The Washington PostDemocracy Dies in Darkness

A voter profiling firm hired by Trump likely grabbed data for tens of millions of Facebook users

Facebook revealed on Friday that a voter profiling firm hired by Donald Trump and other Republicans had improperly used data from 270,000 users of the social media platform. But what Facebook didn’t say may be more important: The number of people affected by this aggressive form of data grabbing likely numbered in the tens of millions.

The reason concerns the nature of how Facebook handled its users’ data before rising privacy concerns prompted it to tighten its policies against what critics have called an egregious kind of abuse — allowing app developers to gain access to information not only on their customers but also on their customers’ many Facebook friends.

This technique, once widely used but now severely restricted, meant that officials affiliated with the voter profiling firm, Cambridge Analytica, could gain access to basic demographics and the Facebook “likes” of all of the friends of the 270,000 people who downloaded an app called “thisisyourdigitallife.” If the people who downloaded the app averaged 200 “friends” each, that could lead to the collection of data on more than 50 million Facebook users.

That, as it turns out, is the number reported by a New York Times story on Facebook and Cambridge Analytica published Saturday, citing documents and people familiar with the collection and use of the data. Facebook declined to confirm this number but also did not dispute it.

Special Counsel Robert S. Mueller III has reportedly requested documents from Cambridge Analytica for its investigation. The revelation underscores the power of social media networks and the unexpected ways in which technology companies can use data that users voluntarily give up. It also gives further hints to the important role big data plays in modern politics.

"This is more evidence that the online political advertising market is essentially the Wild West," said Sen. Mark R. Warner (Va.), the top Democrat on the Senate Intelligence Committee, in a statement in response to the stories on Facebook and Cambridge Analytics. "Whether it's allowing Russians to purchase political ads, or extensive micro-targeting based on ill-gotten user data, it's clear that, left unregulated, this market will continue to be prone to deception and lacking in transparency."

Facebook’s announcement on Friday focused on how people affiliated with Cambridge Analytica had violated policies of the social media platform. A Cambridge University professor, psychologist Aleksandr Kogan, built the app that collected the user data. The app created by Kogan in 2014 offered a personality prediction and billed itself on Facebook as “a research app used by psychologists.”

People who downloaded it gave Kogan consent to access information such as the city they set on their profile and the content they had expressed interested in by pressing the "like" button, as well as information about friend groups and contacts. Those who downloaded this and other app could have set their privacy settings in a way to block this access, but the default setting allowed this broad access to app developers.

Facebook said Kogan then broke its policies by passing the information he collected through his app to Cambridge Analytica. Facebook learned about Kogan's activities in 2015 and removed app. The company also demanded certifications that Cambridge Analytica and Kogan destroy information they had shared.

They certified to Facebook that they had done so, the company said, but it said on Friday that it had received recent reports that the data was not deleted. For violating its data use policies, Facebook suspended the accounts of Strategic Communication Laboratories, the parent company of Cambridge Analytica, as well as the accounts of University of Cambridge psychologist Aleksandr Kogan and Christopher Wylie of Eunoia Technologies.

Facebook issued a statement Saturday underscoring that its policies now prevent a repeat of what Kogan and Cambridge Analytica did.

"In 2014, after hearing feedback from the Facebook community, we made an update to ensure that each person decides what information they want to share about themselves, including their friend list," the statement said.

In a statement, Cambridge Analytica said: "We worked with Facebook over this period to ensure that they were satisfied that we had not knowingly breached any of Facebook’s terms of service and also provided a signed statement to confirm that all Facebook data and their derivatives had been deleted."

It added: "Cambridge Analytica fully complies with Facebook’s terms of service and is currently in touch with Facebook following its recent statement that it had suspended the company from its platform, in order to resolve this matter as quickly as possible."

Cambridge Analytica specializes in using online data to create voter personality profiles in order to target users with political messages and ran data operations for Donald Trump's presidential campaign. The company was funded by Trump supporter and hedge fund billionaire Robert Mercer, and the president's former senior adviser Stephen K. Bannon once sat on its board.

The company, which began working for the Trump campaign in June 2016, promised that its so-called "psychographic" profiles could predict the personality and political leanings of every adult in the United States.

Tony Romm contributed to this report.