Ad company says it can target 91% of adults with highly-personalized ads, now it will be helped by AI

Data broking is a highly profitable industry responsible for those creepy invasive ads that chase you around the web. The industry is worth over $250 billion, and is expected to reach $440 billion by 2032. And while it thrives on selling your personal data to thousands of third parties, some of which are more shady than others, it does so largely behind closed doors.

Unlike high-profile companies like Apple, Microsoft, and Google, the biggest players in the data broking industry remain largely unknown to the public. One reason for this is the nature of their business: they operate on the premise that your data — information about where you live, what you watch, who you follow on social media, and whom you live with — does not belong to you. Instead, it is treated as an asset that can be repackaged and sold for a price. The data-selling business is a legal grey area, and with regulators now taking a keener interest in privacy issues, it's rare to see data brokers willingly thrusting themselves into the spotlight. It’s more often that they are thrust into the spotlight unwillingly — such as when they are caught red-handed illegally collecting and selling people’s data, including their precise geolocation.

Making a data collection monster

Given all this, it was surprising to see Arthur Sadoun, the CEO of French advertising giant Publicis Groupe, openly reveal just how much his company knows about nearly every Internet-connected person on the planet. But before diving into what he shared, let’s take a moment to look more closely at Publicis and what makes it so powerful.

Publicis Groupe is not just any advertising company; by the end of 2024, after a series of mergers and acquisitions, it has become the largest advertising company in the world. Since 2019, it’s owned Epsilon, one of the biggest data brokers out there, alongside heavy hitters like Acxiom, Experian, and Equifax.

Epsilon has a long history of data collection — it's basically the foundation of its business. It’s said that Epsilon has been churning out more than 47 billion permission-based emails every year, managing thousands of databases, and serving up a whopping 50 billion digital ads per day. In 2014, it bought Conversant, a tech firm that developed a tool called Common ID. This solution could connect anonymous online profiles to real-world names and addresses, expanding its reach even further. As part of Epsilon, Conversant’s tech now sits under the Publicis umbrella.

And most recently, Publicis announced it was acquiring Lotame, a company that bills itself as “the world’s leading independent identity solution.” Lotame runs one of the largest data marketplaces across 109 countries, collecting information from over 100 sources. One of the main ways it does this is by using tools like JavaScript tags — small pieces of code that track your online behavior, collecting data on what you click, what you buy, and how long you stay on websites. These profiles, which represent over 1.6 billion IDs, are then sold to more than 4,000 top brands and publishers, all eager to use them for razor-sharp targeted advertising.

You are under the microscope

Back to Arthur Sadoun and his revealing admission. In a recent promo for Publicis, where he highlighted the power of AI, Sadoun shared that with Epsilon, the company has access to data on 2.3 billion people worldwide. "But we don’t just see them," he added. "Because we have an identity-led view, we uniquely have permission to directly engage with each of them." And with the acquisition of Lotame, that number will jump by another 1.6 billion IDs.

"On top of 2.3 billion people we already see with Episolon, Lotame adds an additional 1.6 billion IDs across 109 countries. As a result, each of our clients can now engage with 91% of all adults connected to the Internet"

This means that, if we take Sadoun’s words at face value, Publicis' 3,600+ clients will now be able to target around 3.9 billion people around the globe.

As one of the largest — and arguably the largest — players in the advertising world, Publicis boasts an extensive roster of clients, including industry giants like Samsung, Google, Hulu, ESPN, Pfizer, Toyota, Target, Visa, and Marriott. Epsilon, in particular, works with 15 of the top 20 global brands and the majority of the top 10 Fortune 500 companies. Its clients span a wide range of industries such as financial services, retail, CPG, insurance, automotive, healthcare, and beyond. Some of the names on their impressive list include American Express, AstraZeneca, AT&T, Bank of America, Dell, Dunkin' Donuts, FedEx, General Motors, Hilton, JPMorgan Chase, Kraft, Nestlé, NFL, Unilever, Walgreens, and even McDonald’s and Coca-Cola.

As for how accurate the data is, Sadoun claims that it is as accurate as it can be. The looming cookie phase-out which some hoped would be good for privacy will not make it less so, he claims.

"The identity is the most accurate. We address real people, not devices or cookies, and we have the highest number of identity points and attributes per person. In the US alone, we see 7,000 individual attributes and 75% of what people buy. We see 1 trillion interactions each day, updated every 5 minutes thanks to AI."

If that doesn’t sound a bit unsettling, it should. The level of detail and constant tracking Sadoun is describing goes beyond what most people would consider comfortable or even ethical. We're talking about a system that continuously collects, updates, and profiles personal data in real time, down to the minutiae of what you buy and how you interact online. The sheer scale of this surveillance, combined with AI's ability to constantly refine and improve its accuracy, paints a picture of a world where personal privacy feels almost nonexistent. It's not just about ads anymore — it's about having a digital profile so precise, it can predict your behavior with disturbing accuracy. To drive his point home even further, Sadoun brought up the example of a fictional woman named Lola.

Run, Lola, Run!

Lola is someone many people can relate to, and that’s what makes this example so disturbing. She’s a young woman with two kids who love drinking orange juice — premium orange juice, no less. But lately, Lola has had to cut back because her income just isn’t keeping up with rising inflation, Sadoun explains.

If someone knowing these granular details about your life doesn’t sound invasive enough, Sadoun goes further, revealing they know “who she is, what she watches, what she reads, and who (sic) she lives with,” along with “who she follows on social media, what she buys online and offline, where she buys, when she buys,” and here’s the kicker — “more importantly, why she buys.”

Using all this data, Sadoun explains that Publicis’ AI can predict that Lola will likely switch to a cheaper juice brand. Once the AI makes that call, it immediately starts targeting her with ads for more affordable options.

