6 ms·

Researchers show Facebook’s ad tools can target a single user

120 points by elorant 5y ago

david422 5y ago
This guy already discovered this: https://ghostinfluence.com/the-ultimate-retaliation-pranking-my-roommate-with-targeted-facebook-ads/ https://ghostinfluence.com/the-ultimate-retaliation-pranking...
- spurgu 5y ago
  Came here to post this. Also, can't read Techcrunch articles because they're blocked (by NextDNS) due to redirecting through https://guce.advertising.com/ https://guce.advertising.com/
- thedevelopnik 5y ago
  Yeah like 7 years ago I was thinking about moving into a marketing role and bought a book on social media. The introduction included a bit where the author bought a Facebook ad wishing his wife a happy anniversary because he could target her so precisely.
- brianswichkow 5y ago
  OP of the aforementioned Facebook Ads Prank here. Thank you for remembering it all these years and sharing it here! Yes, it was discovered 7 years ago (by many) and Facebook has continually lied about it being patched. Here's a more recent overview of all their lies regarding micro-targeting: https://thetyee.ca/News/2019/05/07/Facebook-Privacy-Busting-Bug/ https://thetyee.ca/News/2019/05/07/Facebook-Privacy-Busting-...
geoduck14 5y ago
Serious question: While you can target a SINGLE person, the targeting doesn't tell you who that person is. So, I can target my wife - but I already knew who she was. Also, I can target someone using 18 parameters, but I don't actually know who that person is unless they click on my add and tell me "this is who I am". So: does this violate privacy laws?
- twright 5y ago
  Maybe. I'm not a lawyer, but it's unlikely that you make your friends sign NDA's to prevent them from selling metadata about you so firms can nanotarget ads at you. I hope most would consider it to be unethical. The concern that immediately comes to mind is that this nanotargeting ability could be abused by (just to name a few) spiteful ex-partners, stalkers, internet trolls, and generally vengeful unpleasant people.
- elorant 5y ago
  What if you're a stalker though? You can target a person by his/her e-mail address or phone. Facebook used to allow you to target as little as 20 persons. I don't know if this still holds true. So you enter 19 fake e-mails and the one you're interested in targeting. So eventually only a specific person will see your ad.
- amelius 5y ago
  Assume you target an ad for an adultery service to your wife. Assume she clicks the ad. Then the service (a mock-up you built) will ask her for her name and other information. Assume she gives the service this information. Now you know that your wife is interested in adultery. Interestingly, there is a different way to go about it. Assume you create an ad for diamonds, and target it to people who are into adultery. Your wife, who likes diamonds, sees the ad, clicks it, and fills in her information on the diamonds website (a mock-up you built). Now again, you know that your wife is interested in adultery. But she is unaware that she even revealed this information in her transaction with the "diamond" website. She wrongfully assumed that all the private information she shared with FB stayed on FB's servers only. Note that this leak also exists in Google.
- proc0 5y ago
  Have we not learned to assume the worse from these institutions/corporations yet? Again and again it's proven they will go as far as they're able to. Unless there is proof they DON'T do this, like some law that is clearly enforced, or some piece of code that mathematically prevents it from doing so... I think it is more than safe to assume they can and they have violated privacy concerns.
benreesman 5y ago
Leaving aside the morality, one huge objection to this level of targeting granularity is that it’s just bad business. Obviously a gross oversimplification, but to a first approximation ads ranking, pacing, and auction drive ads revenue. Ads targeting drives careers, at least at FB at least as of a few years ago. The creepy factor does way more damage to FB’s business than the bells and whistles that the buyers of inventory use adds to it. When something happens on Google, people feel like it happened in their living room. When something happens on FB, people feel like it happened in their bedroom.
- pixelgeek 5y ago
  > The creepy factor does way more damage to FB’s business than the bells and whistles that the buyers of inventory use adds to it. They helped to create a genocide in Burma. If people didn't leave after that then I doubt any "creep factor" is going to hurt their business.
