Facebook–Cambridge Analytica data scandal

On 17 March 2018, The Guardian and The New York Times published the account of whistleblower Christopher Wylie, revealing that the political consultancy Cambridge Analytica had obtained the personal data of tens of millions of Facebook users without their consent and used it to build psychographic voter-targeting models. The disclosure became the defining data-privacy scandal of the social-media era and led to a record $5 billion penalty against Facebook.

What happened

The data was not extracted through a hack. It was harvested through Facebook's own platform design. Around 2013–2014, Cambridge University researcher Aleksandr Kogan built a personality-quiz app called "thisisyourdigitallife" and distributed it via Facebook. Roughly 270,000 people installed the app and consented to share their data.

The critical flaw lay in Facebook's Graph API, which at the time allowed an app not only to read the installing user's data but also data about all of that user's friends — without the friends' knowledge or consent. Through this friend-network multiplier, Kogan's app collected information on up to 87 million people, the overwhelming majority of whom never installed anything.

Kogan's company, Global Science Research, passed the dataset to Cambridge Analytica (a subsidiary of SCL Group), which used it to develop psychographic profiles intended to micro-target voters during the 2016 U.S. presidential primaries and general election, as well as other political campaigns.

Impact

• Up to 87 million Facebook users had their data harvested, including names, locations, email addresses, page "likes," and inferred psychological traits.
• Facebook's market value fell by roughly $100 billion in the weeks after the story broke amid a #DeleteFacebook movement.
• The U.S. Federal Trade Commission imposed a $5 billion penalty in July 2019 — the largest the agency had ever levied for a privacy violation — along with a 20-year order overhauling Facebook's privacy governance and creating an independent board-level privacy committee.
• The U.K. Information Commissioner's Office fined Facebook £500,000 (the maximum under pre-GDPR law).
• Cambridge Analytica and SCL Group filed for insolvency in May 2018.

Why it matters

The scandal reframed personal data as a systemic platform-governance problem rather than a series of isolated breaches. It exposed how permissive third-party API design — granting apps access to non-consenting users' data through friend graphs — could be weaponized at population scale. The fallout accelerated global privacy regulation (the EU's GDPR took effect two months later), prompted Facebook to lock down its developer APIs, and established the precedent that platforms can be held financially accountable for how third parties exploit their data-sharing architecture.

It remains the canonical case study in consent, secondary data use, and political micro-targeting, cited in virtually every modern data-protection curriculum.