Electronics Guide

Lists, Ledgers, and the Origins of a Trade in Personal Facts

Commercial information about individuals became a product in the middle of the nineteenth century. Lewis Tappan founded the Mercantile Agency in New York in 1841 to supply subscribers with reports on merchants seeking credit, and a network of local correspondents, many of them attorneys, wrote assessments that mixed financial fact with judgments about temperament, drinking, and reputation. The agency became R. G. Dun and Company and survives as Dun and Bradstreet. Consumer credit reporting followed the same model at retail scale: Retail Credit Company, founded in Atlanta in 1899 and renamed Equifax in 1975, sold reports to merchants and insurers, and its investigators gathered neighborhood gossip, marital details, and lifestyle observations because insurers paid for them. The pattern both firms established, in which a third party sells an assessment of a person to someone deciding whether to transact with that person, has never gone away.

The parallel trade was direct mail. Mail-order houses such as Montgomery Ward and Sears built customer files valuable to other advertisers, and a profession of list brokerage grew up to rent those files by the thousand names. Brokers distinguished compiled lists, assembled from telephone and city directories, motor-vehicle registrations, and returned warranty cards, from response lists of people who had actually bought by mail. Response lists cost more, because a prior purchase predicts the next.

The economics of that trade explain much of what followed. A mailing has a fixed cost per piece and a response rate in the low single digits, so any information that raises the response rate is worth money up to the cost of obtaining it. Selection became the central skill, and the demand for discriminating attributes was effectively unlimited. It was demand, not any particular technology, that pulled the industry forward.

Electronics supplied the other side. Punched-card tabulating equipment allowed a list to be sorted mechanically, and magnetic tape and mainframe computers in the 1960s made two previously prohibitive operations cheap: matching one file against another to remove duplicates, which the industry called merge-purge, and standardizing postal addresses so that two spellings of one address would collide. Both are identity-resolution problems, and both are direct ancestors of the identity graph described below. The move from a filing cabinet to a tape reel did not change what the industry wanted; it changed how many people it could afford to want it about.

Inference arrived with geodemographics. In 1974 Jonathan Robbin's firm Claritas introduced PRIZM, which used cluster analysis on United States census data to sort small geographic areas into a few dozen lifestyle types. A marketer who knows nothing about an individual still knows a great deal about that individual's census tract, because neighborhoods are more homogeneous than a random sample. PRIZM turned a public statistical product into a commercial targeting attribute and established the practice of selling a modeled label rather than an observed fact. A 1965 proposal to consolidate federal statistical records into a National Data Center had meanwhile provoked congressional hearings and been abandoned; the proposal died, but within two decades the private sector had assembled files of comparable reach without the oversight demanded of the state.

The Fair Credit Reporting Act and the First Regulated Data Industry

The Fair Credit Reporting Act, enacted on October 26, 1970 as Title VI of Public Law 91-508 and effective the following April, was the first United States federal statute to regulate a commercial information industry. It responded to a documented set of harms: files that were inaccurate, files the subject could not see or rebut, and decisions about credit, insurance, and employment made on the strength of them.

The statute works through a chain of defined terms. A consumer reporting agency regularly assembles information on consumers in order to furnish consumer reports to third parties, and a consumer report is a communication bearing on a consumer's creditworthiness, character, or general reputation that is used or expected to be used for eligibility decisions in credit, insurance, employment, and similar contexts. Once both definitions attach, obligations follow. The agency may furnish a report only for a permissible purpose and must follow reasonable procedures to assure maximum possible accuracy. The consumer may see the file, dispute an item, and have the dispute investigated. Most adverse information ages off after seven years, and bankruptcies after ten. A user who takes adverse action on the strength of a report must say so and identify the agency.

Two features of that design shaped everything after it. The first is that the Act gave individuals enforceable rights in a record held about them by someone else, a genuinely novel idea in 1970 that became a template: the same vocabulary of notice, access, correction, and purpose limitation runs through the Fair Information Practice Principles of 1973, the privacy guidelines the Organisation for Economic Co-operation and Development issued in 1980, and the European General Data Protection Regulation four decades later.

