The Machine That Knows You Better Than You Do

In the Black Mirror episode Nosedive, every social interaction is rated on a five-star scale. Your aggregate score, updated in real time, determines your access to housing, transport, jobs, and healthcare. Institutions query it before making decisions about you. The data accumulates from thousands of small interactions over time. You cannot meaningfully inspect or challenge what the system holds. People with low scores are quietly excluded from things other people take for granted, and most of them don't fully understand why.

Most viewers watched it as a satire of social media anxiety. It is more usefully read as a fairly precise description of an infrastructure that already exists, with one key difference.

China's social credit system is the parallel people usually reach for. That framing lets Western audiences off the hook. The US system produces similar outcomes through a commercially operated, privately held, largely unregulated version of the same infrastructure. The score is distributed across thousands of companies rather than centralised in government, which makes it harder to see, harder to challenge, and arguably harder to dismantle. None of this is a future risk; it is the current situation.

This piece explains how it works.

Apple's App Tracking Transparency framework, introduced in 2021, gave iPhone users a simple choice: allow an app to track them across other apps and websites, or don't. By the end of 2021, the average opt-in rate for tracking across iOS had fallen to around 25 percent, according to data from mobile attribution platform Adjust. The rate has risen since, reaching 46 percent globally by March 2022 per MarketingCharts, but for social media apps specifically, around 80 percent of users opted out during the initial rollout period. Privacy advocates declared a victory. The ad industry complained about billions in lost revenue.

Neither reaction fully captured what was happening. The ATT popup addresses one specific mechanism: the IDFA, Apple's device identifier used for cross-app attribution. When you decline, that identifier is withheld from the requesting app. What the popup does not address, cannot address, and was never designed to address is the broader infrastructure already built around you.

Most people have a vague awareness that companies collect data about them. Very few have a sense of the actual scale. The numbers are worth sitting with, because they reframe what is otherwise easy to dismiss as background noise.

There are estimated to be up to 5,000 data broker companies operating globally. The industry is consolidating: the number of distinct companies fell by roughly 30 percent between 2010 and 2024, while total assets under management grew by around $1.7 trillion over the same period. Fewer players controlling more data is the direction of travel.

Acxiom has been collecting data on consumers since 1969. It runs 23,000 servers processing more than 50 trillion unique data transactions per year. LiveRamp, which grew from Acxiom's data onboarding business, describes its identity graph as drawing from "hundreds of contributors" and maintaining records on individuals that are continuously updated as people move house, change jobs, and acquire new devices. Oracle advertises connections with 80 data broker companies.

These are not small operations. This is infrastructure. It predates most of the internet companies people think of when they think of data collection, and it will outlast most of them.

The profile built on you doesn't come from one place. It comes from hundreds, and the aggregation is the product. Individual data points are often not sensitive in isolation.

A Cornell Law Review note on derived information from data brokers describes how these companies "integrate data into a single database, analyse it, and build predictive models to produce derived information," segmenting consumers based on factual and predicted characteristics. The key word is predicted. The profile doesn't just describe who you are. It infers things about you that you may never have shared with anyone, based entirely on the pattern of things you have done.

What makes this inference hard to regulate is precisely that it doesn't rely on sensitive data. Prohibiting the use of protected characteristics from predictive models doesn't prevent discrimination, because the models can predict those characteristics from entirely unprotected inputs. Your postcode, your browsing time, your purchasing patterns, and your app usage collectively imply your income bracket, health status, political leaning, and religious affiliation without any of those things being explicitly captured.

The data is only valuable if it can be tied to a consistent identity across sources and devices. When you use different apps, different browsers, different devices, the raw data appears fragmented. The identity graph is the infrastructure that resolves all of that into a single persistent record.

LiveRamp's RampID is a pseudonymous, people-based identifier that ties together offline personally identifiable information (name, postal address, email, phone number) with online devices, browsers, and app IDs. It is transmitted through the real-time bidding infrastructure that underpins programmatic advertising. Every time a page loads and an ad auction runs, that identifier passes through the bidstream, allowing any participant in the auction to match the incoming user against their own database.

Identity resolution uses two methodologies. Deterministic matching links devices using exact, verified identifiers like email addresses or phone numbers. Probabilistic matching is statistical: it infers that two devices likely belong to the same person because they consistently connect from the same IP address, share browsing patterns, or appear in the same household data.

When you opt out of tracking on one app, the rest of the graph continues building. When you get a new phone, the graph eventually links the new device to your existing profile. The system was designed specifically to survive the things people do when they try to limit their exposure.

A static profile, however detailed, is only so useful. What changed the economics of the whole system was the application of machine learning to behavioural data, shifting the model from descriptive to predictive. The question is no longer who you are, but what you will do next, and when.

Google's advertising platform offers "predictive audiences," described in its own documentation as using AI to "predict user intent based on past behaviour, allowing you to target users likely to convert even before they actively search for your product." The system is not waiting for you to express intent. It is predicting intent before you have consciously formed it.

