Yes and yes, respectively. They openly correlate your physical presence in retail shops with your web browsing, so as to count web-to-physical conversions for t

Yes and yes, respectively. They openly correlate your physical presence in retail shops with your web browsing, so as to count web-to-physical conversions for that shop's advertising. The latter two (piercing the Incognito veil) are technically straightforward, but I doubt they do it. Google is pretty tightly bound by a certain set of ethics. By their lights, that creepy McDonalds experience is totally OK, but ignoring explicit privacy settings is not legit. This is why they bother with dark patterns like making it inconvenient - but not impossible - to turn off Google Play's access to location data. They could just ignore you, but they won't. I'd bet they do collect and keep the information for some time [eg for anti-abuse], but deliberately don't use it. (And consequently feel very proud of how ethical they're being, compared with others in their industry, and how terribly unfair it is when people complain about them but not the sleazier ad networks.) As I see it, the "advertising creepiness" problem has two factors. One is black-hats explicitly extracting information you're not sharing (eg Evercookie, canvas fingerprinting and friends). The other is grey-hats like Google, Facebook and MS, whose access to that data is perfectly legitimate in that you gave them permission (what, you didn't click through the three small buttons within 30 days to withold your WhatsApp contacts from Facebook? Too bad!), but whose market dominance and dark patterns make giving them that data less and less of a free choice. Conflating the two is easy but unhelpful.