Privacy and Targeting on LinkedIn: Insights into the Campaign Manager

Table of Links

Abstract and Introduction

LinkedIn Advertising Platform Background

Dataset

Methodology

User’s Uniqueness on LinkedIn

Nanotargeting proof of concept

Discussion

Related work

Ethics and legal considerations

Conclusions, Acknowledgments, and References

Appendix

2 LinkedIn Advertising Platform Background

One of LinkedIn’s primary sources of revenue is online advertising [9]. Advertisers use the LinkedIn Campaign Manager [10] to define their target audience by selecting attributes such as location, gender, age, professional skills, etc. Once the target audience is defined, LinkedIn delivers the ads to users whose profile matches the selected attributes. For example, an advertiser could target users in Germany between 18 and 25 who are skilled in Python AND R.

LinkedIn reports the estimated number of users that match the target audience defined through the dashboard, referred to as Target Audience Size. This information permits advertisers to know the potential reach of their ad campaign. In our work, we leverage this functionality and use specific HTTP queries to systematically collect the size of thousands of audiences.

An essential feature of the LinkedIn Campaign Manager is that it allows us to narrow the audience size by combining non-PII attributes using the AND operator. Moreover, the information of users (location, skills, experience, education, etc.) is publicly available in their profile for anyone registered on LinkedIn. We have explored whether it is possible to customize the access to a user profile (e.g., to limit the access only to direct contacts), and it was not possible. It is important to note that LinkedIn is a professional social network where users are willing to expose their profiles publicly. This may be why LinkedIn does not consider offering users profile visibility customization options relevant.

LinkedIn seems to consider that revealing the actual value of small audiences may be problematic and does not report the actual audience size for any audience formed by less than 300 users. This is a positive privacy-preserving measure, a standard among social media platforms with a similar business model. For instance, Facebook and TikTok have defined a lower bound of 1000 users. Moreover, we found a LinkedIn document including guidelines for advertisers where they specifically state: "The minimum audience size required to run an advertising campaign is 300 members" [11]. We understand this as a policy imposed by LinkedIn on ad campaigns. This measure would impede advertisers (attackers) from running nanotargeting campaigns to target a specific individual. Unfortunately, this paper demonstrates that this policy is not effectively enforced since it is possible to nanotarget LinkedIn users.