It’s a perfect example of how deeply personalized — and potentially intrusive—behavioral advertising has become. Unlike contextual advertising, which targets you based on the context (for example, this happens when you see an ad for a baby stroller when browsing a site for new parents, or a new game console when on a gaming forum), these data-driven ads are based on what you do both offline and online. And this can feel incredibly intrusive.

But this isn’t even the worst part. Having collected such detailed data on the vast majority of Internet users worldwide, data brokers aren’t invincible fortresses — they’re just as vulnerable to data leaks and bad practices as any other company. And we don’t have to look too far to see the risks. In fact, Epsilon itself was the victim of one of the most expensive breaches to date.

Epsilon’s troubled history

In April 2011, Epsilon revealed that it had suffered a massive data breach. Though the company hasn’t fully disclosed how it happened, it was likely a result of a phishing attack — where hackers trick company’s employees into revealing sensitive information like developer credentials. Through this breach, hackers gained access to Epsilon’s email database, stealing a staggering 250 million records from 75 of its clients. Only names and email addresses were compromised in the breach, but it was enough for those affected to lose an estimated $2 million as a result of spam emails and other scams.

The breach also dealt a massive blow to the data broker’s reputation — it is estimated to have lost $45 million in business. On top of that, the company paid $127.5 million in a settlement with the US Department of Justice and spent an additional $225 million on forensic audits, monitoring, and legal expenses. Initially, it was projected that the breach could cost Epsilon as much as $4 billion if the criminals had gained access to and exploited email addresses, using that data to the fullest to gather more information for further attack. While the damages were lower than that, it still cost the company a dime.

Perhaps even more damning is the fact that the company was found knowingly selling consumer data to clients involved in fraudulent schemes. As part of a settlement with the US authorities in 2021, Epsilon admitted that between July 2008 and July 2017, its employees sold data on more than 30 million consumers to a mass-mailing fraud operation. This operation used the data to send fake "sweepstakes" lottery letters and astrology solicitation emails to unsuspecting, often elderly, victims. In 2024, two Epsilon employees — a senior executive and a sales manager — were sentenced to prison for their roles in the scam. Epsilon was forced to pay $150 million in penalties and victim compensation. More than 218,000 victims were defrauded of over $23.7 million, with some victims being targeted repeatedly.

These cases highlight that not only do data brokers gain unprecedented insights about individuals through various online tracking methods like web scraping, purchasing information from other companies, analyzing public records, and loyalty programs, but they also occasionally mishandle this data — with serious and far-reaching consequences.

How to protect your privacy from data brokers

It’s nearly impossible to escape the all-seeing eye of data brokers — going off the grid would be the only surefire way. However, if you want to limit the amount of data they can collect on you with the purpose to sell it, this is a difficult task but it is still within reach.

Buried deep within data broker websites is often a form that allows you to opt out of data collection for behavioral advertising. For instance, Epsilon offers an option to opt out of interest-based advertising, which is advertising based on your browsing history. Additionally, Publicis provides a link where you can opt out of having your personal data sold by the company here.. After some digging, we found an opt-out form for US-based users on Acxiom’s website. However, if you're outside the US and want your data removed, you'll need to email Acxiom at a country-specific address. Keep in mind, though, that this won’t affect any data already sold to marketers before you made the request.

Opting out of data collection and sale by contacting each data broker individually is no cakewalk. You’ll often need to spend a sizable chunk of time just finding the right form. And even then, it’s not a comprehensive solution — the likelihood of reaching every data broker (and there are hundreds of them) is slim, and covering most of them will demand extensive research and a great deal of patience.

If you don’t want to do all this hard work yourself, there are companies that will clean these Augean stables for you, but for a fee. Some of the popular names include Incogni, Privacy Bee, DeleteMe, Aura, Optery, and DeleteMyInfo.

The process of extinguishing your online trail is a painstaking ordeal. Not leaving that big of a trail in the first place, however, will make it easier. Here are some strategies to help keep your online presence minimal:

• Limit what you share on social media: Avoid sharing sensitive personal details, such as your birthdate or address. These pieces of information are often used for identification or security purposes and can be easily exploited.

• Set social media accounts as private: Unless you’re a social media influencer, you will only benefit from your accounts being closed to the public. Through settings, you can restrict visibility to only trusted friends and family members.

• Steer clear of online lotteries, quizzes: These seemingly harmless activities often gather more personal data than you might think. It’s better to steer clear of them if you want to maintain your privacy.

• Be selective with apps you download: Download apps only from trusted sources. Unnecessary apps can not only clutter your device but may also collect and share data. Make sure to uninstall any apps you no longer use.

• Use a temporary email or alias for sign-ins and one-off interactions: Instead of using your primary email for every sign-up, consider creating a temporary or disposable email address for situations where you don’t want to share your main email. This can protect your inbox from spam and prevent your personal details from being linked to unnecessary accounts. Some services like AdGuard Mail offer alias emails that forward to your real inbox, so you can filter them later if needed.

• Avoid opening emails from unknown sources: Be cautious with emails from unknown senders. They might contain phishing attempts, malware, or other harmful links. Never click on links or download attachments from unfamiliar emails, even if they look legitimate at first glance.

• Use privacy-focused browsers and ad-blocking tools: Browsers like Brave or Mozilla Firefox are designed to block trackers and protect your privacy. Pair these with ad-blocking apps or extensions like AdGuard Ad Blocker to further shield your online activities from being tracked and reduce unwanted ads.

• Mask your IP address and encrypt your data with a VPN: A VPN (Virtual Private Network) is a great tool for enhancing your privacy online. It hides your real IP address and encrypts your internet traffic, making it more difficult for websites and third parties to track your activity. Using a VPN also helps secure your data, especially when browsing on public Wi-Fi.