Ad Profile Test

Discover what ad networks know about you

HOW IT WORKS

Ad profile analysis

DATA COLLECTION

Gathering browser signals

TARGETING

Analyzing targeting parameters

COOKIES

Checking tracking cookies

RECOMMENDATIONS

Privacy recommendations

How Ad Profiles Get Built (and Why Browser Tests Only See Half)

Open the developer tools on most websites. Watch the network tab during page load. Twenty to fifty third-party requests fire. Some are obvious (Google Analytics, Facebook Pixel). Most aren't (Pubmatic, Magnite, Criteo, LiveRamp, The Trade Desk). Each one is a connection to a company that may already have a profile of you, and is now adding the page you're reading to it. The profile they're building isn't a single record in a single database. It's a composite identity stitched together across cookie syncs, mobile ad IDs, hashed email matches, and behavioral inference. The output is a vector: demographics (often estimated from inference, not declaration), interests (machine-classified from your reading history), and intent signals (you searched for 'flights to Tokyo' last Tuesday, here come the airline ads). Some attributes are accurate. Some are wildly off. None are visible to you without a tedious data subject access request, which most companies handle slowly and incompletely. Sections below: how an ad profile actually gets assembled across the ad ecosystem, what a browser-based test can and can't see, and the practical defenses that move the needle.

How a Profile Gets Stitched Together

Five layers feed an ad profile, each filling gaps the others miss. First-party data is the foundation. When you log in to a site, that site has a known identity for you (account, email, billing address). It can ship that data to its analytics and ad partners through server-side integrations. Hashed email matching turns the email address into a stable join key across every site that has your email and every advertiser that has the matching hash. LiveRamp's RampID and Adobe's CDP run on this principle. Same handoff as a supermarket loyalty card system: every checkout pings the brand reps before you've made it to the parking lot. Cookie syncing builds the cross-site graph. Tracker A loads on site 1, drops a cookie with ID X. Tracker B loads on site 1 too, drops a cookie with ID Y. They sync via a redirect chain: A→B handshake, both sides now know 'X corresponds to Y'. Visit site 2 with tracker B. B knows it's Y. B has previously matched Y to X. Now A's profile, built on site 1, gets enriched with site 2 data even though A never loaded on site 2. The graph metastasizes through the ad ecosystem in milliseconds. On mobile, ad IDs unify in-app data. Until iOS 14.5 dropped, the IDFA was a stable per-device identifier shared across every iOS app. Android's GAID (Google Advertising ID) plays the same role. Apps shipped IDFA/GAID with every event, ad networks built dossiers per device, and the profile traveled with you across apps. Apple's ATT prompt knocked iOS opt-in rates to 13-25%, depending on geography. Android's deprecation timeline is more gradual but moving in the same direction. The mobile ad profile is materially smaller than it was in 2020. The boring stuff comes from offline data brokers. Acxiom, Experian, LiveRamp, Equifax, Oracle Data Cloud (shut down in 2024). They aggregate credit card transactions (de-identified but not robustly), loyalty program memberships, voter registration, court records, public licensing data, magazine subscriptions. The result: every US adult has a few hundred attributes attached to their hashed email and physical address, available for purchase by any advertiser with a budget. On top of all that, real-time bidding telemetry feeds the live model. Every time an ad loads on a page, the auction generates a bid request containing your IP, user agent, viewport, page URL, page category, and any user IDs the SSP has on file. That data flows through hundreds of DSPs in milliseconds. Each DSP keeps records. The resulting log is a near-complete history of every page view that hosted ads. The profile is the join of all five.

