You search for a hotel, explore an idea for a mobile app or ask ChatGPT a question. You might even save the idea in Gmail to share with your partner later. And then, you see a related ad on Facebook or YouTube. It can feel like digital companies are listening to your conversations.
How Your Online Activity Becomes Valuable
Searches, website visits, purchases, location signals and app activity can reveal details about a person.
Trackers help in collecting this information. Cookies and tracking pixels can record website activity, while software development kits (SDKs) let apps send information to outside services. Browser fingerprinting can also help identify devices through details such as browser settings and screen characteristics. The US Federal Trade Commission (FTC) explains these methods in its guide to online tracking.
Companies can combine these signals to build profiles of people's interests and likely behavior. Someone who searches for flights and visits hotel websites may be classified as a potential traveler. Advertisers can use that profile to reach people who are more likely to buy their products.
Data brokers gather information from different sources and compile profiles for sale or sharing. In a 2024 enforcement case, the FTC alleged that a data broker used location histories to classify people into groups such as “parents of preschoolers” and “wealthy and not healthy”. This shows how location data collected through apps can reveal sensitive details about people's lives.
How Big Tech Uses the Data
For companies such as Google and Meta, personal data helps power targeted advertising. Advertisers pay to reach selected audiences, and platforms use their advertising systems to decide which ads to show. The platforms can earn revenue from this process without selling advertisers a person's name or complete personal profile.
Information can also move between services. A retailer using Meta Pixel, for example, may send website activity to Meta for advertising. Meta announced in June 2026 that it would also use activity businesses already shared with it to personalize Facebook and Instagram feeds and AI responses, extending its use beyond ads. Meta said the change involved using existing data for additional purposes, not collecting new data.
Google's privacy policy, effective October 16, 2026, offers another example. Users may allow services such as Search or Gemini to access information from Gmail, Drive and Google Photos to personalize their experience. Search may use permitted data to personalize content, including ads.
Google says it does not show personalized ads based on content from Gmail, Drive or Photos unless users choose to make data from those services available to other Google services that support personalized ads. Its Gmail help page also says Gmail does not scan or read messages to select ads shown inside Gmail.
These examples show how data shared across services can be used for purposes beyond the one for which people originally provided it.
What AI Adds to the Picture
People share more than browsing activity with AI tools. Depending on the product and its terms, companies may use submitted content to provide answers, improve services or train models.
Advertising is a separate use. OpenAI's privacy policy, updated in 2026, describes sharing limited information with selected marketing partners to promote its products on third-party websites and apps. Its explanation of this practice says partners may receive identifiers linked to a browser or device, an IP address or a hashed email or phone number, along with basic commercial or browsing information. OpenAI says it does not share conversations or uploaded content with those partners for this advertising purpose.
As AI becomes part of everyday life, users may need to consider not only what they share with these tools, but also how the companies behind them use data to reach and influence them.
What Can Users Do?
Read a service's privacy policy and terms before signing up, especially if you plan to share private conversations, documents, photos or location data. Check them again when the company changes its policy or introduces a new AI feature.
Look for sections on data collection, advertising, sharing, retention, AI training and account deletion. Ask practical questions: What information does the service collect? Why does it need it? Can it share that information with advertisers or other businesses? How long does it keep the data? Can you delete it?
Then compare the answers with your own expectations. If an app requests access to contacts, photos or location that it does not need for its main function, deny that permission where possible. If a company's data practices go beyond what you accept, consider limiting what you share, disconnecting linked services or switching to an alternative with clearer privacy practices. Before deleting an account, check what happens to stored content and retained data.
You can also reduce some forms of tracking with Privacy Badger which is a free browser extension that blocks many third-party trackers.
These measures have limits. Tracker blockers cannot prevent all data collection inside apps or accounts, and private browsing does not make you invisible to websites. Data brokers may also retain information gathered from other sources. Treat these tools as ways to reduce exposure, not erase your digital footprint.
Why This Is a Public Issue
Concern about these practices is widespread. In the US, a March 2026 Verasight survey found that 75% of 1,000 adults were concerned about their online activities being tracked, while a separate Pew Research Center survey found that 71% said increased AI use would make their personal information less secure. Similarly, in a survey of 2,074 UK adults conducted in May 2026, consumer group Which? found that 72% were worried about the security of their data, 71% about how businesses collect and use it, and 69% about how businesses use AI in ways that affect them.
Individual choices can reduce exposure, but they cannot solve every problem. People can share reliable privacy guidance, ask companies to explain unclear practices and raise concerns with consumer groups, regulators and policymakers. When a company's data practices affect large numbers of people, public pressure can help push for clearer rules and meaningful choices.
Personal data helps fund online services and can make products more useful. But people need to know what they are sharing, how companies use it and who else can access it. Without clear answers, they cannot make an informed choice about the services they use.
Read next: AI Chatbots Push Users to Share Sensitive Data During Tax Help, With ChatGPT Most Persistent, Analysis Finds
