The Observer, The Guardian, and The New York Times reported that political consultancy Cambridge Analytica had obtained data on millions of Facebook users without their consent. Whistleblower Christopher Wylie described how the data was used for political profiling.
What happened
- The data was collected through a personality quiz app built by academic Aleksandr Kogan, which also gathered data on users’ friends.
- Initial reports said 50 million profiles were involved, and Facebook later estimated up to 87 million.
- Mark Zuckerberg testified before the US Congress in April 2018, and Cambridge Analytica closed the following month.
- The UK ICO fined Facebook the maximum £500,000 under the old Data Protection Act, and in 2019 the US FTC imposed a $5bn penalty.
Why it mattered
The scandal became a turning point in public awareness of data privacy and the power of social media platforms, and it shaped regulation for years afterwards.
Lessons for organisations
Organisations should control how third parties access personal data through apps and APIs, and ensure that data is only used for the purposes people were told about.
Sources: Al Jazeera, NPR
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