The second feature is that the Act regulates use, not collection. Nothing in it prohibits assembling a file; the obligations attach when the file is furnished for an eligibility decision. A firm that gathers identical information and sells it for marketing, audience targeting, people search, or analytics falls outside the definitions, and therefore outside the accuracy duties, the access rights, the dispute process, and the aging limits. That seam is less a drafting oversight than a consequence of the theory: Congress regulated the decisions it considered consequential and left the rest to the market. The modern data-broker industry grew in the space that choice created, and the recurring regulatory question ever since has been whether to widen the definitions or to legislate separately.

Later amendments extended the framework without changing its shape. The 2017 Equifax breach, which exposed personal information on roughly 147 million people, made the industry's defining asymmetry vivid: the people in the files are not the customers, cannot decline to be included, and bear the loss when the custodian fails.

From Purchased Lists to Observed Behavior

The commercial web changed the raw material of the trade. A list broker sold the fact that a person had once done something. A web publisher could observe what a person was doing continuously, at a marginal cost close to zero, without asking. That shift from purchased declaration to passive observation is the most important change in the history of the personal-data economy, and it followed from two ordinary engineering decisions.

The first was the cookie. HTTP as specified had no memory: each request stood alone, which made a shopping cart impossible. Lou Montulli at Netscape introduced the cookie in 1994, and the mechanism was later standardized in RFC 2109, RFC 2965, and finally RFC 6265. A server sends a small opaque value, the browser stores it, and the browser returns it on subsequent requests to the same host. Statefulness was restored, and with it the ability to recognize a returning visitor.

The second decision was older and more consequential. A web page may embed resources served by other hosts, and the browser fetches each of them, sending whatever cookies that host has previously set. The origin boundary that governs scripting was never applied to the identity of subresources. An advertising server embedded on a thousand sites therefore sets one cookie and sees the same visitor on all thousand, along with the page each visit occurred on, carried in the referrer header. Third-party tracking was not designed; it emerged from the composition rules of the web. The tracking pixel generalized the technique: a one-pixel transparent image serves no visual purpose, and its function is to cause a request carrying a cookie, a referrer, an IP address, and a user-agent string. The same device works in email, where loading a remote image reveals that a message was opened and roughly where. Scripting widened the sensor further: JavaScript reports dwell time, scroll depth, pointer movement, and text typed into a form field before the form is submitted.

Advertising networks assembled these pieces into a business. DoubleClick, founded in 1996, ran an ad server whose logs were a behavioral record across its entire publisher base. In 1999 it agreed to acquire Abacus Direct, a cooperative database of catalog purchase records contributed by participating retailers, and announced that it would join the anonymous online profiles to named postal identities. The backlash was immediate, involving the Federal Trade Commission, state attorneys general, and private litigation; DoubleClick abandoned the plan in March 2000, and the Commission closed its inquiry without action in January 2001. The episode drew a line the industry then observed rhetorically for a decade: online profiles were described as anonymous and kept nominally separate from named offline records. The line was always weaker than it sounded, because a cookie identifier is pseudonymous rather than anonymous, and joining a pseudonym to a name is a record-matching problem rather than a cryptographic one. Within ten years the industry would build businesses whose explicit purpose was to perform that join, marketed as identity resolution. Free analytics accelerated deployment in the meantime: Google acquired Urchin in 2005 and offered Google Analytics at no charge, placing a measurement tag on a very large share of the web.

The Ad Exchange and the Machinery of Real-Time Bidding

Between roughly 2007 and 2010 the display advertising market restructured around exchanges. Yahoo acquired Right Media in 2007, Google acquired DoubleClick in 2008, and independent exchanges and supply-side platforms proliferated. The economic logic was that an impression should be priced individually, at the moment it occurs, according to what is known about the person who will see it, rather than in bulk by placement.

