Facebook maintains that users have some level of anonymity when clicking on ads.

It does this by preventing ad campaigns that launch with less than a minimum audience size.  Or so it claimed.  My research showed that anyone who can Google can find out how to get past their flimsy security.

This means anyone could target an ad to JUST YOU.  And you’d never know it.   Worse than that, if you click on the ad to an advertiser’s website, they’ll know exactly who you are even if you don’t type in any identifying information in.

Facebook said they fixed the flaw, they even paid me a bug bounty for it. But it’s still very possible to do.

Read more here.