You search for boots and click on a pair you like — just once — then decide they are not what you want. But the Internet disagrees. For days, every website you visit features an advert for those same boots. You read an article about childbirth — maybe you’re pregnant, maybe you want to get pregnant or maybe you are just looking for a friend — and within hours your feeds are filled with ads for pregnancy tests, baby clothes, and parenting apps.

We’ve all been annoyed – and often confused – about how much our devices seems to know about us. How does a search or a click turn into a digital stalker that follows us everywhere we go?

What’s behind the ad?

The answer lies in the sprawling, hidden machinery of the adtech industry — a global system that tracks, profiles and predicts our behaviour in real time. It’s far more invasive than most people realise. In this blog, we outline how ad brokers track your online activity and explain what you can do to minimise this.

Every time you go to a website, small pieces of data called cookies are stored on your browser. These let online trackers recognise you when you visit other sites. Over time, they build a profile based on what you buy, read and watch.

All this information is collected, shared, and sold within a huge advertising system called real-time bidding (RTB).

Here’s how it works:

• When you visit a website, advertisers use ad tech companies to bid for the chance to show you an ad.

• The bids are based on what advertisers think your interests are, according to your online profile.

• The highest bidder wins, and their ad appears on your screen.

This system runs automatically, thousands of times a second, across millions of websites.

Your privacy for sale

RTB allows companies to collect and share deeply personal data about you without you being able to see or control it.

• Day-to-day surveillance
  RTB tracks almost everything you do online and shares that data with thousands of unknown companies. It’s like having a TV crew follow you around every day, announcing to the world when you go to the shops, to the pub, or to your GP.

• No data security
  The data is automatically shared between ad tech companies with no real protection. No one can fully control or check how your data is used.

• Decide who you are
  Adtech companies often put people into categories based on what they think their personality traits are. They use categories like ‘Depression’, ‘Infertility’, ‘Diabetes’ and ‘Substance Abuse’. This can result in people seeing harmful, upsetting or exploitative adverts. For example, if you are experiencing infertility, it may be upsetting to suddenly receive ads related to this.

• Inaccurate profiling
  These profiles can be completely wrong or based on crude stereotypes based on your gender, race and age.

• Online harm
  Ads and algorithms often promote emotional or extreme content because it keeps people engaged. This fuels polarization, addiction, and misinformation — making the internet more toxic.

• Discrimination and exploitation
  Online ads have been used to exclude certain groups (like women or ethnic minorities) from job or housing ads, target vulnerable people with harmful products, or even monitor people’s private health choices.

Consent and cookies

Under UK law, companies must get your consent before using cookies to track you online.
But in practice, regulators have been too lenient, allowing companies to bombard users with confusing or manipulative cookie banners. As a result, most people end up being tracked whether they want to be or not.

The adtech industry tries to get around cookies.

For example, our investigation into LiveRamp found that they will use contact details you enter onto a website, such as email, phone number or home address, to identify your activities across different websites. You are still tracked across the Internet, but in a way that dodges protections against cookie tracking.

Google is developing Privacy Sandbox, a system that would track your online activities within the browser, and allow advertisers to communicate with your browser to target you with adverts. Adtech intermediaries can’t see what you do online, which improves privacy, but you still could see ads that are discriminatory or exploitative.

The ICO wants to relax cookie rules

Last July, the UK’s Information Commissioner’s Office (ICO) said it might relax the rules around cookie consent.

This is risky. If done badly, it could make it even easier for advertisers to target people based on their mental health, addictions, or other vulnerabilities.

The real problem isn’t the existing rules — it’s that they’re not enforced. Ad tech companies keep breaking privacy laws because there are no serious consequences for them.

Instead of weakening protections, regulators should enforce the law properly and issue strong penalties to stop these abuses.

Digital Privacy

Stop Stalker Ads

Find Out More