Attacks¶

Extraction reuses a small set of moves. None is exotic, and the interest is in how ordinary each looks while it runs, and how often one has already been caught in the open with a name and a number attached, gathered in the cases.

Collection dressed as a feature¶

A product whose stated job is one thing gathers and sells on the side: a VPN that logs the traffic it promised to hide, a torch that asks for location, an antivirus that resells what it sees. The Avast case is the clean example, a tracker-blocker whose maker sold the tracking. The feature is the cover; the data is the business.

The auction as a data tap¶

Real-time bidding hands every firm in the auction a description of the reader. A company can join not to win the advert but to harvest those descriptions, and there is nothing to win or lose, since the request arrives whether or not a bid follows. The mechanism sold as efficient ad-buying doubles as a standing feed of who is reading what, where.

Match, append, enrich¶

A business hands a broker its own customer list, keyed on the hashed email, and gets it back thickened with attributes it never gathered: income band, life stage, health interests, inferred politics. The join key does the joining; the enrichment is simply bought. A thin first-party record becomes a full profile without the person touching either firm.

Inferring the protected trait¶

A special category, health, sexuality, a pregnancy, derived from proxies and sold as a ready-made audience, with nothing ever ticked as sensitive. Flo passed the fact of a logged period; Grindr passed the fact of being on a gay dating app. In each, the sensitive conclusion travelled without a sensitive field.

The invisible third party¶

Collection under a first party’s brand by a party the person never sees: the embedded SDK, the tracking pixel. The Meta Pixel on hospital pages reported the booking of a medical appointment to a company the patient had no dealing with, from a website they had every reason to trust.

Consent manufactured to order¶

The banner and the shared consent string produce a record that collection was agreed to, which is a different thing from agreement. The record is the object of the exercise: it converts extraction into compliance on paper, and a signature no one meant to give is still a signature on the file.

Buying past the warrant¶

The state joins the market as an ordinary customer and obtains what a court order would otherwise gate. The Databroker Files investigation traced commercially traded location data into the movements of EU and NATO officials. No interception was needed, only a purchase order.

Resold into the open¶

A profile does not stay with its first buyer. It is licensed onward, matched into cooperatives, and, when a broker is breached, spilled into criminal markets where it is recombined with stolen credentials. An opt-out that might have stopped the first sale seldom reaches the tenth, by which point no one can say who holds a copy.

The moves do not change, the reach does¶

The patterns are old and unglamorous. What moves is the cost of running them: cheaper matching, sharper inference, wider distribution each year mean the same handful of moves covers more people, more precisely, than it did the year before. A decade-old technique keeps producing fresh cases, not because anyone invented a new one, but because the old ones now reach further for less.

Last reviewed: 2026-07-16.