Case Study: Facebook and Cambridge Analytica, Global (2018)

Organisations: Facebook (now Meta Platforms) and Cambridge Analytica Sector: Technology and Political Consulting | Region: Global | Year: 2018

What Happened

In March 2018, journalists at The Guardian, The New York Times and Channel 4 News published simultaneous investigations revealing that Cambridge Analytica, a British political consulting firm, had harvested the personal data of approximately 87 million Facebook users without their explicit knowledge or consent. The data had been collected through a Facebook application called ‘This Is Your Digital Life’, developed by a researcher, which invited users to complete a personality quiz. Approximately 270,000 users consented to share their data with the application; however, by exploiting Facebook’s then-existing data-sharing policies, the application also collected data from those users’ entire networks of Facebook friends, without those friends’ knowledge or consent.

Cambridge Analytica used this data to build detailed psychological profiles of voters in multiple countries. The firm claimed to have developed a model using the so-called OCEAN framework (measuring Openness, Conscientiousness, Extraversion, Agreeableness and Neuroticism) that could predict individuals’ political preferences and susceptibility to specific types of messaging. This profiling was used to target individuals with highly personalised political advertising, reportedly including in the 2016 US presidential election and the UK’s Brexit referendum.

Facebook had been aware since 2015 that the data had been collected in breach of its policies but had not informed the affected users or taken effective action to ensure the data was deleted. When the story broke publicly in March 2018, the scale of what had occurred and the nature of Facebook’s delayed response created one of the most significant corporate data ethics crises of the decade.

The Scale and Consequences

• Approximately 87 million Facebook users had their personal data harvested without explicit consent, spanning multiple countries including the United States, the Philippines, Indonesia, the United Kingdom and Australia
• Facebook’s share price fell by approximately 18% in the week following the public disclosure, representing a loss of approximately $120 billion in market capitalisation at its lowest point
• In 2019, the US Federal Trade Commission fined Facebook $5 billion for violations of a 2012 consent order regarding user privacy. It was, at the time, the largest fine ever imposed by the FTC on any company for any reason
• The UK’s Information Commissioner’s Office fined Facebook £500,000 (the maximum available under then-applicable UK data protection law) and issued enforcement notices against Cambridge Analytica’s parent company
• Cambridge Analytica declared insolvency and closed in May 2018, weeks after the story broke
• The scandal directly contributed to the acceleration of data protection legislation globally, reinforcing the case for the GDPR (which came into force in May 2018, two months after the story broke) and prompting regulatory reviews in multiple jurisdictions

The Ethical Failures

The Facebook-Cambridge Analytica scandal is significant not primarily as a cyber security incident but as an ethical failure of profound scale. Understanding it through an ethical lens is more illuminating than a purely technical or regulatory analysis:

• Violation of informed consent: the fundamental principle of informed consent holds that individuals should understand what they are agreeing to before they agree to it. The Facebook users whose data was harvested had not consented to Cambridge Analytica accessing their personal information. They had not consented to the creation of psychological profiles about them. They had not consented to their data being used to influence their political beliefs. The technical mechanism through which the data was collected may have complied with the letter of Facebook’s policies at the time; it violated the spirit of what any reasonable user would have expected or agreed to.
• Failure of the duty to disclose: Facebook became aware in 2015 that Cambridge Analytica possessed data that had been collected in violation of its policies. Rather than informing affected users, Facebook sent a cease-and-desist letter to Cambridge Analytica and accepted assurances that the data had been deleted. No independent verification was conducted and no disclosure was made to users. The decision not to disclose prioritised Facebook’s reputational interests over the genuine interests of the 87 million people whose data had been misused.
• Data as a weapon against individuals: the use of psychological profiling data to micro-target individuals with messages designed to exploit their specific emotional and psychological vulnerabilities raises fundamental ethical questions that go beyond data protection law. The individuals whose data was used were not informed that they were being targeted, did not understand the basis on which they were being approached, and could not meaningfully contest or opt out of the targeting. Whatever the legal status of this practice at the time, it represents a use of personal data that treats individuals as objects to be manipulated rather than subjects with rights and autonomy.
• The aggregation problem: one of the most important lessons from the Cambridge Analytica case for any manager who handles data is the aggregation problem. Individual data points, each of which may seem trivial in isolation (a Facebook like, a demographic category, a location check-in), can be combined to reveal highly sensitive information about an individual’s psychology, political views, health status, financial circumstances or personal relationships. The ethical obligation of data minimisation is not just about not collecting data you do not need: it is about understanding that the combination of data you do collect may reveal far more than any single element suggests.

Relevance for Managers: Lessons Beyond Social Media

• Ethical obligations exist independently of legal requirements: at the time the data was harvested, Facebook’s terms of service may have technically permitted the data collection mechanism that was used. The ethical failure was real regardless. Managers who restrict their ethical analysis to what the law requires will repeatedly find themselves on the wrong side of questions that matter.
• Transparency builds trust and prevents catastrophe: Facebook’s decision not to disclose the 2015 breach to users, based on a judgement that disclosure was not in the company’s interests, ultimately caused far greater reputational and financial damage than early disclosure would have. The same principle applies at an organisational level: transparent handling of data incidents, even when transparency is difficult, is both the ethical and the strategically sound choice.
• Data ethics requires genuine engagement with purpose: the question is not only whether you can use data in a particular way, but whether you should. Organisations and managers who ask genuinely whether their proposed use of data respects the interests and reasonable expectations of the people whose data it is will make different, and better, decisions than those who ask only whether the use is technically permitted.
• The scale of harm from data misuse can be civilisational: the Cambridge Analytica scandal raised concerns about the integrity of democratic processes in multiple countries. The potential for misuse of personal data at scale to influence elections, undermine public trust and distort political discourse represents a category of harm that goes far beyond any individual organisation or incident. Managers who understand this scale of potential consequence take their data protection responsibilities with appropriate seriousness.

Reflective Opportunity

The Cambridge Analytica case illustrates the gap between technical legality and genuine ethical compliance. Reflecting on your own organisation’s data practices, consider: are there ways in which data about customers, employees or partners is used that are technically permitted but that those individuals might not expect or agree with if they fully understood them? How would you approach the question of whether a proposed data use is ethically sound, not just legally permissible? Share your reflections in the discussion forum.