I would sooner put it down to the 500 no-name data collection companies that come up when you look at a website's GDPR/cookie disclosures. The ones with ever-so-subtle descriptions like "Matches online activity with offline accounts."