Study: Facebook lets ads target your account using info given for security purposes, like your phone number, as well as info from your friends' address books
Last week, I ran an ad on Facebook that was targeted at a computer science professor named Alan Mislove.
Context & Ripple Effects
Northeastern researcher Alan Mislove ran a cheap test ad aimed at himself and confirmed what the platform's settings never made obvious: Facebook matches advertisers against phone numbers users handed over for account security, and against contact lists their friends uploaded without the user's say-so. That builds on a pattern already visible in political advertising, where presidential campaigns uploaded massive email lists and voter files to Facebook years earlier to reach donors and voters directly.
The finding matters because it widens the gap between what a user agreed to share and what the ad system actually knows about them — a gap later studies kept probing, including [[a:940230|research showing ads delivered along race and gender stereotypes even under neutral targeting parameters]].
First-order effects
- Users who gave Facebook a phone number for two-factor authentication or account recovery learn that the same identifier is matchable by any advertiser holding it, converting a security credential into a targeting key.
- Advertisers gain a way to reach people who never opted into marketing, since a friend's address-book upload exposes everyone in that friend's network to matching.
Second-order effects
- Facebook is pushed toward disclosure tools as the workaround — its advertiser-transparency feature, which BuzzFeed News found nearly unusable for a normal person, shifts the burden of auditing contact-list targeting onto individual users.
- Rival platforms face the same research playbook: once one academic demonstrates shadow-profile targeting on Facebook, the method gets replicated to test whether other social networks hold comparable non-consented data.
Third-order effects
- If the pattern holds, consent frameworks built around individual opt-ins prove structurally inadequate for networked data, where one person's upload determines another's exposure — the kind of mismatch that invites regulator attention to how 'security' data is repurposed.
- The credibility of platform self-description erodes further: each study that surfaces an undisclosed data flow makes third-party audits, rather than company statements, the de facto source of truth about ad systems.
The trend: Social ad targeting is steadily expanding from data users knowingly surrendered to data supplied about them by others, with academic probes and clunky transparency tools filling the accountability vacuum.