[groovecoder]

I found the statements about PII uploaded by advertisers confusing. The authors say “PII uploaded by advertisers to target customers via custom audiences” was NOT found “being used for advertising” but the whole point of uploading PII into custom audiences is to target them for advertising.

You have to read the details later, where they uploaded 2 different pieces of PII for a customer - one already associated with a FB user, and therefore targetable. The other was brand new PII. Only the latter was not found to be targetable.

So yay - Facebook doesn’t use rainbow table lookups to extract plaintext PII from hashes that advertisers upload. Gold star for them.