Meta/Facebook Knowledge of Cambridge Analytica Before March 2018 (2015-18)
Introduction
In December 2015, Facebook''s internal trust-and-safety team identified that Aleksandr Kogan, a Cambridge University academic, had used a personality-quiz app called ''thisisyourdigitallife'' to harvest data from approximately 87 million Facebook users — and had then transferred that data to SCL Group and its political data subsidiary, Cambridge Analytica, in violation of Facebook''s platform policies.
What Facebook did next, and what it failed to do, is the core of the documentary controversy.
What Facebook Knew and When
Facebook''s platform terms prohibited developers from selling or transferring data obtained through the platform to third parties. When the December 2015 Guardian article (by Harry Davies) reported that Cambridge Analytica held Facebook data, Facebook contacted Kogan and Cambridge Analytica and required them to certify in writing that the data had been deleted.
Facebook did not verify the deletion independently. It did not notify the approximately 87 million affected users. It did not report the incident to the FTC. It treated the matter as closed once it received the certifications.
Internal documents produced during the subsequent FTC investigation showed that Facebook''s policy enforcement team had documented the gap — the scale of data harvested, the fact that third-party transfer had occurred — but categorised the matter as resolved by the certifications. This is the basis for the ''cover-up'' characterisation: Facebook possessed knowledge of a serious data misuse event and made a deliberate choice not to disclose it to users or regulators.
The Wylie Whistleblower Disclosures (March 2018)
On 17 March 2018, Christopher Wylie — a former Cambridge Analytica employee — provided extensive documentation to The New York Times and The Guardian showing that the data had not been deleted as certified. The simultaneous publication of these investigations triggered immediate regulatory and congressional responses.
Mark Zuckerberg testified before the Senate Commerce and Judiciary committees on 10-11 April 2018. His testimony included the acknowledgment that Facebook had not adequately policed third-party developer access to user data. Antigone Davis, Facebook''s VP of Global Safety, provided additional testimony.
Regulatory Outcomes
The FTC reached a $5 billion settlement with Facebook on 24 July 2019 — the largest fine ever imposed on a technology company at that time. The settlement included requirements for a new privacy oversight structure within Facebook, including an independent privacy committee on the board. The SEC separately imposed a $100 million fine in July 2019 for misleading investors about the risks of data misuse.
The UK Information Commissioner''s Office (ICO) fined Facebook £500,000 — the maximum allowed under pre-GDPR rules — for the breach. Cambridge Analytica and its parent SCL Group filed for bankruptcy in May 2018 following the disclosures.
Partially True: What the Record Supports
The documentary record supports the claim that Facebook knew about the data harvest in December 2015, chose not to notify users, and accepted self-certified deletion assurances rather than conducting independent verification. This is a documented institutional failure with a clear paper trail.
The more maximalist version of the claim — that Facebook actively facilitated Cambridge Analytica''s political operations, or that senior leadership including Zuckerberg personally directed a cover-up — has not been established by the documentary record to the same degree.
Verdict
The core factual claim — that Facebook knew about the Kogan/Cambridge Analytica data harvest in December 2015 and did not notify users or regulators — is supported by internal documents and regulatory findings. The $5 billion FTC settlement reflects this. The stronger claim that this constituted deliberate executive-level conspiracy rather than institutional negligence and prioritisation of commercial interests over disclosure obligations is partially supported but not fully established.
Evidence Filters8
Facebook internal documents: Dec 2015 knowledge confirmed
SupportingStrongDocuments produced in the FTC investigation confirmed that Facebook's policy enforcement team identified the Kogan/Cambridge Analytica data transfer in December 2015 — more than two years before the public disclosures of March 2018. The knowledge is a matter of documentary record.
Facebook did not notify ~87 million affected users
SupportingStrongDespite identifying the data harvest in December 2015, Facebook did not notify the approximately 87 million users whose data had been transferred to Cambridge Analytica. This non-disclosure to users — spanning more than two years — is documented and central to the FTC's findings.
