Cambridge Analytica — the harvest is documented, the persuasion never was

Read the limitation in §5 before citing any regulator figure in this file. Every primary document behind this entry — the FTC's press releases and its complaint and final order against Cambridge Analytica, the ICO's November 2018 report to Parliament, the ICO's October 2020 letter to the DCMS committee, the DCMS committee's own report, Kogan's written evidence to Parliament, the SEC's release, the PNAS papers — returned HTTP 403 to this session's fetch tool, and the one fallback (a plain curl with a browser user-agent) needed an approval this non-interactive job cannot obtain. So the regulator findings below are quoted at one remove, from outlets quoting the PDFs. The proposal that commissioned this entry said, in as many words, "verify every figure and finding against regulator reports rather than press coverage," and that instruction could not be carried out from here. It is the single largest weakness in this file, it is not distributed evenly — §1.3 and §3 lean hardest on it — and the entry should get a re-verification pass the first time a session can open the PDFs.

Filed under idea in proposals.md; written here as moment. The id sits at line 570, inside the idea block (lines 195–721) with the rest of the 2026-08-17 batch. That block is where these were written down, not what they are.

Why not idea. The house definition, fixed by build.py and argued out in tcp-ip-1983, is "a framing later work is built out of rather than argued about." Nothing here qualifies. There is no technique in this entry that later work inherits — the modelling was, in the ICO's own phrase, built from "'off the shelf' analytical tools," and the interesting technical ancestor is somebody else's paper (§1.1). What is here is a thing that happened over about six weeks in the spring of 2018, and it is argued about constantly, which is the disqualifying clause.

Why not interpretation, which is the close call. The sentence this entry exists to carry — a capability's claimed power and its demonstrated power diverged further here than anywhere else in the record, and the seller and its loudest critics had the same interest in the larger number — is a reading laid over facts, not a fact. content-farms-2016 took interpretation on exactly that reasoning, and I nearly did the same. It fails for one reason: unlike that entry, whose two subjects share no date and cannot be pinned to one, this one is a dated event chain with a start and an end. 17 March 2018, publication. 19–20 March, the undercover footage and Nix suspended. 2 May, the company announces it is shutting down. 24 July 2019, two US regulators on the same day. 6 December 2019, the FTC's final order. 2 October 2020, the ICO closing the file. A moment is "something that happened and changed what people expected next," and this changed what people expected next twice over — correctly about platforms, incorrectly about persuasion. The interpretation is what §2 through §4 say about the moment, which is how mass-collection-2013 handles its own framing.

On the year: field. 2018 is right and the id is right, with one thing worth saying so it is not mistaken for sloppiness: almost nothing dated 2018 in this entry happened in 2018. The harvesting ran from mid-2014 to about mid-2015. Facebook knew in December 2015. The campaigns were 2015 and 2016. 2018 is the year it became public and the year the company died — a disclosure date, not an event date — and this entry dates the disclosure on purpose, because the disclosure is the thing that changed expectations.

On the creator: field. There is no author, and the field is deliberately lopsided. The journalists and the whistleblower are named because they did the work that made any of it visible, and because Wylie in particular is an interested party whose account is load-bearing and needs to be attributable when it is graded (§3.6). The four institutions are named because the durable content of this entry is theirs: the reporting established that something happened, and the regulators established what. Where those two diverge — and on the central question they do — this entry follows the regulators and says so.

Ancestors named and not made. The one real parent is mass-collection-2013. Not by subject: that is a state signals-intelligence story and this is a commercial one. By frame. The Snowden disclosures established, in public, the default assumption that the scale of automated collection is larger than the operator says it is, and Cambridge Analytica is the first big commercial instance read through that assumption — which is why a story about a permissive developer API landed as a story about surveillance. The lineage is also literal in the enforcement record: the SEC's charge against Facebook was that it described the misuse of user data as a hypothetical risk in its public filings for more than two years after it knew the misuse was actual, which is the exact posture mass-collection-2013 graded and found wanting.

Three ancestors I want and cannot name, per the rule against inventing ids. The underlying research — Kosinski, Stillwell and Graepel's 2013 PNAS paper showing Facebook Likes predict private attributes, and the myPersonality dataset behind it — is the actual technical parent of everything Cambridge Analytica sold, and it is not in canon/. It should be; it is the entry that would let a reading separate "the inference works" from "the persuasion works," which is the distinction this whole file turns on. Facebook's platform business has no entry either. google-index-1998 is the canon's one piece of ad-funded-attention infrastructure and it is the wrong rail: Veles ran on Google's ad business, this ran on Facebook's social graph, and the two are not the same machine. rosenblatt-nyt-1958 is the shape-sibling and is not a parent — it is this canon's standing case of a capability's press description outrunning its measured performance, with the seller and the press both better off for the larger claim, but nothing here came out of it. Two others are adjacent and also not parents: content-farms-2016, which separates a revenue-driven operation from a state-directed one and is the entry to read next to this one; and twitter-acquisition-2022, which shares the problem of a platform's measurable governance being confused with its contested politics.

