Cambridge Analytica: what was real and what was hype

Series: How minds are moved · The modern machinery · 5 of 7

In 2018 the world learned that a personality quiz app had pulled data on up to 87 million Facebook users, and that a political consultancy called Cambridge Analytica had used it. The story became the symbol of an age: secret profiles, “psychographic” ads, minds hacked at scale. Two years later the UK’s data protection regulator closed its investigation and wrote, in effect, that the company’s methods were neither as new nor as powerful as it had claimed. My AI agent and I separated what the regulators proved from what the company sold. They are not the same thing, and the gap between them is the lesson.

Contents · 9 sections

TL;DR #

• The data misuse is documented: the US Federal Trade Commission found in 2019 that Cambridge Analytica deceived people about what it collected, and Facebook paid a record $5 billion FTC penalty over its privacy failures.
• The mind-control claims are not documented. The UK Information Commissioner found the company’s techniques were well-known methods, overstated in its own marketing.
• Research on political ads and on personality-based targeting shows real but small effects, not the power to flip elections.
• A company that sells influence has every reason to exaggerate its influence. So do its critics, when the exaggeration makes a better story.

What happened, according to the record #

A researcher, Aleksandr Kogan, built an app called “thisisyourdigitallife” (the FTC calls it the GSRApp). About 300,000 people used it, according to the UK regulator, many of them paid small amounts to take its personality survey. Because of how Facebook’s platform worked at the time, the app could also collect data about those users’ friends, who never agreed to anything. Facebook narrowed that access in April 2014. In May 2014 Kogan applied for extended access; Facebook refused, saying it would breach its terms, but, the UK regulator found, did not remove the app, so it kept collecting through the grace period. That is how about 300,000 participants became up to 87 million profiles, by Facebook’s own estimate, including at least 1 million people in the UK. The data went to SCL, the parent of Cambridge Analytica.

In March 2018 the Guardian, the New York Times and Channel 4 News published the story, with the former employee Christopher Wylie as a source. Channel 4 also broadcast undercover recordings of the chief executive, Alexander Nix, boasting about the company’s methods. He was suspended, and the company closed in May 2018.

Then came the official findings:

• UK ICO, October 2018: fined Facebook £500,000, the maximum under the old Data Protection Act, for failing to protect users’ data. Facebook later paid without admitting liability.
• FTC, July 2019: Facebook agreed to a $5 billion penalty and new oversight, for deceiving users about how much control they had over their data, including sharing with apps their friends used.
• FTC, December 2019: in a unanimous opinion, the FTC found that Cambridge Analytica itself had used deceptive practices, telling app users it would not collect identifying information when it did, and ordered it to delete the data.
• Class action, December 2022: Meta agreed to pay $725 million to settle the US consumer lawsuit, without admitting wrongdoing.

Kogan and Alexander Nix settled separately with the FTC in 2019, neither admitting nor denying the allegations, and agreed to delete the data and any work derived from it. Kogan has said he was made a scapegoat by both Facebook and Cambridge Analytica, that the company assured him his work was legal and within Facebook’s terms, and that Cambridge Analytica overstated what such data could do. Facebook said he lied to it about how the data would be used.

That part is not in dispute. Data was taken under false pretences, a platform failed to protect it, and regulators and courts imposed real penalties.

What was claimed #

The company’s pitch was something else. Cambridge Analytica marketed itself as able to sort voters by personality, using the “OCEAN” model (openness, conscientiousness, extraversion, agreeableness, neuroticism), and to send each type a message designed to move it. Its executives presented this as the secret behind political victories. The media, horrified, often repeated the claim as fact, turning a sales brochure into a threat assessment.

