Table of Contents:
Investigative file: Cambridge Analytica and the 2018 data-harvesting scandal
For many, “Cambridge Analytica” came to stand for the messy collision of personal data, profit-seeking and politics. This file pieces together what’s publicly known—newsroom disclosures, regulator reports, hearing transcripts and leaked materials—to show how information gathered through a personality-quiz app moved from curious users’ profiles into analytics workflows used for political targeting. Where the public record is thin or sealed, this account points out the gaps instead of filling them with conjecture.
A converging picture
Three independent strands of evidence form a consistent narrative. Investigative journalists published internal slides, emails and invoices; data protection authorities issued findings and enforcement notices; and participants testified in public hearings. Together these sources describe an arc: a quiz app collected profile details (and, because of how the platform’s API worked then, data about many friends), that data was exported and linked with commercial lists, and analytics teams produced audience segments and “look‑alike” groups presented to political clients. Technical notes and internal documents show how datasets were joined and matched; invoices and pitches explain how services were packaged and sold. At the same time, some exhibits remain redacted or unpublished, so this reconstruction cross-checks claims across multiple independent records.
How the flow worked
The publicly documented chain breaks down into four broad steps.
1) Collection: A personality-survey app attracted volunteers who answered standard questions. Due to the platform’s API permissions at the time, the app could also pull certain profile attributes from respondents’ friends, dramatically enlarging the pool of records.
2) Aggregation: Harvested profiles were cleaned and enriched with commercial data—demographics, consumer files and other third-party lists—creating fuller individual-level datasets.
3) Modelling and targeting: Analysts used psychographic techniques to build segmentations and identify look-alike audiences. Demonstrations and client-facing materials show these segments being framed as tools for highly tailored messaging.
4) Exposure and response: Whistleblowers, investigative reporting and regulator probes followed. Public hearings, fines and tighter platform rules eventually changed how developers can access and use social-data APIs.
Who appears in the record
Several recurring actors show up across those sources. Aleksandr Kogan is named as the developer of the survey app that collected the initial information. Cambridge Analytica and its parent, SCL Group, appear in internal materials and press disclosures as recipients and users of the datasets. Platform operators (principally Facebook/Meta) are central because their API design and access controls permitted extraction of friend-network data; their internal deliberations and subsequent policy changes are documented in regulator files. Finally, journalists, whistleblowers and data protection regulators supplied the disclosures, testimony and determinations that pushed the story into public scrutiny.
What the documents prove—and what they leave open
The documentary trail clearly supports the sequence from app collection to analytics outputs and confirms those outputs were shown to political clients. Regulators’ determinations and public testimony also record corporate and platform reactions: audits, fines, and revised API rules. Less settled are some custody details—redactions and sealed exhibits obscure parts of the chain of possession—and rigorous, peer‑reviewed proof that psychographic targeting on this scale definitively changed voter behaviour. In short: the mechanics of collection and commercialisation are well documented; claims about large-scale behavioural impact need stronger causal evidence.
Regulatory and commercial fallout
The episode produced three visible shifts. Regulators increased scrutiny of third-party access to platform data and tightened enforcement. Platforms narrowed API permissions and applied stricter controls to developers. And the scandal fuelled public debate and legislative interest around targeted political advertising, prompting proposals for more oversight in several jurisdictions. For businesses and investors, the story serves as a reminder that reputational exposure can rapidly trigger regulatory action and operational change—an important factor when vetting partners and suppliers.
Where to pick up the trail
This account depends on publicly available materials: press revelations, regulator findings and hearing transcripts. Those documents give a strong outline, but researchers and reporters still face redactions, missing exhibits and unresolved questions about data custody and causal effects. Anyone looking deeper should triangulate across independent sources and treat sealed or redacted passages as legitimate gaps rather than settled facts.
