It's a fairly common practice now (not the spam, I've gotten spam email clearly triggered by a re-targeting campaign but as far as I know it is not a widespread thing).

The basic pattern is: Get user to trigger re-targeting campaign, use re-targeted ads to read a tracking cookie or browser fingerprint from the user, use that to look up user info in your customer profile database you bought (or bought API access to) from a data broker, send targeted email, package up your new piece of customer profile data (Walter Kirn went to an art gallery in Hollywood) for later resale/trade.

The specifics for each step change all the time.

The author wrote this piece in a style where he defaults to paranoia in the face of all coincidences to mirror the subject matter so it was not an accusation. But this one is actually feasible.