Document reveals Facebook was informed in 2014 that Aleksandr Kogan's company's survey app could sell user data, which broke with Facebook's policy at the time
Facebook was informed that the app at the centre of a massive data leak could sell user data to third parties …
Context & Ripple Effects
This document lands at the center of the Cambridge Analytica fallout arc. Facebook had already raised its damage estimate to as many as 87 million people, and Kogan has since admitted he broke the platform's terms while arguing his survey app operated within industry norms. What changed with this report is the timeline: Facebook's position rested on not knowing what Kogan's app could do until 2015, and a 2014 warning that the app could sell user data directly undercuts that.
First-order effects
- Facebook's 'we didn't know' defense collapses into a 'we were told and didn't act' problem, handing regulators and Congress a documented notice-and-inaction record rather than an ignorance claim.
- Kogan's framing that his app was within norms now collides with evidence Facebook itself flagged the data-selling risk a year before the harvest was cut off.
Second-order effects
- The pattern repeats across Facebook's ecosystem: Sen. Wyden's letter showed the company ignored auditor warnings about device-partner misuse, and internal docs later revealed roughly 150 companies got more data access than disclosed — so scrutiny expands from one rogue app to how Facebook polices every data channel it operates.
- Every partner, developer, and advertiser on the platform faces re-contracting under tighter data-use terms as Facebook tries to prove enforcement it failed to demonstrate internally.
Third-order effects
- If the pattern holds — ignored auditors, unenforced policies, undisclosed sharing — platform data governance shifts from self-policed terms of service to externally enforced compliance, with regulators treating documented internal warnings as the evidentiary basis for penalties rather than trusting platform attestations.
The trend: Social platforms are losing the ability to self-certify their data handling, as each disclosed internal warning converts privacy scandals from isolated breaches into systemic governance failures.