Google makes users' sensitive information available to companies via its top marketing agency; in the US, it concerns chronic illnesses, financial debt, or whether a user works in national security. That is a clear breach of the tech giant's own user policy, which states that all data is anonymised and sensitive information won't be used in that ad-broking process.

This was revealed by Ireland's oldest independent human rights organisation, the Irish Council for Civil Liberties (ICCL). In theory, European users are protected by GDPR, the EU legislation that protects personal data. Using your data for advertising purposes has to be done with your explicit consent. However, the director of the ICCL's investigative branch told The European Correspondent that this is likely happening to Europeans, too, as consent is usually hidden in cookies.

Here's how it works: your phone leaves a trail of data based on your online activity, such as what you like and buy, but also where you live. Ad brokers are given that information to see whether you are their target audience, and then the highest bidder pays to advertise on the pages you visit..

Commercial data can also be combined to reverse engineer identities. If the data ends up in the wrong hands, it opens the door to stalking, harassment, blackmailing – and potential national security breaches.