Privacy impacts of advertising and marketing

Behavioural or targeted advertising is using a sorting and recommendation algorithm to match ads with consumers who are most likely to respond to them. This means that two people who look at the same video or website may see completely different ads based on their data profile. (This can be distinguished from contextual advertising, which shows you ads based on just what you’ve most recently done – what video you’re watching, what you just searched for – and not any other information about you.)

For example, if you search for a product online, ads for that product may come up on your social media pages, like Instagram, because algorithms have been tracking your behaviour online: Instagram “show[s] you ads from businesses that are interesting and relevant to you.”[2] Your internet experience is now curated for you and what you like. This also happens with videos online on YouTube, because for them to make money they have to be monetized. It is important that they and the ads that accompany them, “reach and resonate not just with most people, but also with the right people.”[3]

Because behavioural ads are considered to be more accurately targeted than contextual ones (or ones aimed at broad demographic, psychographic or economic groups, such as magazine or TV advertising), the data that’s used to target ads is considered highly valuable. Whether or not they actually “sell” data to others, targeted advertising that uses your personal information is an essential part of how almost every social network, video site, and search engine makes money: Alphabet, which owns Google and YouTube, made more than four-fifths of its revenue from targeted ads in 2020, while Facebook made more than nine-tenths.[4]

Many platforms claim they don’t target ads at users under 18, but these policies don’t always work as intended. For example, an ad campaign promoting Instagram was allegedly able to target teens because they were the ones most likely to be labeled as “unknown” in YouTube’s demographic data.[5] Other platforms have been found to ignore users’ opt-out signals. A 2026 study found that Meta failed to recognize users’ opt-out preferences 69 percent of the time, while Google had an 86 percent failure rate.[6]

Here are some of the things that advertisers want to know before showing you an ad:

• Brand loyalty: Your feelings about a brand. People who are loyal to a particular brand are more likely to respond to an ad about that brand. But most of the time, they won’t respond to ads for a competing brand. It would be a waste of money to show Coke ads to a die-hard Pepsi fan, for instance.
• Income: How much money you have. This keeps advertisers from wasting money showing ads to people who can’t afford the product, and also lets them target bargains to budget-conscious consumers.
• Intent to buy: Whether or not you’re looking to buy this type of product right now. Viewers with intent to buy will be shown “hard sell” ads that focus on the features of the product; those without it will be shown “brand building” ads that make them more aware of the product or develop positive feelings about it.
• Interests: What the viewer is interested in. If advertisers know you’re interested in video games, for example, they will show you video game ads.
• Location: Where you are. For some advertisers, like restaurants, it’s important to only show ads to people who live near them. Other advertisers might show different versions of an ad to people in different places (with prices in different currency, for example).
• Personality: What kind of person you are. This lets advertisers target people based on how worried they are about different things, how much they like to take risks, and so on.

Advertising and data collection can also happen on the same platform: a study of fast food and restaurant apps in Canada found that nine in 10 collect personally identifiable information from users, and don’t distinguish between child and adult users,[7] while in 2019 Burger King ran an ad campaign that used geolocation data to offer people a free Whopper whenever they were within 600 feet of a McDonald’s.[8] Data can even be used to customize the content of ads: “Where one customer sees a Coca-Cola on the table, the other sees green tea. Where one customer sees a bag of chips, another sees a muesli bar… in the exact same scene.”[9]

How does targeted advertising work? Different apps do things slightly differently, but in general it works more or less like this:

• Any time you open a web page that has ads (or an ad comes up in your video or social network feed), the site or app’s advertising platform sends a signal that an ad space is available for auction. This signal includes the data that the app or website has about you.
• Advertisers’ platforms analyze that data to see if it matches their current campaigns. (Sometimes a third platform will be involved that matches the data that was included in the initial signal with a larger data profile of you.) You may be put into broad categories like “Affluent Millennials” and more niche ones like “Heavy purchaser of refrigerated meat pies.” These categories may also be based on things they think have happened in your life (“Newly engaged”), your political beliefs, your health, your psychological profile and many other factors. This is a privacy and security risk in part because, “while only one advertiser wins the auction, all participants receive the data. Indeed, anyone posing as an ad buyer can access a stream of sensitive data about the billions of individuals using websites or apps with targeted ads.” Even if that data isn’t used inappropriately, the way real-time bidding works encourages apps and websites to collect and acquire more data because it allows them to demand higher fees in the auction.[10]
• Advertisers whose ads match with your profile make bids for that ad space. How much they’re willing to pay may depend on how good the match is between the ad and your profile, or there may be something in your data that makes you seem like a more or less valuable audience.
• The ad that made the highest bid is shown to you.

