Facebook has more or less choked itself on users' data. And here, it was discovered that advertisers can indeed target users based on sensitive interests.
This was revealed by a joint investigation between The Guardian and the Danish Broadcasting Corporation. The two found that Facebook has allowed advertisers to deliver tailored ads based on sensitive subjects.
From subjects like inferences about their sex life, religion or political beliefs, Facebook is said to gather and process data that is considered a breach under the General Data Protection Regulations (GDPR).
The EU's regulation explicitly labels such categories of information as so sensitive, that it requires special conditions around how they can be collected. Processing of this data is therefore prohibited unless explicit consent is given by users.
Included in the GDPR's sensitive categories are marked out by Article 9 of GDPR as "special categories". They include a person’s race, ethnic origin, politics, religion, sex life and sexual orientation.
As part of its GDPR-focused updates, Facebook has asked each and every users to confirm whether or not “political, religious, and relationship information” they had entered on its platform should be stored or displayed.
What this means for those users, an advertisers can target an ad, for example, to 68,000 UK citizens that were identified by Facebook's advertising tools as being interested in homosexuality and Hinduism.
Facebook does demonstrate that sensitive information such as these are prone to misuse. So here, the company provides advertisers with the ability to exclude users based on their interests, but not for sensitive interests. For this example, Facebook allows advertisers to target people interested in Islam, but cannot advertise to everyone except those interested in Islam.
In order to make the practice viable, Facebook requires advertisers to agree to a set of policies, that prevent them from "using targeting options to discriminate against, harass, provoke or disparage users, or to engage in predatory advertising practices."
And in its defense, Facebook said that its method of classifying users' interests wasn't the same as classifying personal traits.
"Like other internet companies, Facebook shows ads based on topics we think people might be interested in, but without using sensitive personal data. This means that someone could have an ad interest listed as gay pride because they have liked a Pride-associated page or clicked a Pride ad, but it does not reflect any personal characteristics such as gender or sexuality."
The company also said it provided some controls to users on its ad preferences screen.
"People are able to manage their ad preferences tool, which clearly explains how advertising works on Facebook and provides a way to tell us if you want to see ads based on specific interests or not. When interests are removed, we show people the list of removed interests so that they have a record they can access, but these interests are no longer used for ads."
"Our advertising complies with relevant EU law and, like other companies, we are preparing for the GDPR to ensure we are compliant when it comes into force.”