How Cambridge Analytica Harvested 87 Million Facebook Users

In the spring of 2018, one of the largest data breaches in internet history became public—not through an anonymous leak, but through a whistleblower willing to testify and journalists willing to investigate. The story that emerged from *The Guardian* and *New York Times* on March 17, 2018, exposed a systematic surveillance operation that had compromised the personal information of roughly one in three American Facebook users.

The operation itself was deceptively simple. Between 2013 and 2015, Cambridge Analytica, a British-headquartered political consulting firm, deployed a psychological survey app called "thisisyourdigitallife." Created by researcher Aleksandr Kogan, the app was straightforward: users installed it, answered questions, and received feedback on their personality.

But the real data collection operated on a different level. When someone installed the app, it didn't just gather their responses—it gained access to data from all of their Facebook friends as well. The app was installed by approximately 300,000 people, but through Facebook's permissive API (Application Programming Interface) design at the time, Cambridge Analytica captured information from roughly 87 million users who had never even interacted with the app.

The Technical Vulnerability

This breach reveals a critical flaw in how Facebook operated during the early-to-mid 2010s. The platform allowed third-party applications sweeping access to user data—a design choice that prioritized developer innovation over user privacy. Facebook's API permitted apps to retrieve not just a user's direct information, but data from their entire social network, with minimal oversight.

Cambridge Analytica weaponized this vulnerability. The harvested data—demographic information, behavioral patterns, political leanings, and psychological profiles—was compiled into detailed voter profiles. The firm used this intelligence to assist political campaigns, notably the 2016 presidential campaigns of Ted Cruz and Donald Trump, crafting targeted messaging designed to influence voting behavior.

For nearly three years, the operation remained hidden. Then, in March 2018, Christopher Wylie, a former Cambridge Analytica employee turned whistleblower, provided journalists and regulators with evidence of the scheme.

Swift Corporate Collapse

The consequences were swift and severe. Facebook suspended Cambridge Analytica from its platform within 24 hours of the public revelation. Within two months, Cambridge Analytica filed for Chapter 7 bankruptcy protection—the legal mechanism that results in complete liquidation rather than restructuring. The firm ceased operations entirely by May 2018.

Facebook itself faced historic regulatory penalties. The U.S. Federal Trade Commission imposed a $5 billion fine in July 2019—at that time, the largest privacy penalty ever assessed against a technology company. The United Kingdom's Information Commissioner's Office fined Facebook £500,000 in October 2019.

Mark Zuckerberg, Facebook's CEO, was called to testify before the U.S. House Energy and Commerce Committee. The company announced it would notify affected users starting April 9, 2018, and pledged new privacy protections.

Global Ripple Effects

The Cambridge Analytica scandal became a watershed moment in technology regulation. It demonstrated that social media platforms could serve as infrastructure for political manipulation at scale, and that self-regulation by tech companies was insufficient.

The case accelerated legislative efforts worldwide. Europe's General Data Protection Regulation (GDPR), which had been finalized in 2016, took effect in May 2018—just weeks after the scandal broke—with significantly stricter requirements for how companies handle personal data. Other countries followed with comparable legislation, treating the Cambridge Analytica case as evidence that strong data protection laws were necessary.

For international observers, the scandal illustrated how digital platforms developed in one country could be weaponized across borders to influence elections globally. It also exposed the vulnerability of personal data in an era when information flows across jurisdictions that operate under fundamentally different legal frameworks.

Today, Cambridge Analytica exists primarily in retrospect—as a case study in corporate misconduct, regulatory failure, and the hidden mechanisms of modern political persuasion. Its collapse did not erase the questions it raised, but rather ensured they would shape technology policy for years to come.