All of that is done automatically, by algorithms – and takes just milliseconds.[11] Because of that, there is a strong risk that targeted ads may “facilitate discrimination by selecting or excluding target audiences based on categories that are protected under equality law”: various social networks and search engines have been found to have allowed advertisers to discriminate against women, different ethnic and racial groups, and nonbinary people in job ads.[12] For instance, one experiment found that Facebook was more likely to show ads for for-profit colleges – including ones that had been fined or sued by the U.S. Department of Education – to Black users, while White users were more likely to see ads for public universities.[13] While this may be done intentionally, it can also happen because of the proxies that algorithms use: using an interest in hip hop or K-pop music as proxies for race, for example.[14] Some researchers have found that this kind of algorithmic discrimination can happen even when platforms have specifically taken steps to prevent advertisers from discriminating.[15]

Even if the result isn’t discriminatory, it is often inaccurate. One study found that contextual advertising presented search engine users with more relevant ads than targeted advertising.[16] Ads that reach young people may be even less accurate. According to another study, “having a larger number of people in a household tends to decrease accuracy in identifying the correct characteristics of individuals,” with the result that guesses about users’ gender in households with children were only 37 percent accurate, or significantly less than chance.[17] Some industry figures have estimated that as much as eighty percent of the data collected is unusable, because it cannot be connected to enough additional data about the users (particularly geolocation data).[18] There’s also evidence that behavioural ads make advertising less useful to consumers as a way of finding good products, by encouraging advertisers to sell (and consumers to buy) things based on identity rather than value.[19]

These factors may explain the finding that while two-thirds of people are in favour of targeted advertising when they’re first asked, that number drops to just one-third after they’re shown how it works,[20] and one study found that just one in a thousand people would choose to opt in to third-party tracking if they had the choice.[21] A survey of young people, similarly, found just two percent felt that behavioural advertising was helpful, and in particular were worried about how vulnerable youth might be targeted:

“I think that some targeted advertising around things like gaming isn’t dangerous, just a bit weird. However, around certain topics such as extreme weight loss or addictive things like gambling it could definitely be a problem, and harm a person’s state of mind which might already be at risk.”[22]

As tech journalist Shoshana Wodinsky puts it, “people understand when something feels wrong to them. People understand, ‘hey, this company is using my data without my explicit permission. I don't want them to do that.’ Many fundamentally understand that this is how the internet works but they don't have the words to describe how it works.”[23]

There is reason to believe that behavioural advertising as it’s currently practiced may be actually counter-productive advertisers. While there is evidence that it’s more profitable for publishers, the difference is small – about four percent, according to one estimate.[24] Research also shows that when consumers learn how a platform uses their data, they become less receptive to ads if they feel that their data practices are unacceptable – but more receptive if they conclude that they can trust the platform with their data.[25]

Advertising can be a cybersecurity risk, as well. Malicious advertising, which uses marketing tools to target victims with malware or scams, now accounts for 40 percent of all cyberattacks, and one study found that one in three ads on Meta platforms were malvertising. This technique “is a social engineering toolkit that blends into whatever people already trust and are currently paying attention to.”[26] In some cases, criminals avoid detection spending weeks or more running “chameleon ads” that look legitimate and then only briefly switching to scam content. AI, in particular, has made this threat more common, as it’s easy to create the chameleon ads in many different languages.[27] According to documents obtained by the wire service Reuters, Meta itself estimates that scam ads are responsible for 10 percent of its annual revenue. Advertisers are only banned, however, if Meta’s detection systems are at least 95 percent sure that they are malicious, and the company’s ad targeting systems mean that a user who falls for one malicious ad is more likely to be shown others.[28]This murkiness costs advertisers money, too: ad fraud is estimated to account for one-fifth of all ad spending worldwide.[29]

[1] Attributed to John Wanamaker. See https://quoteinvestigator.com/2022/04/11/advertising/

[2] (n.d.) How does Instagram decide which ads to show me? Instagram Help Center. Retrieved from https://www.facebook.com/help/instagram/173081309564229

[3] Brisson-Boivin, K & McAleese, S (2021). Algorithmic Awareness: Conversations with Young Canadians about Artificial Intelligence and Privacy. MediaSmarts. Ottawa.

[4] Mccann, D. (2021). The billion-dollar business of surveillance advertising to kids. New Economics Foundation. Retrieved from https://neweconomics.org/uploads/files/i-Spy__NEF.pdf

[5] Morris, S., Murphy H. & McCarthy H. (2024) Google and Meta struck secret ads deal to target teenagers. The Financial Times.

[6] (2026) California Privacy Audit: A Legal Minefield that Puts Users at Risk. California CCPA.

