What is personal data, and how do companies make money from it?

Personal data is any information that relates to a person who can be identified. Companies make money from it mostly by using it to aim advertising, and some firms called data brokers collect it and sell or license it to others.

The definition is wider than most people expect. Under the European GDPR, personal data is any information related to an identified or identifiable natural person, and even the IP address of an Internet subscriber may count. What matters is the link to a person, not the value itself. The colour "red" is just a colour, but stored in someone's record as their favourite colour, it becomes personal data.

A surprising thing is how little it takes to point at one person. In 1990, gender, ZIP code and full date of birth were enough to uniquely identify 87% of the American population. Details that look harmless alone can single you out when they are combined.

That is why collecting it pays. Targeted advertising is directed at an audience with certain traits, and the traits can include behavioural variables such as browser history, purchase history and other recent online activities. The more a company knows about what people do, the better it can match an ad to a person.

Data brokers add another layer. A data broker collects personal data, mostly from public records but sometimes privately, and then sells or licenses it to third parties. Brokers combine many sources into individual profiles and sell them to organisations that use them mainly to target advertising and marketing, or to verify identity, including for fraud detection. One broker, Acxiom, says it has data on 2.5 billion different people.

The practice raises concerns. Critics point to privacy and algorithmic bias. Knowing what counts as personal data is the first step to understanding every other privacy story.