Deletion certifications accepted without independent verification
SupportingStrongFacebook's response to the identified breach was to obtain written certifications from Kogan and Cambridge Analytica that the data had been deleted. It did not conduct independent technical verification. Christopher Wylie's 2018 disclosures confirmed the data had not been deleted as certified.
$5 billion FTC settlement (24 Jul 2019)
SupportingStrongThe FTC's $5 billion settlement with Facebook — then the largest tech company fine in US history — was predicated on findings of inadequate privacy safeguards and misleading disclosures. The scale of the penalty reflects the regulatory view of the severity of the conduct.
Christopher Wylie whistleblower disclosures (17 Mar 2018)
SupportingStrongWylie, a former Cambridge Analytica employee, provided internal documents and testimony to the New York Times and The Guardian simultaneously published on 17 March 2018. His disclosures established that data was retained despite deletion certifications and that SCL/CA had used the data for political profiling.
Cambridge Analytica and SCL Group bankruptcy (May 2018)
SupportingFollowing the public disclosures, Cambridge Analytica and parent SCL Group filed for bankruptcy in May 2018. The commercial destruction of the firm limits further documentary discovery, as records may not be fully preserved.
Zuckerberg Senate testimony acknowledged inadequate developer policing
DebunkingIn his April 2018 Senate testimony, Zuckerberg acknowledged that Facebook had not adequately policed third-party developer data access. This admission on the record is consistent with the institutional-failure framing but does not establish deliberate senior-executive cover-up.
Rebuttal
The acknowledgment of inadequate policing is consistent with both institutional negligence and deliberate concealment. The testimony alone does not resolve which framing is more accurate; it is consistent with both.
UK ICO £500K fine — maximum under pre-GDPR rules
SupportingStrongThe UK Information Commissioner's Office fined Facebook £500,000, the maximum available under the pre-GDPR Data Protection Act 1998. The ICO specifically found that Facebook had failed to safeguard users' personal data and failed to be transparent about how that data could be used.
Evidence Cited by Believers7
Facebook internal documents: Dec 2015 knowledge confirmed
SupportingStrongDocuments produced in the FTC investigation confirmed that Facebook's policy enforcement team identified the Kogan/Cambridge Analytica data transfer in December 2015 — more than two years before the public disclosures of March 2018. The knowledge is a matter of documentary record.
Facebook did not notify ~87 million affected users
SupportingStrongDespite identifying the data harvest in December 2015, Facebook did not notify the approximately 87 million users whose data had been transferred to Cambridge Analytica. This non-disclosure to users — spanning more than two years — is documented and central to the FTC's findings.
Deletion certifications accepted without independent verification
SupportingStrongFacebook's response to the identified breach was to obtain written certifications from Kogan and Cambridge Analytica that the data had been deleted. It did not conduct independent technical verification. Christopher Wylie's 2018 disclosures confirmed the data had not been deleted as certified.
$5 billion FTC settlement (24 Jul 2019)
SupportingStrongThe FTC's $5 billion settlement with Facebook — then the largest tech company fine in US history — was predicated on findings of inadequate privacy safeguards and misleading disclosures. The scale of the penalty reflects the regulatory view of the severity of the conduct.
Christopher Wylie whistleblower disclosures (17 Mar 2018)
SupportingStrongWylie, a former Cambridge Analytica employee, provided internal documents and testimony to the New York Times and The Guardian simultaneously published on 17 March 2018. His disclosures established that data was retained despite deletion certifications and that SCL/CA had used the data for political profiling.
Cambridge Analytica and SCL Group bankruptcy (May 2018)
SupportingFollowing the public disclosures, Cambridge Analytica and parent SCL Group filed for bankruptcy in May 2018. The commercial destruction of the firm limits further documentary discovery, as records may not be fully preserved.
