Without your knowledge. Insurance tariffs. The insurance company knows that you search for information about illnesses. This affects the price of the policy. Price discrimination. Plane tickets, hotels, online stores show different prices to different users on the basis of their profile. A rich district — a higher price. Political targeting. Cambridge Analytica is not an exception. It is a normal practice used for political purposes. Profiles are used to show political advertising maximally relevant to your fears and beliefs. Hiring decisions. In some jurisdictions employers buy data about candidates from brokers.

Why GDPR was created precisely for this

When you read the articles of GDPR knowing this architecture — everything falls into place. Art. 5 — principles of processing: because brokers collect everything without limits. Art. 6 — legal basis: because brokers process without consent. Art. 14 — notification when collecting from third parties: directly about brokers. Art. 17 — the right to erasure: because profiles exist without a person’s knowledge. Art. 21 — the right to object to profiling: directly about this. Art. 25 — protection by default: because fingerprinting is collected before any consent. Chapter V — transfer of data: because brokers operate globally and data goes to the US, Russia, Singapore. GDPR is not bureaucracy. It is a response to a specific industry with a specific architecture.

The bottom line

The difference between a knowing and an unknowing user is that the knowing one understands: every tracker in his browser, every pixel in a letter, every fingerprint on a site — is not a technical detail. It is a link in a chain that ends with a profile. His profile. And this profile — is legally his data. Under GDPR. Which he has the right to request, check and demand to be deleted. From every broker. Separately.