PRIVACY-PROTECTED ADVERTISING SYSTEM

A database of consumer profiles is generated from multiple sources of information including demographic databases identifying demographic attributes of the consumers and transaction records for the consumers. The transaction records are processed to generate transaction attributes and interests of the consumer. The consumer profiles identify deterministic and probabilistic attributes about the consumer, but do not contain privacy violating information such as raw transaction records. The consumer profiles may be maintained in a plurality of distributed databases. Advertisers generate profiles that identify attributes of an intended target market of the advertisement. The advertisement profiles are in the form of operators that can be applied to the database of consumer profiles to determine applicability of advertisements to the subscribers. The operators may only be applied to or make measurements on certain “observables”. The operators will not be able to obtain private information from the database of consumer profiles.