That's not a loophole in the language — it's the actual mechanism. No single company hands over a file labeled with your name. Instead, everyday services feed identifiers and behavior into a shared layer that reassembles them into the same thing a sale would produce.
TL;DR "We don't sell your data" is true on paper and meaningless in practice.
A simplified version of a real pipeline. Company names are illustrative of the category — the exact partners change, the pattern doesn't.
Purchase history, wishlist and browse behavior, delivery address, voice-assistant queries.
Who you interact with, what you linger on, precise location from photos and check-ins, contacts you've uploaded.
Every query, every place searched or visited, app usage across your phone, ad ID tied to the device itself.
Matches the same person across sources using shared identifiers — a hashed email, an advertising ID, a device fingerprint — even though no single source knew the whole picture. This is where "shadow profiles" get built on people who never used the originating service at all.
Health conditions inferred from purchases and searches, financial tier, likely political leaning, daily routine, household composition and relationships — none of it explicitly stated by you anywhere, all of it derivable from the combination.
Bid on the right to show you something in real time, milliseconds after you load a page.
Feed the profile into risk scoring and screening — with no obligation to tell you it happened.
Can simply buy access to the same profile instead of getting a warrant for the same information.
The toolkit's later sections cover both — removing yourself from the pipeline, and introducing noise into the profile that's already been built.