Most websites state or imply in their privacy policies that they share data with affiliates. However, they do not specify who these affiliates are. We sent messages to each of the top 50 websites and requested a list of all affiliates with whom they share user data.
Expecting that most of them would not respond with this information, we also searched for affiliate information in the Mergent Online database to discover parent companies and all the subsidiaries listed under that parent, including foreign offices. Based on these lists we got a general sense of the potential number of affiliates each company could share data with according to their policies. The lists did not contain subsidiaries of subsidiaries, so each company's family of affiliates could be much larger than he numbers we compiled.
This data could only be found for publicly-traded companies. Privately-controlled companies do not have to disclose this kind of corporate information.