Facebook–Cambridge Analytica Data Scandal: Privacy and Policy
This paper examines the 2018 Facebook–Cambridge Analytica data scandal, tracing how the political consulting firm harvested the profile data of millions of Facebook users through a third-party app during the 2016 U.S. presidential campaign. The paper outlines Facebook's longstanding data-collection business model, analyzes Mark Zuckerberg's congressional testimony, and evaluates the concrete steps the company announced in response to public and regulatory pressure — including limiting third-party data brokers and aligning with European data-protection standards. It concludes by considering the broader implications for the tech industry as regulators and users demand greater transparency and privacy controls.
- Introduction: Overview of the 2018 Facebook data scandal
- The Issue: Cambridge Analytica and Data Harvesting: How Cambridge Analytica harvested Facebook user data
- Securing Data: Zuckerberg Before Congress: Zuckerberg testifies and announces European-aligned policy
- Steps Facebook Is Taking: Facebook limits third-party data brokers and ad targeting
- Conclusion: Long-term implications for tech industry data practices
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- It grounds abstract privacy concerns in concrete events — the 2016 election, Zuckerberg's congressional testimony, and specific FTC statements — giving the argument real-world weight.
- It moves beyond surface-level scandal coverage to explain Facebook's underlying business model, showing that data harvesting was not an anomaly but a structural feature of the platform.
- It uses direct quotations from primary sources (congressional testimony, news reports) to support claims and adds critical commentary rather than simply summarizing events.
Key academic technique demonstrated
The paper demonstrates critical analysis of corporate rhetoric: it juxtaposes what Facebook and Zuckerberg publicly promised with what the company's actual business model incentivizes, using source evidence to expose the gap between stated policy and structural practice. This technique — surfacing contradictions between public claims and institutional logic — is a hallmark of effective argumentative writing in media and technology studies.
Structure breakdown
The paper follows a clear problem–context–response–critique–implication arc. The introduction frames the scandal; the second section narrates how Cambridge Analytica operated and how Facebook's own policies enabled it; the third section covers the regulatory pressure and Zuckerberg's testimony; the fourth section evaluates Facebook's announced remedies with skepticism; and the conclusion broadens the lens to the entire tech industry. Each section builds logically on the previous one, maintaining a consistent critical perspective throughout.
Introduction
The Facebook data scandal of 2018 was less a traditional "breach" than the harvesting of data by third parties looking to monetize and use Big Data by collecting information on Facebook users. The true "breach" that did occur, however, was a breach of trust among Facebook users, who believed their personal information was safer and more private than it actually was. At the center of the scandal was a company called Cambridge Analytica, which was accused of inappropriately harvesting the data of Facebook users through an app that supplied the firm with users' profile information (Vengattil, 2018). In reality, data leaks had occurred routinely on Facebook going back years (Rash, 2018). This paper discusses the current and past situations regarding Facebook's user data issues and examines the steps the company was taking to resolve them.
The Issue: Cambridge Analytica and Data Harvesting
The 2016 presidential race in the U.S. was fraught with tension as Trump and Clinton vied to outdo one another on the campaign trail. Analysts tried to get a read on how voters would turn out at the polls — and one such group was Robert Mercer's Cambridge Analytica, headed at the time by Trump advisor Steve Bannon. Cambridge Analytica wanted a non-traditional poll reading and so turned to social media to obtain it. Using an app called thisisyourdigitallife, designed by a university scientist named Sanjay Sreeni, Cambridge Analytica began inviting Facebook users to take an online survey ostensibly for academic purposes (Cadwalladr & Graham-Harrison, 2018).
While survey participants agreed to allow Cambridge Analytica to collect their data, the app went beyond those participants' profiles and collected data belonging to their Facebook friends as well. This was actually permitted by Facebook's platform policy, which allowed Cambridge Analytica to collect "friends' data to improve user experience in the app," though the policy did forbid that data from "being sold on or used for advertising" (Cadwalladr & Graham-Harrison, 2018). Cambridge Analytica not only used that data to identify how millions of Americans were likely to vote, but the organization also used it to conduct direct advertising — a clear violation of Facebook's policy. The collection or harvesting of data itself, however, was technically not a violation of the site's policy. That policy would have to change once the public discovered how its data was being used by third parties and Congress got involved.
The issue of Facebook and the election was already a thorny one because of accusations that the election had been "hacked" and rumors that Russian operatives had used social media agents to manipulate public opinion. While those accusations were not firmly grounded in evidence, the issue of data harvesting was real — and it was one that Facebook CEO Mark Zuckerberg would have to answer for before Congress. Data security issues in Facebook's case had already been noted by the FTC as far back as 2011 (Rash, 2018). Now it was time for Zuckerberg to answer questions about exactly what role Facebook played in gathering information on its users and allowing others to obtain it.
