  The privacy of an individual is bounded by the ability of a third party to
reveal their identity. Certain data items such as a passport ID or a mobile
phone number may be used to uniquely identify a person. These are referred to
as Personal Identifiable Information (PII) items. Previous literature has also
reported that, in datasets including millions of users, a combination of
several non-PII items (which alone are not enough to identify an individual)
can uniquely identify an individual within the dataset. In this paper, we
define a data-driven model to quantify the number of interests from a user that
make them unique on Facebook. To the best of our knowledge, this represents the
first study of individuals' uniqueness at the world population scale. Besides,
users' interests are actionable non-PII items that can be used to define ad
campaigns and deliver tailored ads to Facebook users. We run an experiment
through 21 Facebook ad campaigns that target three of the authors of this paper
to prove that, if an advertiser knows enough interests from a user, the
Facebook Advertising Platform can be systematically exploited to deliver ads
exclusively to a specific user. We refer to this practice as nanotargeting.
Finally, we discuss the harmful risks associated with nanotargeting such as
psychological persuasion, user manipulation, or blackmailing, and provide
easily implementable countermeasures to preclude attacks based on nanotargeting
campaigns on Facebook.
