Angel Merino
Universidad Carlos III de Madrid, Leganes, Madrid, Spain
The literature has shown that combining a few non-Personal Identifiable Information (non-PII) is enough to make a user unique in a dataset including millions of users. This work demonstrates that a combination of a few non-PII items can be activated to nanotarget users. We demonstrate that the combination of the location and 5 rare (13 random) skills in a LinkedIn profile is enough to become unique in a user base of ∼970M users with a probability of 75%. The novelty is that these attributes are publicly accessible to anyone registered on LinkedIn and can be activated through advertising campaigns. We ran an experiment configuring ad campaigns using the location and skills of three of the paper's authors, demonstrating how all the ads using >13 skills were delivered exclusively to the targeted user. We reported this vulnerability to LinkedIn, which initially ignored the problem, but fixed it as of November 2023.
doi.org/10.1145/3613904.3642107
The ACM CHI Conference on Human Factors in Computing Systems (https://chi2024.acm.org/)