Facebook parent company Meta has agreed to pay $725 million to settle a class-action lawsuit that claims it improperly shared user information with Cambridge Analytica, a data analytics firm that was used by the Trump campaign.[1]
In a scandal dating back to 2018, the proposed settlement arose from a reveal that information of up to 87 million people was improperly accessed by the firm. The settlement marks a record for the largest recovery in a data privacy class action suit.
Background on the Cambridge Analytica Scandal
Cambridge Analytica is a political consulting firm that did work for the Trump campaign. Though it has since filed for bankruptcy, the complicated web of relationships involved in the scandal endures.
Here’s a breakdown.
Facebook exposed data on up to 87 million Facebook users to a researcher who worked at Cambridge Analytica, the same firm that worked for the Trump campaign. The firm was created when Steve Bannon approached conservative donors Rebekah and Robert Mercer to fund a political consulting firm.
The goal for Cambridge Analytica was to create psychological profiles of American voters to tailor pitches to target specific voter groups. Texas Senator Ted Cruz also used the firm for his 2016 presidential campaign.
In 2016, Bannon became the vice president of Cambridge Analytica and reached out to the Trump campaign for introductions. Bannon would later become the senior advisor to Trump before his termination in 2017.
Cambridge Analytica’s work is done by the SCL Group, a British PR firm that works for politicians, governments, and militaries on a global level. The PR firm describes its capabilities as “psychological warfare” and “influence operations,” claiming to have a sophisticated understanding of human psychology in the art of persuasion.[2]
According to the Wall Street Journal, Cambridge Analytica CEO Alexander Nix reached out to the WikiLeaks founder Julian Assange about hacked emails from the Democratic National Committee’s servers, which is how the firm got some of its data.
The firm also got data from Facebook, according to a former Cambridge Analytica employee, through a Russian American researcher named Aleksandr Kogan.[3] He built a Facebook app that was a personality test, which collected data from users who took it. The quiz exposed a loophole in the Facebook API that allowed it to collect data from the friends of the users as well.
Cambridge Analytica was also exposed for its role in Brexit in 2019, according to whistleblower Christopher Wylie.[4] He claimed that Cambridge Analytica used Facebook user data to target conspiracy theorists and persuade British voters to support the decision to exit the European Union. Bannon was the vice president at the time.
Source: UK Parliament
Despite Facebook prohibiting the sale of data collected in this manner, Cambridge Analytica sold data regardless.
The Scandal Breaks
After the Cambridge Analytica news story broke, Facebook founder and CEO Mark Zuckerberg was silent for five days. When he eventually spoke out, he leveraged PR talking points about data protection and service to users, which culminated in a 3,000-word treatise on Facebook’s new “privacy-focused” future.
Source: Facebook
The revelation wasn’t new – several facts about the Cambridge Analytica scandal had emerged in small doses over the previous year. But when the full story was revealed, the public took notice.
Data breaches happen often, especially with large companies. Facebook’s scandal was different, however, because it wasn’t a malicious actor, but the platform’s design. It amasses data, which can be extracted and exploited.
Zuckerberg has pivoted to a more user-focused talking point, writing that he has been “working to understand exactly what happened and how to make sure this doesn’t happen again. The good news is that the most important actions to prevent this from happening again today we have already taken years ago. But we also made mistakes, there’s more to do, and we need to step up and do it.”
Within the company, the security team and legal team in charge of privacy and user protection were at odds with those who are tasked with bringing in revenue for the platform.
There’s also political strife. Cambridge Analytica’s work may not have had any real impact on Trump’s election, but it lost its credibility in the political consulting industry. The scandal had a larger impact, however.
The exposure of data to Cambridge Analytica sparked a larger debate over Facebook users and how much they can trust their data on the platform. Facebook is charged with protecting its users, but it allowed a third-party developer to create an application to gather data – exploiting not only the users themselves, but their friends, without their knowledge.
Ashkan Soltani, a former chief technologist for the Federal Trade Commission, said that “While it appears that Facebook is suddenly ‘woke’ to privacy issues, it’s safe to assume that it’s business as usual there.”[5]
Lindsey Barret, a teaching fellow and staff attorney at the Communications and Technology Clinic at Georgetown has similar thoughts. Barrett cited Facebook’s insistence on using phone numbers that users provided for security reasons for non-security purposes, stating that, “They keep actually putting growth and profits above designing a platform that’s predicated on the needs of its users.”
Meta Settles the Lawsuit
The legal battle over the scandal began about four years ago, not long after the platform announced that the private data of its users was obtained by Cambridge Analytica. The scandal was intense, drawing the attention of regulators in the US and the UK.
The lawsuit involved a massive amount of information, including millions of pages of documents from Facebook and other parties and hundreds of hours of depositions with current and former Facebook employees.
Meta didn’t admit any wrongdoing as part of the settlement. According to the Meta spokesperson Dina Luce, “We pursued a settlement as it’s in the best interest of our community and shareholders. Over the last three years, we revamped our approach to privacy and implemented a comprehensive privacy program. We look forward to continuing to build services people love and trust with privacy at the forefront.”
One of the considerations is that the users pointed to the changes that Facebook has made to the platform following the breach, which include improving communication about how data is collected and shared and restricting third-party access to user data.
The motion to approve the settlement estimated that between 250 and 280 million people may be eligible for payments as part of the class action suit. It’s pending approval from a judge, which is scheduled for March of this year.
Other Legal Ramifications
According to a report by the UK Information Commissioner’s Office in 2020, there’s doubt over the true capabilities of Cambridge Analytica’s capabilities.[6] The “psychological warfare” of the data firm and SCL Group may have been more marketing and promotion than actual proficiency, but the data breach triggered events that led to more awareness on the part of users as to how vulnerable their data truly is.
In addition to the Cambridge Analytica lawsuit, there was a global outcry for justice and accountability. Facebook made changes to the platform, Zuckerberg went on an apology tour, and more legal consequences followed.
In 2019, Facebook paid a settlement of $5 billion with the US Federal Trade Commission over the breach.[7] There was an additional settlement of $100 million with the US Securities and Exchange Commission over claims of misleading investors about the concerns surrounding the misuse of data.[8]
The Scandal’s Impact on Marketing
After the news broke, Facebook made a number of changes to business tools to ensure that companies went through the proper channels to work on behalf of other companies. This includes a lockdown on custom audiences to prevent the data collected from being sold to third parties.
Other social networks, including Twitter, allow users to see, edit, or delete data on platforms. This is due in part to the California Consumer Privacy Act, or CCPA, which was passed in 2018, California residents now have the right to:[9]
- Know what personal data is being collected about them
- Know whether their data is being sold and to whom
- Opt out of the sale of personal data
- Access the data collected about them
- Request data be deleted
All of this can be done without the loss or reduction of services. CCPA was groundbreaking as “gateway” legislation, which is poised to change how US-based companies handle and collect data about California residents.
Finally, Google announced that it would entirely block third-party cookies in Chrome, an initiative that will be rolled out over the next few years. Google is currenting set to phase out third-party cookies in Chrome by 2024 – a timeframe designed to allow marketers to adjust their advertising approach in favor of less intrusive methods.
Looking Forward
The Cambridge Analytica scandal unfolded over years, finally culminating in a record settlement for data privacy and a public of internet users with eyes wide open. Though the data firm may not have influenced an election – the arguable purpose of this initiative – the chaos that ensued revealed what companies could do with data collection and exploitation.
In a post-Cambridge Analytica world, consumers are more aware of data protection and privacy, and the potential consequences this could bring for marketing remain to be seen.
Sources:
[1] https://www.cnn.com/2022/12/23/tech/meta-cambridge-analytica-settlement/index.html
[2] https://www.wsj.com/articles/wikileaks-assange-says-he-rejected-overture-from-trump-linked-group-1508961298
[3] https://www.theguardian.com/news/2018/mar/17/data-war-whistleblower-christopher-wylie-faceook-nix-bannon-trump
[4] https://www.npr.org/2019/10/08/768287535/cambridge-analytica-whistleblower-christopher-wylie
[5] https://www.commerce.senate.gov/services/files/3761a308-1b00-4aef-b97e-fbaf519c0025
[6] https://ico.org.uk/media/action-weve-taken/2618383/20201002_ico-o-ed-l-rtl-0181_to-julian-knight-mp.pdf
[7] https://www.npr.org/2019/07/24/741282397/facebook-to-pay-5-billion-to-settle-ftc-privacy-case
[8] https://www.sec.gov/news/press-release/2019-140
[9] https://oag.ca.gov/privacy/ccpa
