Cambridge Analytica

A personality application opened a path to millions of nonparticipants

Aleksandr Kogan and his company GSR used a Facebook application to collect data from people who agreed to take a personality survey. Under Facebook's platform rules at the time, the application could also receive information about many of those users' friends. Data then moved into work associated with Cambridge Analytica and political profiling. The friend did not install the application, read its disclosure, or understand herself as joining a research or campaign system.¹

That is the foundational asymmetry. One person's click authorized collection about another person; a platform permission became treated as consent; and data created in a social context became an input to political services. The Federal Trade Commission later found that Cambridge Analytica deceptively claimed it would not collect personally identifiable information from survey takers and that it participated in the EU-U.S. Privacy Shield while failing to meet its requirements.²

The vendor sold a promise of hidden explanatory power

Cambridge Analytica marketed data analytics, audience segmentation, and psychographic methods to campaigns. Personality-derived categories offered a seductive claim: political messages could be tailored not merely to demographics or behavior but to underlying psychological traits. That promise increased the commercial and strategic value of the data, whether or not every advertised persuasion effect could be independently demonstrated.

The distinction between capability and efficacy is essential. Investigations support that data were collected and transferred, profiles and targeting services were developed, and claims to clients were made. They do not establish that Cambridge Analytica determined the outcome of the 2016 United States presidential election, the Brexit referendum, or every campaign it touched. Vendor claims, whistleblower accounts, campaign testimony, and observed electoral outcomes are different kinds of evidence.³

Microtargeting fragmented the public evidence surface

Political persuasion has always segmented audiences. Digital systems change the scale, speed, and observability of segmentation. A campaign can test messages, select narrow audiences, and show each group an argument others never see. Success metrics return clicks, views, donations, or predicted response to the campaign; the broader public may have no archive of the promises, fears, and contradictions being tested.

This creates a problem for autonomy with evidence. A voter may freely respond to the message on the screen and still lack evidence about why she was selected, which profile informed the selection, who paid, what variants others received, or whether the underlying data are accurate. Apparent individual choice occurs inside an information environment optimized by an invisible counterparty.

The Information Commissioner's Office investigated political parties, campaigns, data brokers, platforms, and analytics firms rather than reducing the system to one company. Its report found a complex ecosystem with unclear lawful bases, weak transparency, and governance problems. That breadth is the right causal frame: Cambridge Analytica was a consequential actor inside a platform and campaign market, not a solitary machine controlling voters.¹

Former insiders and regulators made the pipeline observable

Whistleblower accounts and documentary reporting made the data flow public. The ICO obtained a warrant and searched Cambridge Analytica's offices, then worked through servers, devices, contracts, and counterparties. Its retrospective account of the raid shows how difficult it was for public authority to reconstruct a private, cross-border data system after the organization had warning and the company was moving toward closure.⁴

The United Kingdom Parliament's inquiry encountered disputed testimony, incomplete records, platform delay, and changing company structures. Its final report made recommendations on electoral law, platform responsibility, and political advertising. Parliamentary findings are institutional judgments, not experimental proof of persuasion effects; their strongest contribution is to show the accountability gaps created by the system.³

Democratic targeting needs a shared audit trail

The remedy is not to require identical political speech for everyone. Campaigns need to reach constituencies, and voters benefit from relevant communication. The constitutional controls are provenance and inspectability: meaningful consent for data use, limits on friend-network collection, an accessible profile and correction path, public archives of paid political messages and targeting criteria, sponsor identity, and independent research access to platform effects.

The relation to Meta/Facebook is direct but not interchangeable. Facebook designed the permissions and advertising substrate; Kogan's application collected data; Cambridge Analytica and affiliates developed and sold political services; campaigns chose objectives. Responsibility follows the capability each actor controlled. A trustworthy system must prevent every actor from saying the decisive evidence lived somewhere else in the chain.