The Auction Pipeline

The vocabulary is worth stating precisely, because the policy arguments turn on it. A publisher offers inventory through a supply-side platform, which composes a bid request and submits it to one or more exchanges. The exchange broadcasts that request to demand-side platforms, each acting for many advertisers. A demand-side platform consults its own data, and often a data management platform holding purchased audience segments, and returns a bid. The exchange runs the auction, and the winning creative is fetched and rendered. The sequence must complete within roughly one hundred milliseconds, because the page is waiting. From 2015 onward, header bidding moved part of the auction into the browser through libraries such as the open-source Prebid, which raised publisher revenue and multiplied the number of independent parties contacted on a single page load.

What a Bid Request Contains

The Interactive Advertising Bureau standardized the message format as OpenRTB, first published in 2010 and maintained since by the IAB Tech Lab. A bid request is a structured object with defined fields, and the fields are the point. A typical request carries the page URL or the application's bundle identifier, the visitor's IP address, the user-agent string, device make, model, operating system, and screen dimensions, language, coarse or precise coordinates, the mobile advertising identifier, exchange-specific user identifiers, and an array of audience segments attached by the seller or by data partners.

The structural fact follows directly. An auction has one winner, but the request goes to every invited bidder, and nothing in the protocol requires a loser to discard what it received. Data distribution is not a leak in this system; it is the mechanism by which the system operates. A single page view can therefore inform dozens or hundreds of companies of a person's device, approximate location, and reading choice, at no cost to any of them.

The Irish Council for Civil Liberties, an advocacy organization, published estimates of that scale in May 2022 from industry figures. It reported that real-time bidding exposes the online activity and location of a person in the United States about 747 times a day and of a person in Europe about 376 times a day, roughly 178 trillion broadcasts a year across the two regions, and that 4,698 companies were authorized by Google to receive bid-request data about people in the United States. The industry contests these estimates, but the architectural claim beneath them, that a bid request is a broadcast rather than a point-to-point message, is not in dispute.

Regulators eventually addressed the bidstream directly. In an order announced on December 3, 2024, the Federal Trade Commission found that Mobilewalla had collected and retained data from real-time bidding exchanges, including from auctions it lost, and had used it to build audience segments rather than to bid. The order prohibits the company from using data obtained through an advertising exchange for any purpose other than participating in that auction. It was the first United States enforcement action to treat the bid request itself as a collection channel rather than an incidental transport detail.

The Identity Graph

An identity graph is a persistent map of identifiers believed to belong to one person or household: browser cookies, mobile advertising identifiers, hashed email addresses and telephone numbers, postal addresses, and connected-television identifiers. It is the infrastructure that converts scattered observations into a profile, and it marks the difference between advertising to a browser and advertising to a person.

Deterministic Matching

Deterministic matching joins records through a shared key that both parties possess with high confidence. The dominant key is the email address, normalized and hashed, usually with SHA-256. Its advantage over a cookie is durability: a person carries the same address across browsers, devices, applications, and years, and supplies it voluntarily at every account creation and online purchase. Login events, loyalty program numbers, telephone numbers, and postal addresses serve the same function in narrower contexts.

Hashing an email address is frequently described as anonymization, and it is not. A cryptographic hash is deterministic, so the hash of an address is a stable pseudonym supporting exactly the linkage the plain address would support, and the space of plausible addresses is small enough that common ones fall to dictionary search. Hashing protects the value in transit and in a shared file; it does not sever the link to a person, and treating it as though it does is among the most common category errors in the field.

Probabilistic Matching

Probabilistic matching infers a link statistically rather than reading it from a key. Two devices that appear on the same residential IP address every evening, show correlated activity patterns, and travel together during the day are inferred to belong to one household or one person. Typical features include IP address history, user-agent characteristics, time-of-day patterns, geographic clustering, and similarity of browsing or application usage. Vendors attach confidence scores, but independent evaluation of their accuracy is scarce, and the consequences of error are asymmetric. A wrong link attaches one person's inferred interests, income band, or health-adjacent segments to another person's device. Because such a profile is not a consumer report when used for marketing, no access right or dispute process attaches to it: the subject cannot detect the error and has no defined route to correct it.