What a Browser-Based Test Can Actually See

The browser is one observation point in this network. It can see what's loading right now in your tab. It can't see what's already in their database. Cookies are visible. A test can enumerate first-party cookies, third-party cookies (if your browser still allows them), and identify which advertising or tracking domains they belong to. Reading the cookie content is mostly opaque: the ID inside is meaningful only to the company that issued it. Tracking pixels and beacons are visible. The test sees `1x1.gif` requests, `__utm.gif`, Facebook's `tr`, the Pubmatic, Criteo, Outbrain, Taboola pixels. It can list which domains are reaching you on this load. Fingerprint surface is visible. Canvas, WebGL, fonts, AudioContext, screen dimensions, plugins, languages, timezone. A test can compute the fingerprint hash and tell you how unique it is. It can't tell you who has previously seen this fingerprint or what they've matched it to. What's not visible from the browser: The actual contents of any ad network's database. That data lives on their servers. Subject access requests under GDPR or CCPA can pull a copy, but the data is often described in the company's internal taxonomy and isn't readable as a profile. Cross-device linking. If you read a site on your phone and your laptop, both visits feed a single profile in the ad network's identity graph, but the browser on either device has no view into how those got linked. Server-side tracking. Many sites now ship analytics and ad-tech events from their server, not your browser. The browser sees only the regular page request. Server-side GTM, Snowplow, Segment, Rudder. Invisible to a browser-based test. Predicted attributes. The 'predicted age 35-44, predicted income tier upper-middle, predicted interests: travel, finance, parenting' output of a test is an inference based on what tracking infrastructure is loading and the categories of sites you visit, not a readout of what any specific advertiser has. The output is a directional estimate. A useful test scopes its claims to what the surface actually shows. The honest reading: 'your browser is currently leaking enough data that an advertiser with your hashed email could build a profile with these attributes'. The dishonest version: 'Google has assigned you the following income bracket'.

What Actually Reduces the Profile

The mitigation gradient runs from cosmetic to material. Cosmetic: clear cookies, use incognito. Fingerprinting survives both. Cookie clearing breaks first-party login state, which annoys you more than it bothers ad networks. Incognito mode disables cookie persistence for the session but not the underlying network signals. Both are placebos at the cross-site profiling level. Material at the browser level: switch to Brave, Safari, or Firefox with strict ETP. Brave blocks third-party cookies, fingerprint surface, and known tracker domains by default. Safari's ITP partitions third-party cookies per site and aggressively expires them. Firefox's strict ETP blocks known trackers and cross-site cookies. Chrome with default settings does almost none of this; switching browsers moves the needle more than any single setting on Chrome. Material at the extension level: uBlock Origin (filter list-based blocking), Privacy Badger (heuristic tracker detection), Multi-Account Containers (Firefox, isolates first-party state per container). Material at the network level: DNS-level blocking via NextDNS, Pi-hole, AdGuard Home. Catches CNAME-cloaked trackers that some browser extensions miss. Doesn't break sites the way some browser blockers do. Material at the OS level: opt out of personalized ads in iOS Settings, Android Settings, Windows Privacy. These don't stop tracking, but they reduce the precision of mobile ad ID-based profiles. Material at the account level: opt out of personalized advertising on each major platform separately. Google: My Ad Center. Meta: Ad Preferences. Amazon: Advertising Preferences. LinkedIn: Ads Settings. Each opt-out reduces personalization within that platform. None affect the data brokers behind the scenes. The most effective single change: a browser switch from default Chrome to Brave or Safari. The second-most effective: an ad blocker. Combined, the visible tracking surface drops by an order of magnitude. Like switching from a screen door to a steel one. The bugs that get through are the persistent, well-funded ones. The casual ones go away. The WHOX ad profile test enumerates cookies, tracking pixels, fingerprint signals, and known ad-network requests on the current page load, then estimates the profile attributes those signals could feed. The output describes the surface, not the database behind it. Useful for measuring whether your defenses are actually doing what you think they are.

FREQUENTLY ASKED QUESTIONS

What is an ad profile?

An ad profile is a set of characteristics advertisers use to target ads — age, interests, income level, and other parameters.

How to clear ad profile?

Clear browser cookies and use incognito mode. For complete protection, use ad blockers and anti-tracking extensions.

How to protect privacy?

Use browser with built-in tracking protection, install uBlock Origin, and regularly clear cookies.

All our tests

Run the full WHOX toolkit from one place: leak checks, fingerprint probes, network diagnostics, reputation lookups, and privacy failure tests.