--- title: "Data Combination" description: "Three companies each hold a thin, harmless-looking slice of you. One shared key — a phone number or email — combines them into a profile none of them holds alone. No conspiracy. Only incentives." url: https://attentionmachine.org/en/attention-machine/data-combination/ lang: en updated: 2026-10-25 license: "CC BY-NC-SA 4.0 (https://creativecommons.org/licenses/by-nc-sa/4.0/)" --- # One thread ties it together Three different companies hold three harmless-looking pieces of one person. On their own, each piece is thin. The trick is not one all-seeing eye — it is that the same identifier lets the pieces be matched to the same person, and combined into a profile sharp enough to guess what will move them. This is a safe sandbox. The person below — **Sam** — is invented, and so is every figure shown. Nothing here reads your own accounts, nothing is stored, and a **Reset** button sits beside the controls. ## Data Combination demo **Meet Sam (fictional).** Three companies each see one slice of Sam's day. Watch what happens when one key links them. Messaging app What it holds about Sam - Phone number - Who Sam messages, and how often - Times of day Sam is active - Phone model and operating system - The contacts in Sam's address book Message _content_ is end-to-end encrypted — not collected, and not needed. Social platform What it holds about Sam - Email & phone on the account - Pages, accounts, and groups Sam follows - What Sam lingers on (dwell time) - Declared profile: age range, city - Other sites Sam visits (tracking pixel) Ad auction & data brokers What it holds about Sam - Hashed phone / email - Approximate location of Sam's phone - Device identifiers - Broker attributes (life stage, income band) - A resolved, person-level ID 🔗 marks the **same detail** — a phone number or email — that turns up in all three cards. That shared detail is what lets the separate slices be joined into one. How the data is connected All three hold the same detail — a phone number or email. Even when it is scrambled into a "hash" (a fixed jumble of characters), it is the _same_ jumble everywhere, so it still works as the link: `+31 6 1234 5678  →  9f2a1c7b… (same every time)` **A hash is not anonymous.** It hides what the detail says, but it is a _stable label_ — the same number or address always gives the same hash — which is exactly what makes it a reliable key for joining the slices. Apply privacy rules (e.g. EU) Sam's profile inferred · fictional Each company's slice on its own is thin. Press "Connect the data" to combine them. Targeting precision __ low One thing to do now **Stop Meta using what other businesses tell it about you.** In Meta's Accounts Centre, under Ad preferences, switch off the setting that lets Meta use the activity other businesses report about you (Meta renames it from time to time). [Open Meta's settings](https://accountscenter.facebook.com/ad_preferences) (log in first). ## What just happened No single company set out to build the whole of that profile. Each is optimising its own business: the messaging app wants to run a service, the social platform wants to sell attention, the data broker sells the matching, each bidder in the auction wants to outbid the next. The profile is what _falls out_ when they share a key. That is the whole argument of this site: no conspiracy, only incentives. The most important line is the locked one. The messaging app cannot read what Sam says — that part really is encrypted[^src-whatsapp]. It does not need to. _Metadata_ — who, when, how often, on what device, from which contacts — is enough to place Sam in the combined picture. The encryption protects the content; it does not protect the pattern. ## The key is the mechanism Once a phone number or email is turned into a hash, it can be passed between companies without ever sharing the raw number — and still act as the same join key every time. A platform matches its own users to an advertiser's customer list[^src-meta-developers] this way; a data broker resolves a dozen scattered records to one person-level ID and feeds it into the ad auction[^src-cracked-labs-2023]. That is the profile [the Advertising page](https://attentionmachine.org/en/attention-machine/advertising/) describes being broadcast