Cookie Syncing and Onboarding

Two advertising firms cannot read each other's cookies, because a cookie is legible only to the domain that set it. The industry solved this with cookie syncing. Firm A causes the browser to load a resource on firm B's domain with A's identifier in the query string; B reads its own cookie for that browser and records the pair. Repeated across the ecosystem, the practice builds a distributed translation table between identifier spaces, and it accounts for much of the request volume on a commercial page, since sync calls are pure overhead from the reader's point of view.

Onboarding performs the equivalent join between offline files and online identifiers. Acxiom, one of the largest traditional compilers, acquired LiveRamp in 2014 and later took its name; the firm's pseudonymous key allows a retailer to upload a customer file and reach the same people through digital channels. After the decline of third-party cookies, comparable person-based identifiers emerged as replacements, notably Unified ID 2.0, developed by The Trade Desk and built on hashed and salted email addresses. The pattern is worth noting: each successor to the third-party cookie replaces an identifier assigned by the browser, which the user can delete, with one derived from an attribute of the person, which the user cannot.

The Mobile Turn: Identifiers, Kits, and Location

The smartphone changed the economics a third time. A handset is a single device carried continuously by one person, equipped with a satellite navigation receiver and radios that reveal position even without it, and running an application model that admits third-party code. Every property that makes a phone useful also makes it an excellent instrument of observation.

Advertising Identifiers

Early iOS applications used the device's unique hardware identifier as a tracking key: stable, unresettable, and shared across every application on the device. Apple began rejecting applications that accessed it in 2012 and introduced the Identifier for Advertisers with iOS 6 that year, uniform across applications but resettable by the user. Google introduced the Android Advertising ID through Google Play services in 2013 on the same model.

The intent was to give users a control they had lacked; the practical effect for several years was the opposite. A cookie was per-browser, easily cleared, and blocked outright by some browsers. The advertising identifier was a clean, uniform, documented key that every application could read, that survived uninstallation, and that almost nobody reset. Mobile targeting consequently became more reliable than web targeting, not less.

The Software Development Kit as a Collection Channel

A software development kit is a library a developer embeds to obtain a service: analytics, crash reporting, mapping, weather, advertising mediation, or attribution. It executes inside the host application, with that application's permissions and network access. A kit whose real business is location data therefore inherits the permission the user granted to a weather application, a flashlight utility, or a prayer-times application, and the developer is paid per active user. The user consented to the application's stated purpose, and rarely to the onward flow.

The Norwegian Consumer Council documented the pattern in its January 2020 report Out of Control, which instrumented ten popular applications and found that they transmitted user data to at least 135 third parties; the Norwegian Data Protection Authority went on to fine Grindr 65 million Norwegian kroner in December 2021 for sharing user data with advertising partners without a valid legal basis. Reporting by Vice's Motherboard in November 2020 identified the location kit operated by X-Mode Social inside a widely used Muslim prayer application and many others, after which Apple and Google directed developers to remove it. The Federal Trade Commission settled with X-Mode and its successor Outlogic in January 2024, in what it described as its first order banning the sale of sensitive location data, and settled with InMarket Media the same month.

Why Precise Location Is Different

A satellite navigation fix is accurate to a few meters outdoors, and Wi-Fi and Bluetooth beacon databases refine position indoors. A sequence of such fixes is not an abstraction called location data. It is a home address, established by where the device rests overnight; a workplace, established by weekday daytime dwell; and a set of visits to specific buildings, each of which may be a clinic, a place of worship, a union hall, or a shelter. No aggregation of these points is meaningfully de-identified, because the overnight cluster is a name. A 2021 episode in which a United States Catholic publication obtained commercially available application signal data and used it to identify an individual priest through inferred use of a dating application demonstrated the point without any theoretical argument.

The Federal Trade Commission's orders against Gravy Analytics and its Venntel subsidiary and against Mobilewalla, both announced on December 3, 2024, addressed exactly this: the sale of precise location data revealing visits to health clinics, places of worship, and political gatherings. The Commission's litigation against Kochava, filed in August 2022, settled on May 4, 2026 with a permanent ban on selling precise location tied to sensitive locations absent affirmative express consent, though commentators noted that the 2026 order defined the protected categories more narrowly than the 2024 X-Mode order had. Sensitivity had risen sharply after the Supreme Court's 2022 decision in Dobbs v. Jackson Women's Health Organization, which turned reproductive-health location and search records into potential evidence in states that criminalized abortion, converting a marketing asset into a category of legal risk.

