You open a news website to read one article about the monsoon.
By the time the page finishes loading, your datafolk has been to market, been appraised, been auctioned to a roomful of bidders you cannot see, sold to the winner, and delivered, in the form of an ad for a raincoat you will now be followed by for three weeks. The whole transaction took less time than it took you to find the close button on the cookie banner.
You were not invited to this auction. You were the thing being sold.
Welcome to the bazaar.
A Mandi You Cannot See
Picture a vegetable mandi at dawn. Crates arrive. Buyers walk the rows, prodding tomatoes, calling out prices. A good auctioneer can sell a lot of okra in the time it takes you to decide whether the okra is fresh. Money changes hands fast, in the open, over things everyone can see and touch.
Now take that mandi, shrink it to fit inside a web page, speed it up by a factor of a few thousand, hide it completely from the person being traded, and replace the okra with you. That is the modern advertising economy. The crates are your attention. The auctioneers are machines. And the whole thing runs on a quiet, brutal premise: a moment of your attention is a product, and products get sold to whoever pays most.
The mechanism has a name as bloodless as the thing it describes: real-time bidding An automated auction where the right to show you a single ad is sold to the highest bidder, in the time it takes a web page to load — roughly 100 milliseconds. .1
Here is what happens in those hundred milliseconds. The page you opened sends out a notice: a person is here, an ad slot is available. Attached to that notice is a description of you, assembled from cookies, your device, your location, and whatever a dozen data brokers A company that collects, packages, and sells information about people who have never agreed to anything. You are not its customer. You are its inventory. have filed away under your name. Advertisers’ machines read the description, decide how much you’re worth to them, right now, and bid. The highest bid wins. The winning ad loads. You see a raincoat.
All of it, the notice, the bids, the sale, the delivery, happens before the article about the monsoon has even rendered. You refresh the page, and the auction runs again. Different bidders. Different price. You are sold fresh every time, like the okra.
It is easier to believe this once you have watched it happen. So watch it happen.
Open a page and, before it finishes loading, this happens underneath it. Press the button and watch your datafolk go to market.
A person is here. One ad slot is available…
Notice what the auction never asked you. It did not ask your permission. It did not ask your name. It did not, in the end, care very much who you are, only what bucket you fall into and what that bucket is worth to a raincoat company this second. The whole apparatus is indifferent to you as a person and intensely interested in you as a price.
How the Room Knows You Walked In
For the auction to run, the room first has to recognise you. This is the part most people never think about, because it is designed to be unremarkable, and it is worth slowing down on.
When you first visit a site, it drops a small file on your device, a cookie A small file a website leaves on your device to recognise you next time. A third-party cookie is a stranger who followed you from the last shop, and the one before. . A first-party cookie is harmless and useful: it is how a site remembers you are logged in, or that your cart has three items. The trouble is the third-party cookie, set not by the site you are visiting but by an advertising company embedded invisibly inside it. That same company is embedded inside thousands of other sites too. So as you move from a news site to a shopping site to a recipe blog, the same silent observer is present at each stop, quietly noting: same person, still here, now reading about pressure cookers.
Researchers who crawled a million websites found these trackers almost everywhere, with a handful of large companies present across a staggering share of the web, watching the same people move from page to page.4 You did not consent to being followed across the internet. You consented, at most, to reading one article, and the follower came free with it.
And if you clear your cookies, feeling briefly clever, the room has a second way to recognise you: your device fingerprint A near-unique signature built from your device's quirks — screen size, fonts, browser, timezone — so you can be recognised even after clearing cookies. You cannot delete it. . Your screen resolution, your installed fonts, your browser version, your timezone, your graphics quirks, together these are specific enough to pick you out of a crowd of millions. You cannot delete a fingerprint by clearing anything, because it is not a file stored on your phone. It is simply what your phone is like, and your phone is quietly unlike almost everyone else’s.
The lesson lands early and hard: you are recognised far more thoroughly, and far more permanently, than the “clear history” button lets you believe.
You Are Not One Thing. You Are Hundreds of Labels.
To be auctioned, your datafolk first has to be described. And the description is not a portrait. It is a list of labels.
The industry calls them segments A labelled bucket that advertisers buy access to — 'new mothers in Pune', 'frequent flyers', 'likely to switch banks'. Your datafolk is sorted into hundreds of them. . You are sorted into hundreds of them, and you have seen none. Some are dull: “Android user”, “lives in a metro”, “shops online”. Some are commercial: “in-market for a car”, “high-value traveller”, “price-sensitive”. And some are the kind of thing that, if a stranger said it about you on the street, you would find genuinely unsettling: “expecting a baby”, “recently bereaved”, “likely diabetic”, “financially stressed”.
You never told anyone these things. That is the unsettling part. You told a system your pin code, your grocery orders, the time you usually shop, and the brand of formula you once bought for your sister’s kid. The system did the rest. It made an inference A guess a system makes about you, from data you did give, to produce data you never did. Inference is where most of your datafolk is actually written. .
This is the most important thing to understand about the bazaar, and the proposal for this very book put it more bluntly than I could: much of the digital economy runs on inferences, not facts. Your datafolk is mostly guesses. Educated, profitable, occasionally wildly wrong guesses. The advertiser buying the “new mother” segment does not know you are a new mother. They know a machine is fairly confident, and fair confidence, sold at scale, is enough.
The inferences compound in ways that feel almost supernatural until you see the machinery. A well-worn story in the trade tells of an American retailer that worked out a teenager was pregnant, from nothing but shifts in what she bought, unscented lotion, certain supplements, and began sending her baby-product coupons before her family knew. Whether every detail is exact or the tale has grown in the telling, the mechanism is real and now ordinary: your basket is a confession you did not know you were making. In India, the same logic reads your UPI history, your Swiggy orders, your recharge patterns, and reaches conclusions you never stated out loud.
The Myth That Your Phone Is Listening
This is the right moment to deal with the theory everyone has: the phone is listening. You mention a trekking trip out loud; an ad for boots appears within the hour; it feels obvious, the phone must have heard you.
It almost never did. Continuous audio surveillance of a billion phones would be staggeringly expensive, technically noisy, and, given how well the alternative works, completely unnecessary. What actually happened is stranger and more revealing. The system already knew the trip was likely, from your recent searches, from your location lingering near an outdoor-gear store, from a friend booking the same route and your two datafolk being linked, from the season. It did not overhear you. It predicted you, and then an ad arrived at the exact moment you happened to also say the thing out loud, so your brain, which loves a clean story, connected the two.
That should be more disturbing than eavesdropping, not less. Eavesdropping needs you to speak. Inference does not. The bazaar can anticipate a desire you have not voiced, sometimes before you have fully admitted it to yourself, purely from the pattern of a life. The phone is not listening. It does not need to. It is reading, and you have been writing your whole life.
The Price of a Person
If your attention is being sold, it is fair to ask: for how much?
The unit of the trade is the impression One showing of one ad to one pair of eyes. Sold in bulk as CPM — the price of a thousand impressions. , one ad shown to one person once, and it is bought in thousands, priced as a “CPM”, the cost per mille. Most impressions are cheap, a few rupees for a thousand pairs of eyes, which tells you something bracing about the going rate for a stranger’s attention. But not all datafolk are worth the same. The auction paid pennies for you reading about the monsoon. It will pay a great deal more for you the week you start searching for a car, or a home loan, or a maternity hospital, because in those weeks your attention is attached to a decision worth lakhs, and a fraction of that decision is worth bidding hard for.
This is why the segments that feel most invasive are also the most valuable. “Idly curious” is cheap. “In-market for a car, this month, in a metro, with the income to buy one” is expensive, and the machines will pay to reach that version of you specifically. You are not uniformly priced. You are most expensive at the exact moments you are most vulnerable to being sold something, and the market knows those moments about you, sometimes, before you have told anyone.
The Middlemen Who Know Your Pin Code
Between you and the advertisers sits an entire industry whose customers are not people. They are the data brokers The middlemen of the data bazaar — companies that buy, merge, and resell profiles of people they have never met. , and their whole business is buying fragments of you from one place, merging them with fragments from another, and selling the assembled datafolk to anyone with a budget.
