Facebook shut down Signal's ads because they exposed too much

Facebook has barred privacy-focused messaging app Signal from running a series of Instagram ads, which would have exposed just how much personal information the photo-sharing network – and its social media behemoth owner – has on individuals as they browse their timeline. Signal had intended to use Instagram's own third-party advert tools to reveal some of the precise targeting that advertisers can buy access to.

There's a general acknowledgement these days that advertisers can filter who, exactly, sees their commercials. That makes good business sense, after all: there's no point in showing ads to people who are unlikely to be interested in your product.

However it's likely that few mainstream consumers are aware of quite how much targeted information ad network providers like Facebook hold on them. Collated across multiple interactions online – with websites, apps, services, and more – they help build unexpectedly precise profiles about each user. Those profiles can then in turn be sold as visibility filters to more advertisers, so that they can further narrow down their campaigns to whoever they believe will be the most receptive audience.

That's just what Signal aimed to do with its Instagram adverts, only the content itself would be an exposé of the detail in those profiles. "You got this ad because you're a K-pop-loving chemical engineer," copy for one ad reads. "This ad used your location to see you're in Berlin. And you have a new baby. And just moved. And you're really feeling those pregnancy exercises lately."

"You got this ad because you're a GP with a Master's in art history. Also divorced," another ad reads. "This ad used your location to see you're in London. Your online activity shows that you've been getting into boxing, and you're probably getting there on your new motorcycle."

The insightful ads aren't mind-reading, of course, even if they might feel like it if you're in the target category. Instead, the multi-variant targeted ads pull from some of the information Facebook's advertising platform collects, Signal explains. Unsurprisingly, however, "Facebook was not into that idea," Signal's Jun Harada, Head of Growth and Communication, writes.

Instead, Facebook not only refused to run the campaign, it disabled the ad account altogether.

It's not the first time we've seen the Signal team use privacy-stretching companies' own tools used against them. Back in April, Signal creator Matthew Rosenfeld – who goes by Moxie Marlinspike or "moxie0" online – acquired a Cellebrite UFED system as beloved by law enforcement, and which is typically used to extract data from confiscated smartphones. Rosenfeld dissected its software, discovering at least one huge security flaw in the process, and publicizing it on the Signal company blog.

Just how much information companies like Facebook are gathering on people is a topical issue, meanwhile. Apple recently launched its App Tracking Transparency system in iOS 14.5, requiring app-makers to request explicit permission from users before they can share their data across other companies' apps and websites, or sell it to data brokers. Facebook was arguably the most high-profile critic of the system, which it has said could have a huge and detrimental impact on the accuracy of its ad targeting.