Investigating sources of PII used in Facebook’s targeted advertising

By Giridhari Venkatadri, Elena Lucherini, Piotr Sapiezynski, Alan Mislove. 2018

56 citations recorded by the source corpus.

Online social networking services have become the gateway to the Internet for millions of users, accumulating rich databases of user data that form the basis of their powerful advertising platforms. Today, these services frequently collect various kinds of personally identifying information (PII), such as phone numbers, email addresses, and names and dates of birth. Since this PII often represents extremely accurate, unique, and verified user data, these services have the incentive to exploit it for other purposes, including to provide advertisers with more accurate targeting. Indeed, most popular services have launched PII-based targeting features that allow advertisers to target users with ads directly by uploading the intended targets’ PII. Unfortunately, these services often do not make such usage clear to users, and it is often impossible for users to determine how they are actually being targeted by advertisers. In this paper, we focus on Facebook and investigate the sources of PII used for its PII-based targeted advertising feature. We develop a novel technique that uses Facebook’s advertiser interface to check whether a given piece of PII can be used to target some Facebook user, and use this technique to study how Facebook’s advertising service obtains users’ PII. We investigate a range of potential sources of PII, finding that phone numbers and email addresses added as profile attributes, those provided for security purposes such as two-factor authentication, those provided to the Facebook Messenger app for the purpose of messaging, and those included in friends’ uploaded contact databases are all used by Facebook to allow advertisers to target users. These findings hold despite all the relevant privacy controls on our test

Subfields: Information Systems, Information Systems and Management, Sociology and Political Science

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

1. Kobbi Nissim
2. Amos Beimel
3. Alan Mislove
4. Aleksandra Korolova
5. Krishnaram Kenthapadi
6. Thanh T. L. Tran

In Information Systems and Management

1. Aleksandra Korolova

In Sociology and Political Science

1. Aleksandra Korolova
2. Kobbi Nissim
3. Amos Beimel
4. Alan Mislove
5. Piotr Sapiezynski
6. Or Sheffet
7. Uri Stemmer
8. Vitaly Feldman

Citations in the corpus

• The power of synergy in differential privacy: Combining a small curator with local randomizers (2019, background): “Personal data collected by companies can be breached [21]; subpoenaed by law enforcement in broad requests [44]; mis-used by companies’ employees [37, 20]; or used for purposes di ff erent from those announced at collection time [64].”
• Discrimination through Optimization (2019, background): “• Personal information: Alternatively, Facebook allows advertisers to specify the exact users who they wish to target by either (a) uploading the users’ personally identi able information including names, addresses, and dates of birth [30, 72, 73], or (b) deploying web tracking pixels on third-party”