Facebook’s advertising principles and statements from the VP of ads, Rob Goldman, emphasize that its Ads Preferences tool allows users to “control how your data informs your ad experience.” However, Irfan Faizullabhoy and I have observed that when it comes to one of the most privacy-sensitive types of data, location, Facebook does not provide meaningful controls and is misleading in its statements to users and advertisers. Moreover, Facebook gives advertisers tools to run ad campaigns targeting people “who live in” or “were recently in” a geographic area as small as a single house. Taken together, Facebook creates an illusion of control rather than gives actual control over location-related ad targeting, which can lead to real harms.

Few Location Controls are Available

The Ads Preferences page does not contain any location controls, except for a sub-section in interests titled Travel, places and events, which is not clearly connected to any specific location history. For me, the section contained a combination of cities and countries I’ve never been to: Kuala Lumpur, Buenos Aires, Argentina, Uruguay, and other eclectic things: Holiday, Tourism, Booking.com, Sampling (music). This lack of specificity and relation to where I’ve been made it clear it is not a location control. So I dug deeper, and clicked on the link at the bottom, How Facebook ads work. Here Facebook says “We use location data to show you ads from advertisers trying to reach people in or near a specific place” and provides yet another link, “Learn more about your location data”, which leads to Location Settings.

Location Settings mention two things: Location History and the location permissions given to the Facebook app on the mobile device. An explanation About Location History says it “lets you explore what’s around you, get more relevant ads, and help improve Facebook.” Given that advertising is presented as one of the main use cases for Location History, a reasonable Facebook user might conclude that turning off Location History and not granting Facebook the permission to access location on the mobile app will prevent the geo-targeting of ads. But that is not the case.

Exercising Location Controls has No Effect on Ad Targeting

Over the course of several months, I have had my privacy setting in Location Services for Facebook on iOS set to “Never” and Location History cleared and turned off. Nevertheless, Facebook showed me ads targeted at “people who live near Santa Monica” (which is where I live) or “people who live or were recently near Los Angeles” (which is where I work). Moreover, I have noticed that whenever I travel for work or pleasure, Facebook continues to keep track of my location and use it for advertising: a trip to Glacier National Park resulted in an ad for activities in Whitefish, Montana, a trip to Cambridge, MA — in an ad for a business there, and a visit to Herzeliya, Israel — in an ad for a business there.

My profile does not contain my current city, I haven’t uploaded photos to Facebook for years, I don’t post content tagged with my location or check-in to places. I don’t give access to my location to WhatsApp, Instagram or Facebook Messenger. I don’t search for places on Facebook. Yet the location-based ads, using my actual locations, keep coming. Some of the explanations by Facebook for why I am seeing a particular ad even mention specifically that I am seeing the ad because I was “recently near their business”.

The Location Controls provided by Facebook give an illusion of control over the data that informs one’s ad experience, not actual control. Moreover, Facebook makes false claims about the effect of controls.

Facebook claims that “Local awareness ads were built with privacy in mind. […] People have control over the recent location information they share with Facebook and will only see ads based on their recent location if location services are enabled on their phone.” However, as the Cambridge, MA and other numerous ads I’ve seen over the last few months show — this claim is false. For example, since the Cambridge ad states I’m seeing it because I “live or were recently near Cambridge,” and I don’t live in Cambridge, it means I am seeing it based on my recent location, despite my location services and Location History being disabled. The explanation given by Facebook for showing me this ad relies only on being near a specific location.

How Facebook Learns your Location when Location Settings are Off

In How Facebook ads work section on “Your location”, Facebook discloses that it gets location data from sources such as “Where you connect to the Internet” and “Where you use your phone”. What Facebook does not mention there is that exercising all provided location controls will not stop the company from going to great lengths to obtain and use location data for advertising.

Reading Facebook’s explanations to advertisersprovides insight into how this is done. Specifically, Facebook tells advertisers that it learns user locations from the IP address, WiFi and Bluetooth data.