


A brief summary of some high-level findings are below.

Please see our full paper for the details of our results. We believe that our findings provide an important additional perspective to the conversation around the privacy concerns of targeted advertising, and we hope to enable a broad public discussion among advertisers, consumers, and policymakers about how to prevent such risks. By contrast, our work shows that arbitrary individuals - who are not driven by the business aims or reputational concerns of a large advertising network - can also access this personal data, and even narrowly target a particular person’s information. Though the fact that advertising networks are able to collect large amounts of data about users is a potential privacy concern (for example, if that data is breached or misused), such concerns are theoretical or abstract for most Internet users. We conducted this research to provide a new perspective to the advertising privacy debate. We ask: what types of information can these individuals learn about users, and at what cost? Why did you do this work? Our work focuses on a different actor in the broader tracking ecosystem: individuals who can - with a modest budget - purchase ads from advertising networks. This past work has, for example, studied how advertising networks track and target users, as well as what information they can learn about users in the process (e.g., their browsing history).

There have been many past works focused on the privacy implications of online advertising, and the tracking of user behaviors and properties that enable targeted advertising. Our paper describes the details of our study, but we provide a brief FAQ below to highlight some of our findings and their significance. Specifically, we find that an individual can use the targeted advertising system to conduct physical and digital surveillance on targets that use smartphone apps with ads. In this work we examine the capability of a different actor - an individual with a modest budget - to access the data collected by the advertising ecosystem. However, in the broader public debate about these practices this concern is often tempered by the understanding that all this potentially sensitive data is only accessed by large corporations these corporations are profit-motivated and could be held to account for misusing the personal data they have collected. The sheer scale and precision of individual data that is collected can be concerning. There are many studies about how users are tracked and what kinds of data are gathered. Simultaneously, users generate more and more personal data that is shared with advertisers as more and more of daily life becomes intertwined with networked technology. Targeted advertising is at the heart of the largest technology companies today, and is becoming increasingly precise.