UK ICO £500K fine — maximum under pre-GDPR rules
SupportingStrongThe UK Information Commissioner's Office fined Facebook £500,000, the maximum available under the pre-GDPR Data Protection Act 1998. The ICO specifically found that Facebook had failed to safeguard users' personal data and failed to be transparent about how that data could be used.
Counter-Evidence1
Zuckerberg Senate testimony acknowledged inadequate developer policing
DebunkingIn his April 2018 Senate testimony, Zuckerberg acknowledged that Facebook had not adequately policed third-party developer data access. This admission on the record is consistent with the institutional-failure framing but does not establish deliberate senior-executive cover-up.
Rebuttal
The acknowledgment of inadequate policing is consistent with both institutional negligence and deliberate concealment. The testimony alone does not resolve which framing is more accurate; it is consistent with both.
Timeline
Facebook identifies Kogan/Cambridge Analytica data harvest
A Guardian article by Harry Davies alerts Facebook to Kogan's 'thisisyourdigitallife' app and its transfer of user data to Cambridge Analytica. Facebook contacts Kogan and CA and requires written deletion certifications. Affected users are not notified.
Wylie disclosures: data was not deleted; simultaneous NYT and Guardian publications
Christopher Wylie provides internal Cambridge Analytica documents to the New York Times and The Guardian, published simultaneously on 17 March 2018. The disclosures reveal that data was retained despite deletion certifications and was used for political profiling. Facebook suspends Cambridge Analytica within hours.
Zuckerberg testifies before US Senate for two days
Zuckerberg appears before the Senate Commerce and Judiciary committees for two days of testimony. He acknowledges inadequate policing of third-party developer data access. The testimony is broadcast live and watched by millions.
Source →FTC $5B settlement and SEC $100M fine announced
The FTC announces a record $5 billion settlement with Facebook, including new privacy oversight requirements. The SEC simultaneously announces a $100 million fine for misleading investors. Both actions affirm regulatory findings of misconduct.
Source →
Verdict
Facebook's December 2015 knowledge of the Kogan data harvest and its non-disclosure to users is supported by internal documents and the FTC investigation. The $5B FTC settlement (Jul 2019) and $100M SEC fine confirm regulatory findings of misconduct. Wylie whistleblower (17 Mar 2018) confirmed data was not deleted as certified. The claim of deliberate senior-executive cover-up (vs institutional negligence) is partially supported but not fully established.
Frequently Asked Questions
When did Facebook first know about the Cambridge Analytica data harvest?
Facebook's internal trust-and-safety team identified the Kogan/Cambridge Analytica data transfer in December 2015, following a Guardian article by Harry Davies. This is more than two years before the March 2018 public disclosures. The timeline is supported by internal documents produced in the FTC investigation.
Why did Facebook not notify affected users?
Facebook has not provided a full public explanation for the non-disclosure decision. The FTC investigation found that Facebook treated the matter as closed once it received deletion certifications from Kogan and Cambridge Analytica. Facebook did not independently verify deletion or assess the adequacy of the certifications.
Was Cambridge Analytica responsible for Trump's 2016 election win?
This claim is contested and not established by the evidence. Cambridge Analytica's own efficacy claims are disputed by independent researchers. The Senate Intelligence Committee and UK ICO investigations did not conclude that CA's data use decisively influenced the election outcome. The data misuse is confirmed; the electoral impact is not.
What happened to Cambridge Analytica?
Cambridge Analytica and its parent SCL Group filed for bankruptcy in May 2018 following the public disclosures and subsequent loss of clients and regulatory scrutiny. The bankruptcy limits the documentary record available for further investigation, as not all records may have been preserved.
Sources
Show 3 more sources
Further Reading
- articleCambridge Analytica and Facebook: NYT investigation — Matthew Rosenberg, Nicholas Confessore, Carole Cadwalladr (2018)
- paperFTC v Facebook: $5 billion consent order and privacy requirements — Federal Trade Commission (2019)
- bookMindf*ck: Cambridge Analytica and the Plot to Break America — Christopher Wylie (2019)