Privacy-Preserving Advertising: How It Works

---

With zero-knowledge encryption, traditional behavioral advertising (tracking everything users do) won't work. But there are several privacy-first advertising models that can.

Traditional Ads	Privacy-First Ads
Track everything → Build profile → Target ads	Aggregate or contextual → No individual profiles
User has no control	User controls what's shared
Data is an asset (and liability)	Data minimization
"Free" but you're the product	Transparent value exchange

---

Where Ads Live (and Where They Never Will)

Lantern's offers appear only on discovery surfaces: the venue listings, the dashboard hero rail, the inline venue card, and the feed. These are places a user is already browsing to decide where to go, so an offer reads as venue hospitality rather than surveillance. It is pull, not push.

The encrypted 1:1 chat thread is deliberately ad-free, by architecture. There is no chat ad placement, and the system cannot target the intimate space between two people who connected. This is a permanent product guarantee, not a default we might revisit:

• The chat is end-to-end encrypted, so the server cannot read it. Any "targeting" of chat content would either break that guarantee or leak intent on the client.
• Even an untargeted banner in a 1:1 thread signals that the space is monetized and watched, which corrodes the trust the rest of this document is built to earn.
• The chat-assist pill placement that briefly existed was removed on 2026-06-15. See Ad Placement Economics.

The litmus test for any new surface: does it make the user feel taken care of, or watched? Discovery surfaces can pass that test. The chat thread cannot, so ads stay out of it.

---

Privacy-Preserving Advertising Models

1. Contextual Advertising (Easiest to Implement)

Target based on where the user is, not who they are.

User at a coffee shop → Show coffee-related offers
User at a jazz venue → Show music event ads
User in a bar district → Show nightlife promotions

How it works with Lantern:

• User lights lantern at a venue
• Venue type is known (coffee shop, bar, restaurant)
• Show ads relevant to that venue type
• No user profile needed

Privacy level: 🟢 Maximum — no personal data used

2. Cohort-Based Targeting (Privacy-Preserving Segments)

Group users into anonymous cohorts based on behavior patterns.

Instead of:  "John, 28, likes craft beer, visited 12 breweries"
You get:     "User is in cohort: Craft_Beer_Enthusiast (50,000 users)"

How it works:

• On-device algorithm assigns user to cohorts
• Cohort ID sent to ad server (not user ID)
• Advertiser targets cohort, not individual
• Minimum cohort size (e.g., 1,000+) prevents re-identification

Privacy level: 🟢 Maximum — no personal data used

3. On-Device Ad Selection (Apple's Approach)

Ads selected on the user's device, not in the cloud.

Privacy level: 🟢 Maximum — user data never leaves device

4. User-Controlled Data Sharing (Transparent Value Exchange)

Let users choose what to share in exchange for benefits.

Privacy level: 🟡 User-controlled — they decide what's shared

5. Differential Privacy for Analytics (Aggregate Insights)

Advertisers get aggregate trends, not individual data.

Traditional:  "User #12345 visited 3 coffee shops this week"
Differential: "~15,000 users visited coffee shops this week (±500)"

How it works:

1. Add mathematical noise to all queries
2. Individual users can't be identified
3. Trends remain statistically valid
4. Apple and Google use this for iOS/Android analytics

Example for Lantern:

Advertiser wants: Users who visited 3+ coffee shops
User proves:      "I qualify" (cryptographic proof)
Advertiser sees:  Valid proof, no user identity
User sees:        Relevant ad

Privacy level: 🟢 Maximum — cryptographically private

---

Recommended Approach for Lantern

Tier 1: Start Here (Easy, Maximum Privacy)

Method	Implementation	Privacy
Contextual	Show venue-type relevant offers	🟢 Maximum
Merchant self-serve	Venues create their own offers, shown to nearby users	🟢 Maximum

Tier 2: Add Later (More Targeting, Still Private)

Method	Implementation	Privacy
User-controlled sharing	Let users opt-in to share interests	🟡 User choice
On-device matching	Send ad pool, match locally	🟢 Maximum

Tier 3: Advanced (Future)

Method	Implementation	Privacy
Differential privacy analytics	Aggregate trends for advertisers	🟢 High
Cohort targeting	Anonymous interest groups	🟡 High

What This Looks Like for a Merchant

---

TL;DR: Privacy + Advertising Can Coexist

What Works	What Doesn't Work
"Show coffee ads to people at coffee shops"	"Show ads to User #12345 based on their history"
"~2,000 users like jazz venues" (aggregate)	"Here's a list of jazz fans" (individual)
"User opted in to share interest in nightlife"	"We tracked user to 15 bars"
On-device ad matching	Server-side behavioral profiling

Lantern's positioning:

"We help local venues reach nearby customers without tracking anyone. Users control what they share. Advertisers get results, not personal data."