to bidders hundreds of times a day[^src-irish-council]. "Hashed" sounds like "anonymised." It is not: it is pseudonymous — a stand-in name that still belongs to one person — which is precisely what makes it useful for joining records. ## It builds up over time The profile is not a single snapshot. Every message, visit and location is added to the same record, tied to the same key[^src-cracked-labs-2023]. So something from weeks ago can still shape what reaches Sam now: that Sam was in contact with someone, that they follow a certain topic, that Sam's phone was in a certain place. Gathered over time, that history is enough to _predict_ what Sam will respond to next. Say Sam helps a friend who has just moved house, looks up a removals firm and follows a few home-decorating accounts; days later the ads turn to sofas and paint — not because anyone heard a conversation, but because the pattern around Sam now looks like thousands of others who were moving. This is why it can feel as though your phone is listening. When researchers examined more than 17,000 phone apps[^src-pan-2018] they found no evidence of apps secretly recording through the microphone — and the machine does not need one. The record of who you contacted, when, and what is already known about them and you predicts the rest. In one well-documented case[^src-duhigg-2012], reported in 2012, an American retailer built a model that predicted, from buying patterns alone, which customers were pregnant — and began sending them baby offers. No conversation was overheard; the accumulated pattern was enough. (The often-repeated anecdote of a father learning of his daughter's pregnancy from the coupons rests on one unnamed employee's account, and whether the model sent them is disputed[^src-piatetsky-2014]; the modelling itself is documented.) ## What you can do Make it harder to be profiled and tracked. None of these is a full fix — each one weakens the key that ties your slices together. - **Keep your accounts separate.** In Meta's Accounts Centre you can keep Facebook and Instagram as separate accounts, and in the EU you can decline to have WhatsApp's account data combined with them. - **Use a different email or phone number for different services.** That removes the single key that joins your slices into one profile. - **Install a free tracker blocker** such as uBlock Origin — it cuts how much the auction side can follow you around the web. More, ordered by how much they actually change: [What to Do →](https://attentionmachine.org/en/educate/what-to-do/) **Deeper — what is and isn't shared, and where the law has stepped in** **Content vs metadata.** WhatsApp messages and calls are protected by end-to-end encryption[^src-whatsapp] (the Signal protocol), so their content is not readable by the service. What flows to the wider company is metadata and account information — the distinction the demo's locked line makes. **Combining across services is the contested act.** In the ad-tech industry this combining has its own names — _identity stitching_ or _identity resolution[^src-cracked-labs-2023]_ — but the plain idea is the same: link the pieces to one person. Germany's competition authority, the Bundeskartellamt, prohibited Meta (then Facebook) in 2019 from combining a user's data across Facebook, Instagram, WhatsApp and third-party sites without genuine consent. The Court of Justice of the EU backed that approach in Meta v Bundeskartellamt (2023)[^src-court-justice-2023], and the case closed in 2024 only after Meta introduced an "Accounts Centre" letting EU users keep services separate. Closing it was not a clean bill of health: the authority said it did not mean all its competition concerns had been eliminated[^src-bundeskartellamt-2019], and left further improvements to other rules, such as the EU's Digital Markets Act and data-protection law. The "Apply privacy rules (e.g. EU)" toggle reflects this: the architecture is the same everywhere, but in the EU the linking requires consent and can be switched off. **Transparency was found wanting (and is being litigated).