[7] Kent, M.P., et al. (2023) Fast Food & Dine-In Restaurant Apps and Children’s Privacy: Exploring how children’s data and privacy are being protected on the mobile applications of top Canadian fast food and dine-in restaurants. Heart & Stroke. Retrieved from https://www.heartandstroke.ca/-/media/pdf-files/advocacy/monique-potvin-kent-privacy-report-en.pdf?rev=28a626b372bf45bcac5bee0ddfcf5ae8

[8] Fu, J. (2021) Junk Food Ads Don’t Just Harm Children’s Health, They Also Infringe on their Online Privacy. The Counter. Retrieved from https://thecounter.org/junk-food-ads-harm-childrens-health-online-privacy-social-media-coca-cola/

[9] Kort, K. (2020) How OTT Services Are Looking to Further Capitalize on Product Placement. tripelift. Retrieved from https://triplelift.com/blog/how-ott-services-are-looking-to-further-capitalize-on-product-placement/

[10] Cohen, L. (2025) Online Behavioral Ads Fuel the Surveillance Industry—Here’s How. Electronic Frontier Foundation.

[11] Keegan, J., & Eastwood J. (2023) From “Heavy Purchasers” of Pregnancy Tests to the Depression-Prone: We Found 650,000 Ways Advertisers Label You. The Markup. Retrieved from https://themarkup.org/privacy/2023/06/08/from-heavy-purchasers-of-pregnancy-tests-to-the-depression-prone-we-found-650000-ways-advertisers-label-you

[12] Armitage, C., et. Al (2023) Towards a more transparent, balanced and sustainable digital advertising ecosystem: Study on the impact of recent developments in digital advertising on privacy, publishers and advertisers. European Commission.

[13] Biddle, S. (2024) One Facebook Ad Promotes a For-Profit College; Another a State School. Which Ad Do Black Users See? The Intercept.

[14] Keegan, J. (2021) Facebook Got Rid of Racial Ad Categories. Or Did It? The Markup. Retrieved from https://themarkup.org/citizen-browser/2021/07/09/facebook-got-rid-of-racial-ad-categories-or-did-it

[15] Speicher, T., Ali, M., Venkatadri, G., Ribeiro, F. N., Arvanitakis, G., Benevenuto, F., ... & Mislove, A. (2018, January). Potential for discrimination in online targeted advertising. In Conference on fairness, accountability and transparency (pp. 5-19). PMLR.

[16] Mustri, E. A. S., Adjerid, I., & Acquisti, A. (2022). Behavioral advertising and consumer welfare: An empirical investigation. Technical report, Carnegie Mellon University.

[17] Neumann, N., Tucker, C. E., & Whitfield, T. (2019). Frontiers: How effective is third-party consumer profiling? Evidence from field studies. Marketing Science, 38(6), 918-926.

[18] Untersinger, M. (2026) How surveillance companies track smartphone users through advertising data. Le Monde.

[19] Summers, C. A., Smith, R. W., & Reczek, R. W. (2016). An audience of one: Behaviorally targeted ads as implied social labels. Journal of Consumer Research, 43(1), 156-178.

[20] Worledge M and Bamford M, ‘Adtech Market Research Report’ (Ofcom, 21 March 2019) https://www.ofcom.org.uk/__data/assets/pdf_file/0023/141683/ico-adtech-research.pdf

[21] HERE Technologies. (2018) Privacy and location data: Global consumer survey. Retrieved from https://www.here.com/sites/g/files/odxslz256/files/2019-02/HERE%20Technologies%20Privacy%20and%20Location%20Data%20Global%20Consumer%20Study%20March%202018%20-%20Reviewed.pdf

[22] Williams, D., McIntosh, A., & Farthing, R. (2021). Profiling Children for Advertising: Facebook’s Monetisation of Young People’s Personal Data. Reset Australia. https:/au.reset.tech/uploads/resettechaustralia_profiling-children-for-advertising-1.pdf (accessed April 2021).

[23] Quoted in Warzel, C. (2021) The internet’s Original Sin. Galaxy Brain. Retrieved from https://warzel.substack.com/p/the-internets-original-sin

[24] Marotta, V., Abhishek, V., & Acquisti, A. (2019). Online tracking and publishers’ revenues: An empirical analysis. In Workshop on the Economics of Information Security.

[25] Kim, T., Barasz, K., & John, L. K. (2019). Why am I seeing this ad? The effect of ad transparency on ad effectiveness. Journal of Consumer Research, 45(5), 906-932.

[26] Corrons, L., et al. (2026) The Scam Ad Machine. Gen Digital.

[27] (2026) World of Scams: The Fraud Problem at the Heart of Online Advertising. Canadian Anti-Monopoly Project.

[28] Horwitz, J. (2025) Meta is earning a fortune on a deluge of fraudulent ads, documents show. Reuters.

[29] Kessler, B. (2026) Online ad fraud is a feature, not a bug. The GIST.