---

1. What it is

1.1 The mechanism, which is smaller and duller than the story

In 2013, three researchers at Cambridge's Psychometrics Centre — Michal Kosinski, David Stillwell and Thore Graepel — published a paper in PNAS showing that a person's Facebook Likes predict attributes they never disclosed. On a dataset of over 58,000 volunteers, the model distinguished gay from straight men in about 88% of cases, African American from Caucasian American users in about 95%, and Democrats from Republicans in about 85%. Personality prediction was much weaker than any of those, which matters later.

Aleksandr Kogan, a psychologist in the same department but working through his own company, Global Science Research, built an app called thisisyourdigitallife. Users took a personality questionnaire; they were paid a few dollars each. About 270,000 people installed it — Facebook's own figure. The app then read, with each installer's grant, not only that person's profile but their friends' profiles too, and it is the friends who make the numbers large. The Observer's first story said 50 million profiles. On 4 April 2018 Facebook's chief technology officer Mike Schroepfer raised the estimate himself, in Facebook's own words: "the Facebook information of up to 87 million people — mostly in the US — may have been improperly shared with Cambridge Analytica." That 87 million figure is Facebook's, not a journalist's, and it is the one to use.

The friends-of-installers pathway was not a hack. It was Graph API v1.0 behaving as documented. Facebook announced its removal at the f8 developer conference on 30 April 2014 — the new Login and Graph API v2.0, with a Login Review process for permissions beyond public profile, email and friend list — and gave apps created before that date until 30 April 2015 to migrate. Kogan's collection ran inside that window. §4 is mostly about what follows from this.

SCL Elections, Cambridge Analytica's parent, paid for the collection. Its payments went directly to the survey platform Qualtrics and amounted to roughly $800,000, which was chiefly the three-to-four dollars per participant. (This figure is from the DCMS committee's report as quoted secondhand; the committee's own page was not reachable — see §5.) Set that against what the data was said to be worth and the ratio is itself a finding.

What the firm then built on top was, per the ICO's own description of the servers it seized, an aggregation exercise: SCL/CA were "purchasing significant volumes of commercially available personal data (at one estimate over 130 billion data points)" from brokers the ICO names — "Labels & Lists, InfoGroup, Aristotle, Magellan, Acxiom and Experian" — combining it with US voter files, and running "machine learning algorithms to create additional 'predicted' scores relating to partisanship and other criteria." The Facebook-derived material was one input among many. The ICO's flat sentence about the technique is the one worth keeping: "Their models were also built from 'off the shelf' analytical tools."

1.2 The week it broke

11 December 2015. Harry Davies reports in the Guardian that Ted Cruz's campaign is using a firm that harvested data on millions of unwitting Facebook users. This is the date that matters legally: it is when Facebook knew.

17 March 2018. The Observer publishes "Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach" by Carole Cadwalladr and Emma Graham-Harrison, with Christopher Wylie on the record: "We exploited Facebook to harvest millions of people's profiles." The New York Times publishes simultaneously.

19–20 March 2018. Channel 4 News broadcasts undercover footage recorded at a series of London hotel meetings between November 2017 and January 2018, in which an undercover reporter posed as a fixer for a client seeking to elect candidates in Sri Lanka. Alexander Nix, Mark Turnbull and Alex Tayler are filmed discussing bribery stings, entrapment using sex workers, ex-intelligence contacts and untraceable material. Cambridge Analytica calls it entrapment and mischaracterisation. Nix is suspended on 20 March.

2 May 2018. SCL Elections and Cambridge Analytica announce they are ceasing operations; insolvency in the UK, Chapter 7 in the US.

That is the moment. Everything after it is the record being assembled.

1.3 What the regulators actually established

This is the durable half of the entry, and the reason it belongs in a canon rather than in a digest.

The data access was real, the platform's failure was real, and both were penalised.

