Clicking an ad can send the advertiser a signal about who you are. New research maps exactly how strong that signal gets over time.
Researchers built a formal model of the targeted advertising pipeline, focusing on a step most privacy discussions skip: when a user interacts with an ad, the advertiser may receive an observation tied to that specific person rather than an anonymized count. The team generated synthetic user populations with known sensitive labels, created campaign scenarios across four topic types, and tested Bayesian, supervised, and adaptive inference attacks against the resulting event data. After 160 repeated campaigns, the strongest attacks reached roughly 0.64 AUC - comfortably above the 0.50 floor of random guessing. No exotic tracking required; ordinary interaction feedback, accumulated across enough campaigns, does the work.
This reframes a debate the industry has conducted largely around cookies and device fingerprinting. The problem here is more structural: advertisers who target users matching a particular profile receive interaction data that, by construction, reflects that profile back to them. The research also validates the aggregate-reporting design at the core of Apple's SKAdNetwork and Google's Privacy Sandbox, identifying it as the strongest single defense because it severs the individual-level link before any inference can begin.
The benchmark and code are public - which makes it harder for platforms to file this under theoretical concern and move on.