Some are claiming that clickstream data is readily available for sale from many ISPs.
They say that the data is anonymized, but if you have any online presence, it's extremely likely that your clickstream skews heavily towards your own stuff, and probable that urls you visit will have your username in them.
I've also got a post up explaining this: Link.
Boing Boing editor/partner and tech culture journalist Xeni Jardin hosts and produces Boing Boing's in-flight TV channel on Virgin America airlines (#10 on the dial), and writes about living with breast cancer. Diagnosed in 2011. @xeni on Twitter. email: email@example.com.