EN
How they track you (II): what Google and Meta do with your data

Digital bond · Essay

How they track you (II): what Google and Meta do with your data

October 20, 2026 · 8 min read

According to their own documentation, what Google and Meta do with the data collected on many websites, which ad systems it feeds, and what the law says about it in the EU, Spain, and the US.

What this term means, in one sentence →

Imagine you search for a pair of sneakers. You go into an online store, look at three pairs, and close the tab. That evening, on another website and on your social network, ads for those same sneakers show up. Sometimes this happens because the store has activated Google or Meta tools that send what you did to their ad systems.

In the previous piece we looked at what Google Analytics and the Meta Pixel collect, two tools used by a huge number of websites. Today: what do Google and Meta do with that data?

A note on method: when the text says “in our judgment”, it’s our own interpretation, not a statement by Google, Meta, or a legal text — we flag it this way every time so you can tell a documented fact from our own reading.

The short answer: Google and Meta can use what you do on a website to decide which ads to show you afterward, on other sites and apps — sometimes only if that website enables it. There are ways to limit it: we cover them at the end.

What they say they do

Google says its basic role is to work for the website: measuring visits on the store’s behalf and according to its owner’s settings. But if the owner enables a data-sharing setting, Google “can access and analyze the data to better understand online behavior and trends, and use it to improve Google’s products and services,” for example its Google Ads tools, and, according to its help pages, Google then acts as an independent controller of that processing (Analytics help). Its privacy policy adds that when you visit sites or apps that use its advertising or analytics services, “those services may link information about your activity on that site or app with similar information from other sites or apps that use our services.”

Meta says, in the terms websites accept, that it can use that data to measure, to build the audiences a website requests, and to personalize the ads it shows “both on and off our products.” It can combine it with other data and keep it for up to two years. And its privacy policy says it receives this information “whether or not you’re logged in or have an account.”

Meta states it doesn’t sell your information to anyone. Google doesn’t say it sells it either and states it doesn’t share information that identifies you, such as your name or email, with advertisers unless you ask it to.

Where it goes: to their ads

Back to the sneakers. According to the companies’ own help pages, this can happen, as long as the store enables it:

  • With Google, if the store links Analytics to its Google Ads account and turns on personalization, the group of “people who viewed a product and didn’t buy it” is passed to Google Ads and used to show them ads in search, on websites and apps with Google ads, and on YouTube (help and remarketing example).
  • With Meta, the store can build groups of people from Pixel events and, if the group has at least 100 people, ask Meta to find other “similar people” (documentation). In our judgment, your visit may end up being part of the starting point Meta uses to decide who to show ads to afterward.

It’s both companies’ business. According to their annual reports to the SEC (the US securities regulator), advertising brought in more than 70% of Alphabet’s revenue in 2025 and, by its own report’s figures, 97.6% of Meta’s. Neither report attributes this to Analytics or the Pixel: in our judgment, that explains the interest, it doesn’t prove it.

What does the law say?

In summary, before going into detail:

  • In the EU and Spain, a website needs your consent before storing or reading information on your device.
  • As “gatekeepers,” Google and Meta have their own rules — on top of those that apply to any website — although the text doesn’t say that Analytics or the Pixel are among the services subject to them.
  • In the US there’s no federal law, but several states — California among them — do have their own.

The website needs your permission

In the EU and in Spain, as of October 2026, a website needs your permission before storing or reading information on your device, unless it’s essential to provide the service you’re requesting. This is required by the EU’s e-privacy directive and Spanish law (the LSSI).

The AEPD, Spain’s data protection agency, states in its 2024 guide (which covers so-called web beacons: invisible images downloaded when you visit a website that let it log the visit) that analytics is not exempt either.

It also cites the opinion of the Article 29 Working Party (the predecessor of the current European data protection board): it’s unlikely that a website’s own analytics poses a risk if it only uses first-party cookies and aggregated data for a strictly statistical purpose, discloses its use, and allows opting out.

It also states that refusing must be as visible as accepting.

In our judgment, the law doesn’t ban using them; what it generally requires is asking permission before storing or reading information on your device.

The website answers too

In 2019, regarding Facebook’s “Like” button, the Court of Justice of the EU ruled (under the directive that preceded the GDPR) that the website that installs it can be a joint controller of collecting and sending that data, and must ask you for permission; not for what Facebook does with it afterward.

In our judgment, the reasoning resembles the Pixel’s case.

Google and Meta have their own rules

As “gatekeepers,” the EU’s Digital Markets Act bans them, in the core platform services the Commission has designated, from processing the personal data of people using third-party services that rely on those platforms for the purpose of providing online advertising, and from combining it with data from their other services, unless they offer a specific choice and obtain consent. This text doesn’t state that Google Analytics or the Meta Pixel are among those services.

In April 2025 the Commission fined Meta 200 million euros because, according to the Commission, its “consent or pay” model didn’t offer a genuine option with less personal data, nor freely given consent to combine the data. Meta appealed the decision.

In the United States

In the US, as far as we know, as of October 20, 2026 there’s no general federal privacy law (there are bills in Congress); several states have their own.

In California, if a website sends your data to a third party for advertising based on what you do on other websites, the law calls it “sharing,” even if no money changes hands, and companies that exceed certain thresholds must offer you a link or a browser signal to opt out. It’s on you to opt out. The exception is minors under 16 when the company knows their age (or deliberately ignores it): there, prior authorization is required (from the minor themselves between 13 and 15, from their parents below 13).

What you can do

  • In the cookie banner, reject what you don’t need.
  • If you have a Meta account, use “Off-Facebook Activity” (not available in all regions). It lets you “disconnect” that activity from your account, although its help pages don’t say that data already received gets deleted.
  • In Google Ad Settings you can view and turn off ad personalization linked to your account.
  • Ask that your data stop being used for direct marketing: in the EU you can object at any time, under Article 21 of the GDPR (in our judgment, a platform’s personalized advertising fits there). If they don’t respond, file a complaint with the AEPD, if you live in Spain, or with your country’s authority.
  • If you’re in the US, turn on the Global Privacy Control signal in your browser and use, where it exists, the “Do Not Sell or Share My Personal Information” link.

What to take away

According to their own documents, Google and Meta can use what you do on a website for their ads (Google, in several cases only if the website enables it) and, under the EU’s e-privacy directive, a website generally needs your prior consent to store or read information on your device. So, if after looking at a pair of sneakers their ads keep following you, now you know a possible route they may have taken. In the next piece we cover what we do instead, in their place.

A disclosure that concerns us: Xiringase uses Meta Business Suite, Meta’s tool for scheduling social media posts. That’s not the same as building the tools we’ve described on top of our own visitors, but we’re inside that ecosystem, and we’d rather say so. As of October 20, 2026, the initial code of the homepages of the seven websites with Xiringase analytics (xiringase.com, tever.es, labs.tever.es, emtifervienza.com, lavieya.com, tienda.lavieya.com, and asturianu.org) doesn’t show either Google Analytics or the Meta Pixel (we haven’t reviewed the rest of the pages).

Sources (17)

Checked on 2026-10-14; those backing literal quotes were checked again on 2026-10-20.

Google:

Meta:

Law (EU and Spain):

Law (US):