> "A: The only information websites had access to is your mobile number, which could not have been linked to any other identifying information we have about customers."

The problem here is not that it was only the mobile number, rather that these sites are able to link your mobile number to the content that you have viewed. There's a scenario here in which sites that had collected this information could publish (or otherwise leak, i.e. through hacking) lists of mobile numbers to URLs visited.

In an age of lax privacy protections and data-sharing it's not hard to obtain people's mobile numbers. What would happen when a potential employer googles your mobile phone number and finds the crawled data?

Steps we now need to take:

1) Some kind of request to get the full list (Subject Access Request under DPA, as pointed out below?)

2) If there is no opt-out process, lodge a Data Protection complaint to the ICO