• ICO, 25 October 2018 — a £500,000 monetary penalty on Facebook, the maximum available under the Data Protection Act 1998, the law in force at the time. Facebook appealed; in October 2019 it settled, paying the £500,000 without admission of liability.
• ICO, 6 November 2018 — the report to Parliament, Investigation into the use of data analytics in political campaigns. The Commissioner's summary finding was "a disturbing disregard for voters' personal privacy" across roughly thirty organisations — data brokers, platforms, campaign groups, academic institutions and political parties, not one firm.
• FTC, 24 July 2019 — a $5 billion civil penalty on Facebook for violating the Commission's 2012 order by deceiving users about their control over their own data. It passed 3–2. It was, at the time, roughly twenty times the largest privacy penalty ever imposed anywhere.
• SEC, 24 July 2019, the same day — $100 million, for presenting the risk of misuse of user data in public filings as merely hypothetical for more than two years after knowing a developer had actually misused it, and for misleading reporters who asked about the investigation. Settled without admission or denial.
• FTC, 24 July 2019 and 6 December 2019 — an administrative complaint against Cambridge Analytica, Nix and Kogan. Nix and Kogan settled, agreeing to delete the data and to stop misrepresenting their collection practices. Cambridge Analytica, bankrupt since May 2018, never filed an answer, waived its right to contest, and lost on summary decision on all three counts. Note carefully what those three counts were: that the app "did not collect any personally identifiable information from users," that the company "was a participant in the EU-U.S. Privacy Shield," and that it "adhered to Privacy Shield principles" — all found false and misleading. The FTC's case is about lying to people whose data was taken and lying about a certification. It is not a finding about influencing anybody's vote, and it is routinely cited as though it were.
• Insolvency Service, undertaking accepted 14 September 2020, effective 5 October 2020 — Nix disqualified as a company director for seven years. The conduct he did not dispute is worth quoting because it is the part of the Channel 4 footage that survived scrutiny: SCL Elections offered "bribery or honey-trap stings, voter disengagement campaigns, obtaining information to discredit political opponents and spreading information anonymously in political campaigns." Nix admitted no wrongdoing and was never accused of breaking a law; he said he settled to avoid the cost of a trial.
• Private litigation — In re Facebook, Inc. Consumer Privacy User Profile Litigation settled for $725 million, announced 22 December 2022, final approval from Judge Vince Chhabria on 10 October 2023, affirmed by the Ninth Circuit on 13 February 2025: the largest data-privacy class recovery on record. And In re Facebook Inc. Derivative Litigation in Delaware, where shareholders sought at least $7 billion from Zuckerberg and the board for the oversight failure and for allegedly structuring the FTC settlement to shield Zuckerberg personally, went to trial in July 2025, settled after one day of testimony, and the figure — $190 million, payable to the company — surfaced in a court filing on 20 November 2025.

And then the finding that the coverage never absorbed. On 2 October 2020 Elizabeth Denham wrote to Julian Knight MP closing the investigation, after the ICO had worked through the seized servers. Four conclusions from that letter, each quoted from outlets that had the PDF:

1. "SCL's own marketing material claimed they had 'Over 5,000 data points per individual on 230 million adult Americans'. However, based on what we found it appears that this may have been an exaggeration." 2. "there was evidence that their own staff were concerned about some of the public statements the leadership of the company were making about their impact and influence" — and separately, "a degree of scepticism within SCL as to the accuracy or reliability of the processing being undertaken." 3. On Brexit: "It was suggested that some of the data was utilised for political campaigning associated with the Brexit Referendum. However, our view on review of the evidence is that the data from GSR could not have been used in the Brexit Referendum as the data shared with SCL/Cambridge Analytica by Dr Kogan related to US registered voters." The 2018 report had already found no involvement beyond "some initial enquiries made by SCL/CA in relation to UKIP data in the early stages of the referendum process." 4. On Russia: "We did not find any additional evidence of Russian involvement in our analysis of material contained in the SCL / CA servers we obtained."

And the closing line: "there is little in the vast volumes of evidence we have now worked through that has changed our initial understanding or identified new lines of enquiry," with no significant breaches meeting the threshold for further regulatory action beyond what had already been taken.

Two things the same letter found that cut the other way, and belong here so the summary is not a defence brief: SCL/CA kept data "in a variety of locations, with little thought for effective security measures," with "individuals of interest" holding company data in personal Gmail accounts; and toward the end the firm "was drawing up plans to relocate its data offshore to avoid regulatory scrutiny by ICO." This was not a well-run company that was misunderstood. It was a badly-run company that oversold itself.

1.4 What the company said it could do

At the Concordia Summit at Columbia in September 2016, in a talk titled The Power of Big Data and Psychographics, Nix told an audience: "We have somewhere close to four or five thousand data points on every adult in the United States." The pitch was that OCEAN personality scores, inferred at individual level, let a campaign address the same policy to a neurotic voter and an extravert voter in the two different ways each would find persuasive — that this was a new kind of instrument, and that it had just won Ted Cruz the Iowa caucus.

The pitch worked commercially before it worked politically. The Cruz campaign paid Cambridge Analytica about $5.8 million. The company claimed work in dozens of countries.

1.5 What the evidence says it could do

Four independent lines, none of them from the company or its critics.

The man who built the model. Kogan has said consistently and against his own interest that the personality layer was weak: about a 0.3 correlation between predicted and actual Big Five scores, and, in his own construction, "the predictions we gave SCL were 6 times more likely to get all 5 of a person's personality traits wrong as it was to get them all correct." His conclusion was that Cambridge Analytica was selling "a myth" to campaigns.

