SCL Group and Cambridge Analytica:behavioural targeting, the Kogan data harvest and the regulatory record

Mechanism

SCL Group was a UK behavioural-research and strategic-communication firm. Its subsidiary SCL Elections, and Cambridge Analytica as its US-facing brand, sold voter profiling to campaigns. The record shows three activities. Acquiring data: the UK Information Commissioner's Office (ICO) found that SCL/CA bought large volumes of commercial data, "at one estimate over 130 billion data points", mostly on US voters, and added Facebook-derived data from Kogan. Modelling: predicting personality and partisanship and grouping voters into clusters. Delivery: clients sent different messages to different clusters. The taxonomy has no id for microtargeting itself, because it is a delivery method. The ids below score what was said and how it was disclosed, the same test applied to any campaign.

The harvest is documented in the FTC's administrative complaint (24 July 2019). Facebook's Graph API v1 let an app collect data on the person who installed it and on that person's friends. Facebook announced in April 2014 that new limits would follow, but existing apps had a year. Kogan's app was already registered, so it kept the wider access. GSR signed a contract with SCL Elections on 4 June 2014 to harvest data in 11 states, score people on the five-factor "OCEAN" personality model, and match the scores to voter records. The FTC alleged that after "half of the survey participants initially refused" to share their profile data, the app told users it would "NOT download your name or any other identifiable information", while it collected each user's Facebook User ID. The complaint alleges 250,000 to 270,000 US app users and 50 to 65 million of their friends, including at least 30 million identifiable US consumers. The friends were never asked.

Page 6 of the Federal Trade Commission's administrative complaint, In the Matter of Cambridge Analytica, LLC, Docket No. 9383, 24 July 2019, paragraphs 24 to 30. Public domain (US government work). Converted to greyscale and resized. The complaint states allegations; the Commission's later opinion found that the company violated the FTC Act through the conduct alleged; the company did not respond.

Two techniques are scored, both limited to what the record shows. Card stacking: the delivery step chooses which frame each person sees. Cruz-campaign memos reported by Mother Jones (March 2018) proposed different framings and images of the same "abolish the IRS" message for four personality types. That is selection by audience, not shown to be false. Fear appeal: Nix's September 2016 Concordia Summit talk, as reported, described an ad for a high-neuroticism audience showing "the hand of an intruder smashing a window", with gun ownership as an "insurance policy". The ICO could not determine which ads ran in which campaign, so this is scored on the design he described, not on proven deployment. Not tagged: Disclosure theater (the alleged wrong was a false statement, which the taxonomy does not name), Identity fusion and Outrage bait (no evidenced instance), and Narrative laundering (the Channel 4 claims of fake IDs and front companies are boasts that the company denied, with no instance shown).

