One in five dollars spent on online advertising in the United States currently goes to Facebook. The power of the company’s ad platform comes from the ability it gives politicians, brands, real estate agents, nonprofits and others to precisely target people on its social networks.

Facebook has expanded its ad apparatus over time by continuously accumulating details about its users and turning those details into targetable data points. As it has grown, however, the company has drawn the scrutiny of privacy advocates, regulators and lawmakers around the world.

The Early Days

When Facebook introduced its ad platform in 2007, advertisers could target people using information they had volunteered on the platform.

This is what a typical target audience might have looked like with those options:

Anyone who lives in Philadelphia, studies philosophy in college and is 18 to 22.

In 2009, Facebook added several features, including the ability for users to click a “like” button on posts in their newsfeed, which refined the list of interests that advertisers could target. The company also introduced ways for advertisers to target friends of those who had interacted with their brands, and to target ads to people by age or birthday.

Anyone who lives in Philadelphia, studies philosophy in college and is 21.

Introducing Third-Party Data

Three years later, Facebook introduced Custom Audiences, a feature that allowed companies to upload their own lists of people to target. A retailer, for example, could upload its customer list and target ads at those who had recently bought a specific kind of T-shirt.

Anyone who lives in Philadelphia, studies philosophy in college, is 21 and has bought a blue T-shirt in the past year.

Of course, companies were not limited to using lists of their own customers. They could also upload lists of consumers bought from third-party marketing firms known as data brokers.

Data brokers collect vast troves of information from public records, retailers who sell customer information and other sources. The brokers combine that data into consumer profiles, and then resell lists filtered to target certain demographics.

By this time, targeting ads to people based on their interests had become a common online-advertising practice, and marketers and researchers were beginning to tap into big data analysis to push that practice further.

In 2013, a researcher working for the consulting firm Cambridge Analytica released a personality quiz that people could take on Facebook, with the results indicating how open, conscientiousness, extroverted, agreeable or neurotic they were. The researcher compared the quiz results with what those who took it had liked on Facebook, ultimately determining which interests corresponded with which personality traits.

Using that method, which had been developed by researchers at Cambridge University, targeting certain interests was now tantamount to targeting personality traits.

Anyone who lives in Philadelphia, studies philosophy in college, is 21, has bought a blue T-shirt in the past year and is neurotic.

Around 2014, Facebook’s ad program began to evolve dramatically, allowing advertisers to pinpoint people even more precisely than before. By then, more than 1.2 billion people on average used the social network every day.

One new feature, Partner Categories, brought hundreds of targeting options from data brokers into Facebook’s ad platform. Brands could now target people based on demographics like salary; number of open credit lines; car make and model; and whether a user fit into a category such as “trendy moms.”

Anyone who lives in Philadelphia, studies philosophy in college, is 21, has bought a blue T-shirt in the past year, is neurotic, makes less than $28,000 a year and is likely to buy a minivan in the next six months.

In 2014, the company also introduced what it called Lookalike Audiences, a feature that allowed organizations that uploaded customer lists to also target people who had profiles similar to those customers.

Anyone who lives in Philadelphia, studies philosophy in college, is 21, has bought a blue T-shirt in the past year, is neurotic, makes less than $28,000 a year and is likely to buy a minivan in the next six months. Plus, anyone on Facebook who is similar to them.

Tracking You Around the Web and Guessing Your Ethnicity

In mid-2014, Facebook incorporated users’ online browsing history into its ad-targeting platform. The company had been collecting browsing data for years, from any web page that included a Facebook like button or had let people log in through their Facebook accounts. The company used the browsing data — from, say, a user’s visits to several websites while she shopped for a new tent — to refine the specific interests that advertisers could target and to give them more confidence about what they were targeting.

Anyone who lives in Philadelphia, studies philosophy in college, is 21, has bought a blue T-shirt in the past year, is neurotic, makes less than $28,000 a year, is likely to buy a minivan in the next six months and is interested in camping. Plus, anyone on Facebook who is similar to them.

Around this time, Facebook also added a targeting option called Ethnic Affinity. The company does not ask users to identify their race, but it assigns ethnicities based on activities such as the content and pages that users like. A user could be categorized as African-American, for example, because his Facebook activity “aligns with African-American multicultural affinity.” The other ethnicities that can be assigned are Hispanic and Asian-American.

Anyone who lives in Philadelphia, studies philosophy in college, is 21, has bought a blue T-shirt in the past year, is neurotic, makes less than $28,000 a year, is likely to buy a minivan in the next six months, is interested in camping and whose interests align with those of African-Americans. Plus, anyone on Facebook who is similar to them.

The recent revelation that Cambridge Analytica collected information of up to 87 million Facebook users has renewed concerns about privacy on the platform, and has prompted the company to pledge to improve its privacy tools and transparency and to re-think at least one aspect of its ad practices. The company has already said it would drop targeting options based on third-party data from its advertising platform.

The changes coincide with the introduction of a new law in the European Union, the General Data Protection Regulation. The law, which is to take effect next month, requires technology companies to limit their collection of user data to what they need to perform services, and to obtain customers’ consent for how their data will be used and with whom it will be shared.