Fingerprinting and the Answer to Identifier Deletion

Every identifier described so far shares a weakness from the collector's point of view: it can be deleted. Cookies can be cleared, advertising identifiers reset, applications uninstalled. Fingerprinting answers that weakness by deriving an identifier from properties of the device that the user cannot readily change and usually cannot enumerate.

The right way to think about it is information-theoretic. Each observable attribute carries some number of bits of entropy, and the bits combine; distinguishing one device among eight billion requires about thirty-three bits. Peter Eckersley's Panopticlick study for the Electronic Frontier Foundation, published in 2010 as How Unique Is Your Web Browser?, measured roughly 470,000 browsers and found that 94.2 percent of those with Flash or Java installed were unique within the sample. The attributes involved are individually banal: user-agent string, screen resolution and color depth, time zone, installed fonts, preferred languages, reported processor count and device memory, and the graphics renderer string.

Canvas fingerprinting refined the technique. A script draws text and shapes into an off-screen canvas element and hashes the resulting pixels; differences in graphics hardware, driver version, and font rasterization produce small but stable variations, yielding a per-device value that requires no permission and leaves no stored state. Mowery and Shacham described the method in 2012, and Acar and colleagues measured its deployment in the wild in 2014 in The Web Never Forgets, finding it on more than five percent of the top hundred thousand sites, the great majority attributable to a single widget provider. Related techniques probe the audio processing stack and the WebGL implementation for the same purpose. Two adjacent practices belong beside them: respawning, demonstrated in Samy Kamkar's evercookie project in 2010, which stores one identifier in many places at once so that clearing any one allows restoration from another; and CNAME cloaking, in which the publisher delegates a subdomain of its own site to a tracking vendor by DNS record so that the vendor's cookies escape third-party blocking. Behind all of them sits the IP address, the most durable single signal, present in every request by necessity rather than choice.

The clearest evidence that fingerprinting is a substitute rather than a niche came in December 2024, when Google informed firms using its advertising products that from February 2025 it would no longer prohibit the use of fingerprinting signals, including IP address, in those products. The company had characterized the technique in 2019 as one that subverts user choice and is wrong. The United Kingdom Information Commissioner's Office described the reversal as irresponsible and issued guidance on the consent requirements that apply under the Privacy and Electronic Communications Regulations. The lesson recurs throughout this subject: removing a durable identifier does not remove the demand for one, and the substitute is usually less visible and harder for a user to affect than the thing it replaced.

What the Files Contain

The Federal Trade Commission's May 2014 report Data Brokers: A Call for Transparency and Accountability remains the most detailed public accounting of the industry, because the Commission obtained its information under compulsory process from nine large brokers rather than by voluntary disclosure. It reported that one broker's database held more than 700 billion aggregated data elements, and that another maintained more than 3,000 data segments for nearly every consumer in the United States. A 2013 majority staff report of the Senate Committee on Commerce, Science, and Transportation had described segments marketed under names including "Rural and Barely Making It," illustrating both the granularity of the categories and the fact that some sort people by economic vulnerability.

The inputs fall into four families: public records, supplying property deeds, mortgage filings, voter registrations, professional licenses, court judgments, and bankruptcies; self-reported data from sweepstakes entries, product registrations, and surveys whose real purpose is data collection; transaction data from loyalty programs and retail purchase feeds; and the observed digital behavior described above.

Most of what a modern profile contains is none of these. It is modeled: the output of a classifier trained on people whose attributes are known, applied to people whose attributes are not. An income band, an education level, an ethnicity code, a propensity to buy a product, or an interest in a health condition is typically a probability estimate presented as an attribute. This matters for two reasons. A modeled attribute can be wrong in ways no correction process addresses, and it can reconstruct a sensitive category the subject never disclosed and that a direct question would have been unlawful to ask.

