What Data Collection Is and Why Companies Do It?

This is the first in a series explaining how the internet actually works underneath the parts you see.

You can't make a decision about your own privacy without knowing what's being collected, by whom, and why. Most explanations are either marketing or written for lawyers. We're aiming for neither.

Let's start with data collection, because everything else builds on it.

What Counts as Personal Data

Under EU law, personal data means any information relating to an identified or identifiable person. That second word does a lot of work. Information doesn't have to name you. It only has to make you identifiable, on its own or combined with something else.

The European Commission's explanation of data protection includes examples of personal data, and some of them may surprise you. A name and address are obvious. But personal data also includes an IP address. A browser cookie ID. The advertising identifier on your phone.

Two details are worth knowing. First, scrambling (encrypting) the data doesn't necessarily remove it from the category. If information has been encrypted or pseudonymised but can still be used to re-identify someone, it's still personal data under the GDPR. Second, truly anonymous data isn't personal data at all. But the anonymization has to be irreversible. Plain marketing promises don’t count.

How Data Collection Actually Works

Now the mechanics. Four main methods collect data, and most sites use several at once.

Cookies are small files a website stores in your browser, like Google Chrome, Opera, or Mozilla Firefox. These cookies remember your login credentials and your preferences. They also allow a website to recognise you when you come back.

Pixels are invisible images embedded in a page or email. Loading one tells a server that you opened it. Like invisible ink – it’s there, but you can’t see it. The website owner can, though.

Device fingerprinting works differently and is harder for regular users to avoid. Your browser reveals a combination of settings you’re using, including fonts, screen size, and configuration details. According to the Federal Trade Commission's guide to online tracking, that combination is often unique enough to identify you without any cookies at all. Every person is unique, and sometimes that’s not an advantage.

Advertising identifiers are the phone version of data collection. Your device, whether that’s a smartphone or a tablet, has an advertising identifier, and apps use it to track what you do.

The important distinction is who's doing the tracking. When the website you're visiting tracks you itself, that's first-party. When the website’s owners allow another company to track you while you browse their website, that's third-party tracking, and that company can follow you across most of the sites you visit.

That's how you search for running shoes once on Google and then see running shoe ads on Instagram, Reddit, and TikTok. Some people think this is a creepy conspiracy about our devices listening to us, but it comes down to how much personal information is collected and what’s done with it.

Usually, you can reject at least a portion of tracking cookies, but that’s not always as beneficial as the website makes it out to be. Our research team found that while most EU-based websites give you the choice of cookie or no cookie, they still track you even if you decline.

Why Companies Want Your Data

The short answer is that targeted advertising is more profitable than untargeted advertising.

An advertiser will spend more money to reach a person likely to buy their product than to reach a random person who may not. Knowing your personal interests, where you’re located, what device you’re using, and your browsing history makes you a valuable target and a potentially profitable customer.

There's a second market underneath that. Data brokers collect and combine information from many sources, then sell the result. Companies you've never even interacted with assemble your online activity into a profile. Then it gets sold.

And there's a third reason that's less discussed. Companies collect data because it’s cheap, and nobody is technically required to stop. Storage costs almost nothing. The default across the industry is to keep everything, in case it turns out to be useful.

What a VPN Changes, and What It Doesn't

We sell a VPN, that’s no secret – you’re reading this on a Mysterium VPN blog. We'd rather be precise than impressive. Using a VPN encrypts the browsing traffic between your device and a VPN server. Two things follow from that:

• Your internet service provider (ISP), which can usually see what you do online, can no longer see any of it. They can see that you're connected to a VPN, and that's about it.
• The websites you visit see the VPN server's IP address instead of your actual IP. If you, a person in Germany, connect to a Canadian IP, the website you’re visiting will only see the Canadian IP. That matters specifically because, as above, your IP address is personal data. A VPN changes one real identifier in the chain.
• When connected to a Wi-Fi network you don't own, like public Wi-Fi at a hotel or the airport, a VPN also stops other people on that network from reading your traffic.

Here's what a VPN doesn't do: it doesn't stop cookies; it doesn't stop device fingerprinting, which doesn't depend on your IP at all. It doesn't help if you're logged into an account, because you've already told the website who you are. It also doesn't stop the website itself from recording what you do while you're there. And it does nothing about any of your data a company already holds. So a VPN is one layer. It addresses network-level visibility and your IP address. It leaves browser-level and account-level tracking untouched.

Why We're Writing This

Ignorance isn't bliss. It's just a worse negotiating position.

Every privacy decision you make is a trade-off, and you can only judge a trade if you know what's on both sides. When a website asks you to accept cookies, you're agreeing to something specific. Most people haven’t really stopped to think about what that something is. That's the gap this upcoming series of articles is for.