- Nextgrid 5y ago
  Facebook and other ad platforms are just milking the cash cow as much as possible until it is not no longer possible because of regulation. However, regardless of privacy laws and other issues with advertising, this particular kind of abuse could be prevented by displaying how many people fall into that ad's targeting criteria and how much this advertiser has spent in the last year. Legitimate ads will typically target a large amount of people and would've spent significant amounts, where as "gaslighting" ads like these would typically reach very few people and the advertiser would've spent a relatively low amount in comparison.
- Hokusai 5y ago
  > The creepy factor does way more damage to FB’s business than the bells and whistles that the buyers of inventory use adds to it. Facebook incited a genocide in Myanmar. PR is not in their list of worries.
pixelgeek 5y ago
Of interest is that my blocker stopped 45 tracking elements on that Techcrunch article.
- spurgu 5y ago
  I'm unable to even arrive at the site: https://news.ycombinator.com/item?id=28888748 https://news.ycombinator.com/item?id=28888748 :D
  - pixelgeek 5y ago
    Well thank your DNS for that then :-)
stuaxo 5y ago
This was famously used to target Jeremy Corbyn. Labour staffers working to prevent their own party winning under him were not posting the adverts they were meant to, but were able to use geofencing and other specifiers so it looked like everything was it should be when he was browsing. https://www.thetimes.co.uk/article/labour-hq-used-facebook-ads-to-deceive-corbyn-3hvn0jzr8 https://www.thetimes.co.uk/article/labour-hq-used-facebook-a...
yellow_postit 5y ago
Here’s the link to the paper on arXiv: https://arxiv.org/abs/2110.06636 https://arxiv.org/abs/2110.06636 as I didn’t find it in the TechCrunch article.
doctor_eval 5y ago
It’s so frustrating that our political institutions, who are supposed to act for our collective benefit, are so incredibly useless. We’ve known unambiguously about the impact big business had had on our climate, yet it took decades for governments to act decisively - mine still hasn’t. We knew about the hazards of smoking for decades before government acted decisively, despite the enormous costs to society. In many cases these companies continue to be allowed to sell their shit, despite knowing that it’s not just addictive, but also toxic. Asbestos, leaded fuel, road safety, and many other large problems were left unregulated for decades, and in all cases a small number of corporations profited - often marginally - at the expense of thousands or even millions of individuals. And now we see the same with Facebook. We’ve known for more than a decade that Facebook is a toxic waste pit of information. There is much that could be done, and much more quickly, but our politicians sit on their fat arses and do Jack shit. Without effective democracy we have no way to resolve these problems because the whole reason we have a democracy in the first place is to ensure these powerful bastards work in the best interest of everyone. If King Zuckerberg is more powerful than his parliament of lapdogs, then democracy is dead. /rant
kristo 5y ago
I did this to send someone a birthday message in 2010 or so.
rmbyrro 5y ago
At the bottom of the problem is that people are addicted to such disrespectful and careless platforms. Why would we get addicted to such evil? What's wrong with our minds, are we doing something wrong and can we teach next generations to be better than ourselves?
nemoniac 5y ago
Reading the article on which this is based (https://arxiv.org/abs/2110.06636 https://arxiv.org/abs/2110.06636), the researchers don't appear to specify how they randomly select the 25 interests from the interests assigned to a user. This could have a considerable effect on their results, leading to a number somewhat higher than 22. The random selection could be uniform or it could be weighted by the global popularity of the interests. Presumably it's uniform. But if so, you could challenge the reasonableness of that assumption since it would be more likely to know a more common interest of a user that one in the tail of the distribution. For example, suppose I have three interests, two of which are very common and one of which is extremely niche. If you select two of these interests uniformly at random, chances are you'll get the niche one and be highly likely to identify me. OTOH if you randomly select weighted by the global popularity of the three interests, chances are that you'll get the two common interests and be very unlikely to identify me.

