A political consulting firm secretly harvested tens of millions of Facebook profiles to manipulate elections

What is documented, and admitted

The strength of this case is that almost every load-bearing fact is on the record from official or admitted sources, not inference. Start with the harvest itself. Facebook did not merely fail to deny it; the company stated in April 2018 that up to 87 million people may have had their data taken this way, a figure far above Cambridge Analytica's own claim of about 30 million. The United Kingdom's Information Commissioner's Office, after its own investigation, reached the same conclusion and fined Facebook the maximum 500,000 pounds available under the pre-GDPR law.

The money and the people are documented too. Republican donor Robert Mercer put roughly 15 million dollars into the firm, and his political adviser Steve Bannon was involved in steering it before he ran the Trump campaign. Cambridge Analytica worked first for Ted Cruz's 2016 primary campaign and then for Donald Trump's general-election effort. The firm had grown out of SCL Group, a British contractor with a history in military information operations, a lineage that gave the whole enterprise its unsettling cast.

A quiz taken by a few hundred thousand people became a database of tens of millions, because Facebook let the app reach into their friends' profiles too.

Then came the reckoning, and it was concrete. Whistleblower Christopher Wylie handed over documents that let the Observer, the Guardian, and The New York Times publish the story in March 2018. Channel 4 News aired undercover footage of chief executive Alexander Nix and colleagues boasting about entrapment and disinformation tactics. Mark Zuckerberg testified before Congress. Cambridge Analytica and SCL Elections collapsed into insolvency within six weeks. And in 2019 the US Federal Trade Commission imposed a 5 billion dollar penalty on Facebook, the largest privacy fine of its kind at the time, while separately suing the firm and settling with Nix and Kogan. This is not a case that needs embellishing.

Where the story gets oversold

There is a version of this scandal that reaches past the evidence, and it is worth naming precisely because the rest is so solid. In that telling, Cambridge Analytica possessed a kind of psychological superweapon: it read voters' minds from their Facebook likes and, through pinpoint microtargeting, quietly programmed the outcome of the 2016 US election and the Brexit referendum. That is the part the record does not support.

The first thing to notice is where the mind-control framing came from: largely from the firm's own sales pitch. A consultancy selling manipulation as a service had every commercial reason to overstate what it could do, and the undercover boasts were marketing as much as confession. As Oxford's Rasmus Kleis Nielsenput it, it is absurd to accept a for-profit firm's self-interested claims about its own effectiveness as evidence that it worked.

The independent research points the other way. Studies of personality-based microtargeting generally find that it adds little over ordinary ad targeting, and political scientists broadly agree that changing someone's settled vote is extremely hard, whatever data you hold. The firm's involvement in Brexit specifically was investigated and found to be far more limited than the early headlines implied. None of this excuses the harvest. It simply means the proven crime, taking the data without consent, is a different thing from the unproven claim that the data then decided history.

Keeping those two apart is the whole discipline of the case. The improper collection of tens of millions of profiles is substantiated. The notion that this collection amounted to mind control potent enough to swing national votes single-handedly is not established, and treating the firm's advertising copy as if it were a lab result gets the story wrong in the company's favor.

Why it stuck so hard

This one lodged in the public mind more firmly than almost any data story before it, and the reasons are worth understanding, because they are mostly rational. The claim was true in its essentials, and it arrived with the kind of evidence conspiracy narratives usually lack: a named whistleblower, leaked internal documents, hidden-camera footage, sworn testimony, and regulators writing nine- and ten-figure checks. Belief did not require a leap of faith.

It also violated a boundary people thought they understood. The friends-data loophole meant your information could leak because someone elsetook a quiz, an exposure you could not have prevented and did not know about. That feeling, that privacy had been decided for you by strangers and a platform's settings, was widely and correctly felt, and it made the scandal personal in a way abstract data-policy debates never had been.

And the cast fit a story people were already primed to believe: a secretive firm with a military-operations pedigree, a reclusive billionaire, a political strategist, and a winning campaign, all connected by a hidden river of data. The arrangement was strange and elite enough that the darkest reading felt natural. The lesson of the case is not that the suspicion was misplaced; it is that the documented reality was damning enough on its own, and that the temptation to gild it with mind-control powers actually flatters the firm that stole the data.