You do not need to visit a company’s website for that company to have data about you.
That sounds mysterious until the supply chain is drawn.
A person visits a familiar app or website.
The service participates in an advertising system.
An exchange sends a bid request.
A company observing that auction receives data.
That company may then combine, retain, sell, or analyze the information.
At no point did the user intentionally knock on its door.
Mobilewalla provides a documented route
In 2024, the Federal Trade Commission alleged that data broker Mobilewalla collected consumer data from real-time advertising bidding exchanges and third-party aggregators. The FTC said consumers often had no knowledge that Mobilewalla had obtained their information. See the FTC’s Mobilewalla enforcement announcement.
According to the FTC complaint, Mobilewalla collected and retained information contained in bid requests even when it did not win the auction. The agency alleged that, between January 2018 and June 2020, the company collected more than 500 million unique advertising identifiers paired with precise location data.
The FTC finalized the order in January 2025. See the final order announcement.
That gives us a supply chain with real documentation rather than speculation.
Each intermediary sees a different slice
The route can look roughly like this:
- A person uses a website or app.
- Advertising inventory becomes available.
- A real-time bidding exchange distributes a bid request.
- The request contains information useful for evaluating the ad opportunity.
- A bidder or data company receives that information.
- The recipient may combine it with other records or sell derived products downstream.
Not every advertising auction contains the same fields.
Not every participant retains the data.
Not every recipient uses it for profiling.
Those details have to be verified case by case.
The important architectural fact is that direct contact is not required.
The visible service is only the first hop
Consumers naturally think in terms of brands they recognize.
I gave this app my location.
I visited this website.
I used this store.
But modern data systems often operate through chains of processors, SDK vendors, ad exchanges, analytics companies, identity providers, brokers, and clients.
One company can therefore know about a person because another company generated the event and a third company passed it along.
That is why privacy policies full of phrases such as partners, service providers, and advertising companies can be difficult to evaluate without actual recipient names and technical evidence.
The Surveillance Economy becomes hardest to see at the point where the person and the data holder have never met.
The person knows the app.
The broker knows the identifier.
The supply chain introduces them without an introduction.