Cambridge Analytica: What the FTC Record Establishes About the Data Harvest

The narrow verified finding

The Federal Trade Commission concluded that Cambridge Analytica used deceptive practices concerning the collection of Facebook data and its compliance representations. The case involved a personality-quiz application often called thisisyourdigitallife or GSRApp. Users supplied information through the app, while the platform rules then allowed collection of certain data connected to their Facebook friends. The resulting dataset was used in voter profiling and targeting work. That record is serious without claiming the company possessed a reliable switch capable of controlling how any individual voted.

Sources: Federal Trade Commission · Federal Trade Commission · Federal Trade Commission

How the data moved

App developer Aleksandr Kogan created the GSRApp, which asked participants personality questions and collected profile information. The FTC said the app also gathered identifiers and data about users’ Facebook friends. Cambridge Analytica, Kogan and then-chief executive Alexander Nix developed, used and analyzed the information, matching personality scores with U.S. voter records. The central privacy problem was not simply that a quiz existed. It was the gap between what people were told, the scale and identifiability of collection, and the downstream use of data from people who had not directly taken the quiz.

Sources: Federal Trade Commission · Federal Trade Commission · Federal Trade Commission

Allegation, settlement and final order

In July 2019 the FTC issued an administrative complaint and announced proposed settlements with Nix and Kogan. Cambridge Analytica had entered bankruptcy and did not contest the later summary-decision motion. In December 2019 the Commission issued its opinion and final order against the company. Those procedural stages should remain visible. An allegation in the complaint, an agreed restriction in an individual settlement and a Commission finding against a corporate respondent are related but not interchangeable forms of legal record.

Sources: Federal Trade Commission · Federal Trade Commission · Federal Trade Commission

What the order required

The final order prohibited misrepresentations about the protection, use and disclosure of covered information and about participation in privacy or security programs. It also required deletion or destruction of covered information and related work products under the order’s terms. The detailed definition of covered information is revealing: it includes conventional identifiers alongside platform data, messages, activity data and persistent identifiers. Readers can inspect the order directly instead of relying on a headline that compresses a long privacy regime into the phrase ‘stolen data.’

Sources: Federal Trade Commission · Federal Trade Commission · Federal Trade Commission

What remains difficult to prove

The existence of psychographic categories does not automatically establish that a campaign changed the result of an election. Demonstrating causal persuasion requires a different evidentiary design from demonstrating deceptive collection. The FTC case is strong evidence about data practices and representations; it is not an experimental study of electoral impact. Separating those questions prevents both minimization and exaggeration. A system can violate privacy at massive scale even if its commercial claims about predictive power are overstated.

Sources: Federal Trade Commission · Federal Trade Commission · Federal Trade Commission

The durable lesson

Platform permissions can turn one person’s consent into access affecting many others. Researchers and product teams should therefore ask who the data subject is, what each person was told, whether a secondary use is compatible with the original context and how deletion can be verified. Readers investigating the scandal should begin with the FTC case docket, then move through complaint, settlements, opinion and order chronologically. This sequence shows what was alleged, what was uncontested and what the Commission ultimately required—without borrowing certainty from the louder political mythology around the case.

Sources: Federal Trade Commission · Federal Trade Commission · Federal Trade Commission

Evidence notes and limits

The page deliberately does not publish scraped profile examples or recreate voter dossiers. Those materials would add visual shock while repeating the privacy harm under discussion. Instead, its media layer points to the complaint, docket and final order with provenance attached. When describing scale, revisions should quote the population definition used by the regulator rather than convert ‘tens of millions’ into a more precise unsupported count. When describing impact, revisions should separate demonstrated data collection from inferred persuasion. This evidentiary split is not a defense of the company; it is what makes the privacy finding durable even if later claims about electoral effectiveness are revised.

Sources: Federal Trade Commission · Federal Trade Commission · Federal Trade Commission

Questions, answered