Privacy and Targeting on LinkedIn: Insights into the Campaign Manager

Authors: (1) Ángel Merino, Department of Telematic Engineering Universidad Carlos III de Madrid {angel.merino@uc3m.es}; (2) José González-Cabañas, UC3M-Santander Big Data Institute {jose.gonzalez.cabanas@uc3m.es} (3) Ángel Cuevas, Department of Telematic Engineering Universidad Carlos III de Madrid & UC3M-Santander Big Data Institute {acrumin@it.uc3m.es}; (4) Rubén Cuevas, Department of Telematic Engineering Universidad Carlos III de Madrid & UC3M-Santander Big Data Institute {rcuevas@it.uc3m.es}. Table of Links Abstract and Introduction LinkedIn Advertising Platform Background Dataset Methodology User’s Uniqueness on LinkedIn Nanotargeting proof of concept Discussion Related work Ethics and legal considerations Conclusions, Acknowledgments, and References Appendix 2 LinkedIn Advertising Platform Background One of LinkedIn’s primary sources of revenue is online advertising [9]. Advertisers use the LinkedIn Campaign Manager [10] to define their target audience by selecting attributes such as location, gender, age, professional skills, etc. Once the target audience is defined, LinkedIn delivers the ads to users whose profile matches the selected attributes. For example, an advertiser could target users in Germany between 18 and 25 who are skilled in Python AND R. LinkedIn reports the estimated number of users that match the target audience defined through the dashboard, referred to as Target Audience Size. This information permits advertisers to know the potential reach of their ad campaign. In our work, we leverage this functionality and use specific HTTP queries to systematically collect the size of thousands of audiences. An essential feature of the LinkedIn Campaign Manager is that it allows us to narrow the audience size by combining non-PII attributes using the AND operator. Moreover, the information of users (location, skills, experience, education, etc.) is publicly available in their profile for anyone registered on LinkedIn. We have explored whether it is possible to customize the access to a user profile (e.g., to limit the access only to direct contacts), and it was not possible. It is important to note that LinkedIn is a professional social network where users are willing to expose their profiles publicly. This may be why LinkedIn does not consider offering users profile visibility customization options relevant. LinkedIn seems to consider that revealing the actual value of small audiences may be problematic and does not report the actual audience size for any audience formed by less than 300 users. This is a positive privacy-preserving measure, a standard among social media platforms with a similar business model. For instance, Facebook and TikTok have defined a lower bound of 1000 users. Moreover, we found a LinkedIn document including guidelines for advertisers where they specifically state: "The minimum audience size required to run an advertising campaign is 300 members" [11]. We understand this as a policy imposed by LinkedIn on ad campaigns. This measure would impede advertisers (attackers) from running nanotargeting campaigns to target a specific individual. Unfortunately, this paper demonstrates that this policy is not effectively enforced since it is possible to nanotarget LinkedIn users. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. Authors: (1) Ángel Merino, Department of Telematic Engineering Universidad Carlos III de Madrid {angel.merino@uc3m.es}; (2) José González-Cabañas, UC3M-Santander Big Data Institute {jose.gonzalez.cabanas@uc3m.es} (3) Ángel Cuevas, Department of Telematic Engineering Universidad Carlos III de Madrid & UC3M-Santander Big Data Institute {acrumin@it.uc3m.es}; (4) Rubén Cuevas, Department of Telematic Engineering Universidad Carlos III de Madrid & UC3M-Santander Big Data Institute {rcuevas@it.uc3m.es}. Authors: Authors: (1) Ángel Merino, Department of Telematic Engineering Universidad Carlos III de Madrid {angel.merino@uc3m.es}; (2) José González-Cabañas, UC3M-Santander Big Data Institute {jose.gonzalez.cabanas@uc3m.es} (3) Ángel Cuevas, Department of Telematic Engineering Universidad Carlos III de Madrid & UC3M-Santander Big Data Institute {acrumin@it.uc3m.es}; (4) Rubén Cuevas, Department of Telematic Engineering Universidad Carlos III de Madrid & UC3M-Santander Big Data Institute {rcuevas@it.uc3m.es}. Table of Links Abstract and Introduction Abstract and Introduction LinkedIn Advertising Platform Background LinkedIn Advertising Platform Background Dataset Dataset Methodology Methodology User’s Uniqueness on LinkedIn User’s Uniqueness on LinkedIn Nanotargeting proof of concept Nanotargeting proof of concept Discussion Discussion Related work Related work Ethics and legal considerations Ethics and legal considerations Conclusions, Acknowledgments, and References Conclusions, Acknowledgments, and References Appendix Appendix 2 LinkedIn Advertising Platform Background One of LinkedIn’s primary sources of revenue is online advertising [9]. Advertisers use the LinkedIn Campaign Manager [10] to define their target audience by selecting attributes such as location, gender, age, professional skills, etc. Once the target audience is defined, LinkedIn delivers the ads to users whose profile matches the selected attributes. For example, an advertiser could target users in Germany between 18 and 25 who are skilled in Python AND R. LinkedIn reports the estimated number of users that match the target audience defined through the dashboard, referred to as Target Audience Size. This information permits advertisers to know the potential reach of their ad campaign. In our work, we leverage this functionality and use specific HTTP queries to systematically collect the size of thousands of audiences. An essential feature of the LinkedIn Campaign Manager is that it allows us to narrow the audience size by combining non-PII attributes using the AND operator. Moreover, the information of users (location, skills, experience, education, etc.) is publicly available in their profile for anyone registered on LinkedIn. We have explored whether it is possible to customize the access to a user profile (e.g., to limit the access only to direct contacts), and it was not possible. It is important to note that LinkedIn is a professional social network where users are willing to expose their profiles publicly. This may be why LinkedIn does not consider offering users profile visibility customization options relevant. LinkedIn seems to consider that revealing the actual value of small audiences may be problematic and does not report the actual audience size for any audience formed by less than 300 users. This is a positive privacy-preserving measure, a standard among social media platforms with a similar business model. For instance, Facebook and TikTok have defined a lower bound of 1000 users. Moreover, we found a LinkedIn document including guidelines for advertisers where they specifically state: "The minimum audience size required to run an advertising campaign is 300 members" [11]. We understand this as a policy imposed by LinkedIn on ad campaigns. This measure would impede advertisers (attackers) from running nanotargeting campaigns to target a specific individual. Unfortunately, this paper demonstrates that this policy is not effectively enforced since it is possible to nanotarget LinkedIn users. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. available on arxiv