Internet · Cambridge, London and Facebook's platform · 2014–2019

A Personality Quiz Collected More Than Its Players Expected

A small app reached through friendships into a much larger population of profiles.

1. A quiz with a wider reach

A personality-testing app appeared to ask Facebook users for answers and permission to access some information. The scale of the resulting collection was much larger than the group who used it. Under the platform's rules at the time, access could extend into information about users' friends. People who had never opened the app could therefore become part of a dataset assembled through somebody else's decision.

You did not have to take the quiz to become part of its data story.

2. The research connection

Researcher Aleksandr Kogan developed the app through Global Science Research. Data collected through it was supplied to Cambridge Analytica, a company involved in political consulting and voter targeting. The central issue was not simply that people answered personality questions. It was how profile information was obtained, represented to users and passed into a commercial system beyond the purpose many people believed they were authorising.

An academic-looking activity had acquired a political customer.

3. Friends multiply the numbers

A comparatively small population of app users provided access to a much larger set of profiles. The Federal Trade Commission later described collection affecting tens of millions of people through the users' friends. Facebook estimated that up to eighty-seven million accounts might have been affected. Those are not interchangeable counts, and neither means that eighty-seven million people knowingly signed up to take the personality test.

The multiplication happened through relationships, not through millions of extra quiz responses.

4. Promises about prediction

Cambridge Analytica promoted the use of data and personality-based techniques in political communication. Such claims attracted attention because they suggested detailed ways to select audiences and tailor messages. The existence of the collected data does not prove every advertised capability worked. In particular, no responsible account can jump from a large dataset to the conclusion that one company's psychological model single-handedly determined an election result.

A powerful sales claim still needs evidence that the promised power existed.

5. A problem known before the storm

Concerns about the transfer of Facebook data emerged before the scandal's largest wave of attention in 2018. Facebook said it had required the data to be deleted. A promise of deletion was not the same as proving every copy had disappeared or that all further uses had stopped. Once information has moved beyond its original system, oversight becomes more difficult than changing a permission setting on the platform.

An instruction to delete cannot reach backward and prevent a copy.

6. The revelations spread

Reporting and whistleblower accounts in 2018 brought the collection and its political connections into global public view. Facebook faced questions from users, lawmakers and regulators about how the platform had permitted access and enforced its restrictions. Cambridge Analytica became a shorthand for a wider problem: people often did not understand how information shared with one service could travel into another organisation's decisions.

The scandal made an invisible supply chain suddenly visible.

7. The hearings move into public view

Facebook chief executive Mark Zuckerberg appeared before lawmakers as scrutiny intensified. The company faced demands to explain both the original access and its response after learning of the misuse. Public apologies and proposed platform changes did not answer every regulatory question. The matter now involved whether earlier promises to protect information had been honoured, not merely whether a new set of terms could be written.

The question was about promises already made, not only settings still to come.

8. Regulators distinguish the cases

In 2019, the FTC announced action involving Cambridge Analytica, its former chief executive and Kogan over deceptive data collection. It also reached a separate five-billion-dollar privacy settlement with Facebook. The size of that settlement was striking, but it covered Facebook's violations of an earlier privacy order rather than functioning as a precise invoice for each profile in this one episode.

A record penalty did not make all the proceedings the same case.

9. The data outlasts the brand

Cambridge Analytica shut down amid the scandal, but a company's closure does not automatically erase data, repair consent or settle the broader industry questions. Targeted advertising and political communication continued. The practical lesson concerned the architecture of access: one person's permission had allowed information about others to be collected, exposing the limits of treating privacy as an isolated decision by a single user.

Closing the company could not unshare the friendships that had made the collection possible.

10. The person who never clicked

The most revealing figure in the scandal may be the person who never used the app at all. Their information could still become part of the system because of the way a friend had interacted with it. That is why the story extends beyond an unusual quiz or a controversial consultant. It exposed a design in which the boundary around one person's consent did not reliably stop at that person.

The smallest click in the story could reach people who had never clicked.