What the evidence says about the claims #

The regulator’s verdict. In October 2020 the Information Commissioner, Elizabeth Denham, sent Parliament the final findings of a three-year investigation. She found that the methods were “in the main, well recognised processes using commonly available technology”, built on free open-source data science libraries, with no proprietary technology. The company’s marketing boast of “over 5,000 data points per individual on 230 million adult Americans” appeared to be “an exaggeration”. Its models predicted traits reasonably on the people they were trained on, but their real-world accuracy on new people was “likely much lower”, and internal messages showed scepticism inside the company about the gap between its external messaging and what it could actually do. On Brexit, she found no evidence that the company had been involved in the EU referendum campaign beyond some early enquiries, and noted that the Kogan data related to US voters. The company did appear to do “a limited amount of work for Leave.EU”, she wrote, but it involved UKIP membership data, not Facebook data.

What personality targeting can do. The best-known academic result is a 2017 PNAS study by Sandra Matz, Michal Kosinski and colleagues. Ads matched to people’s inferred extraversion or openness got more clicks and purchases than mismatched ads, in campaigns reaching about 3.5 million people. In 2018 other researchers (Eckles, Gordon and Johnson) argued in the same journal that the platform’s own ad-delivery optimisation could explain much or all of those effects, because people were not randomly assigned to see each ad. The authors replied and defended their results. Even taken at face value, the study was about selling cosmetics and games, not about changing votes.

What political ads do. A 2020 study in Science Advances by Alexander Coppock and colleagues ran 59 randomised experiments with real 2016 US election ads. The persuasive effects were small, on average, across message, sender and audience. A 2023 PNAS study by Ben Tappin and colleagues estimated that microtargeting can add some persuasive advantage over a single best message, but concluded it is clearly not mind control.

So the evidence points the same way from several directions: targeted persuasion exists and can be measured, and it is modest.

Why the hype stuck #

Both sides of the story liked the big version. The company sold itself as a weapon, because that was its product. Critics, journalists and people disappointed by the 2016 results found in it a simple explanation for something complicated. And readers found it more comfortable to believe that voters were hacked than that millions of people chose differently from them.

There is another direction too. In my library, Hilke Schellmann’s The Algorithm has a chapter titled “Cambridge Analytica for Work”, about hiring tools that claim to read a candidate’s personality from their online life. The same pitch, “we can see inside people and predict them”, is now sold to employers. The same question applies: show me the evidence, not the demo.

What it feels like from the inside #

If you believed the big story in 2018, you probably felt two things at once: anger at the data being taken by deception, which was justified, and a kind of helplessness, as if your mind could be steered by an ad you did not even notice. The second feeling is the one to examine. It makes people passive. A person who believes they are being mind-controlled stops checking, because what would be the point? That belief serves nobody except those who sell influence.

How to notice it #

Signs that a claim about mind control is a sales pitch:

• The evidence is a client list, a victory, or an undercover boast, not a controlled test.
• Effect sizes are missing, or given as “up to” numbers.
• The technique is described as secret, so it cannot be checked.
• Both the seller and the critics benefit from the claim being big.
• Nobody mentions what happened in the cases where it was used and the client lost.

Habits that help: ask “compared with what?”; look for a randomised experiment; separate “they took the data” (a fact you can prove) from “they changed my mind” (a claim that needs much more).

Frequently asked questions #

Did Cambridge Analytica win the 2016 election for Trump or the Brexit vote? #

The record does not show that. The UK regulator found no evidence of its involvement in the referendum campaign beyond early enquiries and a limited amount of work for Leave.EU on UKIP membership data, not Facebook data. For the US, no study has shown that its targeting changed votes, and the research on political ads points to small effects in general.

So was the scandal overblown? #

The data part was not. Tens of millions of people had their data taken without their consent, and regulators found deception. What was overblown is the claimed power of what was done with it.

Is psychographic targeting fake? #

No. Matching messages to personality can raise clicks somewhat in commercial ads. The dispute is about how large the effect is once you control for how platforms deliver ads, and whether it carries over to political beliefs.

Does this mean my data is safe now? #

No. The lesson is about influence, not about privacy. The data trade is larger today than in 2018. The point is that being profiled does not mean being controlled.

The lesson #

Cambridge Analytica got data by deception and sold a myth. The deception is proven; the myth was its best product, and many people bought it, including people who hated the company. When anyone claims they can steer minds at scale, ask for the experiment. Believing in mind control is itself a way of being moved.