In March 2018, The Guardian, The New York Times, and Britain's Channel 4 published accounts from whistleblower Christopher Wylie, a former Cambridge Analytica employee, describing how the political consulting firm had obtained personal data from up to 87 million Facebook users without their knowledge, later confirmed by Facebook itself. The data originated from a personality-quiz app, "thisisyourdigitallife," built by Cambridge University researcher Aleksandr Kogan for academic research purposes, which around 270,000 people had actually installed and consented to.
The mechanism exploiting Facebook's platform rules at the time was straightforward: apps could pull not just a user's own data but data belonging to that user's entire friend network — likes, profile information, sometimes private messages — without those friends' separate consent, a permission structure Facebook did not close until its 2014-2015 platform policy overhaul, and did not fully audit for prior misuse until after the scandal broke publicly.
Cambridge Analytica used the resulting profiles to build psychographic models, based on the "OCEAN" personality framework, intended to microtarget voters with tailored political messaging, and the firm was linked to both Donald Trump's 2016 U.S. presidential campaign, which paid it roughly $6 million, and the pro-Brexit Leave.EU campaign, though the actual persuasive effectiveness of its methods remains disputed among researchers who studied the underlying claims after the fact and found the firm's own marketing had significantly overstated its capabilities.
Facebook's stock dropped roughly 18 percent in the ten days after the story broke, erasing nearly $80 billion in market value at one point, and CEO Mark Zuckerberg testified before Congress for two days in April 2018 — ten hours before the Senate and Commerce Committees combined — in what became a defining image of tech accountability politics. Cambridge Analytica itself shut down within two months of the scandal, filing for bankruptcy in the U.S. and insolvency in the UK in May 2018. Kogan and Wylie both became public figures overnight, one an academic pariah largely shut out of future research collaborations, the other a whistleblower-turned-critic of the industry he had helped build.
Coverage at the time emphasized the political-targeting angle and Cambridge Analytica's own claims of persuasive power, which the firm itself had marketed aggressively to prospective clients; underweighted was the more mundane and durable finding that Facebook's platform architecture, not any one bad actor, had made this kind of large-scale extraction possible for any developer for years, and that thousands of other apps likely harvested comparable data with far less scrutiny.
Facebook paid a $5 billion fine to the FTC in July 2019, the largest privacy penalty the agency had issued at the time, and separately paid $100 million to the SEC over misleading investor disclosures, while overhauling its developer platform to sharply restrict friend-data access going forward. The scandal also accelerated pending EU privacy legislation just two months before GDPR's effective date and boosted American appetite for a federal privacy law, though Congress still had not passed comprehensive legislation years later.
Facebook itself rebranded its parent company to Meta in 2021, a move widely read in part as an attempt to distance the corporate identity from the accumulated reputational damage of Cambridge Analytica and the subsequent years of related controversies over misinformation and platform harms.
Harvesting Facebook profile data via a quiz app's friend permissions turned academic-seeming research into political targeting fuel. The scandal made 'psychographics' a household word and forced Facebook into public contrition, API lockdowns, and regulatory crosshairs.
FTC orders, GDPR enforcement culture, and political ad libraries grew in the aftermath. Consultancies rebranded; the underlying voter-file industry adapted. Trust in platform-mediated democracy took a hit that no single consent dialog could repair.
Consent dialogs multiplied while meaningful consent stayed scarce. Political consultancies learned to speak softer about the same voter files. The scandal’s present tense is skepticism: users assume profiling, and democracies legislate in that shadow.
Political parties quietly kept buying data even as they denounced misuse. The scandal changed permission dialogs more than it changed the electoral incentive to microtarget. Outrage without structural alternatives fades into UI tweaks.
The episode remains the reference case for platform data-sharing risk: every subsequent developer API restriction, data-portability audit, and political-ad transparency rule at major platforms traces its justification back to the specific mechanism Cambridge Analytica exposed — that consent given by one user could be quietly extended to harvest an entire social graph.
Century Signals note: Guardian/Observer and Channel 4 reporting; UK and U.S. parliamentary/ FTC materials; Facebook API policy changes. Editorial judgment about what still structures the present — not a comprehensive history.