When Personal Becomes Profitable: Sensitive Targeting on X

AI Forensics investigation reveals how X's advertising system allows brands to target users based on sensitive personal data categories

18-06-2025

Want to check if you've been targeted by ads based on sensitive data? haveibeentargeted.online

Our investigation relied on X's Ads Repository, which, unlike competitors such as Meta that limit disclosure to basic demographics, reveals the actual keywords used to target users.

Key findings:

Major brands target sensitive personal data ranging from political opinions and sexual orientation to religious beliefs and health conditions
Companies like TotalEnergies exclude users interested in Green politicians and environmental activists
Dell Technologies targeted users with interests in specific medications, sexual orientation, and faith
Saudi Arabia's Public Investment Fund excluded users based on ethnic origin, faith, and sexual orientation keywords

We archived and publicly released all targeting options used by these brands, allowing anyone to make their own determination as to whether such practices contravene EU regulations, from the GDPR to the DSA.

Solution & Methodology

For this report, we exported from X's Ads Repository the ads that major advertisers ran between September 2023 and May 2025. Despite contacting X's team, we were not granted API access, restricting our study to a limited number of advertisers. We then manually inspected targeting options to determine whether any relied on criteria that could be construed as revealing "sensitive categories" of personal information as per the GDPR. For instance, we flagged ads targeting users based on their interest in political movements or figures' names, or those targeting drug and illness names

20-11-2024
Le Monde reports on our investigation uncovering hundreds of ads that used "sensitive" targeting criteria in ways that were likely illegal under EU law.