Research finds that privacy-protected ad targeting and campaign metrics can compose into an inference channel. The result is a systems limit, not evidence of misuse by one named platform.