The uses divide along the boundary drawn in 1970. Marketing, audience targeting, and analytics fall outside the Fair Credit Reporting Act; credit, insurance, employment, and tenancy decisions fall inside it. Brokers accordingly sell products under terms of service that disclaim eligibility use while supplying data that would be regulated if the buyer used it that way, and the Commission has brought enforcement actions where products crossed the line, particularly in tenant screening and employment background checks. Whether a given product is a consumer report remains the most consequential unsettled question in United States data regulation. People-search sites sit at the consumer-facing edge of the same inventory, assembling public records and purchased files into profiles of named individuals and often charging for a removal that proves temporary.

Countermeasures at the Device and Browser Layer

The interventions that measurably changed collection came from the companies that control the client software, not from statutes. The reason is structural. A browser or operating system change takes effect on hundreds of millions of devices the day it ships, and requires no complaint, no proof of harm, and no litigation. A disclosure regime requires each affected person to notice, understand, and act, and the number who do so is always small.

Apple shipped Intelligent Tracking Prevention in Safari in June 2017, applying heuristics to restrict cross-site cookies, and blocked all third-party cookies by default in Safari 13.1 in March 2020. Mozilla enabled Enhanced Tracking Protection by default in Firefox in September 2019 using a curated tracker list, and in June 2022 made Total Cookie Protection the default, partitioning cookies per top-level site so that a tracker receives a separate cookie jar on every site. Independent browsers such as Brave block trackers by default, and content blockers reach a substantial minority of desktop users.

The most consequential single change was Apple's App Tracking Transparency, which shipped with iOS 14.5 on April 26, 2021 and required an application to obtain explicit permission through a system prompt before accessing the advertising identifier or tracking the user across other companies' applications. Measurement vendors consistently reported low opt-in rates. Meta stated in February 2022 that the change would reduce its 2022 revenue by roughly ten billion dollars, a company estimate rather than an independent measurement, though the direction was corroborated across the sector. Related measures include Mail Privacy Protection, which pre-fetches remote images and thereby breaks open-rate tracking, and iCloud Private Relay.

Google's parallel effort took a different course. The company announced the Privacy Sandbox in August 2019, intending to retire third-party cookies in Chrome while supplying replacement mechanisms for targeting, auctions, and measurement. Federated Learning of Cohorts was trialed in 2021 and abandoned in January 2022 in favor of the Topics API, while the Protected Audience and Attribution Reporting interfaces addressed remarketing and conversion measurement. Deprecation slipped repeatedly. In July 2024 Google replaced deprecation with a plan for a user-choice prompt, in April 2025 it decided to retain third-party cookies without any new prompt, and it subsequently wound down parts of the initiative. An equivalent Android program followed a similar course.

The contrast between the two outcomes is instructive rather than moralizing. Apple's advertising business is small relative to its device revenue, so a restriction on cross-application tracking cost its competitors more than itself; Google's revenue depends on the system the Privacy Sandbox proposed to re-engineer. Platform countermeasures are effective precisely because they are unilateral, and unreliable for the same reason: they answer to the implementer's commercial interest rather than to any duty toward the people they protect. The French Autorité de la concurrence fined Apple 150 million euros in March 2025 over the manner in which App Tracking Transparency was implemented, on the theory that a measure can be simultaneously privacy-protective and self-preferential.

Regulation in the United States

United States privacy law is sectoral. The Fair Credit Reporting Act covers eligibility decisions, the Health Insurance Portability and Accountability Act a defined set of health-care entities, the Gramm-Leach-Bliley Act financial institutions, the Children's Online Privacy Protection Act services directed to children under thirteen, and the Driver's Privacy Protection Act motor-vehicle records. Most brokered data belongs to none of these categories, which is why the industry operated for decades with essentially no federal statute addressed to it.

Registration and Deletion

Vermont enacted the first data-broker registration statute in 2018, requiring brokers to register annually and disclose whether they permit opt-outs; California followed with a registry in 2019, and Texas and Oregon added their own in 2023. Registration imposes no substantive limit, but it produces something the field had never had: an enumerated list of firms, which is the precondition for any obligation that must be served on all of them.

