WorldFacebook knows your tastes so much that it can show you an...

Facebook knows your tastes so much that it can show you an ad just for you



Facebook ranks users by their interests. If a company wants to show ads to someone who likes motorcycles, is a vegan, drinks beer and vacations on beaches, the social network allows it. Now, a new study has just shown that these interests can taper until the final audience of an ad is a single user. A group of Spanish academics proved for the first time how simple and inexpensive it is to minimize the potential audience. Thus, an advertising tool can turn into a privacy nightmare.

Other studies have already shown that a small set of daily activities (location, card purchases) is capable of identifying an individual person. Facebook interests also allow this: with just 4 rare interests or 22 general ones it is possible to send an ad to just one of the more than two billion Facebook users worldwide. You rare interests include, for example, being a fan of the Puerta Bonita team, from the Carabanchel (Madrid) neighborhood, or a fan of a little-known musical group from the 1990s; generic interests include, on the other hand, Real Madrid, coffee and Italian food.

The novelty of this study is the ease with which an advertisement can be sent to a specific individual. “I wasn’t really surprised by the number of interests needed to identify a user,” says David García, a professor at the University of Technology in Graz, Austria. “What really surprised me is that we could do a campaign for just one individual. I expected Facebook to have a lot of controls, but the truth is, it was pretty easy,” he adds.

Privacy experts have read the results of this study with concern. Nor did they believe it was possible to reach such small groups of users. “It’s one of the 10 most important privacy scientific articles of the decade so far,” says Lukasz Olejnik, researcher and independent consultant on privacy issues. Facebook allowed microsegmentation by defining audiences very well. This experiment proves that it also allows for nano-segmentation, reducing ad focus to a minimum. “My surprise is that I didn’t believe that this type of targeting was ever possible: I thought the minimum audience would be greater than one, and that it was limited,” adds Olejnik.

What are the dangers of this? Imagination can fly. The article mentions the case of a man who sent messages to his wife a decade ago, but this route could also serve for unwanted approaches or for establishing communication when other channels are blocked. Ángel Cuevas, a researcher at the Carlos III University of Madrid and also co-author of the article, cites the following example. “If I have a customer who might be thinking about changing their supplier, I can currently send them a series of messages through Facebook, harming the competition,” he says. “These are more surgical things, which don’t necessarily have to do with an invasion of privacy. It can be used to blackmail oneself with a Facebook ad instead of phishing, and say: ‘I recorded you watching porn and you live in such a place’. Seeing this on Facebook would be shocking,” he adds.

Politics is another obvious candidate, according to Olejnik. “It could range from political advertising to disinformation and hacking, from the innocent to cyber wars,” he adds. The possible problem is the ideas that may occur to people who are engaged in such matters. “One thing is certain,” says Olejnik. “Anyone who knows how to overcome the minimum size of audiences will have really valuable knowledge. He will give advice for a lot of money.” The authors so far are skeptical, but they’ve already lectured for major US corporations and artificial intelligence departments.

The microscale ghost of something akin to the Cambridge Analytica scandal also looms large. “Since that scandal where the use of psychological profiles was apparently used to manipulate, believe it or not, there is a sector of the privacy and marketing world that says that’s how it is, that there is the ability to reach someone because it’s simpler to manipulate a individual only. There are studies that claim that the probability that a user will click on an ad when the campaign is highly profiled for that user increases significantly”, explains Cuevas.

Almost free campaigns

How much does it cost to do campaigns like this? Cents, or nothing at all. Facebook charges by the number of users reached, and these campaigns promote the opposite. “Some campaigns, especially highly targeted ones, cost us a few cents of a euro. In some, Facebook didn’t even charge us. When we combined seven interests, they charged us a lot. The total cost was 309 euros [2.000 reais]”, says Cuevas.

Regular Facebook users easily have a few hundred interests assigned. The article’s authors’ interests database comes from a tool they had for previous studies, voluntarily installed by Facebook users in their browser. The average number of interests in this user group is 426, but in total they add up to almost 100,000 different ones.

The company sees a substantive error in the article about how the ad system works. “The list of interests we associate with a person is not accessible to advertisers unless that person chooses to share them. Without this information or specific details that identify a person who has seen an ad, the researchers’ method will be useless for an advertiser trying to violate the rules,” says a company spokeswoman. The researchers ran the experiment with their own accounts to prove their thesis: they took all their interests, selected a random group and saw that with 22 of them there was a 90% chance of seeing a particular ad.

Facebook is right in claiming that knowing the interests of any individual is just as or more difficult than getting their email address. But it doesn’t take into account cases where someone is famous, known by the advertiser, or the small target community is individually anonymous but identifiable as a group. The researchers, furthermore, recall that they were forced to “do the experiment with one hand tied behind their back”, says Cuevas. “It was made with interests only, and the geographic reach is worldwide, but if I know your age, gender, where you live or work, I can start from a much smaller base population by starting to add interests, so I would still need to know less about you,” he adds.

Facebook warns advertisers if they choose an audience that is too small: “Try to make it wider,” reads a message. “But this is for informational purposes only; Facebook does not prevent the campaign from being carried out,” says Cuevas. Facebook should only effectively limit the minimum number of potential audiences. In the campaign results is where they saw that their ad had after all been seen by only one person. Facebook closed the researchers’ accounts a week after the experiment, about a year ago.

According to its authors, the article does not have a clear regulatory claim, but the implications of interests as personal data become evident. “These are personal data and should be included in the General Data Protection Regulation (RGPD) of the European Union, but our article does not pursue this”, says Cuevas. Another type of campaign on Facebook, which uses users’ email or cell phones, requires their authorization, but not with interest segmentation: “At no time do you need to ask permission to gather interests. We didn’t find this on the many cool Facebook pages. From the RGPD’s point of view it’s something else: if a data protection agency investigates, it might say that gathering 20 interests from a user means you have to treat it as personally identifiable information. We try not to get bogged down in a debate over legal terms,” explains Cuevas.

This concreteness in the platforms is still to be explored, although the European Union is already debating the limitation of microsegmentation in some areas. The amount of individual information that major platforms have about their users gives them many options. “I don’t know if Amazon can do the same thing we did on Facebook, but Amazon may have data to infer your interests to the point of identifying you individually, and then run a Facebook campaign to advertise just for you,” says García.

sign up on here to receive the daily newsletter of EL PAÍS Brasil: reports, analyses, exclusive interviews and the main information of the day in your e-mail, from Monday to Friday. sign up also to receive our weekly newsletter on Saturdays, with highlights of coverage for the week.