The independent technical read. Matthew Hindman, writing in The Conversation on 30 March 2018 and having interviewed Kogan about the method, reached a more interesting verdict than either camp wanted. The model was good — at demographics. Gender, race and sexual orientation would come in above 90%; party would come in around 85%, comparable to published work. Personality would not. Hindman's summary is the sentence to carry: "psychographics is mostly demographics." The tool was real and it was a competent voter-file enrichment engine wearing a psychological costume. That is a materially different object from the one that was sold and from the one that was feared.

The base rate for the effect being claimed. Political persuasion is one of the few areas of social science with a genuinely large randomised literature, and it says the ceiling is low. Kalla and Broockman (APSR, 2018), pooling 40 field experiments and adding 9 of their own, concluded that "the best estimate of the effects of campaign contact and advertising on Americans' candidates choices in general elections is zero," with exceptions in narrow circumstances that decay. Coppock, Hill and Vavreck (Science Advances, 2020) ran 49 real 2016 ads through 59 experiments on 34,000 people and found small average effects that did not conceal large offsetting ones: "During the primary and general election, in battleground states, for Democrats, Republicans, and Independents, effects are similarly small." A technique cannot swing a general election through a channel whose measured ceiling is that low unless it does something categorically outside that literature, and no one has shown that it did.

The measurement problem that inflates every observational estimate. Ad-effect numbers derived from platform data rather than randomisation run large, because the platform's own optimisation selects who sees what. This is exactly the objection Eckles and colleagues raised in PNAS against Matz, Kosinski, Nave and Stillwell's 2017 psychological- targeting result — that Facebook's delivery algorithms confound the comparison — and the original authors' reply conceded the mechanism while disputing that it explained their findings. That exchange is the honest state of the field: targeting effects exist, they are contested at the first decimal, and the confound runs in the direction of overstatement.

---

2. Why a reading would cite it

LENSES.md already contains the rule this entry is the evidence for. Under AI as accelerant, it names mass manipulation and campaigning as harms that count, then sets the test: "It counts only if the source shows AI was actually used in the work — a named model or method in a methods section, a technical account, or documented forensics — and says what became possible that wasn't. 'AI will revolutionise X' is not a finding; neither is 'experts warn AI could sway elections.'"

That clause is not a stylistic preference. It is a ruling, and this is the case it was ruled on. Cambridge Analytica is what "experts warn AI could sway elections" looks like after seven years of investigation: the data access was real and cost Facebook something over $6 billion across five jurisdictions and two decades of litigation; the vote-swinging was never demonstrated by anyone, was doubted by the firm's own staff at the time according to the regulator that read their servers, and was priced into public belief years before anybody checked. When a reading needs to say why it is declining to record an influence claim as a finding, this is the citation, and the strength of the citation is that it does not require believing the claim was harmless — the penalties are in the file.

The occasions are live and they are dense in this project's own window.

The 2026 US midterms. The readings this month already carry the buildout's politics — the NRSC memo obtained by Axios on 19 August, the Ohio polling, a governor's executive order. Election season is precisely when the "AI swung it" claim gets made, will get made at volume, and will be indistinguishable in form from the 2016 version. The value of this entry on the night is that it supplies the questions: what was actually deployed, by whom, at what scale, measured how, against what counterfactual — rather than the answer.

Lab and platform threat reporting. OpenAI, Meta and Anthropic all now publish accounts of influence operations run through their systems. Those reports are genuine primary material and they are also the interested party's account of the harm it would be blamed for; both halves need saying. Their own consistent finding, so far, is that the operations they disrupt do not achieve engagement — which is the same shape as the CA finding and should be recorded with the same caution in both directions.

The one piece of external measurement of the 2024 cycle. CETaS at the Alan Turing Institute analysed 16 viral AI-enabled disinformation cases in the UK and 11 across the EU and French elections and found no measurable impact on results, while recording real second-order harms — hate directed at candidates, uncertainty about what is authentic, entrenched polarisation. That is the shape this entry teaches: separate the demonstrated mechanism from the asserted outcome, and record both.

And the update to the actual technique, which is the most useful thing here. The question CA raised — does tailoring a political message to the individual beat sending everyone the good generic one? — has now been tested with the tool CA never had. Kobi Hackenburg and Helen Margetts, PNAS, published 7 June 2024, built a live application feeding self-reported demographic and political data into GPT-4 prompts in real time and ran a preregistered randomised experiment on n = 8,587 across four political issues. Two findings, in their words:

> "First, messages generated by GPT-4 were broadly persuasive, in some cases increasing > support for an issue stance by up to 12 percentage points. Second, in aggregate, the > persuasive impact of microtargeted messages was not statistically different from that of > non-microtargeted messages (4.83 vs. 6.20 percentage points, respectively, P = 0.226). > These trends hold even when manipulating the type and number of attributes used to tailor > the message. These findings suggest — contrary to widespread speculation — that the > influence of current LLMs may reside not in their ability to tailor messages to > individuals but rather in the persuasiveness of their generic, nontargeted messages."

