The
Federal Trade Commission issued an Opinion finding that the data analytics and
consulting company Cambridge Analytica, LLC engaged in deceptive practices to
harvest personal information from tens of millions of Facebook users for voter
profiling and targeting. The Opinion also found that Cambridge Analytica
engaged in deceptive practices relating to its participation in the EU-U.S.
Privacy Shield framework.
In an administrative
complaint filed in July, FTC staff alleged that Cambridge Analytica and its
then-CEO Alexander Nix and app developer Aleksandr Kogan deceived consumers.
Nix and Kogan agreed to settle the FTC’s allegations. Cambridge Analytica,
which filed for bankruptcy in 2018, did not respond to the complaint filed by
FTC staff, or a motion submitted for summary judgment of the allegations.
The FTC staff’s administrative complaint alleged that Kogan worked
with Nix and Cambridge Analytica to enable Kogan’s GSRApp
to collect Facebook data from app users and their Facebook friends. The
complaint alleged that app users were falsely told the app would not collect
users’ names or other identifiable information. The GSRApp,
however, collected users’ Facebook User ID, which connects individuals to their
Facebook profiles.
The complaint also alleged that Cambridge Analytica claimed it
participated in the EU-U.S.
Privacy Shield—which allows companies to transfer consumer data legally
from European Union countries to the United States—after allowing its
certification to lapse. In addition, the complaint alleged the company failed
to adhere to the Privacy Shield requirement that companies that cease
participation in the Privacy Shield affirm to the Department of Commerce, which
maintains the list of Privacy Shield participants, that they will continue to
apply the Privacy Shield protections to personal information collected while
participating in the program.
In its Opinion,
the Commission found that Cambridge Analytica violated the FTC Act through the
deceptive conduct alleged in the complaint. The Final
Order prohibits
Cambridge Analytica from making misrepresentations about the extent to which it
protects the privacy and confidentiality of personal information, as well as its
participation in the EU-U.S. Privacy Shield framework and other similar
regulatory or standard-setting organizations. In addition, the company is
required to continue to apply Privacy Shield protections to personal
information it collected while participating in the program (or to provide
other protections authorized by law), or return or
delete the information. It also must delete the personal information that it
collected through the GSRApp.
The Commission voted 5-0 to issue the Opinion and Final Order.
The Federal Trade Commission works to promote competition, and protect
and educate consumers. You can learn
more about consumer topics and file a consumer
complaint online or by
calling 1-877-FTC-HELP (382-4357). Like the FTC on Facebook,
follow us on Twitter,
read our blogs,
and subscribe
to press releases for the
latest FTC news and resources.