You asked where do they get the data from… well, that’s the answer 🤷

The numbers could be fictitious (you didn’t ask whether they get “reliable data”), or they could be doctoring them themselves… but there is a number of companies whose work is to let sites put trackers that gather user data, so they can in turn use it as a point when luring advertisers.

It isn’t “highly guarded confidential” information, websites would happily submit their access logs if that could make them look more appealing to advertisers… but they don’t, because: a) they could be sending fake data, which would make the aggregating company lose face, meaning they won’t accept self-reported data, and b) site logs contain a lot of users’ personal information, sharing which could fall afoul of privacy legislation.

They may still have to pay for access to parse that data, or extract it from the data made publicly available (…which could still be doctored, but 🤷)