California then built the obligation. The California Consumer Privacy Act took effect on January 1, 2020 and was amended by the California Privacy Rights Act, effective January 1, 2023, which created the California Privacy Protection Agency and a distinct category of sensitive personal information. The Delete Act of 2023 is the structurally novel piece: rather than requiring an individual to send a separate deletion request to each of hundreds of brokers, it creates one request that propagates. The agency's Delete Request and Opt-out Platform opened to consumers on January 1, 2026, and from August 1, 2026 every registered broker must access the platform at least every forty-five days, process the accumulated requests, and report back. More than six hundred brokers are registered, and a subsequent amendment doubled the daily administrative penalty for failing to register from one hundred to two hundred dollars.

Comprehensive State Statutes and Federal Retreat

Virginia enacted the first comprehensive state consumer privacy statute outside California in 2021, followed by Colorado, Connecticut, Utah, and a steadily widening group; by 2026 roughly twenty states had comprehensive laws in force or scheduled. The common template grants access, correction, deletion, and portability rights, requires opt-out of sale and of targeted advertising, obliges controllers to honor a universal opt-out signal such as Global Privacy Control, and requires assessments for higher-risk processing. Washington's My Health My Data Act of 2023 is an outlier, carrying a private right of action and defining consumer health data broadly enough to reach location observations near health facilities.

Federal action moved the other way. The Consumer Financial Protection Bureau proposed a rule in December 2024 that would have treated brokers selling certain identifiers and financial information as consumer reporting agencies, closing part of the seam left in 1970, then withdrew the proposal in a Federal Register notice published on May 15, 2025, stating that legislative rulemaking was not necessary or appropriate at that time. The American Privacy Rights Act, introduced in 2024 as the most serious attempt at a comprehensive federal statute in years, advanced through a subcommittee markup and was not enacted. The practical consequence is that the operative United States rules for the personal-data economy are now written by state legislatures and by two platform companies.

The European Framework and the Lawful Basis Problem

The European approach differs in a way that matters more than the size of its fines. The General Data Protection Regulation, applicable from May 25, 2018, requires that every processing operation rest on one of six lawful bases identified in advance under Article 6. The question is therefore not whether a person was notified, but whether the processing was permitted at all, and that question sits upstream of every technical mechanism described in this article.

For behavioral advertising the plausible bases are consent, contractual necessity, and legitimate interests. The ePrivacy Directive adds an independent requirement: Article 5(3) demands consent before storing information on, or reading information from, a user's terminal equipment. That covers cookies, local storage, and reading a device identifier, whether or not the data is personal, and it is the actual legal origin of the consent banner, which most people wrongly attribute to the General Data Protection Regulation.

Enforcement has concentrated on the lawful basis. Following binding decisions of the European Data Protection Board, the Irish Data Protection Commission announced decisions in January 2023 fining Meta 210 million euros in respect of Facebook and 180 million euros in respect of Instagram, rejecting contractual necessity as a basis for behavioral advertising. The Court of Justice reinforced the analysis in Case C-252/21, Meta Platforms v. Bundeskartellamt, decided on July 4, 2023, holding that personalized advertising could not generally be justified by contractual necessity and that legitimate interests could not override the interests of a user who objects. Meta moved to a subscription alternative in November 2023; the Board's opinion of April 2024 concluded that large platforms will in most cases not obtain valid consent through a binary pay-or-consent choice, and in April 2025 the European Commission fined Meta 200 million euros under the Digital Markets Act over that model.

The industry's own consent plumbing came under the same scrutiny. The Belgian data protection authority decided in February 2022 that the Transparency and Consent Framework string, the compact encoding of stated preferences that circulates through the advertising supply chain, is itself personal data and that IAB Europe acts as a controller for it; the Court of Justice largely upheld that analysis in Case C-604/22 on March 7, 2024. The finding is quietly significant: the mechanism built to demonstrate compliance was itself a processing operation requiring justification.

