Advertising & Surveillance

The platforms are free. You are the product — in a more specific sense than the phrase usually suggests.

How to read this page. Tap any underlined word to see the precise academic term and a short definition. Expand any "Deeper" box for the evidence and contested points. The main text works on its own — you can skip both and still get the whole argument.

How it started

DoubleClick was founded in 1996 and began tracking users across websites using cookies — the first large-scale behavioural profiling of internet users for commercial purposes. In 1999, it acquired Abacus Direct, an offline data broker with records of real-world consumer purchases. Privacy advocates immediately raised alarm: combining anonymous online browsing with personally identifiable purchase history would create something qualitatively new. The FTC investigated and closed the file in 2001 without taking action — while noting that closing it was no finding that the law had been kept.

Google announced its purchase of DoubleClick in 2007 and completed it in 2008. In 2009 it launched interest-based advertising, which profiled each browser by the sites it visited. For seven years Google kept that browsing record separate from the names in its users' accounts; in 2016 it quietly dropped that promise — precisely the combination of online behaviour and identity that advocates had warned about in 1999. The concern was documented, investigated, and then set aside. The industry grew.

Real-time bidding: the auction you never see

When you visit a website, an auction takes place in the time it takes the page to load — typically 100 milliseconds. Your behavioural profile is broadcast to dozens of advertising companies simultaneously. They bid for the right to show you an ad. The winner's ad appears. The auction is complete before you have finished reading the headline.

This system is called real-time bidding (RTB). According to research by the Irish Council for Civil Liberties (ICCL), the average EU internet user has their data broadcast to advertisers an estimated 376 times per day. In the United States, the estimate is 747 times per day. Not to the winning bidder. To all bidders — every company that receives the broadcast can keep a copy of your profile data whether or not it wins the auction, and nothing in the system stops it.

In 2022 the Belgian Data Protection Authority found that the advertising industry's own consent framework for RTB breaches the GDPR, and in 2024 the Court of Justice of the European Union, on questions referred by a Belgian court, confirmed key parts of that reasoning. The system continues to operate.

What the profile contains

The data broadcast in an RTB auction typically includes: your approximate location, the device you are using, the time and date, the site you are visiting, and — critically — your inferred characteristics. These are not facts about you. They are inferences drawn from your behaviour across thousands of sites over months and years: your likely income bracket, your health concerns, your political leanings, your relationship status, your anxieties.

Inferred data

Data you never provided, generated by predicting your attributes from your behaviour — for example inferring a health condition from the articles you read. Under European data-protection law, inferences about you can be personal data, but you rarely know they exist, cannot see them, and cannot easily correct them. The profile that decides what you are shown is one you have no access to.

Sources

Wachter & Mittelstadt (2019), A Right to Reasonable Inferences, Columbia Business Law Review.

Shoshana Zuboff, in The Age of Surveillance Capitalism (2019), describes this as a fundamental reorientation of the internet's economic logic: human experience is raw material, processed into behavioural prediction products, sold to whoever will pay. The product is not the platform. The product is you — specifically, the predictive model of what you will do next.

Behavioural surplus

Zuboff's term for the behavioural data left over after a service has been delivered to you — the click patterns, locations, and timings that aren't needed to run the product, but are captured anyway and fed into prediction. This surplus is the raw material of the business: it is refined into predictions about your future behaviour and sold in markets you never see.

Sources

Zuboff, S. (2019), The Age of Surveillance Capitalism, PublicAffairs.

Device fingerprinting: the surveillance that survives

Most people know about cookies and delete them or accept cookie banners. Device fingerprinting is different. It identifies your device by combining dozens of technical characteristics — your browser version, screen resolution, installed fonts, graphics card behaviour, timezone, language settings — into a unique identifier that does not require storing anything on your device.

Fingerprinting relies on signals you cannot easily wipe, so clearing cookies does not stop it, and it is harder for browsers to block. It persists across sessions and, combined with other identifiers, can tie your browsing together.

In 2024 Google abandoned its long-announced plan to phase out third-party cookies in Chrome — the tracking mechanism that had been under regulatory and public pressure for years. Separately, from February 2025 it stopped prohibiting companies that use its advertising products from fingerprinting — a change the UK's data regulator called "irresponsible". The industry's response to pressure to retire one surveillance mechanism was to keep it, and to permit a more powerful one alongside.

Cambridge Analytica: what this enables

In 2014 and 2015, data from up to 87 million Facebook profiles was harvested without consent through a quiz app and passed to Cambridge Analytica, which used it in its work for US political campaigns in the 2016 cycle. The harvesting and the transfer are confirmed facts, documented in Facebook's own disclosure and Congressional testimony (2018), the US Federal Trade Commission's order against Cambridge Analytica (2019), and the UK Information Commissioner's investigation. Whether the data served the 2016 presidential election is less certain: the Commissioner's letter says some of it is understood to have been used in political campaigning, "including (it is suspected) the 2016 US presidential election", but that which data was used in any specific part of a campaign has "not been possible to determine" from the evidence reviewed.

The Brexit referendum is a separate and more limited story. The UK Information Commissioner's Office investigated and concluded in October 2020 that Cambridge Analytica was not involved in the referendum beyond initial inquiries, and that the harvested Facebook data — relating to US-registered voters — could not have been used in it. We note this precisely because the site's credibility depends on not overstating even a convenient claim.

The effectiveness of the targeting on election outcomes is genuinely contested by political scientists — the claim that Cambridge Analytica determined results is not well-supported. What is not contested is that the infrastructure existed and was used, and that the rules then in force did little to stop it: the UK regulator later fined Facebook the maximum £500,000 available under the pre-GDPR law, and the FTC's $5 billion settlement with Facebook followed in 2019. The stronger data-protection framework came later.

