Cambridge Analytica

Overview

Cambridge Analytica was the London-based political consulting firm whose harvest of Facebook user data for voter profiling detonated one of the defining privacy scandals of the 2010s. Founded around 2013 as an offshoot of the SCL Group, the firm first worked for Ted Cruz’s 2016 presidential campaign and then for Donald Trump’s, marketing psychographic profiling — its so-called “secret sauce” — as the edge that could read voters’ personalities. The scandal broke in March 2018, the firm shut down on May 2, 2018, and the story has usually been told as finished there.

It is not finished. On September 25, 2026 — eight years after the company ceased trading — a jury in Santa Fe, New Mexico found Meta Platforms liable for misleading users in the Cambridge Analytica case, awarding New Mexico a verdict that no other jurisdiction had pursued. The state’s attorney general filed suit in 2021, took the case through a two-week trial, and accused Meta of misleading statements about how user data was shared with third parties, alongside allegations about its handling of hate speech and misinformation and its preferential application of its own policies. New Mexico was the only jurisdiction to take the case to trial, and it sought up to $5,000 per violation, with Judge Francis Mathew set to determine monetary penalties.

The verdict is only the most visible part of the firm’s live legal afterlife. In the same 2026 season, Meta agreed to pay $459 million to a handful of states that had sued over Cambridge Analytica privacy violations — a deal struck inside the far larger roughly $16.7 billion agreement with 47 states, the District of Columbia and the territories over teen-addiction claims. That figure drew little attention at the time because the headline was the $16.7 billion total, with $5.4 billion of it a trust for teen safety; but buried inside the settlement were 22 specific claims, including Cambridge Analytica, Snapchat, and a handful of other issues. The company that died in 2018 is still generating liability in 2026.

The firm and the data harvest

Cambridge Analytica presented itself as a political consultancy with an edge: personality profiling built on data. It was an offshoot of SCL Group, a firm with government and military clients, and was backed by about $15 million from the American billionaire Robert Mercer, a major Republican donor. Its name was chosen by Steve Bannon, who later became a senior Trump White House aide. The firm was staffed largely by British workers and listed offices in New York, Washington, London, Brazil and Malaysia.

The mechanism of the scandal was, in retrospect, disarmingly simple. An academic at Cambridge University, Aleksandr Kogan, built an app called “thisisyourdigitallife,” which about 270,000 users downloaded and logged into with their Facebook accounts. The app collected their personal data — and, under Facebook’s platform rules at the time, the data of their friends as well — and that information was passed on to Cambridge Analytica. March 2018 reporting by The New York Times and The Observer put the affected figure at about 50 million users; Facebook’s later estimate rose to 87 million. Facebook responded by suspending Cambridge Analytica, its parent SCL Group, Kogan, and Christopher Wylie, the former employee who blew the whistle on the firm’s practices.

The Trump campaign’s digital director, Brad Parscale, said the campaign did not use Cambridge Analytica’s data, relying instead on voter data supplied by the Republican National Committee. Whether the firm’s models ever worked as advertised is a separate question — and the one regulator that examined the evidence most closely gave a sceptical answer.

Collapse

The firm’s end was abrupt. On May 2, 2018, Cambridge Analytica announced it was “immediately ceasing all operations.” SCL Elections Ltd. began bankruptcy proceedings covering Cambridge Analytica and some US affiliates, and the firm entered insolvency in the United Kingdom. Its parting statement called the accusations against it “unfounded” and blamed relentless media coverage for driving away “virtually all” of its customers and suppliers, making continued operation “no longer viable.”

The immediate trigger was a Channel 4 undercover sting. Reporters posing as prospective clients filmed chief executive Alexander Nix discussing honey-trap operations and bribery as campaign tactics, and the network broadcast the footage. Nix was suspended, the firm hired the investigator Julian Malins to audit the broadcast, and the Cruz and Trump campaigns’ former digital partner died within weeks of the story it had spent two years courting.

The corpse kept walking, briefly. In 2017 — before the shutdown — a new company called Emerdata had been incorporated. It listed Alexander Nix as a director alongside other SCL executives, with Robert Mercer’s daughters, Rebekah and Jennifer Mercer, joining as directors, according to Companies House filings reported at the time. Critics read it as a shell built to absorb the old firm’s assets and personnel; the firm itself rejected the characterization, and the trail goes quiet there.

The regulator’s corrective

The most durable part of the Cambridge Analytica story may be the one least remembered: the UK Information Commissioner’s Office spent years inside the firm’s seized servers and delivered its final account to Parliament on October 2, 2020. Its findings read less like the exposure of an all-seeing data machine and more like the puncturing of a myth.

The ICO concluded that Cambridge Analytica’s analytical methods were “well recognised processes using commonly available technology” — open-source libraries such as scikit-learn, not proprietary secret sauce — and that the real-world accuracy of its predictions was “likely much lower” than the firm claimed. Staff inside the company were themselves sceptical of some of the public statements their leadership made about the firm’s impact and influence. The firm had bought what one estimate put at over 130 billion data points of commercially available personal data, mostly about American voters, and combined it with the Facebook-derived information from Kogan’s app.

Two other findings quietly contradicted popular narratives. The ICO found no further evidence to change its view that Cambridge Analytica was not involved in the EU referendum campaign in the UK, beyond some early enquiries about UKIP data that were never taken forward. And it found no additional evidence of Russian involvement in its analysis of the material on the SCL/Cambridge Analytica servers.

The enforcement record, by then, was written: Facebook paid the ICO’s £500,000 fine in November 2019 after withdrawing its appeal under a settlement agreement; SCL Elections was fined £18,000 for failing to comply with an ICO Enforcement Notice; the ICO referred SCL’s conduct to the Insolvency Service; and Alexander Nix was disqualified from acting as a company director for seven years. The ICO also required everyone it had contacted to certify that the data they held had been deleted.

The American enforcement arc

Across the Atlantic, the enforcement story was bigger in dollars and thinner in admissions. In July 2019, Facebook agreed to pay $5 billion to resolve the Federal Trade Commission’s privacy probe — a probe triggered by allegations that the company had violated a 2012 consent decree by improperly sharing the data of 87 million users with Cambridge Analytica. The settlement was adopted in a 3–2 commission vote, and the firm’s clients had included President Donald Trump’s 2016 campaign.

The FTC also went after the corpse itself: it found that Cambridge Analytica had deceived consumers about its collection of Facebook data for voter profiling and targeting, and about its participation in the EU-US Privacy Shield framework. The agency voted 5–0 for a final order barring the firm from misrepresenting how it protected personal information — an order of uncertain impact, since the firm was already gone.

That is where most timelines end. But the New Mexico verdict and the $459 million settlement inside the 2026 multi-state deal show the timeline is still open: a company that ceased trading in 2018 continues to shape American privacy law and Meta’s balance sheet in 2026. The scandal’s second act is being written in courtrooms the firm never entered.

What this profile does not claim

• The profile does not assert that Cambridge Analytica’s psychographic models actually worked as advertised; the UK regulator found their real-world accuracy was likely much lower than claimed.
• It does not assert the firm’s involvement in the Brexit referendum; the ICO found no evidence of it beyond early enquiries.
• It does not assert Russian involvement in the firm’s data operations; the ICO found none in the seized server material.
• It does not assert what Emerdata did after 2018 — only its 2017 incorporation and reported directors are documented here.
• It does not assert that the September 2026 New Mexico penalties have been set; they were pending before Judge Mathew as of the verdict report.