Online ads can feel like they know you better than you know yourself.
Ads for baby clothes before a pregnancy is confirmed. Hotel ads when you're only dreaming about travel.
It's little wonder there's a rumour Facebook listens to you through your smartphone microphone, even when you're not using the app.
Facebook denies this, and it doesn't have to eavesdrop: digital targeted advertising is increasingly sophisticated.
Since 2014, the social media giant has shared information about why you're being targeted. This appears when you click "Why am I seeing this ad?" in the corner of a promoted post.
Twitter has a similar tool.
But how transparent are Facebook's messages?
Ad explanations should help users "control, verify and protect" their data, according to Oana Goga, a researcher in the Laboratoire d'Informatique de Grenoble in France.
She worked on a recent case study that suggests the company's "explanations" can be an incomplete picture.
How do ads find you?
There are three key ways ads find their target through Facebook's self-service ad-buying platform.
Firstly, advertisers can make a target audience based on gender, age and location. That's information you give to Facebook when you first sign up.
They can also choose and exclude groups based on demographics, interests and behaviours: A love for board games or "People in the USA who have a somewhat conservative political affiliation".
These characteristics are inferred from your online activity, explained Matt Sherry, a digital marking consultant at Reload Media. That activity might be on Facebook, or it might be on other sites and tracked by Facebook cookies.
Secondly, advertisers can add attribute targeting from data brokers. In Australia, Facebook confirmed it works with three data brokers: Acxiom, Experian and Quantium.
Brokers typically model consumer insights from things like purchases, loyalty schemes and surveys, as well as other sources.
Modelling might range from people who have mortgages to martial status. According to its website, Experian has a list about new parents that's updated weekly.
The third way to target ads is through "Custom Audience". Say you want to serve ads to regular shoppers — you can upload their email addresses or identifying attributes.
And of course, new technologies and ways of targeting are constantly being developed, according to Dr Louise Kelly, a digital marketing lecturer at QUT Business School.
What does Facebook tell you about ad targeting?
Dr Goga's team conducted an intricate study to compare how targeting works for an advertiser with the explanations of targeting that Facebook offers consumers.
They created a browser extension that gathered 26,173 unique ads and their corresponding ad explanations from 35 Facebook users in Europe and the US over five months.
They also created their own ad campaigns, targeted at the attributes of their test subjects. In total, they managed to collect 254 ad explanations from their own ads.
The researchers found Facebook ad explanations typically have two parts:
- One key reason why the advertiser is targeting you
- A broad statement that "there may be other reasons why you are seeing this ad", including that advertisers want to reach a certain range of age and location
Although multiple consumer attributes can be targeted by an advertiser, in the collected ad explanations, one attribute at most appeared in the first part.
Based on their observations, Dr Goga and her team suggested that Facebook is often disclosing the most common attribute that's been targeted.
"For example, for targeting 'Video games (915M users) AND Time (823M)' and 'Video games (915M) AND Photography (659M)', 'Video Games' would be chosen. This result suggests (but does not conclusively prove) that Facebook chooses the most common attribute to include in the ad explanation," the paper explained.
And according to the study, while Facebook may tell you your data came from a broker such as Acxiom, it does not typically reveal which personal attribute was targeted by that broker. In other words, the how, what and why of your presence in a data broker's target audience.
Facebook declined to detail how it decides which attribute to show.
Why does this matter?
The study concludes that Facebook's ad explanations are "often incomplete and sometimes misleading".
"What we want to show in this is study is, you can provide explanations that are not optimal and might actually do more harm than good to users because they don't show the complete picture of what is happening," Dr Goga said.
"It's like they've half-baked a cake," Mr Sherry said, suggesting the full targeting picture was not being disclosed.
Dr Goga is concerned advertisers could purposefully choose a large target group to obscure their more sensitive targeting.
Past ProPublica investigations have found Facebook ads could be aimed at people who expressed interest in the topic of "Jew hater", for example. Facebook removed the anti-Semitic ad categories.
"You can group this way, and then users will never know your intent," she said. "That could be privacy-sensitive, or discriminatory."
Facebook lets users see and edit their ad profile, but Katina Michael, a professor in the University of Wollongong's Faculty of Engineering and Information Sciences, said the research demonstrates how "under the microscope" we are online.
"What would come up would be ... your health insurance provider is, plus your kids go to a private school, plus you visited a website for this kind of vehicle, plus you said this on Facebook last week."
More comprehensive ad explanations could help empower users to control their data, although the study does not investigate how.
"We want people to understand why they saw a specific Facebook ad," Matt Hural, Facebook product manager said in a statement.
"In our research and testing, people have consistently told us they prefer a few reasons why an ad was delivered, so they can adjust their settings to better tailor the ads they see.
"We're also planning in the coming months to give people easier ways to understand and control the data we use from partners."
Experian and Acxiom declined to comment. Quantium was approached for comment.