With GDPR imminent, investigation finds Facebook lacks privacy controls for information inferred about users, including sensitive details used in ad targeting
Social network categorises users based on inferred interests such as Islam or homosexuality — Facebook allows advertisers …
Context & Ripple Effects
The investigation lands days after Facebook rolled out enhanced privacy controls worldwide ahead of GDPR — controls the story shows stop short of the platform's core ad engine: categories like Islam or homosexuality are inferred by Facebook itself, not declared by users, so they sit outside what those settings let people view or delete.
It also sharpens a commercial anxiety already running through the ad market, where advertisers were re-examining their Facebook spend commitments on expectations that GDPR would make targeting harder and pricier. The earlier campaign-data coverage — campaigns uploading voter files and cross-device tracking of political habits — established that Facebook's value rests on granular personal categorization; this story reveals the most sensitive layer of it is invisible to users.
First-order effects
- EU users gain no way to see or remove inferred sensitive attributes such as religion or sexual orientation, meaning the just-launched privacy dashboard leaves the platform's most sensitive targeting inputs untouched days before GDPR takes effect.
Second-order effects
- Advertisers already weighing reduced commitments face added brand-safety risk: campaigns aimed at inferred religious or sexuality segments now carry both regulatory exposure under GDPR's special-category rules and reputational cost if exposed.
- Facebook's own anti-discrimination policies become harder to defend — as the later financial-services targeting investigation showed, policy on paper does not constrain how advertisers actually use the platform's category system.
Third-order effects
- If regulators treat algorithmically inferred traits as protected special-category data, the entire inference-driven ad model faces a compliance boundary that pushes platforms toward declared or contextual signals — a structural constraint no settings page can absorb.
- The gap between user-facing controls and backend profiling sets up the recurring enforcement pattern for GDPR-era platforms: audits find the sensitive layer, policy updates follow, and the burden shifts onto advertisers to justify segment choices.
The trend: GDPR is shifting scrutiny from what platforms collect to what they infer, forcing ad businesses built on unobservable profiling toward auditable, user-visible data.