Cambridge Analytica: The Data Scandal That Changed Democracy

Cambridge Analytica's pitch centered on psychographic profiling: using the OCEAN model — openness, conscientiousness, extraversion, agreeableness, and neuroticism — to predict personality traits from Facebook activity and tailor political messaging to them. ^[2]

Testifying before the U.S. Senate Judiciary Committee in May 2018, whistleblower Christopher Wylie said the company "sought to identify mental and emotional characteristics in certain subsets of the American population and worked to exploit them by designing [messaging] to activate some of the worst vulnerabilities in people, such as neuroticism, paranoia and racial biases." ^[5]

Much of this messaging reportedly ran as Facebook "dark posts" — ads that appear only in a targeted user's own feed and leave no public record. Digital-forensics reporting later found Trump campaign-aligned dark ads running on audience lists built with Cambridge Analytica data, making it difficult for outside observers to see what was actually being shown to whom. ^[6]

Cambridge Analytica worked for multiple political campaigns during the 2015–2016 U.S. election cycle:

Ted Cruz campaign (2015–2016): Cambridge Analytica's data underpinned Ted Cruz's presidential primary run, an early proving ground for the firm's psychographic-marketing pitch, before Cruz dropped out of the race. ^[7]

Trump campaign (2016): After Cruz exited, Cambridge Analytica moved to Donald Trump's campaign, which paid the firm $5.9 million in five installments between June and December 2016. Steve Bannon, who became Trump's campaign CEO in August 2016, had served as Cambridge Analytica's vice president and secretary since June 2014. ^[8][9]

Leave.EU (Brexit): Cambridge Analytica and Leave.EU's leadership repeatedly claimed the firm had worked on the Brexit referendum campaign. But after a multi-year investigation, the UK Information Commissioner's Office concluded it had found no further evidence that Cambridge Analytica or its affiliate SCL were significantly involved in the EU referendum campaign, beyond an initial, abandoned inquiry involving UKIP data. ^[10]

The scandal broke publicly on March 17, 2018, when Christopher Wylie, a data scientist who had helped build Cambridge Analytica's psychographic models, went public with his account to journalists Carole Cadwalladr and Emma Graham-Harrison at The Observer/The Guardian. ^[1]

Days later, Channel 4 News aired undercover footage of CEO Alexander Nix describing how the firm could use bribes and "honey traps" to compromise candidates — saying it could "send some girls around to the candidate's house" — and boasting the firm could "set up fake IDs and websites" and pose as students or tourists to gather compromising material. ^[11]

Facebook initially said the data had been misused by a third party and that the company bore no responsibility. CEO Mark Zuckerberg stayed publicly silent for roughly five days before addressing the scandal in a Facebook post and a CNN interview on March 21, 2018, calling it "a major breach of trust." ^[12]

In April 2018, Zuckerberg testified before Congress across two hearings — first a joint Senate Judiciary and Commerce Committee session, then a House Energy and Commerce Committee hearing the next day. The original Guardian/Observer reporting showed Facebook had learned by late 2015 that Kogan's data had been harvested on an unprecedented scale, but the company failed to verify that Cambridge Analytica had actually deleted it as promised. ^[1]

In July 2019, the Federal Trade Commission announced Facebook would pay a $5 billion penalty — the largest privacy penalty the agency had ever imposed — and restructure its privacy governance, including new quarterly compliance certifications personally signed by Zuckerberg and other designated officers. ^[13]

The Cambridge Analytica scandal accelerated data-privacy regulation on both sides of the Atlantic:

GDPR Implementation (May 2018): The EU's General Data Protection Regulation, already years in the making, became enforceable on May 25, 2018 — about two months after the scandal broke — and Cambridge Analytica quickly became a reference case for why such rules were needed. ^[14]

UK ICO Fine: In July 2018, the UK Information Commissioner's Office fined Facebook £500,000 — the maximum penalty allowed under the 1998 Data Protection Act — for failing to safeguard user data and for a lack of transparency about how it was harvested and used. ^[15]

California Consumer Privacy Act (2020): Analysts have linked the scandal to the momentum behind California's sweeping privacy law, noting its passage followed closely on Facebook's scandal and the state's position as home to many of the companies the law targets. ^[16]

Academic researchers remain divided on whether Cambridge Analytica's psychographic targeting actually swayed voters. Michal Kosinski, the Stanford researcher whose Cambridge University work on predicting personality from Facebook likes helped inspire the technique, has said psychological targeting is a real and measurable tool of "digital mass persuasion" — while stressing he "never worked for Cambridge Analytica and never acquired Facebook data without users' permission." ^[19]

But Nature's own reporting on the "scant science" behind Cambridge Analytica's marketing found little independent evidence the firm's own targeting swayed the 2016 electorate, and other experts went further: a former Facebook employee dismissed the firm's pitch outright, and a Fordham University researcher who reviewed its work concluded "there is little evidence to support claims that Cambridge Analytica helped swing the election." ^[17][18]

The ethical question is separate from the effectiveness question, however: up to 87 million people had their data harvested and used for political targeting without meaningful consent, regardless of how well the targeting actually worked. ^[3][4]

Cambridge Analytica and SCL Group both filed for bankruptcy on May 2, 2018, after the scandal cost the firm nearly all of its roughly 50 clients. ^[20]

Several Cambridge Analytica and SCL directors, including acting CEO Alexander Tayler and SCL chairman Julian Wheatland, resurfaced soon after as directors of a new company, Emerdata Limited, which one SCL Group director said was "set up to acquire all of SCL and Cambridge Analytica" — raising questions about whether the underlying operation had truly ended. ^[21]

The scandal fundamentally changed public understanding of data privacy and became a touchstone for debates about social media's role in democracy, demonstrating how data harvested for one purpose could be repurposed for political manipulation with few real safeguards in place.