One thread ties it together

Three different companies hold three harmless-looking pieces of one person. On their own, each piece is thin. The trick is not one all-seeing eye — it is that the same identifier lets the pieces be matched to the same person, and combined into a profile sharp enough to guess what will move them.

This is a safe sandbox. The person below — Sam — is invented, and so is every figure shown. Nothing here reads your own accounts, nothing is stored, and a Reset button sits beside the controls.

How to read this page. The demo below is interactive, but the explanation carries the whole argument on its own — it reads fully with JavaScript off. Expand the "Deeper" box for what is and isn't shared, and where the law has stepped in.

What just happened

No single company set out to build the whole of that profile. Each is optimising its own business: the messaging app wants to run a service, the social platform wants to sell attention, the data broker sells the matching, each bidder in the auction wants to outbid the next. The profile is what falls out when they share a key. That is the whole argument of this site: no conspiracy, only incentives.

The most important line is the locked one. The messaging app cannot read what Sam says — that part really is encrypted. It does not need to. Metadata — who, when, how often, on what device, from which contacts — is enough to place Sam in the combined picture. The encryption protects the content; it does not protect the pattern.

The key is the mechanism

Once a phone number or email is turned into a hash, it can be passed between companies without ever sharing the raw number — and still act as the same join key every time. A platform matches its own users to an advertiser's customer list this way; a data broker resolves a dozen scattered records to one person-level ID and feeds it into the ad auction. That is the profile the Advertising page describes being broadcast to bidders hundreds of times a day. "Hashed" sounds like "anonymised." It is not: it is pseudonymous — a stand-in name that still belongs to one person — which is precisely what makes it useful for joining records.

It builds up over time

The profile is not a single snapshot. Every message, visit and location is added to the same record, tied to the same key. So something from weeks ago can still shape what reaches Sam now: that Sam was in contact with someone, that they follow a certain topic, that Sam's phone was in a certain place. Gathered over time, that history is enough to predict what Sam will respond to next. Say Sam helps a friend who has just moved house, looks up a removals firm and follows a few home-decorating accounts; days later the ads turn to sofas and paint — not because anyone heard a conversation, but because the pattern around Sam now looks like thousands of others who were moving.

This is why it can feel as though your phone is listening. When researchers examined more than 17,000 phone apps they found no evidence of apps secretly recording through the microphone — and the machine does not need one. The record of who you contacted, when, and what is already known about them and you predicts the rest. In one well-documented case, reported in 2012, an American retailer built a model that predicted, from buying patterns alone, which customers were pregnant — and began sending them baby offers. No conversation was overheard; the accumulated pattern was enough. (The often-repeated anecdote of a father learning of his daughter's pregnancy from the coupons rests on one unnamed employee's account, and whether the model sent them is disputed; the modelling itself is documented.)

What you can do

← Advertising & Surveillance
Tracking & Targeting demo →
What to Do →