Tracking
Cookies and Data Brokers: What Happens to Your Data?
When you browse the Internet, your personal data does not necessarily remain in the hands of the websites you visit. Third-party companies may collect or process information about you to measure your activity, personalize advertisements, build profiles, or commercialize certain types of data. These companies include advertising vendors and data brokers. Although they may work together and sometimes pursue similar goals, their roles are different. Understanding how they operate can help you identify companies that may hold your personal data and determine whom to contact when requesting access to or deletion of that data.
Data Brokers: Intermediaries That Collect and Commercialize Your Data
Data brokers are companies that collect, combine, analyze, or commercialize information about individuals. Unlike a website where you voluntarily create an account, a data broker may obtain information about you from numerous third-party sources, even if you have never interacted directly with the company.
Their sources may include publicly available databases, commercial partners, online forms, loyalty programs, competitions, and other data providers. Depending on the information available and the processing activities involved, a broker may combine multiple sources to associate different pieces of information with the same person.
These companies may offer marketing lists, audience segments, data enrichment services, or analytics to other businesses. For example, they may help an advertiser identify people who are likely to be interested in a product, enrich a customer record, or better target a marketing campaign.
The data they process is not necessarily limited to information you have provided directly. It may include contact details, demographic characteristics, inferred interests, or information derived from different behaviors. The exact nature of the data depends on the broker, its sources, and its business activities.
Not all data brokers sell datasets directly to individuals or advertisers. Some primarily provide analytics or data enrichment services. The term covers a wide range of activities, so you need to examine each company's practices to understand what information it holds and how it uses that information.
What Types of Processing Can Data Brokers Perform, and What Data May Be Involved?
- Data collection and aggregation: gathering information from multiple sources, such as contact details, professional information, or publicly available records.
- Profile enrichment: matching datasets to supplement an individual's profile with information obtained from other databases.
- Commercial segmentation: grouping individuals according to criteria such as age range, geographic area, inferred interests, or likelihood of being interested in a particular offer.
- Marketing and prospecting: providing contact details or prospect lists to businesses seeking to run marketing campaigns, subject to applicable legal requirements.
- Analytics and profiling: creating categories or indicators based on observed or inferred data, such as presumed consumer habits.
- Online and offline data matching: potentially linking digital identifiers, contact details, or information from transactions and commercial records.
- Potentially involved data: first and last names, email addresses, phone numbers, postal addresses, age or age range, occupation, employer, geographic area, purchase history, interests, and inferred consumer preferences.
- Potentially sensitive data: some companies may process or infer particularly sensitive information. Processing special categories of personal data is subject to specific legal requirements and cannot be assumed to be freely permitted.
Cookie Providers and Advertising Vendors: Tracking, Measuring, and Personalizing
A cookie is a small file stored on your device by a website or service. Other technologies, known as trackers, can also be used to recognize a browser, remember preferences, or measure activity. Not all these technologies are used for advertising: some are essential to the operation of a service, while others may be used for analytics or tracking across websites.
In the digital advertising ecosystem, the term vendor generally refers to a third-party company that provides services related to online advertising, audience measurement, or content personalization. Examples include advertising platforms, analytics providers, and intermediaries involved in delivering ads. Some vendors use cookies or other trackers, while others may operate without directly placing cookies on your device.
When a website integrates third-party tools, certain information about your browsing activity may be transmitted to these providers. Depending on the technology, website configuration, and applicable legal framework, this information may include online identifiers, pages visited, interactions with content, technical data, or stored preferences. These signals may be used to measure campaign performance, limit how often an advertisement is displayed, or personalize ads.
Data collected across multiple websites or services may sometimes be combined to recognize the same browser or build an advertising profile. Some solutions may also link online identifiers to other information, such as an email address already known to a partner, when technically feasible and legally permitted. However, not every cookie directly identifies an individual, and not every vendor has access to all these types of information.
The distinction between the website you visit and the third-party companies involved is important. You may recognize the website displaying an advertisement without knowing all the companies involved in delivering or measuring it. Some of these companies may operate across many different websites. Identifying them can therefore help you understand which organizations may be processing your personal data.
In the European Union, the applicable rules depend in part on the type of tracker and the purpose of the processing. Some trackers require prior consent, while others may qualify for an exemption under specific conditions. Consent to cookies does not exempt companies from their other obligations under data protection law.
What Types of Processing Can Advertising Vendors Perform, and What Data May Be Involved?
- Audience measurement: analyzing website traffic, pages visited, browsing journeys, and interactions with content.
- Targeted advertising: using signals or profiles to select advertisements that may be relevant to a user.
- Retargeting: displaying ads related to products or services previously viewed, where the mechanisms used and applicable legal framework allow it.
- Frequency capping: measuring or controlling how many times an advertisement is shown to the same browser or identifiable user.
- Conversion attribution: evaluating actions taken after an advertisement is displayed, such as a visit, registration, or purchase.
- Profile creation and enrichment: potentially combining browsing signals or identifiers to better characterize an audience.
- Personalization: adapting advertisements or certain content based on observed or inferred preferences and behavior.
- Potentially involved data: cookie identifiers, advertising IDs, IP addresses, browser and device information, pages visited, timestamps, interactions with advertisements, mobile advertising identifiers, and consent preferences.
- Additional data: some services may receive identifiers or information supplied by a website or partner. The nature of this information depends on the technical integration and the declared purposes of processing.
What Is the Difference Between a Data Broker and an Advertising Vendor?
The main difference lies in their roles. Advertising vendors generally provide technology or services used to deliver, measure, or personalize online advertisements. Data brokers focus on collecting, combining, enriching, or making information about individuals available to other organizations.
Their data sources may also differ. A vendor may receive information through a tool integrated into a website. A data broker may aggregate information from multiple businesses, public sources, or commercial partners. However, these business models are not mutually exclusive: the same company may perform both types of activities.
Their use of data can differ as well. An advertising vendor may process information to measure a campaign or select an advertisement. A data broker may use information to build profiles, enrich datasets, or provide audience segments to its clients. In some cases, data may flow between these two categories of companies.
Finally, there is no universal directory covering every company that may process your data through cookies, nor is there a single worldwide register of all data brokers. Available directories generally cover a specific scope, industry, regulatory framework, or group of companies that have registered with a particular program.
Why Should You Contact These Companies When Requesting Data Deletion?
- Deleting an account on a website does not guarantee that every copy of your personal data has disappeared from the systems of its service providers or partners. The situation depends on data flows, the role of each organization, and applicable retention requirements.
- An advertising vendor may process identifiers or browsing information associated with a website you visited, even if you have never created an account with that vendor.
- A data broker may hold information about you obtained from third parties, independently of any direct relationship you have with the company.
- You can ask an organization whether it processes your personal data and, where the legal conditions are met, request its erasure. Some information may nevertheless be retained when a legal exception or retention obligation applies.
- A deletion request does not automatically remove data held by every other company in the data-sharing chain. You may therefore need to identify and contact several organizations separately.
- Before sending a request, check the organization's privacy policy and contact details. In Europe, the right to erasure under the GDPR applies subject to certain conditions and is not absolute.