For the vast majority, it's demographics and interest based stuff. LinkedIn for example will keep lots of 1st party data to itself for it's own ad business but will share generic data like: female, 30s, IT engineer, new york, etc. This is how much of the ad targeting works. Trying to target a single person/identity just isn't easy, scalable or worth it so big overlapping buckets are used.

On the other side, specific identity data is also shared, called PII (personally identifying information), in a hashed format with other data networks. This is often used in retargeting by profile, an example being if a company wants to target all of it's current customers, it'll upload it's CRM database full of emails and data providers will match this up to cookies or other identifiers and let that company target these users with ads online. It's anonymized in that the advertising company doesnt know your identity, just that you're in this bucket of "XYZ email address list".

The way providers get to know your identity is major sites that share your profile data when you login, because they definitely know that it's you. LinkedIn will set a cookie when you login and then they'll have an API or data dump to other providers that can request your info or if you fit a bucket (in a hashed format).

Data is usually on a CPM (cost per 1000 impressions) basis although ranges widely from $1-$100 depending on quality and depth of targeting.