Read that against Nix at Concordia and the entry writes itself: the model is more persuasive than Cambridge Analytica ever was, and the targeting — the thing that was sold, feared, and legislated about — is the part that did not show up. The non-targeted arm scored higher, though not significantly so.

The contrary result exists and must be carried with it. Simchon, Edwards and Lewandowsky (PNAS Nexus, 2024) ran four studies and found personality-tailored political ads outperform untailored ones, at a scale they translate as roughly 2,490 additional people persuaded per 100,000 exposed by style matching alone, rising to about 11,405 under optimal matching — and showed the generation and validation of those ads can be automated. Two papers, same year, apparently opposite conclusions. They are less opposed than they look: Simchon et al. measure ad-response outcomes and an optimal-matching ceiling, Hackenburg and Margetts measure issue-stance movement against a strong non-targeted control. But a reading that cites one and not the other is doing advocacy.

---

3. What it got right, and what it got wrong

Not required for moment, and unavoidable here, because this entry consists almost entirely of dated claims by four sets of people with different interests. Graded through 19 August 2026.

3.1 Right — the harvest happened, at the scale reported, and the platform's control failed

Claimed March 2018. Confirmed within three weeks by the platform itself, at a higher number than the journalism used: Facebook's own 87 million against the Observer's 50 million. This is the rarest outcome in a data story and it should be said plainly: the first reported figure was too low, and the correction came from the accused party.

Enforcement followed in four jurisdictions and has not been reversed anywhere. Nothing in the eight years since has dented it.

3.2 Right — that the company's public claims were sales material

Wylie said it, Kogan said it against his own interest, and in October 2020 the regulator that had read the servers said it: the "5,000 data points" line "may have been an exaggeration," the tooling was "off the shelf," and staff inside the firm were "concerned about some of the public statements the leadership of the company were making about their impact and influence."

Two of those three sources are interested. The third is not, and it is the one holding the hard drives.

3.3 Right — that the conduct was genuinely bad, independent of any effect

Worth stating because §3.4 is often mistaken for exoneration. The FTC found three counts of deception proven. The Insolvency Service extracted a seven-year directorship disqualification over services including entrapment and voter-disengagement campaigns, on conduct Nix did not dispute. The ICO found company data sitting in personal Gmail accounts and a plan to move the servers offshore to escape the regulator. None of that depends on whether a single vote moved. An entry that argued "the effects were small, therefore this was a fuss about nothing" would be misreading its own evidence, and would be wrong on its own terms: deceiving people about what is taken from them is a completed harm at the moment of the taking.

3.4 Wrong — that psychographic targeting measurably moved votes

This was the load-bearing claim of the entire episode and nobody has ever demonstrated it. Not the company, whose CEO asserted it on a stage and whose staff privately doubted it. Not the campaigns: Brad Parscale, the Trump campaign's 2016 digital director, told 60 Minutes in October 2017 that the campaign never used the psychographics Cambridge Analytica was famous for, and said the practice "doesn't work" — and the campaign moved to RNC data for the general election. Not the researchers: the two large randomised literatures put the ceiling on campaign persuasion near zero, the man who built the model puts its personality layer at r ≈ 0.3, and the best independent read of the technique concluded it was demographics wearing a costume. Not the regulators, neither of whom made a finding of electoral effect — because neither was asked to, which is itself worth knowing.

Due date: this claim has now had eight years and the most-studied election in history to produce a demonstration, and has produced none. Graded wrong, with a caveat that keeps it honest: "not demonstrated" is not "demonstrated false." No study rules out a small effect. What the record rules out is the claim as made — a decisive, novel, individually targeted instrument — and it rules it out by the ordinary means of nobody being able to find it.

3.5 Wrong — Brexit, and this one has to be kept surgically separate

The proposal that commissioned this entry insisted on the separation and it was right to.

Cambridge Analytica and the referendum: the ICO found no significant involvement. Not "insufficient evidence" — a mechanical impossibility for the specific pathway everyone argued about, since the GSR data was US registered voters, plus a 2018 finding of nothing beyond initial enquiries about UKIP data early on. That is the answer to the question that was actually asked.

Vote Leave, BeLeave and AggregateIQ are a different matter with a different outcome, and one that partly unravelled. On 17 July 2018 the Electoral Commission fined Vote Leave £61,000 and referred it to the police, finding that BeLeave had spent over £675,000 with AggregateIQ under a common plan with Vote Leave that should have been declared, putting Vote Leave nearly £500,000 over its £7m limit. Darren Grimes was fined £20,000 — and won his appeal on 19 July 2019, the sanction withdrawn and the Commission ordered to pay costs. The Metropolitan Police took no further action after CPS advice in 2020. So: a spending-declaration finding against the lead campaign that stands, a personal fine that was overturned, and no prosecution. That is a campaign-finance story about a Canadian data contractor. It is not a Cambridge Analytica story and it is not a psychographics story, and the two get merged constantly.

