How Facebook's old terms of service allowed Cambridge Analytica to get data on 50M people from just 270K users of an app that used Facebook Login
Facebook says it isn't at fault. — Cambridge Analytica, the data analytics firm that helped Donald Trump get elected president …
Context & Ripple Effects
The mechanics here are the story: a personality-quiz app with just 270K users tapped harvested personal information from 50M profiles because Facebook's old terms of service let an app pull not only its own users' data but their friends' as well — all through Facebook Login. The New York Times and Recode reporting landed within hours of each other on March 17–18, framing this as a terms-of-service loophole exploited for voter psychographic profiling rather than a hack.
Facebook's immediate posture is denial of responsibility, which sets up a fight over scope that has already escalated: by April 5 the company itself raised the estimate to as many as 87M people, while Cambridge Analytica countered that it licensed data for no more than 30M — and separately argued its 2014-era models no longer need fresh Facebook data at all.
First-order effects
- Roughly 50M Facebook users had data taken without ever installing or consenting to the quiz app — their exposure came purely through friends who used Facebook Login — while Facebook deflects blame onto the old terms and the developer.
- Cambridge Analytica is pushed into a defensive repositioning, denying it uses Facebook data in current voter profiles even as documents show it built psychological profiles of US voters from the harvested set.
Second-order effects
- The disputed headcount becomes the battleground: Facebook's own revision upward to 87M versus Cambridge Analytica's 30M cap means every subsequent disclosure — like the confirmed collection of some users' private messages affecting 1,500 people — widens the gap between what was permitted and what happened.
- Advertisers and platform partners now face a trust question about Facebook Login itself, since the same friend-data plumbing that enabled the harvest was available to any app developer under the old terms.
Third-order effects
- If the pattern holds, the friend-of-friends data access that defined the open-graph era gets shut down across social platforms, moving the industry toward a stricter permission boundary where apps see only the consenting user's own data.
- Political data analytics firms lose the ability to source behavioral data through platform APIs at scale, pushing voter modeling toward first-party and licensed data — and regulators toward treating platform data-sharing terms as a matter of public accountability rather than private contract.
The trend: Social platforms are being forced to collapse the loose third-party data permissions of the API era, as political profiling scandals convert developer access from a growth feature into a regulatory liability.