Facebook says the number of users affected by Cambridge Analytica data leak is 87 millionFacebook says the number of users affected by Cambridge Analytica data leak is 87 million

In March 2018, reporting by The Guardian, The Observer and The New York Times revealed that political consulting firm Cambridge Analytica had obtained data on tens of millions of Facebook users without their knowledge. Initial estimates put the number at about 50 million. On April 4, 2018, Facebook raised its own estimate to as many as 87 million people, the majority of them in the United States.

The data was collected in 2014 by a personality quiz app built by Cambridge University researcher Aleksandr Kogan. Around 270,000 people installed the app and consented to share their data, but Facebook's platform rules at the time also let developers pull information about those users' friends. That design allowed a small pool of quiz takers to expose a vast social graph. Kogan then passed the data to Cambridge Analytica, in violation of Facebook's terms, and the firm used it to build psychological profiles for political advertising, including work tied to the 2016 US presidential campaign.

Facebook had learned of the transfer in 2015 and asked for the data to be deleted, but it did not verify that happened or inform users. When whistleblower Christopher Wylie went public, the company faced intense scrutiny over its data practices. Chief executive Mark Zuckerberg testified before the US Congress in April 2018, and the company's share price fell sharply in the days following the first reports. Cambridge Analytica shut down in May 2018.

The regulatory aftermath was historic. In July 2019 the US Federal Trade Commission imposed a $5 billion penalty on Facebook, the largest privacy fine it had ever levied, along with new oversight requirements. The Securities and Exchange Commission separately collected $100 million over misleading risk disclosures, and the UK Information Commissioner's Office issued the maximum fine available under pre-GDPR law, £500,000. In 2022 Meta agreed to pay $725 million to settle a US consumer class action.

Although no system was hacked, the case reshaped how the public and lawmakers think about data breaches. It showed that permissive developer APIs can leak as much as a network intrusion, and it pushed platforms to restrict third-party access, audit apps, and shut down features such as friend-data sharing. For users, it made clear that the privacy of their information depends partly on what their friends agree to.