How your data gets out: apps, cookies, location and public records

The previous lesson described what data brokers hold. This one follows four concrete paths your information travels to reach them: the third-party code bundled inside ordinary apps, cookies and pixels on websites, your phone’s location, and public records you cannot prevent from existing in the first place.

Apps and the software development kits inside them

Most apps are not built entirely by the company whose name is on them. Developers commonly add third-party software development kits (SDKs) for things like analytics, crash reporting or advertising. Apple’s own developer documentation, which requires apps to disclose this, defines “third-party partners” as “analytics tools, advertising networks, third-party SDKs, or other external vendors whose code you’ve added to your app”, and it warns developers directly against “placing a third-party SDK in your app that combines user data from your app with user data from other developers’ apps to target advertising or measure advertising efficiency, even if you don’t use the SDK for these purposes.” In other words, an SDK a developer added for one reason can, on its own, forward data that ends up combined with data from entirely unrelated apps.

Cookies and pixels on the websites you read

On the web, the same idea shows up as cookies. Cloudflare’s Learning Center explains that a first-party cookie, set by the site you are looking at, is different from a third-party cookie, set by a domain that is not the one shown in your address bar — most often an advertising or analytics company embedded on many different sites. Because that third party sees you again every time you land on another site carrying its cookie, it can build a record of your browsing across sites you never told it you were visiting. The FTC’s own consumer guidance confirms this happens beyond cookies too: sites “may track your online activity by using a cookie or pixel to identify you even after you leave the site”, and in apps, “advertisers may use a unique advertising identifier to track you”, sometimes alongside device fingerprinting, which recognises your browser or device from its particular settings rather than from a stored file at all.

Your phone’s location, often without a special sensor at all

Location is one of the more sensitive categories, and the FTC has taken direct enforcement action over it. In 2022, the agency sued Kochava, a broker it described as selling “massive amounts of precise location data collected from tens of millions of mobile users.” The FTC’s alert noted that this kind of data can reveal visits to “medical care, places of worship, reproductive health, homeless shelters and domestic violence shelters, and addiction recovery”, and as a demonstration, FTC staff said they were able to use Kochava’s data to identify a device that visited a women’s reproductive health clinic and trace it back to a specific home. That data starts with an app that asked for location permission, then, separately from anything your mobile carrier can already work out from which cell towers your phone connects to, passed the location onward to outside companies.

Public records: the source you cannot opt out of

The FTC’s 2014 study of nine major data brokers found that all but three obtained data directly from federal sources such as the Census Bureau and the Social Security Administration’s death records, and that state and local governments supplied property records, voter registration, court records and professional licenses. Some of that flow does have legal limits: the FTC report notes that at least twenty-two U.S. states restrict commercial use of voter registration records, and the federal Driver’s Privacy Protection Act restricts disclosure of motor vehicle records outside specific purposes. But the underlying records themselves — a property deed, a marriage record, a court filing — exist because the law requires them to, whether or not you would prefer they did not.