Cambridge Analytica and the Plot to Break America
A timeline of evidence from Christopher Wylie's whistleblower account
Facebook opens its platform to third-party apps, allowing developers to request access to users' personal data — and crucially, to the data of their Facebook friends without those friends' consent.
The US Federal Trade Commission and Facebook sign a consent decree in which Facebook promises it will not share users' data without their explicit permission.
24-year-old Canadian data scientist Christopher Wylie takes a job at SCL Group in London, a firm supplying the UK Ministry of Defence and NATO with information operations expertise. He is tasked with building a team to combat extremism online.
Cambridge Analytica is established as a subsidiary of SCL Group by Nigel Oakes and Alexander Nix (CEO). The project is acquired by billionaire Robert Mercer and shaped by Steve Bannon's vision to build a far-right insurgency in America.
Data scientist Aleksandr Kogan and his company Global Science Research develop a personality quiz app on Facebook. Approximately 300,000 users are paid to take the test — but the app harvests data from all their Facebook friends too.
Cambridge Analytica begins actively harvesting Facebook user data at scale. Wylie had commissioned a mass data-scraping exercise to build psychological and personality profiles, enabling prediction of political behavior and targeted content delivery.
CA deploys its psychological profiling tools in elections across the developing world — including Trinidad, Nigeria, and other countries — before bringing these methods to Western democracies. Wylie describes this as "digital colonialism."
Cambridge Analytica is involved in 44 US congressional, Senate, and state-level elections. The company works with the John Bolton Super PAC on digital and TV campaigns in Arkansas, North Carolina, and New Hampshire.
Facebook updates its rules to limit developers' access to friends' data. However, the changes are not retroactively enforced — Kogan does not delete the improperly acquired data.
Increasingly disturbed by what he and his colleagues are building, 24-year-old Research Director Christopher Wylie leaves the company. Much of CA's most damaging US election work is still ahead.
Senator Ted Cruz's presidential campaign engages CA during the early days of his Republican primary bid, using psychographic profiling to micro-target voters.
Through a Guardian inquiry, Facebook learns Kogan sold his "research" dataset to SCL/Cambridge Analytica. Facebook verifies the breach but does not publicly acknowledge it. It pressures CA to certify they deleted the data — they claim they did.
The pro-Brexit campaign group Leave.EU, headed by Nigel Farage, hires CA. Alexander Nix and Farage are personal friends; the work is done pro bono.
The Guardian publishes the first major article on Cambridge Analytica and its methods, revealing how Ted Cruz's campaign was powered by CA's data-driven psychological profiling.
After the Cruz campaign folds, Cambridge Analytica is hired by Donald Trump's presidential campaign. The same psychographic tools and harvested Facebook data are deployed for micro-targeted digital advertising.
Britain shocks the world by voting to leave the European Union. Wylie later states this was the moment he realized it was time to expose his former associates and the tools they had built.
Cambridge Analytica's data-driven micro-targeting is deployed at scale. Racially stereotyped slogans, images and videos are targeted at specific voter segments. Facebook ads mean the evidence of this deception is largely invisible and ephemeral.
Emerdata, the functional successor to SCL and Cambridge Analytica, is founded. Registration documents list several people associated with SCL and CA, suggesting the operation is being restructured rather than shut down.
The Guardian and New York Times simultaneously publish explosive reports based on Wylie's whistleblowing. Initially reporting 50 million profiles compromised (later revised to 87 million), the stories reveal the full scope of CA's data harvesting and political manipulation.
CA executives, including CEO Alexander Nix, are caught on hidden camera boasting about using honey traps, bribery, and other illegal practices to influence elections in multiple countries.
Facebook attempts to pre-empt the press reports by announcing it has suspended CA and the SCL Group from its platform. The company faces intense scrutiny over its failure to act when it first learned of the data breach in 2015.
Mark Zuckerberg appears before the US Senate and House in a two-day hearing, calling it "my mistake" that he didn't do enough to prevent Facebook from being used for harm. He faces five hours of questioning.
The SCL Group is officially dissolved. Cambridge Analytica ceases operations due to the mounting scandal. However, successor entities and related firms continue to exist.
Christopher Wylie testifies before the US Senate Judiciary Committee, presenting evidence of a complex web connecting Facebook, Russia, WikiLeaks, the Trump campaign, and the Brexit referendum.
The European Union and more than 20 countries open inquiries into Facebook, social media, and disinformation. In the UK: National Crime Agency, MI5, ICO, Electoral Commission, and Metropolitan Police investigate. In the US: FBI, DOJ, SEC, and FTC launch probes.
The Federal Trade Commission imposes a record $5 billion fine on Facebook for violating the 2010 consent decree by failing to protect user data. It remains one of the largest penalties ever imposed for a data privacy violation.
Christopher Wylie publishes his full account: Mindf*ck: Cambridge Analytica and the Plot to Break America. The book reveals the inside story of how military-grade psychological warfare tools were weaponized against democratic populations.
In response to the scandal: Twitter bans political ads entirely. Google reduces targeting options for political advertising. Facebook gives users the ability to opt out of political ads. The EU passes the Digital Services Act and Digital Markets Act.
Facebook (now Meta) agrees to pay $725 million to settle a class-action lawsuit brought by users whose data was improperly shared with Cambridge Analytica — one of the largest data privacy settlements in history.