What you can do

No individual action defeats the RTB system — it operates at the infrastructure level, and the answer that fits its scale is structural. The partial defences that do help are kept in one place so they stay current: What to Do for the actions, Tools & Sites for the specific tools. And to see what your browser reveals right now, the Tracking & Targeting demo shows it live.

How we know — the RTB figures, the GDPR rulings, and what's contested about Cambridge Analytica

The 376 (EU) and 747 (US) daily figures come from the ICCL's analysis of industry data on how often a typical user's profile is broadcast in RTB auctions. They measure broadcast frequency, not proven misuse — but the point stands: every bidder that receives a broadcast can keep a copy whether or not it wins, so the data spreads far beyond any single transaction.

The legal status. The Belgian Data Protection Authority found IAB Europe's Transparency and Consent Framework — the consent layer underpinning much of RTB — in breach of the GDPR (Decision 21/2022). On referral, the Court of Justice of the EU (Case C-604/22, 2024) confirmed key parts of that reasoning, including that a "TC String" can be personal data. The system nonetheless continues to operate while the framework is reworked.

Cambridge Analytica — holding the line on what's proven. Confirmed: the harvesting of up to 87 million profiles, their transfer to Cambridge Analytica and its use of them in its US political work, and the weakness of the rules then in force. Contested: whether the targeting changed election outcomes — political scientists are sceptical that micro-targeting has the decisive persuasive power often claimed. Refuted: the common claim that Cambridge Analytica swung Brexit — the UK ICO's investigation found the harvested US-voter data could not have been used in the referendum. We keep these three buckets separate on purpose.

Sources

Irish Council for Civil Liberties (ICCL) — report on the IAB's RTB system (2022); the 376/747 daily figures.
Belgian DPA Decision 21/2022 on IAB Europe's TCF — Belgian Data Protection Authority.
Court of Justice of the European Union (7 March 2024), IAB Europe, Case C-604/22 — a TC String is personal data and IAB Europe a joint controller.
Kristol, D.M. (2001), HTTP Cookies: Standards, Privacy, and Politics, ACM Transactions on Internet Technology 1(2), 151–198 (open version: arXiv:cs/0105018) — third-party cookies and the advertising networks whose profiles depended on them; DoubleClick’s incorporation in January 1996 (footnote 21).
DoubleClick Inc. (13 March 2001), Form 10-K for the fiscal year ended December 31, 2000, US Securities and Exchange Commission — incorporated 23 January 1996; merger with Abacus Direct on 23 November 1999; the FTC “closed its inquiry … without recommending any further action” in January 2001.
US Federal Trade Commission, Bureau of Consumer Protection (22 January 2001), staff letter closing the investigation of DoubleClick — staff found DoubleClick “did not combine PII from Abacus Direct with clickstream” and closed the file, a step “not to be construed as a determination that a violation may not have occurred”.
Angwin, J. (21 October 2016), Google Has Quietly Dropped Ban on Personally Identifiable Web Tracking, ProPublica — the 1999 outcry over DoubleClick and Abacus; DoubleClick’s browsing records kept “separate by default from the names” until Google changed its privacy policy in 2016.
Google (13 April 2007), Google to Acquire DoubleClick, press release filed with the SEC ($3.1 billion in cash), and (11 March 2008), Google Closes DoubleClick Acquisition, Inside AdWords blog.
Wojcicki, S. (11 March 2009), Making ads more interesting, Official Google Blog — the launch of “interest-based” advertising, which associates “categories of interest … with your browser”.
Zuboff, S. (2019), The Age of Surveillance Capitalism, PublicAffairs.
Wachter & Mittelstadt (2019), A Right to Reasonable Inferences, Columbia Business Law Review.
Facebook (4 April 2018), An Update on Our Plans to Restrict Data Access on Facebook — the disclosure that up to 87 million people's data may have been shared with Cambridge Analytica.
US Federal Trade Commission (December 2019), FTC Issues Opinion and Order Against Cambridge Analytica.
US Federal Trade Commission (24 July 2019), FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook.
UK Information Commissioner's Office (ICO) (2 October 2020), letter to the DCMS Committee concluding the Cambridge Analytica investigation — not involved in the EU referendum; the Facebook data related to US voters; its use in the 2016 US presidential election suspected, not determined (Annex 2, paragraphs 18 and 30).
UK Information Commissioner's Office (ICO) (19 December 2024), Our response to Google's policy change on fingerprinting.
Chavez, A. (22 July 2024), A new path for Privacy Sandbox on the web, Google Privacy Sandbox.
Kalla, J.L. & Broockman, D.E. (2018), The Minimal Persuasive Effects of Campaign Contact in General Elections: Evidence from 49 Field Experiments, American Political Science Review 112(1).
Wang, J., Zhang, W. & Yuan, S. (2017), Display Advertising with Real-Time Bidding (RTB) and Behavioural Targeting, Foundations and Trends in Information Retrieval 11(4–5), 297–435 (open version: arXiv:1610.03013) — from a page visit to the winning ad "usually within 100ms".
US Senate Committee on Commerce, Science, and Transportation and Committee on the Judiciary (10 April 2018), Facebook, Social Media Privacy, and the Use and Abuse of Data, joint hearing, S. Hrg. 115-683 — Mark Zuckerberg's testimony on Aleksandr Kogan's quiz app and its data passing to Cambridge Analytica.
UK Information Commissioner's Office (6 November 2018), Investigation into the use of data analytics in political campaigns: A report to Parliament — the £500,000 penalty on Facebook (25 October 2018), "the highest permitted by the DPA1998".