Surprisingly Useful AI Article Enhancements
The online advertisements a person sees on Facebook can be used by artificial intelligence to determine their political preferences, education level, employment status and approximate income – without ever accessing their browsing history or personal data.
That is the finding of a study by researchers from UNSW Sydney and Queensland University of Technology (QUT), who analysed more than 435,000 Facebook ads shown to 891 Australian users and found that off-the-shelf large language models could reconstruct detailed personal profiles from ad exposure alone.
The research, presented at the ACM Web Conference 2026, represents one of the largest real-world investigations into how AI can infer personal information from the advertising people passively consume online.
Ads are not random
The study was conducted through the Australian Ad Observatory, a citizen science project run by the ARC Centre of Excellence for Automated Decision-Making and Society (ARC ADM+S). The project collects data on the ads shown to volunteer participants via a browser plugin.
Lead Author Baiyu Chen, from UNSW, explained that the patterns of ads shown to any individual user carry embedded signals about who that person is.
“The key point is that the ads a person sees are not random,” Chen stated. “Advertising systems optimise delivery based on inferred profiles and behaviours, so the overall pattern of ads shown to a user can carry signals about traits such as gender, age, education, employment status, political preference and broader socioeconomic position.”
“Our study shows that LLMs can analyse those patterns and infer private attributes from ad exposure alone.”
The researchers used large language models – the same type of AI that powers tools like ChatGPT and Google’s Gemini – to analyse the content and patterns of ads shown to each user. The AI systems were not trained on any user data. Instead, they used their general reasoning capabilities to draw inferences from the ads themselves.
AI matched or beat human judgement
The study benchmarked the AI’s performance against six human annotators who were shown the same ad content and asked to infer the same demographic attributes.
The results showed that AI systems matched and in some cases exceeded human ability to infer personal characteristics from ad streams. For gender, the top-performing model achieved 76 per cent accuracy compared to the human average of around 74 per cent. For education and employment status, the AI systems performed significantly better than the human annotators, reaching 51 per cent and 53 per cent accuracy respectively, compared to human averages of roughly 34 per cent and 38 per cent.
The AI was also able to infer political party preference with around 42 per cent accuracy at the user level – well above both random chance and census-based baselines.
Even when the AI did not predict the exact category correctly, its errors tended to be near misses. For age, the model’s predictions were on average less than one age bracket away from the correct answer, indicating that it could reliably identify a user’s approximate life stage even when it missed the precise bracket.
Over 200 times cheaper than human analysis
Beyond accuracy, the researchers found that AI-based profiling was dramatically more efficient than manual analysis.
Processing 100 user sessions took the AI system approximately 138 seconds, compared to around two hours for human annotators. The cost of the automated approach came to roughly 18 cents per 100 sessions, compared to $40 for human analysis at standard wage rates.
That makes the AI approach around 52 times faster and 223 times cheaper than human analysis, according to the paper.
Related: Best Business Laptops for work & school
Related: Best Gaming Laptops
Related: Best Portable Laptop
“These findings provide the first empirical evidence that ad streams serve as a high-fidelity digital footprint, enabling off-platform profiling that inherently bypasses current platform safeguards,” the researchers wrote in the paper.
Short browsing sessions are enough
One of the more concerning findings is that prolonged tracking is not required for the technique to work.
The researchers demonstrated that actionable profiles could be built from individual browsing sessions – short windows of ad exposure during a single period of Facebook use. While accuracy improved when the AI aggregated data across multiple sessions, even single-session analysis produced results above chance for most attributes.
“Critically, actionable profiling is feasible even within short observation windows, indicating that prolonged tracking is not a prerequisite for a successful attack,” the researchers wrote.
This means that an attacker would not need to monitor a user for weeks or months to build a useful profile. A handful of browsing sessions could be sufficient.
Browser extensions as an attack vector
The researchers identified browser extensions as the most likely vehicle for this type of privacy attack.
Extensions such as ad blockers, coupon finders and page translators already require permissions to read web page content in order to function. The researchers argue that these legitimate permissions provide cover for data harvesting, allowing a malicious or compromised extension to silently collect ad content without triggering security alarms.
“Rather than distributing specialised malware, an adversary can opportunistically deploy this attack within the existing ecosystem of widely installed, benign functioning extensions,” the researchers wrote.
“These extensions legitimately require permissions to read web page content to function, providing a perfect cover for data harvesting.”
The researchers noted that app store reviews typically focus on code safety rather than the privacy implications of data that can be inferred from content an extension legitimately accesses. This creates a gap where an extension could harvest ad content without raising flags from either users or platform review processes.
Platform safeguards are being bypassed
The study highlights what the researchers describe as a systemic vulnerability in the online advertising ecosystem.
In 2022, Meta removed detailed targeting options for sensitive categories including political beliefs, health causes, sexual orientation and religious practices. The intent was to prevent advertisers from directly targeting people based on these attributes.
However, the research shows that while explicit targeting options were removed, the platform’s ad delivery algorithms still produce demographic skews. The ads shown to users continue to reflect their underlying characteristics, even when advertisers are not deliberately targeting those traits.
The result is that the protections Meta introduced can be circumvented by analysing the output of its own ad delivery system.
“This work reveals a critical blind spot in web privacy: the latent leakage of user private attributes through passive exposure to algorithmic advertising,” Chen explained.
“These findings provide the first empirical evidence that ad streams serve as a high-fidelity digital footprint, enabling off-platform profiling that inherently bypasses current platform safeguards, highlighting a systemic vulnerability in the ad ecosystem and the urgent need for responsible web AI governance in the generative AI era.”
Users cannot fully protect themselves
Chen acknowledged that individuals can take some steps to reduce their exposure, but cautioned that the problem is broader than any single user can solve.
“In terms of protection, users can reduce the risk by being cautious with browser extensions, limiting unnecessary permissions and using available privacy and ad-personalisation settings,” Chen noted.
“However, this is not something users can fully solve on their own, because the broader issue is systemic: people cannot easily opt out of the ad ecosystem altogether, so stronger platform safeguards are also needed.”
The researchers argued that current privacy protections may need to be rethought to account for what can be inferred from the content people are exposed to, rather than focusing solely on what data is collected about them.
A new category of privacy risk
The research team – which includes Professor Flora Salim, Professor Daniel Angus, Dr Benjamin Tag and Dr Hao Xue – described the findings as representing a shift in how privacy risks should be understood.
Unlike traditional profiling attacks that rely on data users actively share, such as social media posts or uploaded photos, this technique exploits passive exposure. Users do not need to post anything, share anything or click on anything for the profiling to work. Simply being shown ads is enough.
The researchers also noted that this is not a theoretical exercise. The tools required to carry out this kind of analysis are commercially available, accessible to people with limited technical skills and cheap to operate at scale.
The study used data collected between 2021 and 2023 from the Australian Ad Observatory project. The researchers acknowledged that the findings are based on a self-selected cohort of Australian Facebook users and may not generalise to all populations or platforms.
The paper, titled “When Ads Become Profiles: Uncovering the Invisible Risk of Web Advertising at Scale with LLMs,” was presented at the ACM Web Conference 2026 in Dubai. The code used in the research has been made available on GitHub.
Last Updated on May 4, 2026 by Nick Ross
