Google says they don't sell personal information [1], and I've never heard a credible source say that they bought any. It doesn't stop people from making all sorts of claims, though.
If Google uses cookie based ad tracking, how do they prevent others from reading the cookies?
TechCrunch certainly implied that Google's approach shared information in a way that Apple's former iAd platform did not back in the day.
>what [iAd] reveals to its advertising partner is next to nil; rather than offering a cookie-based ad-tracking and targeting mechanism, it essentially requires partners to tell it what kind of audience it needs to reach, and then trust that Apple will handle the rest, AdAge says. And it’s well worth noting that Apple prioritizes customer privacy here over a big potential upside in ad revenue.
...what it doesn’t do is hand over the keys to all that data and let advertisers plug into it directly with their own data-mining and targeting software. That’s not standard for the ad industry and that’s likely the reason a few Madison Avenue feathers are ruffled over their approach.
[1] https://safety.google/privacy/ads-and-data/