It’s happened time and time again. You’ve just been looking at a product on your phone, you open Facebook on your computer, it shows you an ad for that exact same product.

Ad targeting from Facebook is so eerily accurate, people have begun to believe that Facebook is somehow listening to them through their phone. But Facebook has said time and time again it does not use microphones on people’s phones to listen to conversations.

So what’s really going on?

Let’s look at this real scenario that happened to an editor at CNBC. He was looking at a furniture retailer’s website for bed frames on his iPad, and mentioned it out loud to his wife. His wife opened her computer and went to Facebook, where she saw an ad for that specific furniture retailer.

We talked to several sources who are familiar with Facebook’s advertising technology to see how this could have happened. Here are several possibilites.

1. The furniture retailer asked its ad be shown to a certain demographic, and she fit the bill.

Businesses can show Facebook ads to people within certain parameters. This targeting can get pretty specific, down to a 1 mile radius of an address. Facebook is also testing household targeting, meaning some advertisers have the option to reach family members in addition to the initial target customer.

The methods are “completely compliant” with the law, said Havas Media’s agency Socialize executive vice president and managing director of North America Jess Richards.

“It allows advertisers, if they are doing it right, to be more relevant based on the information they know,” she said.

So, let’s say the editor’s wife listed herself as a female, her birthdate and the city she lives in on her Facebook profile. The furniture retailer was looking to show an ad to women in her age group in the New York metro area, and showed her the ad. The fact that her husband had just been talking about it was coincidental.

It could also be the furniture retailer intended to target someone who fit the description of her husband, and she was simply part of the householding targeting test. She would also receive the ad.

2. She showed interest in the subject matter by her activity on or off Facebook.

Facebook knows what you like and post on its platform. From that, it determines what ads it thinks you’ll like.

But it can also figure out what other sites you browse as long as you remain logged in on that device. It does this courtesy of tiny pixels publishers and businesses embed in their websites. These dots send a message back to Facebook when you visit — the technology is called Facebook Pixel. It allows companies to target people based on other sites they previously looked at.

You can see which sites have Facebook Pixels using the company’s Chrome extension.

DigitasLBi vice president and group director of paid social Jeanne Bright gives an example.

Say a person was looking at jackets on Nordstrom from their mobile phone while they were logged into the Facebook app. Then they open their computer to Facebook and sees ad from Nordstrom.

“They are able to get a ping if I’m logged into Facebook that I opened a new tab in a my browser, and see I was browsing for a jacket,” explained Bright. “Nordstrom now ‘knows’ through anonymized data I was looking at jackets, and serves (everyone who had looked on their site for jackets) an ad.”

In this case, the editor’s wife may have visited that same furniture retailer’s website at an earlier date, or visited other similar websites, while she was logged in to Facebook. She may have also liked the retailer or other furniture pages on Facebook. The business knows she’s looking for furniture, so they serve her an ad.

3. The furniture company specifically targeted her.

Facebook allows companies to upload email lists of specific users they want to see their ads. Businesses usually use this to re-target customers who had previously purchased items.

They could also know a customer’s Facebook ID if they used that same email to log into the furniture retailer, or used Facebook directly to log into that site. Or, someone the household could be on the company’s list, and that company may choose to serve its ads to everyone in the household.

Havas’ Richards said targeting “coming from a single data point like email” is one of the most plausible reasons why the editor’s wife saw the ad.

Here the editor may have logged into the retailer’s website using the same email he uses for his Facebook account. The company uploaded his email into Facebook and told Facebook to show the ad to everybody in his household.

4. He used her device to look at the product.

Many households share devices, whether it’s using the computer that is closest to you or watching on the same digital media player like a Roku or Apple TV. If people remain logged into Facebook on that device, the company has access to multiple people’s browsing history. Facebook is also excellent at tracking behavior across devices, since people use the same log-in on different devices.

So let’s say the editor had previously used his wife’s computer to look at the bed frames. If his wife had never signed out of her Facebook account, Facebook thinks she was looking at the bed frames web site, then serves this ad on her computer the because it thinks she’s interested in the company.

Or, perhaps the husband’s iPad was logged into the wife’s Facebook account when he was looking at the bed frames. Facebook would assume she was the one looking, and show her the relevant ad on other devices where she was logged in — in this case, on her computer.

Advertisers sometimes work with third-party marketing services like Axiom, Datalogic or Epsilon to find the right customer. These companies use a variety of data sources like credit card information and other consumer behavior, and provide information that can be integrated with Facebook or any other advertising platform to target someone.

“Let’s say we want to reach someone who is a high grocery purchaser,” Bright explained. “Axiom gets data from grocery store loyalty numbers, matches that to an individual and passes that hashed information to Facebook.”

Third-party data collectors focused on 360-degree connectivity may also be able to connect behavior on multiple devices that share email logins. If you use the same email to log into your internet provider and Facebook, they may be able to collect information on your shopping habits across devices.

That third-party information can also be used to target households. Facebook accounts have enough information through relationship statuses, pictures and interactions to determine who lives in the same household. (The advertisers don’t get access to this invidualized information.)

In this scenario, the furniture retailer might have hired a third-party company to find anyone who is a new homeowner, since those people are likely to need furniture. It just so happened the editor and his wife had recently bought a new house. Their names could have been anonymized and put on an advertiser’s list that was uploaded to Facebook. Facebook served everyone on that list an ad, and she saw it.

We are shown hundreds of ads a day, most of which we gloss over. It could just be fate that an ad showed up while they were talking about the company.

“The fact you talked about it makes you more likely to notice it,” Bright said. “People are seeing hundreds of advertisements a day, but they aren’t noticing what all of them are for.”

None of these methods are unique to Facebook, Bright pointed out.

“The things that Facebook does is pretty common to other digital advertisers,” she said. “Everything we talked about, Google does it too.”

If you’re still freaked out, you can see why you are shown any sponsored post on Facebook by clicking on the three dots on the upper right hand corner, and selecting the “Why am I seeing this ad?” option. It doesn’t always give exact details, but you can see what it tells you and figure out pretty quickly what makes sense.

For instance, in this screenshot, Facebook says it’s showing me a Barkbox ad because I use the same email address to log into Barkbox that I use on Facebook. Barkbox wants to reach me specifically on Facebook (example 3 above) and so it targets an ad to me using that email address.