Click a local ad on HomeDepot.com and 13 companies get your name and email address. Type the wrong password into WSJ.com and seven companies get your email. Click the validation link in the signup email for a Reuters newsletter and 5 companies get your email.
Interact with classmates.com and 22 companies get your full name; Bleacher Report sends it to 15 companies.
Changing user settings on Metacafe sends your full name, birthday, email and physical addresses and phone number to two companies, Mayer found.
The studies refer to the whole process as private-data leakage, but Mayer noted specifically that in web advertising, "leak" does not mean "accident."
In computer security, leakage is a term of art for an information flow – some instances of leakage are entirely intentional. For example, OkCupid, a free online dating website, appears to sell user information to the data providers BlueKai and Lotame, including gender, age, ZIP code, relationship status, and drug use frequency. – Jonathan Mayer, Tracking the Trackers: Where Everybody Knows Your Username.
And that's just looking at what information the first-party site hands to third parties accidentally (sometimes), for a fee, as part of a data-trade or as a premium for buying an ad in the first place.
Third parties – companies you never chose to deal with or agreed should be allowed to use your data – can also identify you buying profile data from a matching service it can use to narrow down your identity, geo-locate your IP to reduce the number of possible false IDs, use security holes in your browser to gather more of your data, or "deanonymizing" you by matching generic new clicktrails, usernames or other information with data that's already confirmed to be about you, according to Arvind Narayan, another researcher in Stanford's CIS.
"Identification of a user affects not only future tracking, but also retroactively affects the data that's already been collected. Identification needs to happen only once, ever, per user," Narayan wrote.
Once again, though, that's just the beginning.