Input data and information sources
Advertisers supply advertisements and audience criteria; click behaviour can be deliberately falsified. The system analyses individual usage behaviour and profiles.
Personalised online advertising (behavioural targeting)
Also known as: Behavioural advertising, ad targeting
The system uses a person's behaviour and profile to select which advertisements they see.
Understand the use case
What defines this use case?
Meta states that it uses such models to serve advertisements. The European Data Protection Board has ruled on the permitted legal basis.
This page describes a typical system design. Actual data flows and permissions depend on your implementation.
- System design
- Analysis and processing
- Ability to act
- Provides results for subsequent use
- Fields of use
- online platforms
- Also known as
- targeting, behavioural advertising, audience targeting
How it works, step by step
System design and data flows
Input data
Visited pages, clicks, profile details and advertisers' criteria are combined.
Advertisers supply advertisements and audience criteria; click behaviour can be deliberately falsified. The system analyses individual usage behaviour and profiles.
Processing
A model estimates response likelihood for each suitable advertisement; an auction determines their order.
Processing links usage and contextual signals to a target audience or an estimated response to advertisements. Selection or auction logic determines which advertisement is delivered. Model estimates, bids and actual delivery each serve a distinct purpose.
Results
The person sees selected advertisements on the website or app.
The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.
Use and impact
Selection determines which offers someone sees or misses, and their response feeds back into the profile.
The model supplies information for subsequent use. Selection, adoption or a professional decision in the following workflow is a separate step and should not automatically be attributed to the model.
Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.
7 review first10 clarify9 baseline threats
- Present
- Depends on your system
- Absent
- Review first
- To clarify
How to use the model
The diagram shows the typical architecture. Select a component to see what happens there and adapt its features to your system. Enable “Analysis guidance” to see which threats need reviewing for this architecture. The page's checklist continues to describe the typical case.
Changes from the typical case
None yet. Each change will appear here.
Where most threats arise
- 4 clarify
- 3 review first
- 2 review first, 1 clarify
- 3 clarify
In this system design: 7 to review first, 10 to clarify, 9 baseline threats.
Architecture as a list
External access: Depends on your system
To clarify
Input: Part of every AI system
Review first
- Privacy Attacks Review priority
- Sensitive Information Disclosure
To clarify
Baseline for every AI system
Third-party content: Present
AI model: Part of every AI system
Review first
- Misalignment Review priority
Baseline for every AI system
Provider service: Depends on your system
To clarify
Document collection: Present
Review first
To clarify
Training and feedback: Present
Review first
Result: Part of every AI system
Baseline for every AI system
person: Part of every AI system
Baseline for every AI system
Affected person: Depends on your system
Unapproved AI services: Depends on your system
To clarify
Supply chain and technical foundations: 5 baseline threats applying to every AI system
Baseline for every AI system
How it differs from similar use cases
Selects the service's own products or content rather than paid advertisements
Image, video and voice generation
Generates advertising creative rather than selecting existing advertisements
Data and information
Processing and operating environment
The model processes the inputs. Whether it runs internally or with a service provider must be established for the specific implementation.
Storage and further use
The system retrieves advertisements from a large collection to match the person's profile. The platform trains its models on its own users' responses.
Results and data sharing
Serving advertisements through networks passes personal information to other companies.
Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.
Assess risks and determine measures
From understanding the system to analysing risks
- Define the system boundary
Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.
- Investigate threats
Relate review candidates to actual data flows: what could happen, and who would be affected?
- Assess risk
Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.
- Provide evidence of measures
Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.
Key threats in the application context
- 3 particularly important
- 4 typical
- 10 depending on the system
- 9 for every AI system
A total of 26 threats from the threat catalogue may be relevant to this use case.
Priority review points
The model assigns someone to an audience such as debt advice or fertility based on browsing. Advertisers indirectly learn information the person never supplied through that audience selection.
The system learns that people in crisis or with gambling addiction click more and serves them more such advertisements. Click rates rise while the most vulnerable suffer harm.
Automated click fraud creates apparent interest in particular advertisements. The model learns false relationships, and advertisers pay for nonexistent reach.
4 further review candidates in the typical design
Other relevant threats
Targeted Poisoning / Label Poisoning
Falsified training labels can deliberately shift model outputs.
Listed because of this characteristic
- Uses operational feedback
Training data or an adopted base model can introduce hidden triggers for misbehaviour.
Listed because of this characteristic
- Learns from your own data
Sensitive Information Disclosure
Confidential content can appear in answers, supplied context or logs.
Listed because of this characteristic
- Processes personal data
RAG-Specific Attacks (Document Poisoning)
Content entering the retrievable knowledge collection can influence answers and subsequent steps.
Listed because of this characteristic
- Searches its own document collection
Up to 10 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system.
System features and open questions
Each Yes adds further threats to your checklist, up to 10 in total. If you cannot yet answer a question, include its threats in your review.
- Added by this Yes
How your system is built
How you operate the system
- Available to people outside the organisation5 threats
- Accepts queries directly through an interface4 threats
- Accessible over a network3 threats
- Incurs costs with each query1 threat
- Passes content to services outside your environment1 threat
- Shares computing resources with other customers or applications1 threat
- Used alongside unapproved AI services1 threat
How your system is built
Do documents from several customers, departments or permission groups share one search store?
Advertising platforms hold many advertisers' customer lists and audiences in one system.
If yes, add
Does the system process confidential information such as trade secrets, health or financial data?
Interests and visited pages can reveal health, religion or political views.
If yes, add
Does the system process several input types together, such as text with images or speech?
If yes, add
How you operate the system
These questions arise for almost every AI system.