A loyalty card at a pharmacy. A discount in exchange for your phone number at a clothing store. A free app that wanted your contacts. A website that set a tracking cookie. None of these felt like a sale. Each was one. The pharmacy knows what you treat. The clothing store knows your size and your salary band. The app has your contacts. Sold, merged, and resold, these fragments become a single profile rich enough that a regulator once warned brokers may hold thousands of individual attributes on a single person, most of whom have no idea the broker exists.2
In India, this trade has been quietly enormous and, until recently, almost entirely unregulated. For years you could buy spreadsheets of names, numbers, and “HNI” (high-net-worth individual) tags in bulk, which is exactly why a stranger calls offering you a pre-approved loan and somehow already knows your employer. Your datafolk was on a list. The list was for sale. Nobody involved in the transaction had ever met you, and you were never paid a rupee for the thing being traded, which was you.
This is the part the law is finally trying to reach. The Digital Personal Data Protection Act, which we will meet properly in Chapter 6, is India’s first serious attempt to make selling that list a problem for the seller rather than only for you,5 to insist that your datafolk cannot simply be inventory to be moved without your knowing. Whether it works will depend on enforcement, but the principle is a genuine shift: the person in the spreadsheet is supposed to have a say now.
The Feed Is a Bazaar Too
Not everything in the bazaar costs money to win. Some of it is paid for in time.
Every feed you scroll, Instagram, YouTube, a shopping app’s homepage, is run by a recommendation engine The system that decides what you see next. It does not know what you want; it knows what kept people like you watching, and that is usually enough. , and a recommendation engine is just an auctioneer with a different currency. It does not ask advertisers to bid rupees. It asks content to bid for your attention, and the winning bid is whatever the system predicts will keep you there longest.
This sounds harmless, even helpful, until you notice what “keeps people watching” actually selects for. Outrage holds attention. So does anxiety. So does the slightly-too-extreme version of whatever you already believe. The engine has no opinion about any of this. It is not trying to radicalise you or sell you a diet. It is trying to win the next hundred-millisecond auction for your eyes, and it has learned, from billions of people like you, exactly which okra you cannot walk past.
And the two bazaars, the one that sells ads and the one that sells your time, are the same machine wearing two faces. Both run on the same profile of you. Both improve by knowing you better. The feed keeps you present so the auction has someone to sell; the auction funds the feed so it can keep you present. You are the product in one and the raw material in the other, and you experience both as a free service you rather enjoy, which is the most elegant part of the whole design.
When the Bazaar Sells More Than Raincoats
It would be comforting to think all of this is only about shopping, that the worst outcome is a badly-timed ad. The most consequential misuse of the bazaar proved otherwise, and it is worth remembering precisely because the machinery involved was utterly ordinary.
In 2018 it emerged that the profiles of tens of millions of Facebook users had been harvested and turned into psychological segments, then used to target political messaging, without those users’ knowledge or consent.3 No new technology was invented. The data was the same data the ad bazaar uses every day; the segments were the same kind of segments; the targeting was the same targeting that sells raincoats. Only the product being sold had changed, from raincoats to votes. A market built to sell you things can be pointed, without modification, at selling you beliefs, and it will run just as fast and just as invisibly.
Why This Matters
Here is the quiet trick of the whole arrangement: it is designed to feel like a service. The feed is convenient. The recommendations are sometimes good. The ad for the raincoat was, annoyingly, well-timed. None of this is a lie. It is a trade, and like most trades in a mandi, it goes better for the side that can see the whole market.
You cannot see the market. You cannot see your segments, your inferred attributes, the brokers holding your profile, the trackers that followed you here, or the price your attention fetched this morning. You see only the output: the ad, the reel, the offer. The auction stays invisible, and invisibility, as we said in the very first chapter, is just another word for a power imbalance.
But you now know the bazaar exists. You have watched an auction run. You know your datafolk is mostly inference, that it is sorted into labels you never chose, that it is recognised even after you clear your history, and that somewhere a list with your name and your pin code changed hands. That knowledge does not close the bazaar. It does something smaller and more useful: the next time an ad feels like it read your mind, you will know it didn’t. It read your data. And it guessed.
In the next chapter, those guesses get more ambitious. The bazaar only wanted to sell to you. The next system wants to predict you, to look at your datafolk and decide, before you have done anything, what you are likely to do. Your datafolk is about to meet the mirror.
Next: Mirrors That Predict, where your datafolk meets a reflection that claims to know your future, and occasionally gets it wrong in ways that cost you.