In January 2017. the Federal Trade Commission issued on report on Cross-Device Tracking. Cross-device tracking monitors a user's activity on separate platforms (cell phones, desktops, tablets, etc.). Data gleaned from this process is often combined with information about purchases at stores to send targeted ads to individuals. 'Onboarding' is the compiling of online and offline data to create detailed profiles of individual consumers.

The report was prepared by FTC staff members who participated in a workshop on Cross-Device Tracking. One of their chief areas of concern is the invisibility of data collection. Trade associations, the Network Advertising Initiative, and the Digital Advertising Alliance require their members to allow consumers to opt out of 'behavioral advertising'.

A decade ago cookies were the primary means of tracking consumers' activities online. More recently, browser history sniffing has been utilized.

Cross-device tracking can determine where an individual lives and works, and the specific devices they use, by detecting that a smartphone uses the same IP address as a desktop computer during the day, and the same IP address as a home laptop during the evening. "Additionally, a company might infer that a work smartphone and personal smartphone that visit the same unusual combination of websites belong to the same user." See page 3. Tracking can be conducted even if an individual never logs into an account.

The FTC's workshop tested two devices that it used to visit 100 web sites. Companies that conduct cross-device tracking were embedded in 87 of the 100 sites. "Of the one hundred privacy policies reviewed, staff found only three policies that explicitly mentioned enabling third-party cross-device tracking on their site." See page 8. Data brokers can obtain consumer's personal information without having had any direct contact with them.

The FTC recommends that if a consumer opts out of data collection for behavioral advertising on one device, data from that device should not be used for ads on other devices, and data from other devices should be used for ads directed to the opted out device.