Cambridge Analytica

Cambridge Analytica

87 million profiles, lifted from a personality quiz.

---

The Open Graph problem

By 2013, Facebook had become the most extensive personal-data collection system in human history. It had also, in the name of encouraging an "open" developer ecosystem, allowed third-party app developers to extract personal data from users — and, through the much-criticized Open Graph v1 API, from those users' friends as well.

The way the data extraction worked was deceptively simple. A user would visit an app — typically through a Facebook ad or a friend's share — and agree to "log in with Facebook." On clicking Accept, the user authorized the app to collect not only their own profile data (likes, photos, education, employment, location history, page follows) but also a substantial subset of the same data from every person on their Facebook friends list.

The user was generally not aware they had authorized this.

The Facebook friends from whom the data was harvested had given no consent at all. Their data was extracted because someone in their network had clicked Accept.

Facebook removed the friends-of-friends extraction capability from the Open Graph API in May 2015. By that point, an unknown number of developer apps — Cambridge Analytica's was one — had already harvested data on hundreds of millions of users whose only relationship to the apps was that they happened to know someone who had taken a quiz.

A psychology researcher and a hedge-fund billionaire

The mechanism by which Cambridge Analytica acquired its dataset came together in the second half of 2013. The two threads converged at a London office building on New Oxford Street.

The first thread was psychometric research at the University of Cambridge. A team led by Michal Kosinski had been demonstrating since 2012 that Facebook "likes" — the public traces of which posts and pages users had endorsed — could be statistically modeled to predict personality traits, sexual orientation, race, religion, and political affiliation with substantial accuracy. Kosinski's academic work was published in respected peer-reviewed journals between 2013 and 2015. It was the foundational research that made Cambridge Analytica's pitch possible.

The second thread was the political ambition of Robert Mercer, an American computational mathematician and hedge-fund billionaire who had become, by 2014, the most significant private financier of the American populist right. Mercer was the principal backer of Steve Bannon's Breitbart News. He had also begun investing, through his daughter Rebekah, in election-data infrastructure he believed could deliver Republican candidates the analytical edge that Obama's 2012 campaign had pioneered for Democrats.

Mercer's vehicle was a U.S. registered subsidiary called Cambridge Analytica, set up in 2013 within the larger British military-and- political consulting group SCL. The Mercer family put in approximately $15 million. Bannon was named to the board. Christopher Wylie — a 27-year-old Canadian who had previously worked for the UK Liberal Democrats — was hired as director of research and asked to figure out how to operationalise the Kosinski work for political purposes.

The third thread was a Cambridge psychology researcher Wylie contacted in early 2014: Aleksandr Kogan, a Russian-born Senior Research Associate at the University of Cambridge Department of Psychology. Kogan was not part of Kosinski's group but was familiar with the methodology. Through his consultancy company Global Science Research, Kogan agreed to build a Facebook app for Cambridge Analytica that would collect both quiz responses and the underlying Facebook profile data.

The app launched in summer 2014. It was titled, with a kind of defensive irony in retrospect, thisisyourdigitallife.

Election work

What Cambridge Analytica did with the data was build psychographic voter models — statistical profiles purporting to predict an individual voter's response to particular emotional appeals — and sell those models to political campaigns.

The first major contract was the 2014 U.S. midterm campaign of North Carolina Republican Senator Thom Tillis. Cambridge Analytica claimed credit for the win and used the case as a sales reference. In 2015, Texas Senator Ted Cruz's presidential primary campaign contracted Cambridge Analytica as its principal digital vendor. Cruz's campaign paid Cambridge Analytica approximately $5.8 million.

In June 2016, after Cruz dropped out of the primary, the Trump campaign — at Robert Mercer's recommendation — hired Cambridge Analytica for the general-election operation. The Trump campaign paid the company approximately $5.9 million. The work focused on voter persuasion in three swing states: Pennsylvania, Michigan, and Wisconsin. Cambridge Analytica's role in those states' digital operations was confirmed in detail by emails released during the 2017–2018 Mueller investigation and by Cambridge Analytica's own case-study marketing materials, which the company removed from its website in March 2018.

In the UK, Cambridge Analytica's involvement with the Brexit referendum has been more contested. The pro-Brexit group Leave.EU publicly acknowledged a working relationship with Cambridge Analytica in November 2015. Cambridge Analytica subsequently denied that any paid contract had been completed. The UK Information Commissioner's Office conducted a three-year investigation and concluded in 2020 that Cambridge Analytica had been "not involved" in the actual Brexit referendum campaign — though it did not address the question of whether the same dataset had been used for related Brexit-adjacent work.

In 2018, the Channel 4 News hidden-camera investigation showed Cambridge Analytica CEO Alexander Nix offering to help a fictional Sri Lankan client with services that included sending sex workers to the home of political opponents to film them, planting "Ukrainian" prostitutes to entrap them, and other operations that — even if they were sales theatre — established what kind of services the company was willing to be heard discussing.¹

The whistleblower

The whistleblower at the center of the case was Christopher Wylie. He had been Cambridge Analytica's director of research from 2013 to late 2014, had been instrumental in the design and operationalisation of the harvest, and had left the company in distress over what he described in subsequent interviews as the political application of methods designed for behavioural research.

Wylie spent 2015–2017 in independent consultancy work in London and Vancouver. He maintained, through that period, a complete archive of Cambridge Analytica internal documentation — invoices, project proposals, technical specifications, contemporary emails — that he had retained from his employment.

In late 2017 he was contacted by Observer (Sunday Guardian) investigative reporter Carole Cadwalladr, who had been investigating Cambridge Analytica's operations independently. The New York Times reporters Matthew Rosenberg and Nicholas Confessore were also working the story.

The three publications coordinated their disclosures. The first articles appeared on Saturday, March 17, 2018, in The Observer and The New York Times. Within hours the story was the lead on every American and British news organization.

Within twenty-four hours, Facebook had suspended Cambridge Analytica's account. Within forty-eight hours, Facebook had suspended Wylie's own account — a fact he reported as a retaliatory gesture but which Facebook characterized as a routine policy enforcement against someone associated with data misuse.

Zuckerberg before Congress

On April 10 and 11, 2018, Mark Zuckerberg appeared before joint sessions of the U.S. Senate Commerce and Judiciary Committees. He read a prepared opening statement that acknowledged "a major breach of trust" but characterized the underlying mechanism — the Open Graph friends-of-friends data extraction — as a feature that had operated within Facebook's intended developer policy rather than as a security failure.

The hearings lasted approximately ten hours combined. The questions revealed two persistent themes: that very few senators understood the technical mechanism well enough to ask Zuckerberg the questions that mattered, and that Zuckerberg's responses on the questions that did get asked were carefully calibrated to commit Facebook to remedial measures (a Facebook "data lockdown," an audit of all historical Open Graph apps, a Facebook "campaign archive") without acknowledging legal liability for the underlying harvest.

The European Parliament hearings on May 22, 2018 went substantially worse for Zuckerberg, who declined to answer most of the questions put to him by EU parliamentarians — including specific questions about whether Facebook had retained dossiers on the millions of non-Facebook users tracked through its tracking-pixel network.

The Federal Trade Commission settlement of July 2019 imposed a $5 billion fine on Facebook (the largest privacy-related fine in U.S. history to that point) and required substantial structural reforms to Facebook's privacy oversight — including the establishment of an independent privacy committee on the Facebook board. The UK Information Commissioner's Office fined Facebook £500,000, the maximum permitted under pre-GDPR law.

What proponents and critics still argue

The factual record of Cambridge Analytica is, for an operation that ended only seven years before this article was written, surprisingly established. The interpretive disagreements that remain:

Did psychographic targeting actually work? The most contested factual question. Cambridge Analytica's own marketing claimed substantial behavioral influence — voters who saw psychographically matched ads were, the company asserted, more likely to vote, donate, or switch positions. Academic studies post-2018 have produced more mixed findings. The Brennan Center for Justice's 2019 review concluded that the empirical evidence for psychographic targeting in U.S. elections was "considerably weaker than the public discussion suggests." Whether psychographic targeting worked and whether it operated as designed are now seen by some scholars as separate questions: the latter is documented, the former is not yet conclusively shown.

Was Brexit affected? The U.K. Information Commissioner's Office concluded in 2020 that Cambridge Analytica had "not [been] involved in the actual referendum campaign." Carole Cadwalladr and others have argued this finding was narrowly defined — that personnel and data flows between Cambridge Analytica and the broader Vote Leave / Leave.EU operations were substantial, even if the specific contractual relationship was technically absent. The U.K. National Crime Agency declined to bring criminal charges in 2020.

Russian connections? Some of the most-quoted contested claims of the period — Aleksandr Kogan's parallel work with Russian universities, Cambridge Analytica's contacts with WikiLeaks via Alexander Nix, the involvement of London-based Russian-linked finance — have been documented in academic work and in Mueller-era disclosures but have not been criminally charged. The cases are public, partial, and unresolved.

