"As an illustrative example, we quantify the portion of FB users labeled with the ad preference Homosexuality in countries where homosexuality is punished even with the death penalty." <https://cacm.acm.org/magazines/2021/1/249457-does-facebook-use-sensitive-dat...> Citizens worldwide have demonstrated serious concerns regarding the management of personal information by online services. For instance, the 2015 Eurobarometer about data protection^13 <https://cacm.acm.org/magazines/2021/1/249457-does-facebook-use-sensitive-dat...> reveals that: 63% of citizens within the Eurpean Union (EU) do not trust online businesses, more than half do not like providing personal information in return for free services, and 53% do not like that Internet companies use their personal information in tailored advertising. Similarly, a recent survey carried out among U.S. users^9 <https://cacm.acm.org/magazines/2021/1/249457-does-facebook-use-sensitive-dat...> reveals that 53% of respondents were against receiving tailored ads from the information websites and apps learn about them, 42% do not think websites care about using users data securely and responsibly at all, and 73% considers websites know too much about users. A survey conducted by Internet Society (ISOC) in the Asia-Pacific region in 2016^8 <https://cacm.acm.org/magazines/2021/1/249457-does-facebook-use-sensitive-dat...> disclosed that 59% of the respondent did not feel their privacy is sufficiently protected when using the Internet, and 45% considered getting the attention of policymakers in their country on data protection a matter or urgency. Policymakers have reacted to this situation by passing or proposing new regulations in the area of privacy and/or data protection. For instance, in May 2018, the EU enforced the General Data Protection Regulation (GDPR)^6 <https://cacm.acm.org/magazines/2021/1/249457-does-facebook-use-sensitive-dat...> across all 28 member states. Similarly, in June 2018, California passed the California Consumer Privacy Act,^3 <https://cacm.acm.org/magazines/2021/1/249457-does-facebook-use-sensitive-dat...> which is claimed to be the nation's toughest data privacy law. In countries like Argentina or Chile, the governments proposed new bills in 2017 updating their existing data protection regulation.^11 <https://cacm.acm.org/magazines/2021/1/249457-does-facebook-use-sensitive-dat...> For this article, we will take as reference the GDPR since it is the one affecting more countries, citizens, and companies. The GDPR (but also most data protection regulations) define some categories of personal data as sensitive and prohibits processing them with limited exceptions (for example, the user provides explicit consent to process that sensitive data for a specific purpose). In particular, the GDPR defines as sensitive personal data as: "data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation." In a recent work,^2 <https://cacm.acm.org/magazines/2021/1/249457-does-facebook-use-sensitive-dat...> we demonstrated that Facebook (FB) labels 73% of users within the EU with potentially sensitive interests (referred to as ad preferences as well), which may contravene the GDPR. FB assigns user's different ad preferences based on their online activity within this social network. Advertisers running ad campaigns can target groups of users that have been assigned a particular ad preference (for example, target FB users interested in Starbucks). Some of these ad preferences may suggest political opinions (for example, Socialist party), sexual orientation (for example, homosexuality), personal health issues (for example, breast cancer awareness), and other potentially sensitive attributes. In the vast majority of the cases, the referred sensitive ad preferences are inferred from the user behavior in FB without obtaining explicit consent from the user. Then advertisers may reach FB users based on ad preferences tightly linked to sensitive information. For instance, one of the authors of this article received the ad shown in Figure 1 <https://dl.acm.org/cms/attachment/0b939a23-27ba-4a78-9acf-ce60ab6190dc/f1.jp...> (left side). The text in the ad clearly reflects the ad was targeting homosexual people. The author had not explicitly defined his sexual orientation, but he discovered that FB had assigned him the /"Homosexuality"/ ad preference (see Figure 1 <https://dl.acm.org/cms/attachment/0b939a23-27ba-4a78-9acf-ce60ab6190dc/f1.jp...> right side). First, this article extends the scope of our analysis from the EU to 197 countries worldwide in February 2019. We quantify the portion of FB users that have been assigned ad preferences linked to potentially sensitive personal data across the referred 197 countries. Second, we analyze whether the enactment of the GDPR on May 28, 2018 had some impact on the FB practices regarding the use of sensitive ad preferences. To this end, we compare the number of EU users labeled with potentially sensitive ad preferences in January 2018, October 2018 and February 2019 (five months before, five months after and nine months after the GDPR was enacted, respectively). Third, we discuss privacy and ethics risks that may be derived from the exploitation of sensitive FB ad preferences. As an illustrative example, we quantify the portion of FB users labeled with the ad preference Homosexuality in countries where homosexuality is punished even with the death penalty. Finally, we present a technical solution that allows users to remove in a simple way the sensitive interests FB has assigned them. [...] Facebook offers advertisers the option to commercially exploit potentially sensitive information to perform tailored ad campaigns. This practice lays, in the best case, within a gray legal area according to the recently enforced GDPR. Our results reveal that 67% of FB users (22% of citizens) worldwide are labeled with some potentially sensitive ad preference. Interestingly, users in rich developed countries present a significantly higher exposure to be assigned sensitive ad preferences. Our work also reveals that the enforcement of the GDPR had a negligible impact on FB regarding the use of sensitive ad preferences within the EU. We believe it is urgent that stakeholders within the online advertising ecosystem (that is, advertisers, ad networks, publishers, policymakers, and so on) define an unambiguous list of personal data items that should not be used anymore to protect users from potential privacy risks as those described in this article.