> Fig. 6. In the privacy settings the user can decide who can look their profile up using the provided email address and phone number. The most restrictive option available is “Friends”. We find that even when the user sets the PII visibility to “Only me” and searchability to “Friends”, the advertisers can still use that bit of information for targeting.

> 4.3.5 PII obtained without user’s knowledge ... Facebook could learn users’ PII from their friends would be by scanning friends’ contact databases, linking contacts to existing Facebook accounts, and then augmenting the Facebook accounts with any additional PII found in the contacts database ... We found that the previously-unused phone number became targetable in 36 days, 13 showing that it had indeed been linked to the corresponding author’s account without their knowledge. Making this situation worse, the matched phone number was not listed on the account’s profile, nor in the “Download Your Information” archive obtained from Facebook [5]; thus the target user in this scenario was provided no information about or control over how this phone number was used to target them with ads.