The Facebook-Cambridge Analytica scandal

Four years later, Facebook has decided to settle the lawsuit filed on behalf of Facebook users who are seeking damages from Facebook for allowing Cambridge Analytica access to personal information of millions of Facebook users without their knowledge or consent. Meta's out-of-court settlement (disclosed only at the eleventh hour) is being termed as 'desperation to avoid being questioned over cover-up'.

Here is a brief summary of what went down:

What happened?

For the unversed, Cambridge Analytica ("CA") is a data analytics firm that worked with Donald Trump’s election team and the winning Brexit campaign. At the time of this illegal data harvesting, CA was being headed by by Trump’s key adviser Steve Bannon.

Whistleblower, former employee Christopher Wylie publicly revealed that CA harvested data from 50 million Facebook users without their knowledge or consent.

What data was harvested?

Numbers: Wired,?The New York Times, and?The Observer?reported that the data-set had included information on 50 million Facebook users.

Information: Facebook sent a message to those users believed to be affected, saying the information likely included one's "public profile, page likes, birthday and current city". Some of the app's users gave the app permission to access their newsfeed, timeline, and messages. The data also included the locations of each person.

The data was detailed enough for Cambridge Analytica to create psychographic profiles of the subjects of the data. For a given political campaign, each profile's information suggested what type of advertisement would be most effective to persuade a particular person in a particular location for some political event.

How was this data collected?

The data was collected through an app called thisisyourdigitallife, built by academic Aleksandr Kogan. Hundreds of thousands of?users were paid to take a personality test and agreed to have their data collected for academic use. The app in turn pulled data from users' friends' profiles as well, leading to the accumulation of a data pool tens of millions-strong.

Aleksandr Kogan was a Russian professor at Cambridge, who shared the information in a commercial?partnership with Strategic Communication Laboratories (SCL), which later created CA.

How was the data used?

After the Ted Cruz campaign, Trump's campaign hired CA in June 2016 to help target ads using voter data gathered from millions of adults in the US. Donald Trump’s presidential campaign?used the harvested data to build psychographic profiles of users, determining their personality traits based on their Facebook activity.?

The campaign team used this information as a micro-targeting technique, displaying customized messages about Trump to different US voters on various digital platforms. Ads were segmented into different categories, mainly based on whether individuals were Trump supporters or potential swing votes.

What was Facebook's reaction to these claims?

Facebook stated that this incident is not a data breach as Kogan “gained access to this information in a legitimate way and through the proper channels” but “did not subsequently abide by our rules because he passed the information on to third parties."

In short, Facebook denied that this is a data breach from their end, and claimed that people willingly provided their information - no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked.

According to Wylie, Facebook did very little to remedy the situation.?While Facebook claimed?it removed the quiz app from the platform in 2015 and demanded that Kogan, Wylie, and CA confirm that they had deleted all the data harvested, Wylie claimed that Facebook only demanded that he remove all the Facebook data in August 2016, and they were small steps.

What followed?

Some of the key governmental actions:

• July 2018 - the United Kingdom's?Information Commissioner's Office?announced it intended to fine Facebook ￡500,000 ($663,000) over the data breach, this being the maximum fine allowed at the time of the breach, saying Facebook "contravened the law by failing to safeguard people's information". In 2019, Facebook agreed to pay the ￡500,000 fine to the ICO.
• March 2019 - a court filing by the U.S.?Attorney General for the District of Columbia?alleged that Facebook knew of Cambridge Analytica's "improper data-gathering practices" months before they were first publicly reported in December 2015.
• July 2019 - the?Federal Trade Commission?voted to approve fining Facebook around $5 billion to finally settle the investigation into the data breach. The record-breaking settlement was one of the largest penalties ever assessed by the U.S. government for any violation.
• July 2019 - Facebook has agreed to pay $100 million to settle with the?U.S. Securities and Exchange Commission?for "misleading investors about the risks it faced from misuse of user data". The SEC's complaint alleged that Facebook did not correct its existing disclosure for more than two years despite discovering the misuse of its users’ information in 2015.

The settlement

In 2018, a class action lawsuit was filed in the Northern District of California against Facebook by a group called 'Faceboook you owe us' on behalf of the Facebook users affected by this incident, which is now being settled according to a document filed on August 26 in a San Francisco court, where Facebook has stated it is submitting a draft "agreement in principle" and has requested a stay of proceedings for 60 days to finalize it.

On May 23 2022, Mark Zuckerberg was hit with a new lawsuit over Facebook-CA scandal, claiming Zuckerberg directly contributed to the "decision-making that allowed the Cambridge Analytica data breach." This scandal has proven to be one of the key data breaches in the history of Facebook. While the class action lawsuit is undergoing settlement, there seems to be no end in sight currently to the claims being raised on Facebook for its role in the scandal.