They aren’t just tracking you. They’re tracking who your friends are.

The Internet is buzzing with advertising firms that follow Web users from site to site, and now there’s a twist: technology that figures out who you share news and ideas with.

The idea is called “social retargeting,” and it works by mapping people’s social connections when they use certain sharing apps or send links in e-mail. The idea is to let advertisers note people who’ve expressed interest in a product (say, by viewing a dress on Macys.com) and then aim ads at that person’s friends, family, or acquaintances as well.

Call it automated word-of-mouth advertising. For any brand, the next customer is usually somebody who knows a current customer. “If you have a million people that went to a credit card site, then we figure out who they share with and we get seven million people,” explains Gurbaksh Chahal, founder and CEO of RadiumOne, a San Francisco company that specializes in using social data to target ads. Chahal sold a previous ad startup, BlueLithium, to Yahoo for $300 million in 2007.

RadiumOne’s technology is a tweak on widely used techniques that show people ads on the basis of their browsing history. For instance, a person who visits Lamps.com might later see ads for lamps while surfing other sites. Such “behavioral” ads are highly effective. But because people spend so much time on social-media sites, advertisers now want to use social information too.

The trick is how to obtain social data even if you’re not Twitter or Facebook. RadiumOne does it partly with a variety of free widgets, like the link shortener re.Po.st, as well as PingMe, an app for chat and messaging that it circulates on the Web. It’s a Trojan horse strategy. “Every time you share an article, that is how we figure out who you are connected with. We expand the funnel,” says Chahal.

Facebook, the world’s largest social network, still lets advertisers use only small slices of the data it collects to target ads, and only within its own pages. That’s what has created opportunities for startups including RadiumOne, Sharethis.com, Media 6 Degrees, 33Across, and others that cobble together social data on what is termed the “rest-of-Web.”

What’s more, many consumers react badly to ads that appear inside social media, says John Montgomery, chief operating officer of GroupM, a company that manages around $80 billion in advertising dollars (including $7 billion spent online) for clients including AT&T. Social retargeting uses technology to mine social connections but show the ads in more appropriate contexts. “Advertising is much less welcome on the social graph than anywhere else,” says Montgomery.

Ad technology that tracks Web surfers is at the heart of today’s online privacy debate. Individuals are often unaware that their habits are being monitored, and ad firms rarely ask for permission before placing so-called tracking cookies in a person’s browser. It can seem creepy to many people, and companies that show you a BMW ad because they somehow know your college roommate wants one could seem creepier still.

Allie Kline, chief marketing officer at New York–based 33Across, says online advertising—even the sort that tracks social connections—doesn’t justify the fears that surround it. “The kind of advertising that we run, on the scale of privacy, is at a 1 or a 2 compared to catalogues who are selling your physical address,” she says. “The paranoia is all because it’s the Internet.”

Despite threats of regulation, money has poured into online advertising companies. 33Across has raised $11 million, while RadiumOne has raised $33.5 million. Altogether, professional investors have sunk a total of $6.7 billion into private advertising startups since 2007, according to Dow Jones VentureSource—$1.5 billion of it in 2011.

Thanks to the efficiency of Web and database technologies, even small ad outfits are able to track staggering numbers of people. 33Across, for instance, says it has its cookies installed in 1.25 billion browsers at any given time, leading the 81-person company to claim more “users” than even Facebook or Google.

Kline says 33Across purchases data about people’s sharing habits from smaller social networks. She declined to name those sites, saying they don’t want to be identified. Technology Review found that 33Across’s technology is present on Web pages including Lockerz.com (a photo-sharing page) and the dating site OKCupid.

This year, 33Across also purchased Tynt Multimedia, known as the “copy and paste” company. Its service is used by scores of publications, including Sports Illustrated and the New Yorker. Every time a person pastes article text from those sites into an e-mail or other application, the technology appends a URL to the copied text. If anyone clicks on such a link, 33Across records a social connection to the person who sent it.

33across, like RadiumOne, says it doesn’t know the identity of the people it is tracking. It never collects names, Social Security numbers, or other personally identifiable information. In fact, it treats people not as individuals but as examples of any of about 250 consumer types, like soccer moms or “heavy sharers.” Individuals are assigned to one of these groups in mere instants, Kline says.

“It’s ‘Can I categorize you into a group that is saleable?’ And if not, good-bye,” says Kline. “I don’t know who you are. You are just a number in an algorithm.”