Meta/Facebook Knowledge of Cambridge Analytica Before March 2018 (2015-18)

Introduction

In December 2015, Facebook''s internal trust-and-safety team identified that Aleksandr Kogan, a Cambridge University academic, had used a personality-quiz app called ''thisisyourdigitallife'' to harvest data from approximately 87 million Facebook users — and had then transferred that data to SCL Group and its political data subsidiary, Cambridge Analytica, in violation of Facebook''s platform policies.

What Facebook did next, and what it failed to do, is the core of the documentary controversy.

What Facebook Knew and When

Facebook''s platform terms prohibited developers from selling or transferring data obtained through the platform to third parties. When the December 2015 Guardian article (by Harry Davies) reported that Cambridge Analytica held Facebook data, Facebook contacted Kogan and Cambridge Analytica and required them to certify in writing that the data had been deleted.

Facebook did not verify the deletion independently. It did not notify the approximately 87 million affected users. It did not report the incident to the FTC. It treated the matter as closed once it received the certifications.

Internal documents produced during the subsequent FTC investigation showed that Facebook''s policy enforcement team had documented the gap — the scale of data harvested, the fact that third-party transfer had occurred — but categorised the matter as resolved by the certifications. This is the basis for the ''cover-up'' characterisation: Facebook possessed knowledge of a serious data misuse event and made a deliberate choice not to disclose it to users or regulators.

The Wylie Whistleblower Disclosures (March 2018)

On 17 March 2018, Christopher Wylie — a former Cambridge Analytica employee — provided extensive documentation to The New York Times and The Guardian showing that the data had not been deleted as certified. The simultaneous publication of these investigations triggered immediate regulatory and congressional responses.

Mark Zuckerberg testified before the Senate Commerce and Judiciary committees on 10-11 April 2018. His testimony included the acknowledgment that Facebook had not adequately policed third-party developer access to user data. Antigone Davis, Facebook''s VP of Global Safety, provided additional testimony.

Regulatory Outcomes

The FTC reached a $5 billion settlement with Facebook on 24 July 2019 — the largest fine ever imposed on a technology company at that time. The settlement included requirements for a new privacy oversight structure within Facebook, including an independent privacy committee on the board. The SEC separately imposed a $100 million fine in July 2019 for misleading investors about the risks of data misuse.

The UK Information Commissioner''s Office (ICO) fined Facebook £500,000 — the maximum allowed under pre-GDPR rules — for the breach. Cambridge Analytica and its parent SCL Group filed for bankruptcy in May 2018 following the disclosures.

Partially True: What the Record Supports

The documentary record supports the claim that Facebook knew about the data harvest in December 2015, chose not to notify users, and accepted self-certified deletion assurances rather than conducting independent verification. This is a documented institutional failure with a clear paper trail.

The more maximalist version of the claim — that Facebook actively facilitated Cambridge Analytica''s political operations, or that senior leadership including Zuckerberg personally directed a cover-up — has not been established by the documentary record to the same degree.

Verdict

The core factual claim — that Facebook knew about the Kogan/Cambridge Analytica data harvest in December 2015 and did not notify users or regulators — is supported by internal documents and regulatory findings. The $5 billion FTC settlement reflects this. The stronger claim that this constituted deliberate executive-level conspiracy rather than institutional negligence and prioritisation of commercial interests over disclosure obligations is partially supported but not fully established.

The Mechanism: How the Friends' Data Was Harvested

Aleksandr Kogan's app, "thisisyourdigitallife," was downloaded by roughly 270,000 people who consented to share their own data, according to Facebook's own account. That figure ballooned to an estimated 87 million exposed profiles because of how Facebook's Graph API v1 worked: an app could pull not only its installer's data but, by default, data belonging to that user's friends — friends who never opened the app and never separately consented. That friends-permission design is why a few hundred thousand downloads cascaded into tens of millions of exposed profiles.

This was not a loophole Facebook only later discovered. At its F8 developer conference on 30 April 2014, Mark Zuckerberg publicly promised Facebook would end third-party access to friends' data. The FTC's later complaint found Facebook did not follow through on that timeline: it kept granting some "grandfathered" apps — including the one funnelling data toward Cambridge Analytica's parent, Global Science Research — continued friend-data access for at least another year, and let some retain it longer still. At the exact time Kogan's harvesting was underway, Facebook had already told the public, on stage, that the door was closed.

The underlying vulnerability had also been flagged internally years earlier. Sandy Parakilas, an operations manager on Facebook's platform team in 2011-2012 responsible for policing how developers used platform data, has said he warned senior executives — by his account, among the company's top five — that outside developers could harvest bulk user data with little oversight or audit trail. He later told UK lawmakers his warnings went unheeded.