Can people or programs query the model directly, for example through an interface?
If yes, add
Is the system accessible over a network or dependent on network services?
If yes, add
Do you pay per query or unit of computing time, so costs increase with use?
If yes, add
Can content leave your environment, for example to a cloud provider, web search or email?
Serving advertisements through networks passes personal information to other companies.
If yes, add
Does the system share servers or computing resources with other customers or applications?
If yes, add
Can people outside your organisation use the system, including without login?
Outside advertisers book advertisements and define their own audiences on advertising platforms.
If yes, add
Do staff also use AI services for this task that your organisation has not approved?
If yes, add
Controls and implementation
Measures for the priority review areas are expanded. Each linked measure explains how to implement it.
Review priorityPrivacy Attacks3 measures
Review priorityMisalignment3 measures
Review priorityTraining Data Poisoning2 measures
Targeted Poisoning / Label Poisoning3 measures
Backdoor ML Model2 measures
Sensitive Information Disclosure3 measures
RAG-Specific Attacks (Document Poisoning)3 measures
Controls for the remaining threats are available on their pages in the threat catalogue.
AI Act provisions
-
Art. 4: AI literacy
For every AI system Applies since 2 February 2025.
-
Art. 5 para. 1 point a, b: Manipulation and exploitation of vulnerability
Depending on use Review trigger since 2 February 2025.
-
Annex III no. 8 point b: Elections and voting
Depending on use Review trigger from 2 December 2027.
Applies to every AI system
Art. 4: AI literacy
Applies if staff or appointed representatives operate or use AI systems.
Applies since 2 February 2025.
Obligations and details for Art. 4: AI literacy
- Who bears the obligations
- Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model
Detailed obligations
May apply in particular uses
Art. 5 para. 1 point a, b: Manipulation and exploitation of vulnerability
Applies if advertisement targeting deliberately exploits vulnerabilities due to age, disability or economic distress in a way that risks significant harm.
Applies since 2 February 2025.
Obligations and details for Art. 5 para. 1 point a, b: Manipulation and exploitation of vulnerability
- The general condition is
- Applies if the system influences behaviour through subliminal, manipulative or deceptive means, or exploits vulnerability due to age, disability or social or economic circumstances, with a risk of significant harm.
- Who bears the obligations
- Provider, Deployer, Importer, Distributor, Authorised representative, Product manufacturer, Provider of a general-purpose AI model
Detailed obligations
Annex III no. 8 point b: Elections and voting
Applies if the system targets political advertisements to influence an election's outcome or voting behaviour.
Applies from 2 December 2027.
Obligations and details for Annex III no. 8 point b: Elections and voting
- The general condition is
- Applies if the system is intended to influence election results or voting behaviour.
- Exception
- Tools whose outputs do not directly reach people, such as political campaign organisation and logistics tools.
- Who bears the obligations
- Provider, Deployer, Product manufacturer
Detailed obligations
Other legal requirements
Articles 26 and 28 DSA
Platforms must identify advertisements and explain the main selection criteria. They must not show minors profiling-based advertisements.
Articles 21 and 22 GDPR
People may object to profiling for advertising at any time. Solely automated decisions with significant effects are permitted only under limited conditions.
Classify your system with the quick checker All obligations in the obligations compass
Cross-cutting threats
Review these threats for every AI system, whatever its purpose.
Atypical system features
View 14 further questions
If any of these features does apply to your system, add the listed threats.
Does the system generate its own text, such as answers, drafts or summaries?
If yes, add
Does the system generate or edit images, sounds, voices or videos?
The system selects existing advertisements and does not generate its own creative material.
If yes, add
Does the system create new content from open-ended requests that people read, see or hear directly? Translation, reading aloud and transcription do not count.
If yes, add
Can users give the system natural language tasks that it then performs?
If yes, add
Does the system formulate answers from retrieved documents?
If yes, add
Does the system remember content from earlier conversations or tasks and reuse it later?
If yes, add
Does the system call other programs, interfaces or search services itself, even if only to read?
If yes, add
Can the system change things itself, such as storing data, sending messages, initiating transactions or granting permissions?
If yes, add
Does the system determine its next steps itself based on earlier results?
If yes, add
Does the system delegate tasks to other AI agents or incorporate their results?
If yes, add
Is the system connected to tools or data sources through the Model Context Protocol (MCP)?
If yes, add
Does the system directly move or control something physical, such as motors, valves, vehicles or temperatures?
If yes, add
Does the system generate code, scripts or database queries for further use?
If yes, add
Does the system execute programs, scripts or commands itself?
If yes, add
Sources
- Authority, court or parliament
The Board issued a binding decision on the legal basis for behavioural advertising on Facebook.
- Report of a deployment
Meta, Expanding GenAI Transparency for Meta’s Ads Products, February 2025 According to the deployer
Meta states that it uses machine learning models to serve advertisements.
- Legislation, norm or standard
Digital Services Act (DSA), Articles 26 and 28 (dejure.org)
Online platform advertising must be identifiable, and minors must not receive profiling-based advertisements.
Related use cases
Also in the field of Customer service, marketing and platforms
- Customer service chatbots and voicebotsA bot independently handles customers' or citizens' requests in chat or by phone and passes difficult cases to people.
- Recommender systemThe system uses a person's behaviour and profile to select products, content or search results and determine their order.
- Dynamic pricingOnline retailers and platforms automatically adjust prices to demand, costs, capacity and competitors' prices.
- Automated content moderationPlatforms automatically identify unlawful content or breaches of their rules and remove, restrict or refer posts for human review.
- Image, video and voice generationThe system generates or edits images, videos and audio from a short description, for example for advertising and communication.
Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured