The old adage “if the service is free, then you are its product” needs updating. What it signified was that web services (like Facebook, Google, Yahoo et al) that do not charge users make their money by harvesting personal and behavioural data relating to those users and selling that data to advertisers. That’s still true, of course. But a more accurate version of the adage would now read something like this: if you use the web for anything (including paying for stuff) then you are also the product, because your data is being sold on to third parties without your knowledge.

In a way, you probably already knew this. A while back you searched for, say, a digital camera on the John Lewis site. And then you noticed that wherever you went on the web after that John Lewis ads for cameras kept appearing on the site you were visiting. What you were witnessing was the output of a multibillion-dollar industry that operates below the surface of the web. Think of it as the hidden wiring of our networked world. And what it does is track you wherever you go online.

Here’s how it works. When you click on an organisation’s web page, in addition to the page content it will also contain invisible Javascript programs which are there for the sole purpose of tracking your browsing habits. In the old days, tracking was done with “cookies” – strings of text placed on your computer’s hard drive by websites with the (legitimate) aim of improving the “user experience” or site performance. But abuse of cookies eventually led to a backlash via data-protection law and users deleting them, and so their efficacy as trackers was reduced.

Predictably new generations of trackers then emerged. The most pernicious is probably the Flash cookie maintained by the Adobe Flash plug-in. According to the Electronic Frontier Foundation briefing on these, Flash cookies are stored outside the browser’s control and users cannot view or delete them. Nor are users notified when the cookies (which have no expiry date) are set. Flash cookies can track users in all the ways traditional old-style cookies do, but they can be stored or retrieved whenever a user accesses a page containing a Flash application – which is almost every page that most people access.

As the Economist recently reported in a major study, the scale of tracking is staggering, and it’s now done in real time. One advertising executive told the Economist that “his firm has the chance to bid for around 10m online advertising ‘impressions’ (ads seen by a user) every second”. Data brokerage (for that is what this industry calls itself) has evolved from being a table look-up business to something akin to high-frequency trading in the stock market. Even as you browse a web page, an invisible computerised auction is going on somewhere to decide what ads you should see.

If you want to get a sense of what drives this, install the Ghostery plug-in for your browser and then go and visit some of the sites you normally access. I’ve just looked up one at random – reed.co.uk, which describes itself as “the UK’s #1 job site”. It has 10 trackers at the landing-page level, but when you search for particular jobs in a particular location the number of trackers explodes. A search for “software architect” in Cambridge, for example, produces a page with 28 trackers.

The conventional happy talk from the internet and advertising industries is that this kind of data hoovering is unproblematic because your real identity is not being disclosed. But the rise of social media has upended that applecart. It’s trivially easy now to correlate browsing data with, say, Facebook profiles or other online sources. For example, Latanya Sweeney of Harvard long ago established that 87% of the people in the US can be identified via just three data points – age, sex and postcode.

There’s an extraordinary cover story in this month’s Wired magazine by Madhumita Venkataramanan which makes this point vividly. It starts with a long and very detailed account of a person – occupation, interests, culinary tastes, travel, family background, income, charitable donations, marital status, house-cleaning arrangements, etc. And then she writes: “This motley set of characteristics, thoughts and attitudes comes very close to defining me as a person. It’s also a precise and accurate description of what a group of companies – personal data-trackers – has learned about me.”