120 points by elorant 5y ago

This guy already discovered this: https://ghostinfluence.com/the-ultimate-retaliation-pranking-my-roommate-with-targeted-facebook-ads/ https://ghostinfluence.com/the-ultimate-retaliation-pranking...

spurgu 5y ago
Came here to post this. Also, can't read Techcrunch articles because they're blocked (by NextDNS) due to redirecting through https://guce.advertising.com/ https://guce.advertising.com/
thedevelopnik 5y ago
Yeah like 7 years ago I was thinking about moving into a marketing role and bought a book on social media. The introduction included a bit where the author bought a Facebook ad wishing his wife a happy anniversary because he could target her so precisely.
brianswichkow 5y ago
OP of the aforementioned Facebook Ads Prank here. Thank you for remembering it all these years and sharing it here! Yes, it was discovered 7 years ago (by many) and Facebook has continually lied about it being patched. Here's a more recent overview of all their lies regarding micro-targeting: https://thetyee.ca/News/2019/05/07/Facebook-Privacy-Busting-Bug/ https://thetyee.ca/News/2019/05/07/Facebook-Privacy-Busting-...

geoduck14 5y ago

Serious question: While you can target a SINGLE person, the targeting doesn't tell you who that person is. So, I can target my wife - but I already knew who she was. Also, I can target someone using 18 parameters, but I don't actually know who that person is unless they click on my add and tell me "this is who I am". So: does this violate privacy laws?

twright 5y ago
Maybe. I'm not a lawyer, but it's unlikely that you make your friends sign NDA's to prevent them from selling metadata about you so firms can nanotarget ads at you. I hope most would consider it to be unethical. The concern that immediately comes to mind is that this nanotargeting ability could be abused by (just to name a few) spiteful ex-partners, stalkers, internet trolls, and generally vengeful unpleasant people.
elorant 5y ago
What if you're a stalker though? You can target a person by his/her e-mail address or phone. Facebook used to allow you to target as little as 20 persons. I don't know if this still holds true. So you enter 19 fake e-mails and the one you're interested in targeting. So eventually only a specific person will see your ad.
amelius 5y ago
Assume you target an ad for an adultery service to your wife. Assume she clicks the ad. Then the service (a mock-up you built) will ask her for her name and other information. Assume she gives the service this information. Now you know that your wife is interested in adultery. Interestingly, there is a different way to go about it. Assume you create an ad for diamonds, and target it to people who are into adultery. Your wife, who likes diamonds, sees the ad, clicks it, and fills in her information on the diamonds website (a mock-up you built). Now again, you know that your wife is interested in adultery. But she is unaware that she even revealed this information in her transaction with the "diamond" website. She wrongfully assumed that all the private information she shared with FB stayed on FB's servers only. Note that this leak also exists in Google.
proc0 5y ago
Have we not learned to assume the worse from these institutions/corporations yet? Again and again it's proven they will go as far as they're able to. Unless there is proof they DON'T do this, like some law that is clearly enforced, or some piece of code that mathematically prevents it from doing so... I think it is more than safe to assume they can and they have violated privacy concerns.

benreesman 5y ago

Leaving aside the morality, one huge objection to this level of targeting granularity is that it’s just bad business. Obviously a gross oversimplification, but to a first approximation ads ranking, pacing, and auction drive ads revenue. Ads targeting drives careers, at least at FB at least as of a few years ago. The creepy factor does way more damage to FB’s business than the bells and whistles that the buyers of inventory use adds to it. When something happens on Google, people feel like it happened in their living room. When something happens on FB, people feel like it happened in their bedroom.

