An online advertising database used to target specific groups of consumers includes Australian categories for “heavy TAB gamblers” and people who have gambled “in the last seven days”.

While advertising gambling products to adults is legal in Australia, experts said the targeting of habitual gamblers was concerning.

The dataset of 650,000 international “audience segments” was discovered on the website of Microsoft’s advertising technology platform Xandr by Wolfie Christl, a privacy researcher at Cracked Labs. It listed dozens of data providers looking to offer advertisers the ability to reach certain types of people online.

Christl found consumers grouped by interests related to casinos and online gambling, with several data brokers selling ways to reach possible gamblers in the United States, Europe and other regions.

Of the more than 40 categories identified as related to Australian gamblers, the majority were split into subsets related to gambling interest, sport interest or a particular venue: “Gambling at Pub / Club”, “Spring Carnival Punters” and “Online Gaming - NRL”, for example.

Gambling advertising is under increasing scrutiny in Australia: a recent parliamentary inquiry recommended all ads for online gambling be banned across social media and broadcast within three years.

Dr Simone McCarthy, a research fellow at Deakin University who studies the impact of gambling in Australia, said the inclusion of categories of frequent punters in the database was troubling.

“If they gambled in the last seven days, whether it’s a coincidence or they’re a weekly gambler, that puts their risk of being harmed by gambling ads up quite significantly,” she said.

• Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup

‘Nobody knows exactly where the data flows’

Everything from our location to our purchase history are data points that can be packaged and used to serve advertising, often through the creation of profiles based on assumptions about our demographics or potential interests. But we know remarkably little about how the ecosystem works.

First reported by the Markup and netzpolitik.org, the database of potential global consumers were grouped based on everything from political leanings and race to medical history, including “heavy purchasers” of pregnancy test kits and having an interest in brain tumours.

Microsoft said in a statement to Guardian Australia that the document was inadvertently published on its website and was outdated. The spokesperson said Xandr’s data privacy practices were regularly evaluated “to ensure compliance with applicable data protection laws”.

The file metadata indicates it was created in May 2021, according to the Markup, meaning some segments may no longer be in use. At least one of the Australian audience research companies named in the dataset indicated it was now phasing out the gambling segments it offers to advertisers.

But Christl said it still reveals the troubling ways personal data may be traded. “Much of the data is probably inaccurate and flawed, which doesn’t make it better, because it is still used to profile and target people,” he said.

“Nobody knows exactly where the data flows to and how it is used. I believe not even the data brokers themselves always know.”

The database also revealed a tangled web of companies involved in the online ad business. The spreadsheet listed the names of data providers, but the segment names (“Interest – Leisure Activities – Gambling Online”, for instance) often included the names of other companies that provide consumer research and other insights.

Audience data provider Eyeota appeared in the database next to segments that included the name of local market research firm Roy Morgan in several examples, including categories for those who had gambled in the “last 7 days” or “last 4 weeks”. Eyeota did not respond to requests for comment.

Roy Morgan conducts thousands of surveys with Australians each year, according to Howard Seccombe, chief digital officer at Roy Morgan Research. It can use this data to understand the aggregate habits of Australians potentially to the postcode level, but it does not sell or provide individual or household identifiers.

“We simply understand areas in Australia where you’re more likely to find people who do something,” he said. “In this instance, this is basically saying in Australia, where are you more likely to find people who gamble?”

Data providers may then match these types of area-level insights to available identifiers such as mobile IDs linked to geographic regions or other location signals, for example, according to an ad tech insider who did not want to be named.

They typically then offer advertisers the ability to reach these groups of consumers via automated ad targeting, rather than providing the raw data – like a list of IDs. Individuals are not listed in the Xandr dataset, just categories.

“This is almost definitely not a household level of precision and can result in a pretty fuzzy match,” the ad tech expert said. “No data company that is selling your data is omniscient and so they’re taking the tiny sliver of data that they do have and building out an educated guess.”

Another provider in the dataset, Nielsen Marketing Cloud, was listed as a data provider next to categories that indicated levels of gambling, including those named “Heavy TAB Gamblers”, “Heavy Lottery Gamblers” and “Heavy Online Gamblers”.

The segments were drawn from legacy survey data, according to a Nielsen spokesperson. “While some of the data (which was a component of the leisure category) may still be accessible, those segments are no longer updated,” they said.

The legacy survey data classified anyone who claimed to make a gambling purchase one or more times a fortnight as a heavy gambler.

Another company named in the data was StartApp, now known as Start.io. Its website lists audiences such as “Betting and Gambling Enthusiasts” which it says are based on indicators including mobile apps. The company did not respond to requests for comment.

These types of marketplaces do not only offer ways to reach consumers; in some cases, segments in the Xandr dataset were offered for “brand protection” – in other words, to prevent ads appearing next to keywords or on certain websites and apps.

Gambling ads under the microscope

Ad spend estimates for gaming in 2022 were just over $310m, according to Nielsen’s data.

But the ad technology industry has not yet had a genuine conversation about transparency, according to Peter Leonard, the principal with Data Synergies Pty Limited, and in particular whether some forms of targeting are unacceptable.

“One view is there should at least be prohibitions on the use of targeting for particular applications that are regarded as socially deleterious,” he said.

But even if the type of audience targeting found in the Xandr dataset was outlawed online, potential gamblers would likely still see ads, the ad tech insider said, because casinos and similar companies would work directly with gaming-related publishers to target them.

McCarthy says the government is consistently on the back foot with gambling advertising regulations.

“We’re focusing on [gambling advertising in] sport, they move to social media,” she said of the gambling industry. “We focus on social media, there will be a next thing.”