The most common behavior people observe that makes them think companies are selling their data is when they visit some site P that sells widget p and then on completely unrelated site Q they start seeing ads for p. The obvious conclusion to draw is that Q now knows they visited P. In reality, ad broker X knows the user visited P, and is satisfying queries from Q (really, from the user agent visiting Q) by vending ads for p to the user agent that is displaying site Q's content alongside that ad. But the ad and Q's content are generally sandboxed from each other the same way that your bank account login state is sandboxed from Q also (1). In reality, Q has no idea the user has visited P, but the content on the page strongly suggests that Q does.
(1) note: It is possible there are holes in the security model that an unscrupulous Q could use to gather information on a user about their history on P; that's generally considered a violation of the ad vendor's policy and will get Q kicked off the ad network.