The names Gravy Analytics, Kochava, Mobilewalla or Arity probably don’t mean anything to you, and you certainly haven’t had any dealings with them. Me neither. Yet they are real firms, and like thousands of others they know all about you (and me): where you sleep, shop, work, worship, get medical advice, how fast you drive and possibly whether you have sex in your car. No consent is involved: you just need to carry a phone or a payment card in your pocket.
When I wrote a piece on adtech last year, I knew there was something missing from the account. Yes, it’s common knowledge that online advertising (a $700bn a year business) is a swamp, to put it mildly, with capacious hiding places for criminals large and small and the worst possible actors of every stripe. But at its heart was a black hole – a now-you-see-it-now-you-don’t ‘thing’ that was hard to get your head round. It was only when I remembered Santa Fe economist W. Brian Arthur’s book on The Nature of Technology (2009) and what he later called ‘the second economy‘ – a shadowy digital, semi-autonomous network growing up behind the physical one – that the pieces began to come together.
Arthur’s thesis is that every economy expresses the technology beneath it: the internal combustion engine and the assembly line gave the last century its physical economy of mass production; today’s digital platforms have presented us with the poisoned gift of surveillance capitalism. And its hidden engine – the black hole I had sensed but not made sense of – is the sprawling, multi-billion, unaccountable infrastructure devoted to the extraction, refinement and trading of human experience and attention: the data broking industry.
It’s an industry that manages to be both unseen and ubiquitous, everywhere and nowhere. Any sizeable company – any firm with an app, loyalty card, or website with a login – can be assumed to be actively engaged in data trading (why do you think they’re so keen that you download the app?). And while at one end your or my individual profile can be bought for a few pennies, the aggregate value of the trade is colossal – anything between $360-460bn – and growing at a brisk 10 per cent a year clip. Yet it’s invisible. Mention of data trading or its proceeds almost never surfaces in company reports, and it’s only in exceptional cases that, like the white whale breaching in Moby Dick, the value of a firm’s data as an asset suddenly hoves into view. Thus when United Airlines sought a pandemic bailout loan in 2020, its frequent-flyer data programme was valued at nearly $22 billion – roughly twice what the airline itself was worth at the time – a data point echoed this year when the ad group Publicis paid $2.2bn for the data platform LiveRamp, a telling sign of deeper integration of the data business into the advertising and AI infrastructure.
While the base data brokerage industry consists of maybe 5,000 firms, some quite large (Acxiom, Experian, CoreLogic), that collect and trade the gleanings from our digital exhaust, they aren’t the most gluttonous data hoarders. These are the giant triopoly of online advertising, Google, Meta and Amazon, which hoover up truly terrifying quantities of data on our emotional shifts (Meta), commercial desires (Amazon) and human intent (Google). They don’t sell the data, instead charging advertisers for the privilege of using it to microtarget individuals with ads – matching rather than selling – in closed environments separate from both sides of the transaction. Whatever else you might think of it, this is a masterpiece of deceptive commercial design, allowing participants to maintain both that the data remains technically anonymised and that nothing has actually changed hands. Through the platforms, the economy becomes self-laundering – move on there folks, there’s nothing here to see.
While legally speaking brokers and the Big Three are distinct, however, they are commercially inseparable, which in practice means that surveillance is so comprehensive that anonymity is a fiction or not even necessary. In her whistle-blowing Careless People, former Meta executive Sarah Wynn-Williams describes what she called a performance of ‘consent theatre’, in which privacy on-off toggles are no match for corporate incentives for growth and profit – Meta’s systems reportedly interpreting a teenager deleting a selfie as a real-time signal of low self-esteem, in turn triggering an instant shower of ads for beauty or weight-loss products, being a good example.
As for anonymity, the fact is that with just two data points – home and workplace – researchers can identify an individual with near certainty. From this can be developed a pattern of life – a behavioral profile so precise that trackers can predict a target’s location with remarkable accuracy. In a 2024 investigation, German journalists obtained a sample of 3.6 billion location points from a US data broker and were able to zoom into “any corner of any room,” mapping the movements of German military personnel around NATO training grounds and an airbase. A separate investigation the same year, using a smaller dataset sourced in Belgium, tracked the granular movements of hundreds of officials working in and around the European Commission and Parliament in Brussels. We know that in the Russo–Ukrainian conflict an unguarded call from a smartphone near the front-line can yield location data that can be, and has been, picked up and used by the enemy to lethal effect.
The wide and cheap availability of such data is a clear and evident, some would say existential, threat to democracy as well as individual lives. A boon to unscrupulous intelligence agencies that can simply purchase the tools of mass surveillance on the open market, data is routinely weaponised by location and other apps to, for example, track dissidents; identify and follow American women crossing state lines to visit an abortion clinic; and enable criminal organisations to locate and take out informers and law enforcement officers, as drug cartels have done in Mexico. Testimony to the threat: in the US, a proposed ‘Fourth Amendment Is Not For Sale’ Act explicitly aims to prohibit government agencies from buying the data they are constitutionally barred from seizing without a warrant.
Given such deep concerns about the dangers, why aren’t exposés of the evils of tracking and trading data plastered all over our newspapers and television? Alas, one of the most dismaying revelations about today’s situation is that news sites are more enthusiastic trackers and collectors of data from their users than any other category, employing more trackers than gambling, banking or adult sites. Even worse, many media sites – including most of the major US organisations – are members of an advertising association that has actively lobbied against restrictions on data-collection and targeting. In one sense no one should be surprised. Since their traditional print advertising support vanished online, media companies would argue they have little choice but to do what everyone else does, exploiting the data that is their most consident revenue source. But the consequences are troubling. A Columbia Journalism Review/Tow Center report on adtech called out the conflict in the title of its article, ‘Journalists are rightly suspicious of adtech. They are also dependent on it’. It’s a ‘serious ethical quandary’ that journalism schools have largely failed to even teach, and journalists themselves are neither knowledgeable about nor seem much interested in how their trade is funded. It is therefore left to a few ad-independent outlets to write about the issues in depth, while major outlets tend to cover it as occasional features rather than an ongoing beat.
Will things ever change when the incentives of stakeholders are so badly aligned? Some hope so. In rapid succession Meta has been fined close to $1bn for the harms done by its apps to children and is paying up to a further $18bn to settle (although not admit wrongdoing) another huge case accusing it of damaging young users’ mental health by deliberately designing addictive products. And there are plenty of other suits in the pipeline. On the other hand, against market valuations in the trillions – Meta at $1.5tr is the ‘baby’ of the three giants, while Alphabet is worth three times that – even an $18bn fine over 10 years barely registers. It also leaves untouched the central issue: as long as we treat personal data as a tradable, commoditised extension of human identity, the hidden surveillance economy will continue to cast its dark shadow over democracy, decency and individual human lives.