How we read the evidence

Cambridge Analytica is the case that taught the rest of the world what Snowden had begun teaching three years earlier — that the data infrastructure built since 2005 to keep people connected to their friends had become, by 2014, a behavioral influence apparatus that operated at a scale earlier propaganda systems had only dreamed of. The difference between Snowden and Cambridge Analytica was that Snowden's program was governmental and (notionally) legally constrained, whereas Cambridge Analytica's was commercial and largely unregulated.

Five years later, what the case actually changed was less than its defenders predicted. The GDPR came into force in May 2018 (the timing was coincidence — the regulation had been drafted years earlier) and gave EU residents stronger data-rights enforcement. Facebook's Open Graph v1 was permanently closed. Cambridge Analytica's parent SCL Group was dissolved.

What the case did not change is the underlying economic logic of ad-funded social media. Behavioral targeting at scale, using psychographic models trained on user data, remains the central revenue mechanism of the platforms. The categories that Cambridge Analytica's 2014 models claimed to predict — political affiliation, emotional susceptibility, vulnerability to specific persuasion methods — are categories that current ad-targeting platforms model continuously, with substantially more data and substantially better infrastructure than Wylie's team had access to in 2014.

The Cambridge Analytica story has been read as a warning that was issued and largely unheeded. The next case of comparable scale, when it surfaces, will almost certainly not be operated by a 6-person British data-analytics firm.

Key figures

---

Further reading

Books:

• Christopher Wylie, Mindfck: Cambridge Analytica and the Plot to Break America* (Random House, 2019).
• Brittany Kaiser, Targeted: My Inside Story of Cambridge Analytica and How Trump, Brexit and Facebook Broke Democracy (HarperCollins, 2019).
• Carole Cadwalladr, The Real Facebook Pages (Atlantic Books, 2024).
• Mary-Hunter McDonnell, Cambridge Analytica: The Power of Big Data and Psychographics (Wharton Press, 2019).

Films and documentaries:

• The Great Hack (2019, Netflix, dir. Karim Amer & Jehane Noujaim). Brittany Kaiser–centered documentary.
• The Cambridge Analytica Files (2018, Channel 4 News). Hidden-camera investigation.
• The Brink (2019, dir. Alison Klayman). Bannon documentary; substantial Cambridge Analytica context.

Primary archives:

• UK ICO Final Report on Cambridge Analytica, 2020
• U.S. Senate testimony of Mark Zuckerberg, April 10-11, 2018
• The Observer's Cambridge Analytica archive

---

Sources

Primary sources

1. Wylie, C. Sworn testimony before the UK Parliament Digital, Culture, Media and Sport Committee, March 27, 2018.
2. UK Information Commissioner's Office. Investigation into the use of personal data in political campaigns, October 2020.
3. U.S. Federal Trade Commission. Decision and Order in re: Facebook, Inc., July 24, 2019. ($5 billion settlement.)
4. U.S. Senate Committee on Commerce, Science, and Transportation. Zuckerberg testimony transcripts, April 10–11, 2018.

Secondary sources

5. Wylie, C. (2019). Mindfck*. Random House.
6. Kaiser, B. (2019). Targeted. HarperCollins.
7. The Observer / The Guardian — Cambridge Analytica Files archive, March 2018 onward.
8. The New York Times — coverage by Rosenberg, Confessore, Cadwalladr, March 17, 2018 onward.
9. Channel 4 News. The Cambridge Analytica Files, March 19, 2018.
10. Amer, K. & Noujaim, J. (dirs.) (2019). The Great Hack. Netflix.
11. Confessore, N. (2018, March 17). "Cambridge Analytica and Facebook: The Scandal and the Fallout So Far." The New York Times.
12. Cadwalladr, C. (2018, March 17). "'I made Steve Bannon's psychological warfare tool': meet the data war whistleblower." The Guardian.

Academic sources

13. Kosinski, M., Stillwell, D., & Graepel, T. (2013). "Private traits and attributes are predictable from digital records of human behavior." PNAS, 110(15), 5802–5805.
14. González-Bailón, S., De Domenico, M., et al. (2023). "Asymmetric ideological segregation in exposure to political news on Facebook." Science, 381(6656), 392–398.

---

Corrections & updates

(None yet.)

Footnotes

1. Channel 4 News undercover report, March 19, 2018. Cambridge Analytica subsequently sued Channel 4 for defamation; the suit was dropped after the company's bankruptcy. ↩