The European framework has produced very large penalties and changed contractual terms across the industry. It has not measurably reduced the number of parties that receive a bid request. Enforcement is complaint-driven, proceeds one controller at a time, and confronts an architecture that spreads responsibility across thousands of nominal joint controllers, each able to argue that the others were responsible for obtaining consent.

Government Purchase of Commercially Available Data

A distinct policy problem arises when the buyer is a government. Constitutional and statutory limits on state collection are framed around compulsion: a warrant, a subpoena, an order. They say comparatively little about purchase, and a commercial market makes purchase an alternative route to the same records.

The Supreme Court held in Carpenter v. United States in 2018 that acquiring historical cell-site location records from a carrier is a Fourth Amendment search requiring a warrant, reasoning that the comprehensiveness of a location record defeats the usual doctrine that information voluntarily shared with a third party loses its protection. The decision expressly did not address commercially purchased data, and the market in application-derived location grew rapidly afterward. Reporting from 2020 onward documented purchases of mobile location data by components of the Department of Homeland Security, including Customs and Border Protection and Immigration and Customs Enforcement, much of it obtained through Venntel. The Department's Office of Inspector General reported in September 2023 that components had used commercially acquired location data without completing the privacy assessments policy required.

The intelligence community examined the same question internally. A senior advisory panel convened by the Office of the Director of National Intelligence produced a report on commercially available information dated January 2022, declassified and released in June 2023. It concluded that such information has grown so far in volume and sensitivity that it can supply insight into individuals that would previously have required a warrant, and that the intelligence community lacked a coherent framework governing its acquisition and use.

Legislative response has been partial. The Fourth Amendment Is Not For Sale Act, which would require legal process before agencies obtain certain records from data brokers, passed the House of Representatives in April 2024 and was not enacted. Enforcement reflects the same tension: the Federal Trade Commission's December 2024 order restricting Gravy Analytics and Venntel from selling sensitive location data carves out national security and law enforcement purposes. The structural point cuts both ways. Restricting government collection does not restrict government access while a commercial market supplies the same records, and restricting government purchase does not shrink the market, because government buyers are a small fraction of demand.

Conclusion: Why Collection Keeps Winning

The history in this article is a history of costs falling. Nineteenth-century correspondents wrote reports by hand, and the trade was small because the labor was expensive. Tabulating machines and magnetic tape made matching and selection affordable. The web made observation cheaper than purchase, and the profile replaced the list. The smartphone made continuous observation of one identified person cheaper still, and added position. At each step the marginal cost of one more fact about one more person fell by a large factor, and the volume collected rose to consume the new capacity. Nothing in the sequence required a conspiracy.

That is the structural difficulty. The incentive to collect is distributed across every participant and is individually rational for each. A publisher adds another exchange because it raises yield, a developer embeds another kit because it pays per user, an advertiser buys another segment because it lifts response. The cost falls on people who are not parties to those decisions and cannot observe them. Markets handle that configuration poorly, and disclosure handles it worse, because disclosure asks the party with the least information, time, and leverage to discipline the party with the most of each.

The record of the past decade supports a specific and somewhat uncomfortable conclusion. The measures that changed collection at scale were technical and unilateral: third-party cookie blocking in Safari and Firefox, cookie partitioning, and above all App Tracking Transparency. The measures that changed it least were those that asked individuals to read notices and exercise rights. European enforcement has produced serious penalties and forced changes in stated legal bases, but the bid request still goes to everyone invited, and United States law still turns on a use-based boundary drawn in 1970. What works shares a common property: a changed default in software rather than a right on paper, taking effect without requiring anyone to act. California's deletion platform is interesting precisely because it borrows that property, converting hundreds of individual requests into one signal that brokers must fetch on a schedule.

For engineers the implication is direct. The decisions that determine how much of this economy a product feeds are ordinary technical ones: which kits to embed, what a bid request carries, whether an identifier is persistent, what telemetry a device sends and how long it is retained, whether a computation happens on the device or in a data center, and what the default is when the user does nothing. Those choices are made long before any privacy policy is drafted, and they constrain what that policy can honestly say.

Related Topics