Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Facebook’s Cambridge Analytica scandal was a third-party data-access and oversight failure, not a conventional hack of Facebook’s servers. A personality-quiz app collected information from people who used it and, under Facebook’s rules at the time, information about many of their friends. App developer Aleksandr Kogan transferred data to Cambridge Analytica for purposes that contradicted the app’s stated academic rationale and Facebook’s platform rules. Facebook said it learned about the transfer in 2015, but relied on deletion assurances rather than conducting a full audit. The scandal became public in 2018; it exposed serious privacy and governance failures, but does not prove that Cambridge Analytica determined the 2016 U.S. election.
How the data moved
Cambridge Analytica was a political and commercial data-analytics consultancy associated with the SCL Group. Its work for political campaigns and its claims about personality-based voter profiling brought it into the center of the 2016 election debate.
The route into Facebook data began with Aleksandr Kogan, a researcher and app developer, and a personality-quiz app commonly known as thisisyourdigitallife. Users answered questions and authorized the app to access some of their Facebook information. Facebook’s platform rules then allowed apps to access certain information about an app user’s friends as well. Those friends did not have to install the quiz or separately authorize it. Exactly what could be accessed depended on the available permissions and users’ settings; it did not mean the app could see every item on every friend’s profile.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- A person used the quiz and authorized the app to access permitted Facebook information.
- The app collected information from that person and, under the rules then in force, certain information associated with many of their friends.
- Kogan transferred data to Cambridge Analytica, contrary to Facebook’s stated platform restrictions and the app’s represented academic purpose.
- Cambridge Analytica used or sought to use personal information in political profiling and campaign analytics.
This distinction matters: the scandal is often called a “hack,” but the evidence describes data access through a Facebook app and subsequent misuse, not an unknown attacker breaking into Facebook’s central servers. It is also imprecise to say Facebook simply “sold 87 million users’ data.” Facebook’s platform enabled the access; the app developer transferred data to Cambridge Analytica; and the FTC’s case against Facebook concerned deceptive privacy representations, inadequate safeguards, and alleged violations of a prior privacy order.
#1 Best Overall
Why the estimates range from 270,000 to 87 million
About 270,000 people used the app directly. Because the old Facebook platform rules let an app reach certain friends’ data, the potential exposure extended much further. The FTC described a possible reach of 50 million to 65 million friends, including at least 30 million identifiable U.S. consumers. Facebook later gave a broader maximum estimate of approximately 87 million users potentially affected. The FTC’s account and Facebook’s congressional materials describe different estimates and bases for them.
87 million is not a confirmed count of people whose records Cambridge Analytica received, analyzed, or used. It is a potential-exposure or maximum estimate based on data that may have been accessible through app users and their networks. Facebook said it could not determine how many records Kogan actually transferred. Data being technically accessible, actually retrieved, transferred, retained, analyzed, used to target an ad, and seen by a particular voter are separate steps. The public estimate does not establish that every person passed through them all.
What Facebook knew—and why the story broke in 2018
- 2014: Facebook changed its platform rules and ended the ability of apps to access the same breadth of friends’ data. Mark Zuckerberg later told Congress that this kind of access was no longer possible under the revised rules. The Senate hearing transcript records his explanation.
- 2015: Facebook said it learned Kogan had transferred data to Cambridge Analytica. It removed the app and demanded that the data be deleted. Facebook accepted assurances that the data had been destroyed.
- March 2018: Reporting by The New York Times, The Observer and others brought the matter to widespread public attention. Facebook suspended Cambridge Analytica and associated actors.
- April 2018: Facebook publicly gave its approximately 87 million maximum estimate, and Zuckerberg testified before Congress.
- July 2019: The FTC announced a $5 billion Facebook settlement and separate enforcement actions involving Cambridge Analytica, its former CEO Alexander Nix, and Kogan.
- April 2020: The FTC formally approved modifications to Facebook’s 2012 privacy order implementing provisions of the settlement.
