José González-Cabañas

Many Internet services obtain their revenue through the delivery of online advertisements based on the commercial exploitation of users’ profiles. The accuracy and size of these profiles have important implications in terms of advertisers’ campaign performance and users’ privacy. Despite the importance of auditing the profiling accuracy, very little effort has been devoted both in industry and academia. This paper presents the most comprehensive auditing effort to understand the profiling accuracy of four major online advertising platforms: Google, Facebook, Twitter, and LinkedIn. Our work unveils that less than 50% of the assigned interests are relevant. Moreover, platforms can distinguish what interests within the assigned ones are more relevant but hide this information from users and advertisers. Finally, we have proposed a very simple solution that only uses 25 general interests per user. This proposal outperforms all the analyzed platforms in terms of profile accuracy while improving users’ privacy.

The literature has shown that combining a few non-Personal Identifiable Information (non-PII) is enough to make a user unique in a dataset including millions of users. This work demonstrates that a combination of a few non-PII items can be activated to nanotarget users. We demonstrate that the combination of the location and 5 rare (13 random) skills in a LinkedIn profile is enough to become unique in a user base of ∼ 970M users with a probability of 75%. The novelty is that these attributes are publicly accessible to anyone registered on LinkedIn and can be activated through advertising campaigns. We ran an experiment configuring ad campaigns using the location and skills of three of the paper’s authors, demonstrating how all the ads using ≥ 13 skills were delivered exclusively to the targeted user. We reported this vulnerability to LinkedIn, which initially ignored the problem, but fixed it as of November 2023.

A body of literature has shown multiple times that combining a few non-Personal Identifiable Information (non-PII) items is enough to make a user unique in a dataset including millions or even hundreds of millions of users. This work extends this area of research, demonstrating that a combination of a few non-PII publicly available attributes can be activated by a third party to individually target a user with hyper-personalized messages. This paper first implements a methodology demonstrating that the combination of the location and 6 rare (or 14 random) professional skills reported by a user in their LinkedIn profile is enough to become unique in a user base formed by $\sim$800M users with a probability of 75\%. A novel feature in this case, compared to previous works in the literature, is that the location and skills reported in a LinkedIn profile are publicly accessible to any other user or company registered in the platform and, in addition, can be activated through advertising campaigns. We ran a proof of concept experiment targeting three of the paper's authors. We demonstrated that all the ad campaigns configured with the location and $\geq$13 random professional skills retrieved from the authors' LinkedIn profiles successfully delivered ads exclusively to the targeted user. This practice is referred to as nanotargeting and may expose LinkedIn users to potential privacy and security risks such as malvertising or manipulation.

Energy is today the most critical environmental challenge. The amount of carbon emissions contributing to climate change is significantly influenced by both the production and consumption of energy. Measuring and reducing the energy consumption of services is a crucial step toward reducing adverse environmental effects caused by carbon emissions. Millions of websites rely on online advertisements to generate revenue, with most websites earning most or all of their revenues from ads. As a result, hundreds of billions of online ads are delivered daily to internet users to be rendered in their browsers. Both the delivery and rendering of each ad consume energy. This study investigates how much energy online ads use in the rendering process and offers a way for predicting it as part of rendering the ad. To the best of the authors' knowledge, this is the first study to calculate the energy usage of single advertisements in the rendering process. Our research further introduces different levels of consumption by which online ads can be classified based on energy efficiency. This classification will allow advertisers to add energy efficiency metrics and optimize campaigns towards consuming less possible.

Researchers have studied political ideology and polarization in many different contexts since their effects are usually closely related to aspects and actions of individuals and societies. Hence, being able to estimate and measure the changes in political ideology and polarization is crucial for researchers, stakeholders, and the general public. In this paper, we model the ideology and polarization of 28 countries (the 27 EU member states plus the UK) using Facebook public posts from political parties’ Facebook pages. We collected a three-year dataset from 2019 to 2021 with information from 234 political parties’ Facebook pages and took advantage of the EU parliament elections of May 2019 to create our models. Our methodology works across 28 countries and benefits from being a low-cost running process that measures ideology and polarization at a high-resolution time scale. The results show our models are pretty accurate when validating them against 19 individual countries’ elections as ground truth. Moreover, to make our results available to the research community, stakeholders, and individuals interested in politics, the last contribution of our paper is a website including detailed information about the political parties in our dataset. It also includes the temporal evolution of our ideology and polarization estimations. Therefore, our work delivers a novel tool that uses Facebook public data to create country metrics useful for different purposes. To the best of our knowledge, there is no prior work in the literature offering a solution that measures the ideology and polarization of all EU + UK countries.

The privacy of an individual is bounded by the ability of a third party to reveal their identity. Certain data items such as a passport ID or a mobile phone number may be used to uniquely identify a person. These are referred to as Personal Identifiable Information (PII) items. Previous literature has also reported that, in datasets including millions of users, a combination of several non-PII items (which alone are not enough to identify an individual) can uniquely identify an individual within the dataset. In this paper, we define a data-driven model to quantify the number of interests from a user that make them unique on Facebook. To the best of our knowledge, this represents the first study of individuals' uniqueness at the world population scale. Besides, users' interests are actionable non-PII items that can be used to define ad campaigns and deliver tailored ads to Facebook users. We run an experiment through 21 Facebook ad campaigns that target three of the authors of this paper to prove that, if an advertiser knows enough interests from a user, the Facebook Advertising Platform can be systematically exploited to deliver ads exclusively to a specific user. We refer to this practice as nanotargeting. Finally, we discuss the harmful risks associated with nanotargeting such as psychological persuasion, user manipulation, or blackmailing, and provide easily implementable countermeasures to preclude attacks based on nanotargeting campaigns on Facebook.

The currently deployed contact-tracing mobile apps have failed as an efficient solution in the context of the COVID-19 pandemic. None of them have managed to attract the number of active users required to achieve efficient operation. This urges the research community to re-open the debate and explore new avenues to lead to efficient contact-tracing solutions. In this paper, we contribute to this debate with an alternative contact-tracing solution that leverages the already available geolocation information owned by BigTech companies that have large penetration rates in most of the countries adopting contact-tracing mobile apps. Our solution provides sufficient privacy guarantees to protect the identity of infected users as well as to preclude Health Authorities from obtaining the contact graph from individuals.

Facebook labels 67% of its users with potential sensitive interests, sometimes at great risk to the user.

Online advertising is a wealthy industry that generated more than $100B in 2018 only in the US and delivers billions of ads to Internet users every day with. These impressive numbers have also attracted the attention of malicious players that try to exploit the online advertising ecosystem for their own benefit. In particular, one of the most harmful practices refers to malicious users that act as advertisers to deliver unsafe ads. The goal of these ads is to compromise the security of the users that receive those ads. This practice is referred to as Malvertising. Some reports have estimated the economic loss caused by malvertising to the online advertising sector to $1.1B in 2017. This paper is the first work that analyses and quantifies the impact of malvertising in Facebook. To accomplish this study, we rely on a dataset that includes more than 5 M ads delivered to 3 K Facebook users from 126 K advertisers between October 2016 and May 2018. Our results reveal that although the portion of advertisers (0.68%) and ads (0.17%) associated to malvertising is very low, 1/3 of the users in our study were exposed to malvertising. Finally, we also propose a novel solution to block malvertising ads in real-time in Facebook.