** Ireland's Data Protection Commission[^src-data-protection-2021] fined WhatsApp €225 million in 2021 for not telling users clearly how their data was shared with other Meta companies. That penalty is not the end of the story — in February 2026 the Court of Justice of the EU[^src-court-justice-2026] ruled that WhatsApp may challenge the EU-level decision behind it, sending that case back to a lower EU court — so treat it as a live dispute, not a closed verdict. **Why this is a simulation.** Sam is invented and every number is illustrative. We do not — and could not honestly — pull a visitor's own WhatsApp, social or broker data; the point is to show the _mechanism_, not to perform it on you. ## Sources [^src-whatsapp]: WhatsApp, [_Does WhatsApp collect or sell your data?_](https://faq.whatsapp.com/2779769622225319) — end-to-end encryption of content; metadata and account data sharing. [^src-bundeskartellamt-2019]: Bundeskartellamt, [_Meta/Facebook — combining data from different sources_](https://www.bundeskartellamt.de/EN/Digital_economy/proceedings_against_large_digital_companies/Meta_Facebook/Meta_Facebook_node.html) (proceedings 2019; concluded 2024), and press release (10 October 2024), [_Facebook proceeding concluded_](https://www.bundeskartellamt.de/SharedDocs/Meldung/EN/Pressemitteilungen/2024/10_10_2024_Facebook.html) — the case was closed at the authority's discretion; this "does not mean that all competition-law concerns have been fully eliminated". [^src-court-justice-2023]: Court of Justice of the EU (4 July 2023), [_Meta Platforms v Bundeskartellamt_](https://curia.europa.eu/juris/liste.jsf?num=C-252/21), Case C-252/21. [^src-data-protection-2021]: Data Protection Commission (Ireland), [_Decision in WhatsApp transparency inquiry_](https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-whatsapp-inquiry) (2 Sept 2021; €225 million). [^src-court-justice-2026]: Court of Justice of the EU (10 February 2026), [_WhatsApp Ireland v European Data Protection Board_](https://curia.europa.eu/juris/liste.jsf?num=C-97/23), Case C-97/23 P — WhatsApp's challenge to the EDPB's binding decision behind the fine is admissible; the case was sent back to the General Court to rule on the merits. [^src-meta-developers]: Meta for Developers, [_Advanced Matching — Meta Pixel_](https://developers.facebook.com/docs/meta-pixel/advanced/advanced-matching/) — hashed email and phone as the match key for off-site activity. [^src-cracked-labs-2023]: Cracked Labs / Wolfie Christl (2023), [_Pervasive identity surveillance for marketing purposes_](https://crackedlabs.org/dl/CrackedLabs_IdentitySurveillance_LiveRamp.pdf) — resolving identifiers to a person-level ID and into real-time bidding. [^src-irish-council]: Irish Council for Civil Liberties, [_The scale of Real-Time Bidding data broadcasts in the U.S. and Europe_](https://www.iccl.ie/news/iccl-report-on-the-scale-of-real-time-bidding-data-broadcasts-in-the-u-s-and-europe/) — the profile is broadcast 376×/day (EU), 747×/day (US). [^src-pan-2018]: Pan, E., Ren, J., Lindorfer, M., Wilson, C. & Choffnes, D. (2018), [_Panoptispy: Characterizing Audio and Video Exfiltration from Android Applications_](https://petsymposium.org/popets/2018/popets-2018-0030.php), Proceedings on Privacy Enhancing Technologies — a study of 17,260 apps found no evidence of secret microphone recording. [^src-duhigg-2012]: Duhigg, C. (2012), [_How Companies Learn Your Secrets_](https://www.nytimes.com/2012/02/19/magazine/shopping-habits.html), The New York Times Magazine — Target's prediction of a customer's pregnancy from purchase patterns; predictive profiling over time. [^src-piatetsky-2014]: Piatetsky, G. (7 May 2014), [_Did Target Really Predict a Teen's Pregnancy? The Inside Story_](https://www.kdnuggets.com/2014/05/target-predict-teen-pregnancy-inside-story.html), KDnuggets — with an excerpt from Eric Siegel's _Predictive Analytics_ (Wiley): the anecdote is "an anonymous story" whose link to Target's model is an "unsubstantiated but tacit implication". Industry publication. [← Advertising & Surveillance](https://attentionmachine.org/en/attention-machine/advertising/)\ [Tracking & Targeting demo →](https://attentionmachine.org/en/attention-machine/tracking-and-targeting/)\ [What to Do →](https://attentionmachine.org/en/educate/what-to-do/) --- Some content on this site was created with the assistance of AI tools and may contain errors. [How we use AI →](https://attentionmachine.org/en/about/how-we-use-ai/)