Chapter 2: What They Actually Know About You

Most people, when they think about what digital platforms know about them, land somewhere in the vicinity of: my age, my general location, some of the things I have searched for, and maybe my purchase history. That picture is not wrong exactly, but it is significantly incomplete. The data layer beneath modern personalization is considerably deeper, and more importantly, considerably more predictive than the surface-level version most people carry around in their heads.

The gap between what people assume is being collected and what is actually being inferred matters a great deal. Because the privacy conversation most people have internalized is about collection, and the actual risk is about inference. Knowing that someone visited a website is relatively unremarkable. Knowing that the pattern of websites visited, combined with the time of day, the dwell time on specific pages, and the sequence of searches that preceded and followed the visit, suggests that person is in a particular emotional state, facing a specific kind of financial pressure, and likely to respond to a certain type of message — that is a different kind of knowledge entirely.

What Actually Gets Collected

The raw inputs into modern personalization systems are more varied than most people realize. The obvious ones are clicks and searches, but those are only the starting point. Systems also collect dwell time, which is how long you spend on a piece of content before moving on, and scroll depth, which is how far down a page you go before stopping or leaving. These signals tell the system not just what you looked at but how much attention you actually gave it, which is meaningfully different information.

Device fingerprinting adds another layer. The specific combination of your browser version, screen resolution, installed fonts, time zone, and dozens of other technical attributes creates a signature that is often unique enough to identify you across sessions and platforms even when you have not logged in to anything. Geolocation data, collected at varying levels of precision depending on permissions and inferred from IP address when direct access is not available, adds context about where you are, how often you are in certain places, and how your behavior changes across different physical environments.

Purchase history, social graph signals, app usage patterns, the sequence in which you interact with content, how your behavior changes at different times of day and different points in the week: all of it gets collected, stored, and fed into models that are continuously updated. The accumulation of these signals over time produces something that goes well beyond a record of what you have done. It produces a model of how you tend to behave, and increasingly, a model of what you are likely to do next.

The Shift From Collection to Inference

Here is where the conversation needs to move, and where most public discussions of data privacy fail to go. The question is not primarily what platforms have collected about you. The question is what they have been able to infer from it.

Research published over the past decade has demonstrated repeatedly that behavioral data can be used to infer attributes that people have never disclosed and would be surprised to learn have been modeled. Political orientation can be predicted from browsing and purchasing patterns with accuracy that exceeds self-reported surveys in some studies. Emotional states, including depression, anxiety, and loneliness, can be inferred from social media behavior with enough reliability to be commercially useful. Approximate income range, relationship status, major life transitions like pregnancy or divorce or job loss, health conditions, and psychological traits like impulsivity and susceptibility to social pressure have all been demonstrated to be inferrable from behavioral signals at population scale.

None of this requires the system to be right about any specific individual with certainty. Probabilistic accuracy across large populations is sufficient for targeting purposes. If a model correctly identifies people who are experiencing financial stress with 70 percent accuracy, that is enormously useful for anyone who wants to reach that group, whether the objective is selling them something, influencing a decision, or exploiting a vulnerability.

From Demographics to Psychology

One of the more significant shifts in personalization over the past decade is not widely understood even among people who follow technology closely. Traditional targeting was demographic: age, gender, location, income bracket, household composition. These categories are blunt instruments. They tell you something about the statistical properties of a group but very little about how any specific person within that group actually thinks or behaves.

Modern personalization systems have moved well past demographics, shifting from demographic profiles toward something considerably more granular: psychological models of individual behavior. Systems are now capable of modeling attributes like impulsivity, risk tolerance, susceptibility to authority, sensitivity to social comparison, tendency toward novelty-seeking versus loss aversion, and responsiveness to scarcity or urgency signals. These are not attributes that people disclose. They are inferred from behavioral patterns, and they are considerably more useful for influence purposes than knowing someone's age and zip code.

The practical consequence of this shift is that the message, the timing, and the framing that reaches you can be optimized not just for your demographic category but for your specific psychological profile. Two people with identical demographics can receive meaningfully different versions of the same content, each tuned to the particular combination of motivators and vulnerabilities that the system has modeled for them individually. This is what the concept of a segment of one actually means in practice, and it represents a qualitative change in what personalization is capable of doing.

The Feedback Loop Nobody Talks About

There is a dynamic in how these systems operate that gets very little attention in public discussions, partly because it is technically complex and partly because its implications are uncomfortable. Personalization systems do not simply respond to your preferences. Over time, they shape them.

The mechanism works like this. The system observes your behavior and builds a model of what you respond to. It then shows you more of what the model predicts you will engage with. Your engagement with that content updates the model, which refines what gets shown to you next. This feedback loop runs continuously, and its effect over time is to gradually narrow the range of information and perspectives you encounter in favor of the content that the system has determined is most effective at producing engagement from you specifically.

The practical consequence is that what you see, read, and hear through personalized channels is not a random sample of what exists. It is a curated selection optimized for your psychological profile, served through a feedback loop that reinforces certain responses and gradually filters out content that does not produce them. People sometimes notice this as the feeling that their feeds have become increasingly extreme, or repetitive, or emotionally charged over time. That observation is accurate. It is the natural output of systems optimizing for engagement without constraints on how that engagement is produced.

Why This Matters Beyond Advertising

Most of what has been described in this chapter was developed for commercial purposes, and much of it is still used primarily for advertising and product recommendation. The reason it belongs in a Shadow Sciences conversation is not that the commercial applications are unimportant, but that the same data, the same models, and the same inference capabilities are available to anyone with access to the underlying platforms or the data they produce.

The behavioral profile that allows a retailer to predict when you are most likely to make an impulse purchase is the same kind of profile that allows a scammer to predict when you are most likely to trust an unsolicited contact. The psychological model that allows a social platform to determine which emotional triggers keep you scrolling is the same kind of model that allows an influence operation to determine which narrative framings are most likely to shift your beliefs. The infrastructure is not inherently commercial or benign. It is a capability, and capabilities get used by whoever has access to them for whatever purpose they serve.

Chapter 3 examines where the clearest harm patterns are showing up in practice: the specific ways that personalization infrastructure is being used not to serve users but to exploit the vulnerabilities that profiling has made legible.