Evidence

• January 11, 2012: a Ministry of Defence letter, published by the DCMS Committee from a cache supplied by Christopher Wylie, records SCL psychological-operations training for 15 (UK) Psychological Operations Group. Described in The Register, 29 Mar 2018 (the letter itself was not opened): https://www.theregister.com/2018/03/29/cambridge_analytica_parent_firm_had_routine_access_to_uk_secret_information/
• June 4, 2014: GSR and SCL Elections sign the data contract. The FTC complaint sets out the app, the consent text and the counts above: https://www.ftc.gov/system/files/documents/cases/182_3107_cambridge_analytica_administrative_complaint_7-24-19.pdf
• September 19, 2016: Nix's Concordia Summit talk. A senior Cruz staffer, unnamed, later said "Most of that's bullshit or things we designed on the campaign", and the campaign dropped the personality models early in the primaries (Mother Jones, Mar 2018: https://www.motherjones.com/politics/2018/03/cloak-and-data-cambridge-analytica-robert-mercer/ ). The ad example is from CB Insights' account of the talk: https://www.cbinsights.com/research/what-is-psychographics/
• 2018-02: Nix tells the DCMS inquiry "We do not work with Facebook data and we do not have Facebook data." The Observer, 17 Mar 2018, also reports Wylie's documents and Facebook's 2016 letter asking for deletion: https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election . The New York Times ran a joint story the same day, "How Trump Consultants Exploited the Facebook Data of Millions"; not opened by FRAME.
• March 19, 2018: Channel 4 News publishes hidden-camera recordings of Nix and colleagues, filmed November 2017 to January 2018. Content note: the recordings include talk of bribes and of sex workers used to entrap politicians: https://www.channel4.com/news/cambridge-analytica-revealed-trumps-election-consultants-filmed-saying-they-use-bribes-and-sex-workers-to-entrap-politicians-investigation
• March 20, 2018: the board suspends Nix (NBC News: https://www.nbcnews.com/politics/politics-news/cambridge-analytica-ceo-alexander-nix-suspended-amid-hidden-camera-expose-n858406 ). NBC the same day reports experts calling the psychographic approach neither novel nor measurably effective: https://www.nbcnews.com/politics/politics-news/cambridge-analytica-s-effectiveness-called-question-despite-alleged-facebook-data-n858256
• April 4, 2018: Facebook says the data of up to 87 million people, mostly in the US, may have been improperly shared: https://about.fb.com/news/2018/04/restricting-data-access/
• May 2, 2018: Cambridge Analytica and SCL Elections announce they will close (Research Live, 3 May 2018: https://www.research-live.com/article/news/cambridge-analytica-closes-its-doors/id/5037922 ).
• May 16, 2018: Wylie's written testimony to the US Senate Judiciary Committee: https://www.judiciary.senate.gov/imo/media/doc/05-16-18%20Wylie%20Testimony.pdf
• November 5, 2018: the ICO report says it would have issued SCL Elections "a substantial fine" for unfair processing, "including purposes connected with the 2016 US Presidential campaigns", had the company not been in administration. It had fined Facebook £500,000 on October 25, 2018: https://ico.org.uk/media2/migrated/2260271/investigation-into-the-use-of-data-analytics-in-political-campaigns-final-20181105.pdf
• February 18, 2019: the DCMS Committee's final report "Disinformation and 'fake news'" recommends a levy-funded independent regulator, banners identifying the source of paid political ads, and that the National Crime Agency look at links between SCL Elections and Emerdata Ltd. Only the Commons summary page was read, because the full report text was not retrievable: https://houseofcommons.shorthandstories.com/dcms-committee-disinformation-fake-news/index.html
• July 24, 2019: the FTC files its complaint against Cambridge Analytica, settles with Nix and Kogan, and separately announces a $5 billion Facebook penalty for violating its 2012 order: https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-sues-cambridge-analytica-settles-former-ceo-app-developer and https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook
• December 6, 2019: the FTC votes 5-0 on an opinion and final order finding Cambridge Analytica's conduct deceptive: https://www.ftc.gov/news-events/news/press-releases/2019/12/ftc-issues-opinion-order-against-cambridge-analytica-deceiving-consumers-about-collection-facebook
• October 2, 2020: the ICO's closing letter to the DCMS chair, published 6 October (see the next section): https://ico.org.uk/media2/migrated/2618383/20201002_ico-o-ed-l-rtl-0181_to-julian-knight-mp.pdf

Page 17 of the Information Commissioner's letter to Julian Knight MP, 2 October 2020, paragraphs 27 to 30. Information Commissioner's Office, licensed under the Open Government Licence v3.0; letterhead logo cropped out because the ICO excludes logos from the licence; converted to greyscale and resized.