Key Evidence From Internal Documents and Testimony

Much of what is publicly known about Facebook's internal thinking comes from litigation, not voluntary disclosure. Six4Three, a small app developer suing Facebook over a 2015 policy change, obtained internal Facebook emails through discovery in a California lawsuit. When Facebook fought to keep them sealed, the UK Parliament's Digital, Culture, Media and Sport (DCMS) Committee invoked parliamentary privilege in November 2018 to compel a visiting Six4Three executive to hand them over — a move Facebook itself called an "unprecedented" seizure.

The Committee drew on those documents for its February 2019 final report, "Disinformation and 'fake news,'" the product of an eighteen-month inquiry. It concluded Facebook had "intentionally and knowingly violated both data privacy and anti-competition laws," calling the company "digital gangsters" that behaved "ahead of and beyond the law." Zuckerberg, who declined repeated invitations to testify in person, was found in contempt of Parliament.

Facebook's own account of its response appears in a company statement published 16 March 2018 — one day before the Guardian and New York Times ran Christopher Wylie's disclosures. Facebook said it had "recently received reports" that, contrary to the 2015 certifications, the data had not actually been deleted, and it suspended Kogan, Wylie, Cambridge Analytica, and SCL Group "pending further information."

Official Findings: FTC, SEC, ICO, and UK Parliament

The FTC's $5 billion settlement was not unanimous. Commissioner Rebecca Kelly Slaughter dissented, producing one of the most detailed public accounts of the Commission's internal reasoning. She wrote the investigation had found "extremely compelling evidence" of order violations, and that there was "sufficient evidence to name Mr. Zuckerberg" personally as a defendant. The majority declined: the settlement released Facebook's "officers and directors," not just the company, from liability for conduct predating June 2019 — a scope Slaughter called unprecedented and "strenuously" objected to. She also argued the penalty was inadequate given Facebook's revenue had grown from $5 billion to over $55 billion since its 2012 order, and noted Facebook's stock price rose, not fell, once the penalty's scale became public.

Alongside the Facebook settlement, the FTC separately filed a complaint against Kogan and his company, alleging the app obtained users' initial consent through "false and deceptive means." The SEC's parallel $100 million fine addressed a related but distinct failure — misleading investors about the business risk of data misuse — rather than the underlying privacy conduct.

UK regulators pursued Cambridge Analytica's own structure too. Beyond the £500,000 fine against Facebook, the ICO separately and criminally prosecuted SCL Elections, Cambridge Analytica's parent, in January 2019, after the firm ignored an enforcement notice ordering it to answer a subject-access request from academic David Carroll. SCL pleaded guilty and was fined £15,000.

The Strongest Counter-Argument — and Why It Only Partly Holds

The most substantial pushback against the "cover-up" framing is that no regulator — FTC, SEC, ICO, or DCMS — ultimately found named executives personally and knowingly orchestrated concealment of the Kogan matter specifically. The FTC's release of Zuckerberg and other officers from liability, and Facebook's suspension of the responsible parties a full day before the Wylie story broke, are both consistent with a company that was, at minimum, responsive once pressed, rather than one still actively concealing the matter in March 2018. Separately, the scientific basis for Cambridge Analytica's marketing claims is genuinely disputed: Kogan has said the personality data "is just not that accurate at the individual level," complicating the more dramatic version of the story in which the data functioned as a precision propaganda weapon.

This holds as far as it goes, but it answers a narrower question than the claim actually poses. Whether one named executive personally directed a cover-up differs from whether Facebook, as an institution, knew about a serious data-misuse event in December 2015 and chose non-disclosure over notification — and on that narrower, better-evidenced question, the DCMS Committee's "intentional and knowing" finding, Slaughter's dissent, and the FTC complaint's account of the extended friend-data access all point the same direction. Disputed targeting effectiveness and the absence of a proven boardroom conspiracy do not resolve the separate, documented fact that affected users were never told.

Aftermath and Significance

Cambridge Analytica and SCL Group's May 2018 collapse did not end scrutiny of the ecosystem it exposed. The Six4Three documents kept surfacing in litigation and parliamentary inquiries into 2019, feeding a broader regulatory reckoning that culminated in Zuckerberg's contempt finding and years of subsequent hearings on both sides of the Atlantic. Yet the market's own verdict was more ambiguous than the FTC fine's size suggests: Facebook's share price rose, not fell, both when a multibillion-dollar penalty was first disclosed in April 2019 and again when the $5 billion figure was confirmed that July — evidence, Slaughter's dissent argued, that investors read the settlement as manageable rather than punishing. That gap between regulatory rhetoric and market reaction remains a reference point in debates over whether monetary penalties alone can discipline a company whose revenue and data holdings kept growing throughout the violations.