Ok, I found some answers. The original research is linked in the OP: https://adalytics.io/blog/sanctioned-ad-tech-user-data https://adalytics.io/blog/sanctione

Ok, I found some answers. The original research is linked in the OP: https://adalytics.io/blog/sanctioned-ad-tech-user-data https://adalytics.io/blog/sanctioned-ad-tech-user-data -- this is much more informative than the ProPublica writeup. It includes a technical explanation of what's going on. Basically, the accusation is that a sanctioned Russian company is listed as an advertiser ("Demand Side Platform") on Google's real-time bidding platform for ads. This means they get a blob of data for each impression that there is a bid on (this is "the bidstream data"): > These can include: The URL, website, or app the consumer is on, Information about the consumer’s device, The consumer’s geo-location, The consumer’s IP address, Various demographic or behavioral attributes about the consumer (as supplied by the ad exchange or third party data brokers), such as gender, age range, or job occupation These user IDs are anonymized but there's machinery to link the bid data to a cookie that the advertiser already has in their own system ("cookie matching"). They provide some evidence that even though RuTarget was OFAC sanctioned in April, Google may still be providing them the bidstream (and therefore presumably is selling services to an OFAC-sanctioned entity). This would be quite surprising if so, since a company like Google surely has processes to monitor the OFAC watchlist and automatically deactivate companies that are sanctioned. My summary here is that the ProPublica article is incomplete and that makes it a bit misleading; reading the article one would assume the Russians were getting a dump of de-anonymized data, whereas in fact the finding is around them getting access to the bidstream, which is provides anonymized user data, that may in some cases be hypothetically de-anonymizable, or assist with other de-anonymization efforts.