The libel record is not a substitute for either. Banks v Cadwalladr is sometimes cited as though a court adjudicated whether Brexit was bought. It did not. Steyn J's judgment of 13 June 2022 found Cadwalladr had a public-interest defence for the original publication; the Court of Appeal on 28 February 2023 allowed Banks's appeal in part on the serious-harm test for continued publication after a joint statement with the Electoral Commission. The case turned on defamation doctrine — meaning, public interest, serious harm — not on the truth of any claim about the referendum, and citing it either way as a factual verdict is a misuse.

3.6 Wrong in the other direction — "it was all snake oil" overshoots, and the sceptics have a motive too

The strongest form of this entry's argument is not "Cambridge Analytica was fake." Three things cut against that.

The data was genuinely predictive, just not of what was advertised: 85% party discrimination from Likes is a real capability with real uses, and a firm that quietly enriched voter files that well would have been a competent, boring vendor.

The counterfactual was never run. Nobody randomised US counties into CA-targeted and untargeted arms in 2016. The academic literature bounds the class of intervention; it does not measure this instance.

And the debunking has its own interested parties, which almost no account of this episode says out loud. Facebook benefits from "the targeting didn't work" — it converts a story about its platform enabling manipulation into a story about a vendor's marketing. Losing campaigns benefit from "it did work." Winning campaigns benefit from "it did work" right up until it becomes a scandal, at which point Parscale's account changes value. Wylie's testimony made him a public figure and a book advance; Kogan's minimising account serves a man who was, at the time, the most blamed individual in the story; Kosinski's work gains prominence from either reading. Everyone in this story, in both camps, is paid in some currency by the version they tell — which is exactly why §1.3's regulator findings and §1.5's randomised experiments carry the weight here and the participants' accounts do not.

3.7 Unresolved — what nobody has measured, and probably now cannot

The specific counterfactual is gone. The company is dissolved, the data was ordered destroyed by two regulators, the platform's research access has tightened repeatedly since 2018, and the election is a decade back. This entry will not be resolved by new evidence about 2016. It will be resolved, if at all, by experiments on the current technique — which is what makes Hackenburg and Margetts more useful to a 2026 reading than any further archaeology on Cambridge Analytica, and what makes the 2026 midterms a real test rather than a rerun.

One thing that genuinely deserves study and has not had it: not whether targeting persuades, but whether voter disengagement works. The Insolvency Service's finding names "voter disengagement campaigns" among the services offered, and suppression is a different mechanism from persuasion with a different and much thinner literature. The Kalla–Broockman result is about choice between candidates. It is not a result about turnout suppression, and treating it as one — which this entry would be doing if it stopped at §3.4 — would be the same error the entry exists to name.

---

4. Commonly misused as

Not required for moment, and this entry needs it more than most, because the phrase attached to this event is wrong in the first three words.

"The Cambridge Analytica data breach." There was no breach. Nothing was hacked, no control was circumvented, no credential was stolen. Facebook's Graph API v1.0 was documented to let an installed app read the profiles of the installer's friends; Kogan's app did that; Facebook removed the capability from new apps at f8 on 30 April 2014 and from existing apps on 30 April 2015. The Observer's headline used "breach" and it stuck. Why the distinction is not pedantry: a breach is a security failure, which is fixed with security. This was a design decision, which is fixed by not making it — and the whole class of harm lives in the gap between "what the API permits" and "what the user thinks they agreed to." Every consent-scoping fight since, including the ones about what an AI agent may read from a connected account once a user clicks Allow, is in that gap and not in a security gap.

"Proof that AI can swing an election." It is the closest thing to a test case the record contains, it was investigated by two national regulators with seizure powers, and it produced no such finding. Citing it for that proposition is citing the most thoroughly examined counterexample as though it were the exhibit. This is the misuse LENSES.md rules against and the one this entry is filed to answer.

"Proof that Brexit was bought." The ICO's finding is the opposite for Cambridge Analytica specifically, on a mechanical ground. The Vote Leave / AggregateIQ spending findings are real, separate, partly overturned on appeal, and about declaration thresholds rather than persuasion. See §3.5.

"Proof it was all snake oil, so influence operations are a non-problem." The mirror-image misuse and the one that has been gaining, especially among people who correctly noticed the first two. The FTC found three counts of deception. The Insolvency Service disqualified the CEO for seven years over services that included entrapment. The ICO found a plan to move servers offshore to escape it. §3.6 is why the sceptical read has a limit.

"An AI story." It is barely one. The modelling was logistic regression and matrix factorisation over Likes and purchased broker data, running in 2014–2016. It is in this canon because it is the template — the shape a capability claim takes when the seller, the press and the alarmed all profit from the largest version of it — and because the current technique is finally being measured against the claim the old one made. Calling the 2016 machine "AI" flatters it, and flattering it is how the claim got its authority in the first place.