pixelgeek 5y ago
> The creepy factor does way more damage to FB’s business than the bells and whistles that the buyers of inventory use adds to it. They helped to create a genocide in Burma. If people didn't leave after that then I doubt any "creep factor" is going to hurt their business.
Nextgrid 5y ago
Facebook and other ad platforms are just milking the cash cow as much as possible until it is not no longer possible because of regulation. However, regardless of privacy laws and other issues with advertising, this particular kind of abuse could be prevented by displaying how many people fall into that ad's targeting criteria and how much this advertiser has spent in the last year. Legitimate ads will typically target a large amount of people and would've spent significant amounts, where as "gaslighting" ads like these would typically reach very few people and the advertiser would've spent a relatively low amount in comparison.
Hokusai 5y ago
> The creepy factor does way more damage to FB’s business than the bells and whistles that the buyers of inventory use adds to it. Facebook incited a genocide in Myanmar. PR is not in their list of worries.

pixelgeek 5y ago

Of interest is that my blocker stopped 45 tracking elements on that Techcrunch article.

spurgu 5y ago
I'm unable to even arrive at the site: https://news.ycombinator.com/item?id=28888748 https://news.ycombinator.com/item?id=28888748 :D
- pixelgeek 5y ago
  Well thank your DNS for that then :-)

stuaxo 5y ago

This was famously used to target Jeremy Corbyn. Labour staffers working to prevent their own party winning under him were not posting the adverts they were meant to, but were able to use geofencing and other specifiers so it looked like everything was it should be when he was browsing. https://www.thetimes.co.uk/article/labour-hq-used-facebook-ads-to-deceive-corbyn-3hvn0jzr8 https://www.thetimes.co.uk/article/labour-hq-used-facebook-a...

yellow_postit 5y ago

Here’s the link to the paper on arXiv: https://arxiv.org/abs/2110.06636 https://arxiv.org/abs/2110.06636 as I didn’t find it in the TechCrunch article.

doctor_eval 5y ago

It’s so frustrating that our political institutions, who are supposed to act for our collective benefit, are so incredibly useless. We’ve known unambiguously about the impact big business had had on our climate, yet it took decades for governments to act decisively - mine still hasn’t. We knew about the hazards of smoking for decades before government acted decisively, despite the enormous costs to society. In many cases these companies continue to be allowed to sell their shit, despite knowing that it’s not just addictive, but also toxic. Asbestos, leaded fuel, road safety, and many other large problems were left unregulated for decades, and in all cases a small number of corporations profited - often marginally - at the expense of thousands or even millions of individuals. And now we see the same with Facebook. We’ve known for more than a decade that Facebook is a toxic waste pit of information. There is much that could be done, and much more quickly, but our politicians sit on their fat arses and do Jack shit. Without effective democracy we have no way to resolve these problems because the whole reason we have a democracy in the first place is to ensure these powerful bastards work in the best interest of everyone. If King Zuckerberg is more powerful than his parliament of lapdogs, then democracy is dead. /rant

kristo 5y ago

I did this to send someone a birthday message in 2010 or so.

rmbyrro 5y ago

At the bottom of the problem is that people are addicted to such disrespectful and careless platforms. Why would we get addicted to such evil? What's wrong with our minds, are we doing something wrong and can we teach next generations to be better than ourselves?

nemoniac 5y ago

Reading the article on which this is based (https://arxiv.org/abs/2110.06636 https://arxiv.org/abs/2110.06636), the researchers don't appear to specify how they randomly select the 25 interests from the interests assigned to a user. This could have a considerable effect on their results, leading to a number somewhat higher than 22. The random selection could be uniform or it could be weighted by the global popularity of the interests. Presumably it's uniform. But if so, you could challenge the reasonableness of that assumption since it would be more likely to know a more common interest of a user that one in the tail of the distribution. For example, suppose I have three interests, two of which are very common and one of which is extremely niche. If you select two of these interests uniformly at random, chances are you'll get the niche one and be highly likely to identify me. OTOH if you randomly select weighted by the global popularity of the three interests, chances are that you'll get the two common interests and be very unlikely to identify me.