Often you get the data in aggregate, bought and sold as an “audience”. It’s a Boolean flag if a person in the audience. Basically an array of IDs for people in the audience (true).
Almost always the data seller masks the ID of people in the audience to the buyer. This then creates opportunity for third party “matching services” or “identity resolution” who can de-anonymize, link, and re-anonymize. Link audiences together, e.g. flies to Bahamas often AND lives in the US North East AND has a mortgage.
Facebook and Google’s success relies heavily on simplifying huge amounts of the programmatic advertising backend, but the audience selling is still a huge part of the industry, like Acxiom et al.
Much of this buying and selling of data within the paid advertising industry hides in plain sight because it goes by so many names - contextual targeting, relevancy data, media enrichment, lead enhancement, blah blah blah...