"A finding about Facebook's advertising." Also common and also wrong. The harvesting was through the developer platform, not the ad system. Both are Facebook and they are different mechanisms with different remedies, and conflating them makes "ban political ads" look like a response to something it does not touch.

---

5. Sources

Read this first: not one primary regulator document was reachable from this session. The following returned HTTP 403 to the fetch tool: ftc.gov (the July 2019 penalty release, the July 2019 CA/Nix/Kogan release, the case page, the administrative complaint PDF); ico.org.uk (the November 2018 report PDF, the Commissioner's blog, the October 2020 letter PDF); publications.parliament.uk and committees.parliament.uk (the DCMS committee report chapter, Kogan's written evidence); pnas.org (Kosinski et al. 2013); congress.gov (the CRS product on the FTC settlement); cis.pubpub.org; computerweekly.com; openai.com. web.archive.org is blocked by this harness, and a curl fallback with a browser user-agent required an interactive approval this job cannot obtain. Every regulator quotation below therefore comes from an outlet quoting the document, and each is marked. Two outlets — The Register and TechCrunch — carry substantial verbatim passages from the October 2020 ICO letter and their quotations agree where they overlap, which is the only cross-check available here.

Read directly, and load-bearing:

• Mike Schroepfer, "Restricting Data Access," Facebook Newsroom, 4 April 2018 (about.fb.com) — the 87 million figure in the company's own words, and the API restrictions. The only primary document from a named party read in full for this entry.
• Kobi Hackenburg and Helen Margetts, "Evaluating the persuasive influence of political microtargeting with large language models," PNAS 121(24) e2403116121, published 7 June 2024 — read as PDF; the abstract in §2 is verbatim from page 1. n = 8,587, preregistered, GPT-4, four political issues; microtargeted 4.83 pp vs non-microtargeted 6.20 pp, P = 0.226. Dataset released as GPTarget2024.
• Almog Simchon, Matthew Edwards and Stephan Lewandowsky, "The persuasive effects of political microtargeting in the age of generative artificial intelligence," PNAS Nexus 3(2) pgae035, 2024 — abstract and effect sizes read at academic.oup.com. Carried as the strongest contrary result; note it measures ad-response outcomes and reports an optimal-matching ceiling rather than an achieved campaign effect.
• Matthew Hindman, "How Cambridge Analytica's Facebook targeting model really worked — according to the person who built it," The Conversation, 30 March 2018 — the "psychographics is mostly demographics" read, based on the author's own interview with Kogan. Read in full.
• Alexander Coppock, Seth J. Hill and Lynn Vavreck, "The small effects of political advertising are small regardless of context, message, sender, or receiver," Science Advances 6(36) eabc4046, 2020 — abstract read verbatim from the first author's site; the journal page itself was not opened.
• Vian Bakir, "Psychological Operations in Digital Political Campaigns: Assessing Cambridge Analytica's Psychographic Profiling and Targeting," Frontiers in Communication, 3 September 2020 — read in full. Carried mainly for its own stated limitation: it cannot show the tactics changed any vote. Its account of the Leave.EU engagement is in tension with the ICO's conclusion; the difference is proposal-stage work versus referendum involvement, and this entry follows the ICO on the second question.
• Gregory Eady, Tom Paskhalis, Jan Zilinsky, Richard Bonneau, Jonathan Nagler and Joshua A. Tucker, Nature Communications 14:62, 2023 — abstract read via the RePEc record, the journal itself unreachable (the same wall content-farms-2016 recorded). 1% of users took 70% of exposures; "no evidence of a meaningful relationship between exposure to the Russian foreign influence campaign and changes in attitudes, polarization, or voting behavior."
• Claims Journal, 21 November 2025, for the $190m Delaware derivative settlement, the $7bn originally sought, and that the money returns to the company. Secondary.
• Bleichmar Fonti & Auld and Keller Rohrback case pages for the $725m class settlement, the 10 October 2023 final approval before Judge Chhabria, and the 13 February 2025 Ninth Circuit affirmance. Plaintiffs' counsel — interested, but on undisputed procedural facts.
• Hunton Andrews Kurth, "FTC Issues Final Order in Cambridge Analytica Case" — the 6 December 2019 order, the three counts, and the fact that CA defaulted. Secondary, quoting the Commission.

