Online advertising once seemed like background noise. A banner here, a sponsored post there. Yet fresh research shows those ads form a revealing mosaic. Large language models can now examine the sequence of promotions a person encounters and extract sensitive details about them. Gender. Age range. Education level. Job status. Even political leanings.
The implications hit hard for anyone who spends time on social platforms. No clicks required. No search history scraped. Just the ads delivered to a screen. And common defenses fall short. A VPN changes nothing. Incognito mode changes nothing. The signals travel with the content itself.
Lead author Baiyu Chen and colleagues at UNSW Sydney detailed the process in their paper presented at the ACM Web Conference 2026. They collected more than 435,000 Facebook ad impressions from 891 Australian users through a citizen-science browser extension. The data spanned sessions from 2021 to 2023. UNSW researchers processed these impressions with off-the-shelf multimodal LLMs.
First the model described each ad. Captions, visual categories, key entities, industry classifications. Then it received batches of those descriptions. Sometimes just a handful from one sitting. The LLM produced reasoned guesses about the viewer. Accuracy surprised the team.
At the session level, using Gemini 2.0 Flash, the system reached 59.13% accuracy on gender. It hit 42.70% on education level and 48.38% on employment status. Party preference came in at 35.13%. Those numbers beat random guessing and simple census baselines. They held up even when the observation window stayed short, between three and 50 ads.
Longer views improved results further. Aggregating across a user’s sessions pushed gender accuracy to 76.38%. Employment reached 62.46%. The models also delivered strong directional accuracy on continuous traits such as age and income. Mean absolute error for age dropped to 0.85 years in user-level predictions.
Chen put the core insight plainly. “The key point is that the ads a person sees are not random. Advertising systems optimise delivery based on inferred profiles and behaviours, so the overall pattern of ads shown to a user can carry signals about traits such as gender, age, education, employment status, political preference, and broader socioeconomic position.” (UNSW Newsroom).
The study compared LLM performance against human raters. Six people reviewed 100 sampled sessions. The machines proved faster. Dramatically so. They ran 52 times quicker. They cost 223 times less. On several attributes the LLMs matched or outperformed the humans. Education inference reached 51% for the models versus 33.67% for people. Employment stood at 53% against 37.83%.
Such efficiency matters. An adversary no longer needs deep pockets or insider access. Basic technical skill and access to commercial APIs suffice. Browser extensions offer a stealthy collection method. Many already request permission to read page content for legitimate features like ad blocking or translation. The same rights let them quietly log every promotion that appears.
Platforms have tried to limit explicit targeting of sensitive categories. Meta announced changes in 2022. Yet optimization algorithms still adjust delivery based on predicted user traits. The ads themselves become carriers of that prediction. The new work demonstrates how easily those carriers can be decoded after the fact.
TechRadar covered the findings on the day they gained wider notice. The piece stressed that VPNs provide zero shield because the inference happens from content that reaches the device regardless of routing. It also highlighted the scalability. Short sessions suffice for actionable profiles. (TechRadar).
Earlier studies had shown LLMs inferring traits from text people write. Reddit comments. Chatbot conversations. This project shifts focus to passive consumption. The viewer does not create the signal. The platform does. That distinction weakens many existing privacy assumptions.
Related work on LLM privacy risks appeared throughout 2024 and 2025. One NeurIPS paper examined vision-language models inferring location and other details from background objects in photos. Another explored how chatbots could extract information through ordinary questions. The ad-exposure research stands apart because it requires no user-generated content at all.
Chen and his co-authors, including Benjamin Tag, Hao Xue, Daniel Angus and Flora Salim, flagged limitations. Their dataset came from self-selected desktop Facebook users in Australia. Results might differ on mobile or in other countries. The pipeline first summarized ads then reasoned from text, possibly missing some visual nuance. Still, the core demonstration holds. Ad streams function as high-fidelity footprints.
Defenses look incomplete. Users can review ad preferences on major platforms and tighten permissions on browser extensions. Yet the broader advertising economy leaves little room for full opt-out. Platforms themselves face pressure to rethink how optimization leaks information. Regulators may need to expand beyond data collection rules to cover inferences drawn from exposure patterns.
The pace of progress adds urgency. Multimodal models grow more capable each quarter. Costs continue to fall. What required careful human analysis yesterday now runs automatically at scale. And the data source never sleeps. Every refresh of a social feed or news site adds fresh signals.
Industry insiders have long discussed behavioral targeting. This shifts the conversation. The behavior in question is not what users do but what they are shown. The distinction blurs in practice. Advertisers pay for precision. Platforms deliver it through invisible profiling. Now third parties can tap the same signals without any partnership.
Concerns extend beyond individual privacy. Political campaigns could micro-target based on inferred leanings without ever seeing a voter file. Employers might screen candidates through observed ad patterns. Insurers could adjust offers. All without the targeted person uploading a resume or filling out a form.
So the research lands at a pivotal moment. Generative AI tools have democratized many capabilities. Content creation. Code writing. Now profiling joins the list. The barrier that once protected ordinary users has dropped. The question is whether the advertising system can adapt before the risks compound.
Chen offered a measured view on mitigation. “In terms of protection, users can reduce the risk by being cautious with browser extensions, limiting unnecessary permissions, and using available privacy and ad-personalisation settings. However, this is not something users can fully solve on their own, because the broader issue is systemic.” (UNSW Newsroom).
His team’s code sits publicly on GitHub for review and replication. That transparency invites further scrutiny and, perhaps, countermeasures. Yet the genie has left the bottle. Off-the-shelf models already deliver results that once demanded specialized expertise.
Advertising will remain essential to the free internet. The open question is whether the current mechanics can evolve to limit unintended leakage. Until then, the ads in the corner of the screen may say more about a person than they realize. And AI stands ready to listen.
WebProNews is an iEntry Publication