The signals feeding these models go well beyond search queries. Scroll velocity slows when something catches attention. Tap hesitation before a purchase correlates with price sensitivity. Time spent on specific content types correlates with emotional state. Session length and time of day carry information about psychological context.

The predictive layer adds a temporal dimension that most discussions of personalisation skip past entirely. The question is not only who to target but when to reach them. These are not the same problem, and conflating them understates what has been built.

Real-time data pipelines process behavioural signals with very low latency. A user browsing travel deals can trigger a personalised email offer before they have left the page. Push notification timing is optimised by machine learning systems trained on individual response patterns. Email send-time optimisation tools learn each recipient's engagement windows from historical open and click data.

The system is self-improving. Every interaction you have with a targeted ad, every click, every conversion, every scroll-past, feeds back into the model and refines it. The more you engage with a platform, the more accurately it can predict your behaviour. The more accurately it predicts your behaviour, the more effectively it can influence it.

You are, in a very literal sense, providing free labour to a system designed to exploit your own patterns against you. The optimisation target was never your satisfaction; it is your measurable response to stimuli.

The framing of data collection as primarily an advertising problem understates how many other industries are purchasing and acting on the same profiles. This is where the conversation moves from uncomfortable to genuinely alarming.

Employers and background check companies are significant buyers. The Work Number, Equifax's employment data subsidiary, holds 535 million active and historic employment records including salary history, healthcare data, and leave status, sourced from 2.5 million contributor organisations. A Stanford Tech Policy analysis found that sensitive personal information including social security numbers, salary data, and parental leave status are often shared with data brokers on a weekly basis, often without employees being aware.

AI-driven recruitment platforms buy broker data to fill gaps in candidate profiles and score applicants before they are interviewed. Platforms like EightfoldAI advertise using "the world's largest source of talent data" to identify "Validated Skills, Likely Skills, and Missing Skills" in candidates. Systems like Veriato Cerebral monitor employee chats, emails, web activity, and file transfers and produce a daily-updated Risk Score for each worker.

Insurance companies buy health data profiles compiled from browsing behaviour, search history, and pharmacy loyalty card data. If you searched for a medical symptom, or bought medication using a pharmacy rewards card, that signal is potentially in a profile being sold to insurers. The data may reflect a search you ran for someone else. Inaccuracy is endemic to the system and carries no liability for the broker.

Financial institutions use broker profiles to assess creditworthiness and mortgage applications. Landlords use them to screen tenants. The Electronic Privacy Information Center notes that broker algorithms "can be used to determine interest rates on mortgages and credit cards, determine eligibility for public benefits, or deny people jobs." In the United States, none of this requires your knowledge or consent.

The harms from data broker profiles are not theoretical. They are documented and ongoing, and they fall disproportionately on the people with the least ability to challenge them.

Inaccuracy is the first and most mundane problem. Profiles built from hundreds of sources, matched probabilistically, and updated by automated systems are wrong with significant frequency. There is no mechanism for you to inspect or correct a profile held by most data brokers. The consequences of that inaccuracy, a declined mortgage, a failed background check, a higher insurance premium, have no meaningful recourse in most jurisdictions.

There are two ways to read the above. One is as a privacy story, a critique of surveillance capitalism and the erosion of individual autonomy. That reading is valid. The other reading, more immediately useful if you are a practitioner, is structural: you are working inside a system that most of your clients and stakeholders don't fully understand, and that misunderstanding has consequences.

Attribution models built on last-click or multi-touch frameworks are measuring the visible output of a system that made its real decisions earlier in the funnel, at a point of predicted receptivity the attribution model never captured. The conversion you are crediting to a retargeting ad may have been a near-certainty before that ad ever appeared. You are measuring the last domino. The system fell several dominos earlier.

The deprecation of third-party cookies has been slow and incomplete, but the direction of travel is established. The infrastructure described above will not disappear. It will increasingly run on first-party signals, which means the competitive advantage shifts toward whoever has the richest direct relationship with their audience.

The honest answer is: not as much as you should be able to. The architecture described in this piece was built specifically to be persistent, to survive opt-outs, device resets, and account deletions. But partial mitigation is still mitigation.

This piece is not arguing that targeted advertising is inherently bad, or that the companies described above are uniquely malicious. Most of what is described here is legal, widely used, and in some contexts genuinely useful. The question of where personalisation becomes manipulation is legitimate and worth debating, but that debate belongs in a different register than this one.

What this piece is arguing is that the infrastructure described here is real, it is very large, it has consequences that extend well beyond advertising, and most people working in digital marketing have at best a partial understanding of how it actually functions. The permission popup is not the story. The story is what happens after you tap allow, and also what happens when you tap don't allow and the system proceeds anyway through the hundreds of other intake valves you never saw.