Quoted at one remove, from outlets holding the document:

• The ICO's letter to Julian Knight MP, 2 October 2020 — via The Register, 8 October 2020 (the 130 billion data points, the "off the shelf" tools, the staff concerns, the "5,000 data points" exaggeration, the Brexit conclusion, the Russia conclusion) and TechCrunch, 6 October 2020 (the data brokers by name, the predicted partisanship scores, the Gmail accounts, the offshore plan, the internal scepticism). Also ITPro for the "confirmed and reinforced," "little in the vast volumes of evidence" and "no significant breaches" passages.
• The ICO's report to Parliament, 6 November 2018 — via Privacy International's summary, digit.fyi and Research Live for the "disturbing disregard" finding, the £500,000 penalty and the "initial enquiries... in relation to UKIP data" conclusion.
• The FTC's actions of 24 July 2019 — via Ropes & Gray, Sullivan & Cromwell and DOJ coverage for the $5bn penalty, the 3–2 vote and the 2012-order violation.
• The SEC's action of 24 July 2019 — via Hunton's privacy blog and contemporaneous reporting: $100m, SEC v. Facebook, Inc., No. 3:19-cv-04241 (N.D. Cal.), the hypothetical-risk disclosure charge, no admission or denial.
• The Insolvency Service disqualification — via Mirage News (carrying the release text), Al Jazeera and CNBC: undertaking accepted 14 September 2020, effective 5 October 2020, seven years, and the list of services Nix did not dispute; plus his own statement to Reuters that he admitted nothing and settled to avoid costs.
• The DCMS committee's report — via search-result extracts only, for the ~$800,000 paid to Qualtrics and the GSR structure. This is the weakest citation in the file and the $800,000 figure should be treated as provisional until the committee's own page is read.
• Kogan's accounts — via CNN's March 2018 interview and Outline's publication of his email: the r ≈ 0.3 personality correlation, the "6 times more likely to get all 5 wrong" construction, and the "myth" characterisation. Interested party, marked as such throughout.
• Kalla and Broockman, APSR 112(1), 2018 — abstract via SSRN and eScholarship listings; the paper itself not opened here.
• Kosinski, Stillwell and Graepel, PNAS 110(15):5802–5805, 2013 — the 58,000-volunteer sample and the 88% / 95% / 85% figures via phys.org's 2013 release and secondary summaries; PNAS returned 403. These specific percentages should be re-checked against the paper.
• Matz, Kosinski, Nave and Stillwell, PNAS 114:12714, 2017, and the Eckles et al. and Sharp et al. comments with the authors' replies — the existence and shape of the exchange via PNAS listing pages and search results; none of the four items opened.
• The Concordia Summit talk, September 2016 — the "four or five thousand data points" quotation via multiple secondary accounts; the video itself not viewed.
• Channel 4 News, 19–20 March 2018 — via the broadcaster's own article titles, CNN and Axios: the November 2017–January 2018 filming window, the Sri Lanka fixer pretext, Nix, Turnbull and Tayler, the company's entrapment response, and Nix's suspension on 20 March.
• The Observer, 17 March 2018 — Cadwalladr and Graham-Harrison, headline and the Wylie quotation, via the Business & Human Rights Resource Centre's reproduction; the Guardian page not opened.
• f8 2014 and the Graph API v2.0 transition — via Facebook's own developer blog posts of 30 April 2014 and 25 March 2015 as surfaced in search, plus TechCrunch's 28 April 2015 piece: announced 30 April 2014, existing apps required to complete Login Review by 30 April 2015.
• Electoral Commission, 17 July 2018, and the Grimes appeal — via the Commission's own media-centre summary as surfaced in search, The Conversation, BBC and Saunders Law: the £61,000 fine, the £675,000 BeLeave/AggregateIQ common plan, the ~£500,000 overspend against the £7m limit, the £20,000 personal fine withdrawn on 19 July 2019 with costs, and no further action after CPS advice in 2020.
• Banks v Cadwalladr — [2022] EWHC 1417 (QB), 13 June 2022, and [2023] EWCA Civ 219, 28 February 2023, via the judiciary's own press summary listing and law-firm notes; neither judgment opened.
• CETaS, Alan Turing Institute, September 2024, AI-Enabled Influence Operations: Threat Analysis of the 2024 UK and European Elections — the 16 UK and 11 EU/French viral cases and the no-measurable-impact finding, via the Institute's own news page and E&T's coverage.
• **Brad Parscale's October 2017 60 Minutes remarks** — via CBS News's own follow-up reporting; the broadcast not viewed.

Two discrepancies left visible rather than smoothed. The app-installer count appears as ~270,000 (Facebook, and most accounts) and ~300,000–320,000 elsewhere; nothing in this entry turns on it, and the 87 million downstream figure is the company's own and is not in dispute. And the Channel 4 broadcast dates appear as 19 and 20 March 2018 in news reporting and as 17, 18 and 20 March in a television-episode database; the 19–20 dates are used here because they match the contemporaneous coverage and the date of Nix's suspension.

Interest declared, per rule 7. Two, both small and both real. First, this entry sets an evidentiary standard — grade the asserted effect, not the asserted capability — that applies to the project publishing it: these readings are model-written commentary distributed on a social platform during a US election year, and the rule in §2 binds this project's own output first. Second, part of §2's modern evidence is lab and platform threat reporting, and those are self-reports by the parties who would be blamed for the harm; one of them is the vendor of the model that wrote this file. Both are cited for what they observed, both are marked as interested, and neither is the load-bearing evidence — the randomised experiments and the regulator findings are, and those come from people with no stake in this project at all.