Securing Data: Zuckerberg Before Congress
With Zuckerberg in the spotlight and shareholders and users demanding information about how data would be protected in the future, the CEO pointed to new data regulations in Europe as a model for how the company would establish policy going forward (Newcomb, 2018). The new European law governs how companies store data and requires them to alert authorities within 72 hours of a breach. Companies that fail to comply can be fined 4 percent of their global revenue or 20 million euros — whichever figure is higher (Newcomb, 2018). For Facebook, that type of fine would be a significant blow to the firm's bottom line. With Europe setting the pace and the 2018 data scandal serving as the impetus for action, Zuckerberg vowed that Facebook would upgrade its policy to align with European law and implement that policy not just in Europe but worldwide, including in the United States.
Congress wanted assurances that Facebook would indeed implement such a policy, and Zuckerberg appeared before Congress on April 11, 2018, to testify about what had happened and how Facebook would fix the issue going forward. One step the company took was to inform affected users: "Facebook has published a tool that will tell you whether you were one of the 87 million users affected by the breach" (Hicks & Ellis, 2018). However, in terms of broader policy, Zuckerberg was somewhat evasive when he testified. He stated: "To your broader point about the privacy policy … long privacy policies are very confusing. And if you make it long and spell out all the detail, then you're probably going to reduce the percentage of people who read it and make it accessible to them" (Watson, 2018).
The reality of Facebook's existing policy was that data harvesting was precisely what the social media platform was designed to do. By collecting data on users, it could enter the Big Data market and monetize user profiles. Facebook forbade third parties from selling users' data to others or using it for advertising because that revenue stream was what Facebook itself wanted to exploit. The harvesting of data was not forbidden — which is why Zuckerberg told Congress: "Cambridge Analytica wasn't using our services in 2015, as far as we can tell … They weren't an advertiser. They weren't running pages. So we actually had nothing to ban" (Watson, 2018). Zuckerberg further told the Senate: "What we allow is for advertisers to tell us who they want to reach, and then we do the placement … That's a very fundamental part of how our model works and something that is often misunderstood" (Watson, 2018). In other words, Facebook uses users' profiles to handle advertising placements on behalf of advertisers, keeping that data internal so that it can monetize it directly. Allowing third parties unrestricted access to that data would deprive Facebook of that revenue opportunity.
Conclusion
The data scandal at Facebook will have long-term effects on tech companies that collect data, as the central issue is how users' information is being used and distributed by these firms. More privacy controls will be implemented, as is already being seen in Europe — and that means the share prices of tech companies are likely to come under pressure, given that the market capitalizations of many firms that have gone public in recent years have risen exponentially on the promise of data-driven revenues. If those companies are cut off from sharing or monetizing user information by new regulations, they will lose the profits they have been promising shareholders.
If the option of selling Big Data or profiting from digital advertisers is eliminated or substantially curtailed, tech companies will have to find other ways to generate revenue — and that will not be easy in the Digital Age, where the primary driver of many business models is the collection and use of user data. Digital advertising has been the industry's bread and butter for years. Now that the public and Congress are taking a closer look at the way these companies use personal data, the tech industry faces a challenging period ahead — especially if users begin to turn away from social media altogether.
References
Cadwalladr, C. & Graham-Harrison, E. (2018). Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach. Retrieved from https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election
Guynn, J. (2018). Facebook limits ad targeting after Cambridge Analytica data leak. Retrieved from https://www.usatoday.com/story/tech/news/2018/03/28/facebook-limits-ad-targeting-after-cambridge-analytica-data-leak/468470002/
Hicks, M. & Ellis, C. (2018). The Cambridge Analytica and Facebook data scandal: how to tell if your data was shared. Retrieved from https://www.techradar.com/news/us-uk-investigating-facebooks-role-in-cambridge-analytica-data-breach
Newcomb, A. (2018). Facebook data harvesting scandal widens to 87 million people. Retrieved from https://www.nbcnews.com/tech/tech-news/facebook-data-harvesting-scandal-widens-87-million-people-n862771
Rash, W. (2018). Cambridge Analytica breach reveals Facebook's weak user data defenses. Retrieved from http://www.eweek.com/cloud/cambridge-analytica-breach-reveals-facebook-s-weak-user-data-defenses
Vengattil, M. (2018). Facebook shares slide on reports of data breach involving 50 million users. Retrieved from http://business.financialpost.com/technology/facebook-shares-slide-after-reports-of-data-misuse
Watson, C. (2018). The key moments from Mark Zuckerberg's testimony to Congress. Retrieved from https://www.theguardian.com/technology/2018/apr/11/mark-zuckerbergs-testimony-to-congress-the-key-moments
Create your account
Always verify citation format against your institution’s current style guide requirements.