What the regulators concluded, and did not

The ICO closing letter confirms the harvest and the matching of about 30 million US voters, and adds limits. It found no additional evidence of Russian involvement in the SCL/CA servers it obtained. It found that "the data from GSR could not have been used in the Brexit Referendum", since it related to US voters. On effectiveness it wrote that SCL's marketing claim of "5,000 data points per individual on 230 million adult Americans" "may have been an exaggeration", that the models used commonly available open-source tools with no "proprietary technology", that real-world accuracy on new individuals "was likely much lower" than on training data, and that internal communications showed "a degree of scepticism within SCL". It also said it could not determine which GSR data was used in any specific campaign, though it recovered evidence that suggests similar models were used with Republican National Committee data. Outcomes: Facebook paid £500,000; SCL Elections was prosecuted for ignoring an enforcement notice (the letter gives a fine of £18,000); Nix was disqualified as a director for seven years.

Sides on the record

Alexander Nix, then chief executive of Cambridge Analytica, at Web Summit, Lisbon, 9 November 2017. Photo by Sam Barnes for Web Summit via Sportsfile, CC BY 2.0, from Wikimedia Commons. Resized by Wikimedia to 1,280 px.

• Cambridge Analytica and Nix. The company said its GSR contract required Kogan to obtain informed consent, that it had no reason to doubt his authority to license the data, that SCL certified deletion, and that none of the data was used in the 2016 election (The Observer). On the Channel 4 tapes it said it "entirely refute[s] any allegation" of entrapment, bribes or "honey-traps". On closing it said it had been "vilified" for practices it called legal and standard in online advertising. Nix was suspended by his own board, which said the recorded remarks "do not represent the values or operations of the firm".
• Kogan and Facebook. Kogan says his work was legal and that he had a "close working relationship" with Facebook. Facebook denied a "data breach", saying Kogan gained access "in a legitimate way" but broke its rules by passing the data on. The ICO found Facebook processed users' data unfairly by giving developers access without "sufficiently clear and informed consent".
• Wylie. He told the Observer, "We exploited Facebook to harvest millions of people's profiles. And built models to exploit what we knew about them and target their inner demons." His Senate testimony says CA's work "is not equivalent to traditional marketing" and describes Russian contacts (Lukoil, Kogan's work in St Petersburg) as grounds for suspicion. The ICO found no additional evidence of Russian involvement.
• Sceptical research. Kalla and Broockman's meta-analysis of field experiments (American Political Science Review, 2018) puts the average persuasive effect of campaign contact in general elections at about zero. Matz and colleagues (PNAS, 2017; three field experiments, over 3.5 million people) reported up to 40 percent more clicks and 50 percent more purchases for personality-matched consumer ads, not votes. Eckles, Gordon and Johnson (PNAS, 2018, doi:10.1073/pnas.1805363115) argued such field tests face internal-validity threats, and Matz and colleagues replied that Facebook's ad optimisation was unlikely to explain their results. Tappin and colleagues (PNAS, 2023) found in survey experiments that machine-learning microtargeting beat two alternative strategies by an average of 70 percent or more in one study, mainly on one of two policy issues. The ICO's findings concern data practices, not vote effects.
• Scale of the harvest. Brittany Kaiser told the DCMS Committee on 17 April 2018 that other quiz apps meant more people than the Kogan app could be affected. Zuckerberg said Facebook's 87 million was a maximum built by assuming the widest possible friend lists.

Comparators under the same definitions

Facebook's estimates of people whose information may have been improperly shared with Cambridge Analytica, published 4 April 2018, redrawn as a pie chart by Wikimedia user FallingGravity (CC0). Figures were transcribed by the uploader and not re-checked here against Facebook's original graph; Facebook said they were not precise.

	Obama 2012 "Targeted Sharing" app	Cambridge Analytica / GSR	Trump 2016 digital operation
Data source	Campaign's own Facebook app; supporters authorised access to their friend lists	GSR quiz app repurposed for SCL; friends' data collected through it	Facebook's advertising tools plus Republican National Committee voter data; CA staff embedded
Who consented	About 1 million supporters, told the data went to a campaign; their friends did not consent	App users told it was research and (per FTC) that no identifiable data would be taken; friends did not consent	Facebook users targeted through Facebook's own ad tools; no separate data-collection step is described in the sources read
Use	Friends ranked so supporters could message their most persuadable friends	Personality and partisanship scores matched to voter files; clusters targeted directly, including lookalikes	Ad variants tested at volume; some messages aimed at reducing turnout, per a campaign official
Scale	About 1 million users (AP, PolitiFact)	250,000 to 270,000 US users, 50 to 65 million friends (FTC)	Parscale said 50,000 to 60,000 ad variants a day, and Facebook was "80 percent of the budget kind of thing"
Regulatory outcome in this record	None found in the sources read	FTC final order, ICO prosecution, Facebook fines	None found in the sources read

