> I couldn't fully figure it out. In a previous career, I spent a lot of time sourcing, vetting, and managing data vendors. While I didn't buy data from shady

> I couldn't fully figure it out. In a previous career, I spent a lot of time sourcing, vetting, and managing data vendors. While I didn't buy data from shady vendors (our clientele would have skewered us, and I leveraged that fact any time I was pushed to favorably evaluate a shady broker). But in the course of my job, I got a lot of insight into the ways things like that work. Here are just a handful of ways that it could happen, only the first two of which the website owner had any influence over: - Unscrupulous analytics providers. In the course of collecting analytics for the wbesite owner, these things can passively (or actively) capture things like form submission data and query string parameters. An innocuous clause in the ToS could be allowing them to package that up and sell it, separate from the core service they were offering the website owner. It's not just an issue with free analytics services; a website owner could be using an expensive service with the expectation of privacy, yet still have this happening to their site data. - Unscrupulous plugin/service providers. Think stuff like AddThis[1][2], which the website owner used to provide a particular and potentially useful functionality to their site, without realizing that the plugin/service provider was using that privileged access to their user base to do unintended things (like setting ad tracking cookies, like AddThis does). Again, this isn't just limited to free services, but paid services do stuff like this too. - Users give access to their email data directly, and whatever they gave that access to is collecting your info and reselling it. Unroll.me is a really good example of this[3]. If you use Gmail, it's good to periodically check your Permissions page[4], and click on each app to be sure of what does and doesn't have any access to your email data (it only takes read, not write access to siphon off stuff). Note though that you still might not be safe - those permissions are for things you've granted permissions to through Google. That's not always a prereq - for example, if your email is synced to your phone, an app on your phone could have permission to access that data on your phone and indirectly read all your incoming emails that way, and won't show up on that Google Permissions page. - For every Onavo that gets publicly called out[5], there are countless other "helpful" tools that people install to MitM their own traffic. Most of them are owned by companies far less publicly visible and smaller than Facebook, making them far more likely to do shady stuff with the data they collect. At least Facebook keeps their collected data internal, since it's in their interest not to sell it to competitors. - AdWare which comes bundled as part of the installers from downloads on sites like CNet, FileHippo, SourceForge, etc are not just used for AdWare. That toolbar it's installing as part of its installation flow isn't just able to do things like usurp your default search or inject ads into pages. It can also see everything you type and everything you submit on every page you visit (or local PDF that you happen to open in that browser, which has even deeper privacy implications). While virtually anyone on HN might not be largely impacted by this particular vector, they tend to get caught by the next one. - Useful, non-adware browser plugins[6][7]. It was downloaded (and used for) something specific, is generally helpful for that and not at all considered some spammy adware toolbar that actively make unwanted changes to your webpages and traffic. But oh hey you also gave it access to all of your browser data, and they're having a good ol' time leveraging that access passively. Developers aren't immune to this, and generally love browser plugins. I can't recall what it was at the moment, but last year there was a big news splash about some popular extension in the developer community getting bought and having some minor change made to integrate in the new owner's paid service offering. The code was on Github, and people went and forked it from before that particular commit had been made. But when was the last time you audited/sanity checked the current code running in all of your browser extensions? Just because it played nice before doesn't mean it does now. And for non-developers, they never think to (or have the capacity to) look into that in the first place. That's not even an exhaustive list. But provides a bit of context around just how ridiculous it is to keep up with all the ways your privacy gets exploited that could lead to your email ending up on an email list. And generally, the exploitation doesn't involve directly marketing to you in such a traceable way as you getting an actual email, but rather in selling market research, competitive intelligence, or targeting data/capabilities to AdTech companies. None of which you ever get exposed to as an end user, so you never even become cognizant of the volume of transactions involving exploiting your data. [1] http://www.addthis.com/data-solutions http://www.addthis.com/data-solutions [2] Not saying that AddThis sells emails, it's just a well known widget used on a lot of sites that has a revenue stream most site owners and end users aren't ware of. Which both compromises user privacy and got them a buyout from Adobe for $200mm. [3] https://www.nytimes.com/2017/04/24/technology/personal-data-firm-slice-unroll-me-backlash-uber.html https://www.nytimes.com/2017/04/24/technology/personal-data-... [4] https://myaccount.google.com/permissions https://myaccount.google.com/permissions [5] https://www.csoonline.com/article/3254571/security/facebooks-free-vpn-acts-like-spyware-to-ios-users-in-the-us.html https://www.csoonline.com/article/3254571/security/facebooks... [6] https://www.bleepingcomputer.com/news/security/-particle-chrome-extension-sold-to-new-dev-who-immediately-turns-it-into-adware/ https://www.bleepingcomputer.com/news/security/-particle-chr... [7] https://www.express.co.uk/life-style/science-technology/971847/Google-Chrome-update-Web-Store-extensions-collect-sensitive-user-data-warning https://www.express.co.uk/life-style/science-technology/9718...