A Researcher’s Quiz App Deceptively Harvested Data for Political Research, Facebook Alleges

Cambridge Analytica has been kicked off the network's ad platform

Cambridge Analytica CEO Alexander Nix is shown speaking at the 2016 Concordia Summit. The company says it 'fully complies' with Facebook guidelines. Getty Images
Headshot of Marty Swant

A British data analytics firm known for helping political campaigns including Donald Trump’s presidential bid, has been suspended from using Facebook’s advertising platform.

Facebook late on Friday said the firm, Cambridge Analytica, violated company policies related to collecting user data. According to a blog post written by Paul Grewal, a top Facebook attorney, Cambridge Analytica and its parent company, Strategy Communication Laboratories, improperly acquired and retained data from a third-party researcher.

According to Facebook, the researcher provided data to Cambridge Analytica that he had acquired through an app he called “thisisyourdigitallife” that was downloaded by 270,000 users and described as “a research tool used by psychologists.”

Facebook’s announcement came just hours before a report by The Guardian and The New York Times, based in part on extensive information from a Cambridge Analytica whistleblower, reported that the research company “harvested” data about 50 million Facebook users who were linked to those who used the app.

UPDATE: Christopher Wylie, the Cambridge Analytica whistleblower featured in news reports on the data harvesting, tweeted on Sunday that his Facebook account has been suspended:

How a Facebook app became a data mine

In 2015, Facebook allowed researcher Aleksandr Kogan to access its API for an app that, with user permission, collected information about users’ cities, content they liked and additional information based on some other friends. Facebook said Kogan violated its rules by then sharing the user data with Cambridge Analytica.

“Although Kogan gained access to this information in a legitimate way and through the proper channels that governed all developers on Facebook at that time, he did not subsequently abide by our rules,” Grewal, Facebook’s vp and deputy general counsel, wrote in the blog post. “By passing information on to a third party, including SCL/Cambridge Analytica and Christopher Wylie of Eunoia Technologies, he violated our platform policies. When we learned of this violation in 2015, we removed his app from Facebook and demanded certifications from Kogan and all parties he had given data to that the information had been destroyed. Cambridge Analytica, Kogan and Wylie all certified to us that they destroyed the data.”

According to Grewal, Facebook only decided to suspend Cambridge Analytica and SCL after learning a few days ago that the company had allegedly not destroyed the data. Grewal said Facebook is willing to take legal action if further investigations reveal the companies engaged in any “unlawful behavior.”

It’s unclear specifically how the 270,000 app downloads were parlayed into data on tens of millions of Facebook users, though it appears the data stemmed from the social network connections of the app users. A whistleblower within Cambridge Analytica described the data as a “saving grace” for its political research, while the company’s CEO has dismissed the app research project as “fruitless,” according to The New York Times.

Facebook’s blog post and subsequent comments have not addressed the 50 million user total cited by The New York Times and The Guardian in its reporting.

In a statement on Saturday morning, Cambridge Analytica responded to Facebook’s decision to suspend the company from its advertising platform, claiming that it “fully complies” with Facebook’s guidelines and that the company only uses social media platforms for “outward marketing, delivering data-led and creative content to targeted audiences.”

“We worked with Facebook over this period to ensure that they were satisfied that we had not knowingly breached any of Facebook’s terms of service and also provided a signed statement to confirm that all Facebook data and their derivatives had been deleted,” according to the blog post.

Cambridge Analytica also said none of the data acquired was used in service for the Trump campaign.

After many described the data harvesting as a “breach” 0f Facebook user data, the social network updated its blog post and sent out a statement to news outlets including Adweek, insisting that the data was given willingly by users—who were misled about the app’s intent.

“People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked,” a Facebook spokesperson said. “Nevertheless, this was a scam—and a fraud. Mr. Kogan misled us all. He lied about the purpose of his app. He violated our policies, specifically on how the data could be used.”

Andrew Bosworth, Facebook’s former vp of ads and current vp of AR/VR, took to Twitter on Friday night to comment on the suspension. And on Saturday morning, he tweeted again to say it was “unequivocally not” a data breach, echoing the spokesperson who said users were responsible for sharing their data with a third party that didn’t follow Facebook’s rules.

Facebook’s decision to suspend Cambridge Analytica comes just 10 weeks before the European Union enacts its sweeping data protection laws, which will require companies operating in the E.U. to share information with users that want to know what type of information a company has collected about them. The law will also require companies to delete information about user if asked or face massive financial penalties.

Cambridge Analytica is also at the center of a political storm in England, after documents showed that the company told Brexit leaders that it could “design and execute a programme of donor solicitation amongst those individuals interested in Britain’s EU status. These could include corporate and individual targets in the United States, UK or other Commonwealth countries,” according to The Guardian.

Last year, U.S. lawmakers introduced bipartisan legislation that would require larger online companies such as Facebook to detail who is buying ads on the platform. The legislation, known as the “Honest Ads Act,” was introduced right before lawyers for Facebook, Google and Twitter testified on Capitol Hill to explain what they knew about Russian operatives using their platforms to manipulate the American electorate.

In a statement on Saturday, one of the bill’s sponsors, U.S. Sen. Mark Warner, D-Virginia, said Facebook’s revelation is further evidence that the U.S. needs to pass laws pertaining to online transparency.

“This is more evidence that the online political advertising market is essentially the Wild West,” Warner said in a statement. “Whether it’s allowing Russians to purchase political ads, or extensive micro-targeting based on ill-gotten user data, it’s clear that, left unregulated, this market will continue to be prone to deception and lacking in transparency.”

Adweek technology editor Josh Sternberg contributed to this report.

@martyswant martin.swant@adweek.com Marty Swant is a former technology staff writer for Adweek.