The gap between Facebook learning about the transfer in 2015 and the public learning about it in 2018 is central to the scandal. Facebook treated deletion assurances as sufficient. Zuckerberg later acknowledged that the company should have conducted a full audit. The failure was therefore not only the original collection and transfer: it also involved inadequate verification, monitoring of third-party developers, and timely disclosure to people whose information may have been exposed.
Free tools Windows power users keep installed
One-click scans. No signup required.
What Cambridge Analytica claimed—and what is known about election impact
Cambridge Analytica promoted psychographics: grouping or modeling people using inferred personality traits, attitudes, values, or behavioral tendencies, then tailoring messages to those profiles. Such claims were part of the firm’s pitch. They should not be treated as proof that the models reliably identified voters or changed their decisions.
The firm worked for political clients, including Ted Cruz’s campaign and Donald Trump’s 2016 presidential campaign. Campaign use of data, however, is not the same as demonstrated electoral impact. Reporting questioned the reliability of Cambridge Analytica’s psychographic models and whether they were used in the Trump campaign in the way many headlines suggested. Campaigns also use conventional tools—geography, demographics, voter files, interests and engagement data—that do not depend on a distinctive psychographic system.
The evidence supports saying that Facebook-derived information was obtained and that Cambridge Analytica did political analytics work. It does not support saying that the data or the firm’s psychological targeting determined the 2016 result. As Ars Technica’s contemporaneous explainer noted, claims about the firm’s methods and their role in the campaign warranted scrutiny rather than repetition as fact.
Rank #4
Cambridge Analytica was not the same as Russian disinformation
| Cambridge Analytica episode | Russian influence operations |
|---|---|
| Improper acquisition and political use of Facebook data; a data-analytics and platform-governance issue. | Coordinated accounts, pages, advertisements and disinformation; an influence-operation and platform-integrity issue. |
| Involved Kogan, Cambridge Analytica and Facebook’s app permissions and oversight. | Involved Russian actors and related operations, including activity discussed in separate investigations. |
Both stories involved Facebook and the 2016 election, and they were discussed in the same broader congressional period. They were separate mechanisms. Treating them as one operation obscures what happened in each.
Recommended Free Tools
Legal and regulatory consequences
The FTC alleged that Facebook violated its 2012 privacy order and misled users about their control over privacy. In 2019, Facebook agreed to a $5 billion civil penalty and extensive privacy-governance requirements. The settlement included an independent privacy committee of the board, designated compliance officers, a comprehensive privacy program, executive accountability, and restrictions on misleading privacy representations. The FTC described the order as a structural and operational change, not merely a fine. The FTC’s settlement announcement outlines the requirements; its 2020 announcement records final approval of the modified order.
Best Value
The FTC also pursued separate actions involving Cambridge Analytica, Nix and Kogan, alleging deceptive collection and use of personal information. Those proceedings had distinct allegations and remedies. They should not be collapsed into a claim that every element of the episode was adjudicated as a criminal offense.
The settlement did not, by itself, resolve broader questions about platform surveillance, targeted advertising, data brokers, political advertising, or the absence of a comprehensive federal consumer privacy law in the United States. A large penalty can impose consequences and force governance changes, but it cannot by itself establish that every underlying business practice has changed or eliminate the incentives to collect and monetize personal data.
Why the scandal still matters
The episode remains a useful framework for evaluating any data scandal, including those involving ad technology, data brokers, machine learning or AI-based profiling. Ask:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- What information was collected, and what could the app technically access?
- Who actively authorized the collection—and who was affected without using the app?
- What did people reasonably believe they were authorizing?
- Who received the data, and what uses had been represented or permitted?
- Was deletion independently verified, including copies or derived data?
- Were affected people notified, and did the platform change the system that enabled the exposure?
The underlying lesson is larger than one quiz or political consultancy: consent can be limited or misleading when people do not understand downstream uses, network-based permissions can expose people who never sign up, and written rules mean little without audits and enforcement. Political value and data access can be real even when claims about a specific election’s outcome remain unproven.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
