The whole point is to not use 3P data, so that's definitely not involved.
I'm not sure which details are public at this point, but this is done entirely within the confines of the publisher-reader relationship.
Experian, ew.
Also, for the record, I know that people have a hard time hearing it but privacy and monetisation aren't opposites. You can actually seek to optimise for both.