6 Ways Companies Collect Your Data (Most You Never See)

What counts as “your data”

Data about you falls into a few groups. Some is obvious: your name, email address, and payment details. Some is behavioral: what you click, search, buy and watch. Some is about place: where your phone is, and how often. And some is inferred, meaning a company guesses something about you from the rest, such as an interest, an income range or a life event.

The inferred group matters because you rarely see it. The FTC points out that data without a name or Social Security number can still reveal intimate details and be linked back to a person. That is why the details below focus on how collection works, not just on what a form asks.

For how large collections of data are stored and analyzed, see our guides to big data and business intelligence components.

The six ways at a glance

Each way in detail

1. What you hand over

This is the simplest route. You create an account, check out, enter a contest or answer a survey. The company can keep that information and use it for what its privacy policy says. The FTC’s review of data brokers lists contests, surveys and registration websites among the commercial sources that feed the data market, so even this information can travel beyond the first company.

2. Trackers on websites

Websites often include small pieces of code and files, such as cookies, that recognize your browser on return visits. Some belong to the site you are visiting. Others belong to advertising or analytics companies and appear across many sites, which lets them recognize you in more than one place. Browsers and rules around these tools keep changing, so check the settings of the browser you use rather than relying on general descriptions.

3. Apps and location

Apps can collect location, device identifiers and usage. Many also include software development kits (SDKs), which are packages of code from other companies that do tasks like ads or analytics. In 2024 the FTC described cases against three data companies, two of them about location data. It alleged that X-Mode collected precise location through its own apps and through SDKs in third-party apps, and sold it to private government contractors without first telling consumers or obtaining their consent. It alleged that InMarket collected precise location, often multiple times per hour, from its own apps and third-party apps, covering about 100 million unique devices a year from 2016 onward, and built audience segments such as “parents of preschoolers.” These are the FTC’s allegations. The resulting orders restrict how each company handles location data.

4. Software that watches your browsing

Some tools can see every page you visit, including antivirus programs and browser extensions. The FTC alleged that Avast gathered browsing data through its antivirus software and browser extensions, despite promising to protect privacy, and sold granular, re-identifiable browsing information, often without notifying users. Avast was ordered to pay $16.5 million, which the FTC plans to return to affected consumers. The point for you: free or privacy-themed software can still be a collection tool, so read what it collects.

5. Purchases and loyalty programs

What you buy in a store or from a catalog is valuable data. The FTC’s 2014 data broker report lists retail and catalog purchase details, magazine subscriptions and warranty cards among the commercial sources brokers use. Loyalty cards link purchases to you over time, which is why they come with discounts.

6. Data brokers

The FTC defines data brokers as companies that collect consumers’ personal information and resell or share it with others, typically without direct contact with the people they profile. In its 2014 report on nine brokers, it found that they draw on government sources (such as voter, property, motor vehicle and court records), publicly available sources (including information people post online) and commercial sources. Most commercial data came from other brokers, and seven of the nine sold to or bought from each other, which made tracing an original source very difficult. That study used 2012 data and the industry has changed since, so treat it as a picture of how the market works, not a current census.

Worked example: one phone, one year

This is our own made-up illustration, so you can see how quickly small signals add up. The FTC alleged that InMarket collected location “often multiple times per hour.” Suppose an app records location four times an hour during the 16 hours a person is awake.

That is more than 23,000 location points for one person, from one app. Patterns in them, like where you sleep and where you work, can be worked out without a name attached. The count is invented and real apps vary widely, but the lesson holds: small, frequent signals add up.

How the pieces get combined

No single source tells the whole story. The value comes from joining them. A broker or advertiser can match a purchase record, a location pattern and a browsing history to the same person or household, then place that person in a segment. The FTC’s report gave examples of segment names such as “Dog Owner,” “Winter Activity Enthusiast,” “Expectant Parent” and “Diabetes Interest.”

The same label can be used differently depending on who buys it. The FTC noted that a “Biker Enthusiasts” label could help a motorcycle dealership, while an insurer could read it as a sign of risky behavior. That is the real concern: a guess made for marketing can be reused for something with larger consequences.

What you can control

1. Review app permissions. Set location to “only while using” or “never” for apps that do not need it, and delete apps you no longer use.
2. Audit browser extensions and security software. Remove any you do not recognize, and read what the rest collect.
3. Adjust browser privacy settings, including tracking protection and cookie controls.
4. Think before joining loyalty programs. Decide whether the discount is worth the purchase history.
5. Use privacy settings on accounts you already have, especially ad personalization.
6. Look for opt-outs and rights. Some brokers offer opt-outs, and some places give residents rights to access, delete or limit sale of their data. Rules differ by state and country, so check yours. This is general information, not legal advice.
7. Use different email addresses for sign-ups you do not fully trust.

Be realistic. These steps reduce collection but do not eliminate it, and the FTC’s 2014 report found that the choices available to consumers were largely invisible and incomplete. Do what is practical for you.

If you collect data for a business

If you run analytics, marketing or BI, the FTC cases are also a checklist of what to avoid.

• Match use to purpose. A common theme in the FTC’s cases was that data use must match the reason it was collected and what users were told.
• Do not call data “anonymous” unless it is. Browsing and location data can often be tied back to a person.
• Check every SDK and vendor you embed. Third-party code can expose your users to collection you did not intend.
• Write contracts you can enforce. The FTC alleged that at least two X-Mode customers resold data in breach of their contracts, and noted that restrictions without safeguards are not enough.
• Collect less. The FTC said some brokers keep data indefinitely, which it said may create security risks. Set retention limits.
• Document your data. See our guide to metadata for how good records help you protect what you hold.

Health data brings extra rules; see business intelligence in healthcare for an example. Laws vary by place and industry, so get legal advice for your situation.

Common mistakes

• Thinking “no name” means “private.” Location and browsing records can be linked to people.
• Trusting free software without reading what it collects.
• Clicking through permission prompts. They are often the only visible moment of choice.
• Assuming one opt-out covers everything. Data comes from many sources.
• Treating old research as current. The 2014 FTC study is useful for how the market works, not for today’s numbers.
• Collecting everything “just in case.” Extra data is extra risk.

Learn more

If you want to work with data responsibly, online platforms such as Coursera and Udemy list big data and analytics courses. We may earn a commission if you sign up, at no cost to you. We are not affiliated with any university. Look for ones that cover privacy and ethics as well as tools.

Frequently asked questions

How do companies collect my data?

Mainly through what you enter, trackers on websites, apps and the code inside them, software that sees your browsing, purchase records and data brokers who combine public and commercial sources.

What is a data broker?

The FTC describes data brokers as companies that collect consumers’ personal information and resell or share it with others, typically with no direct contact with the people profiled.

Can companies track my location?

Apps can, if you allow location access. The FTC has alleged that some companies collected precise location through apps and SDKs and used it in ways users were not told about. Check each app’s permission.

Is anonymous data really anonymous?

Not always. The FTC alleged that browsing information sold by one company was granular and re-identifiable, even though the company had described sharing as anonymous.

Can I stop companies collecting my data?

You can reduce it, with permission settings, browser controls and opt-outs, but not eliminate it. Your rights depend on where you live, so check local rules.

Why do companies want my data?

To personalize ads and offers, to understand customers, and to build risk and demand models. These uses are what many business intelligence and analytics teams work on.

Is data collection illegal?

Not in general. It becomes a legal problem when it breaks specific laws or when a company misleads people about what it does, as in the FTC cases described above. This page is general information, not legal advice.

What should a business do first?

List what data it collects, why, from whom and who it shares it with. Remove anything it does not need, and make sure its privacy statements match what it really does.