How did my browsing choices reach an Alibaba seller?

Question

Events, spaced about evenly over 2 months:

1. Repeatedly ordered small amounts of webbing on a rather reputable Polish site (Allegro.pl, much like ebay).

2. Got targeted ads in Skype for webbing on Alibaba.

3. Clicked an ad (90% certain it was from Skype, else from targeted ads on some programming site) to see what the hell the image was showing; browsed for a few minutes. I was signed in on AliExpress at the time.

4. Received an unsolicited "we have webbing sling you may have interests" message, catalogue and quotation (80% complete order, just click "confirm order") from a seller on Alibaba

I have Windows 8 with ESET Endpoint Antivirus, Chrome browser, and gmail for the correspondence. All relatively up-to-date and showing no signs of being compromised. Purchases had been made on a computer with Ubuntu; no hijacks found.

That's all that feels relevant so far.
How did the seller know who to spam with this? Does Alibaba grant sellers access to a list of visitors? Was there some script on the listing or ad?

Answer 1

There are many ways that advertisers can track you across different sites.

1. As mentioned here, Skype displays Google ads. In Google's Terms of Service, they state:

Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. This analysis occurs as the content is sent, received, and when it is stored.

This is a likely culprit as Google could have used your Gmail account to use an invoice from Allegro.pl to target you ads. Since 96% of Google's revenue comes from advertising, Google constantly shares your information with 3rd parties such as Alibaba.

2. Another option is through the use of tracking cookies - also known as persistent cookies. If you are interested in how they can be used to track you across the web, EFF has published an article on how they are used in the case of Facebook, which has similar tracking practices to Google.

3. A third option is through browser fingerprinting, which can track browsers through configuration settings. You can check if your browser can be uniquely fingerprinted via Panopticlick. The about page of the Panopticlick research project states:

When you load a web page, you will automatically broadcast certain information about your browser to the website you are visiting — as well as to any trackers embedded within the site (such as those that serve advertisements).

The site may then create a type of profile of you, tied to this pattern of characteristics associated with your browser, rather than tied to a specific tracking cookie.

If you are interested in reducing the likelihood of this kind of tracking in the future, you may want to install the browser addon Privacy Badger or Ublock Origin which will block connections to tracker domains. For more advanced control, try UMatrix.