Speaking of carriers, some have been known to inject IDs into their users' requests, so that site owners can later buy those profiles from them: https://arstechnica.com/information-technology/2014/10/veriz...

That's one way to get that data.