What is the same: all three used Facebook's platform and voter files to segment audiences, and in the first two the friends of app users did not consent (PolitiFact, "Half True", 22 Mar 2018). Carol Davidsen, the Obama campaign's data-integration director, wrote in March 2018 tweets that "Facebook was surprised we were able to suck out the whole social graph, but they didn't stop us once they realized that was what we were doing", and that Facebook allowed such things "because they were on our side" (The Grio; AP via Seattle Times). Facebook said the tweet was inaccurate and that "no campaign received any special treatment"; the campaign's chief scientist Rayid Ghani said the app could only ask supporters to contact friends. Davidsen also wrote that the project "was the only one that felt creepy, even though we played by the rules".

What differs: the Obama app told its users a campaign was the recipient, while the GSR screen, per the FTC, misstated what was collected. The Obama campaign asked supporters to contact friends and did not itself target the friends; the CA data was used to target people directly. Betsy Hoover, the 2012 online organising director, said "We had consent. It was within Facebook's terms of service." No regulator's finding against the 2012 app appears in the sources read here. On the Trump side, a Bloomberg report quoted a senior official describing "three major voter suppression operations", including sending Black voters Hillary Clinton's 1996 "super predator" remarks; the same coverage said those tactics "may or may not be as effective as the official claims". If the official's description is accurate, that would score as Card stacking (selective clips to chosen audiences) under the same definition used for the CA memos. 60 Minutes reported that Parscale "insists he never used psychographics"; he told the interviewer "I just don't think it works". The ICO evidence about RNC-data models sits against Parscale's statement and is unresolved. NPR reported a source saying psychological profiling "never entered into the picture" for Trump. Hersh, who studied the Obama microtargeting, found neither tactic greatly effective at persuading people to vote (PolitiFact). For a platform-targeting comparison from a foreign state actor, see 'Russian Ads on Facebook' (House Intelligence Committee exhibit); that operation used fake identities, which this one is not shown to have done. For the same 2012 cycle's ad content, see The steelworker ad and the welfare ads: two fact-checked attacks from the 2012 U.S. presidential race.

What would falsify this read

A ruling that the GSR consent screen was accurate and that friends' data was collected with valid consent would remove the deception reading. Forensic evidence that GSR-derived models drove specific ads, paired with a measured effect, would raise the stakes of the influence reading; a field experiment showing personality targeting adds nothing over voter-file targeting would lower them without touching the data-acquisition finding. Evidence that the Obama app used friend data beyond ordering friend lists, or that Facebook gave one campaign privileges the other did not get, would narrow the differences stated above. Proof that the Channel 4 claims were carried out would move the colour toward black; proof they were sales talk would leave it gray.

Literacy counter

Split any claim about a data-driven campaign into three: how the data was obtained, what was inferred, and what changed. This record supports the first strongly (FTC, ICO), the second in part (marketing claims the ICO called possibly exaggerated), and the third weakly (published studies find small average effects on votes, and the ICO did not test votes). Ask what the consent screen said and who never saw it. Treat a vendor's headline numbers as marketing until an audit is shown. Ask the same three questions of every campaign, Obama 2012, Cruz, Trump 2016 and their opponents alike, since all used segmentation. Prefer regulators' filings and public ad archives to the memory of former staff, who on every side had reasons to inflate or deny. See Media literacy, Inoculation and prebunking and Emotion and fear.