Making Sense of Private Advertising: A Principled Approach to a Complex Ecosystem

TL;DR

This paper models the private advertising ecosystem, revealing inherent privacy leakage and proposing a redefined, realistic notion of privacy that aligns with user expectations and the ecosystem's complexities.

Contribution

It provides a comprehensive model of the advertising pipeline, demonstrates the impossibility of perfect privacy, and proposes a new approach to privacy that considers the ecosystem's inherent trade-offs.

Findings

Perfect privacy is impossible in advertising ecosystems.

Current privacy notions do not compose well across the ecosystem.

New privacy approaches are needed to align with user expectations.

Abstract

In this work, we model the end-to-end pipeline of the advertising ecosystem, allowing us to identify two main issues with the current trajectory of private advertising proposals. First, prior work has largely considered ad targeting and engagement metrics individually rather than in composition. This has resulted in privacy notions that, while reasonable for each protocol in isolation, fail to compose to a natural notion of privacy for the ecosystem as a whole, permitting advertisers to extract new information about the audience of their advertisements. The second issue serves to explain the first: we prove that \textit{perfect} privacy is impossible for any, even minimally, useful advertising ecosystem, due to the advertisers' expectation of conducting market research on the results. Having demonstrated that leakage is inherent in advertising, we re-examine what privacy could realistically mean in advertising, building on the well-established notion of \textit{sensitive} data in a specific context. We identify that fundamentally new approaches are needed when designing privacy-preserving advertising subsystems in order to ensure that the privacy properties of the end-to-end advertising system are well aligned with people's privacy desires.