An online store does not need one cinematic surveillance move to recognize a shopper later. Identity graphs usually grow from ordinary browsing. A product page loads third-party scripts, a comparison visit comes back from the same phone, a coupon popup asks for an email, a purchase lands under one account, and separate fragments start pointing toward the same person or household.
Princeton's large-scale web tracking measurement is still a useful anchor because it showed how normal that first layer is. Third-party trackers appeared across a huge share of popular sites, which means a retail visit is often visible to more than the merchant itself. That alone does not prove every store has a perfect cross-device profile. It does show that ordinary browsing already creates multiple observation points around the same shopping session.
The FTC's data-broker report adds the next step. The agency documented an ecosystem that collects data from commercial and other sources, combines it, and turns it into profiles used for marketing and related purposes. That matters because identity graphs are not only about one cookie. They are about joining browsing behavior, purchase signals, demographic hints, and durable identifiers until a shopper becomes easier to sort, score, and re-target later.
The FTC's 2024 report A Look Behind the Screens makes the same pattern feel modern instead of historical. It describes extensive collection, sharing, retention, and use of persistent identifiers across digital services. Retailers and their partners do not have to start from a blank slate every time a shopper lands on a page. If enough identifiers survive across visits, the session can stop looking like a stranger and start looking like a returning profile.
Ad-tech's own language is revealing here. IAB Tech Lab's Project Rearc is explicitly about addressability and identity in a post-cookie world. In other words, the industry is not pretending recognition disappeared just because one browser control got stronger. It is actively building new ways to reconnect activity across contexts. That is why Cloak should talk about identity graphs carefully but plainly: not as a conspiracy theory, but as the predictable result of too many ordinary signals being made linkable over time.