Facebook says Cambridge Analytica may have collected information on as many as 87M people, mostly in US; original reports pegged the number closer to 50M
Mark Zuckerberg Sarah Frier / @sarahfrier : What do you do to protect your own privacy/what do you advise? “I certainly use a lot of apps. yeah I mean, I'm a power user of the Internet.” he advises 2fa, changing passwords regularly... Lance Ulanoff / @lanceulanoff : When Zuckerberg learned what Cambridge Analytica had done in 2015, was unaware of their political affiliations. Didn't ban them because, “Turns out...that they weren't using any of Facebook services back then.” #FacebookCall Issie Lapowsky / @issielapowsky : “We're an idealistic and optimistic company and for the first decade we really focused on all the good connecting people brings” - Zuck But in the past, “We didn't take a broad enough view of what our responsibility is...It was my mistake.” Geoffrey A. Fowler / @geoffreyfowler : - Cambridge Analytica had Facebook data on 87 million people, mostly in the U.S. - 139 million Americans voted in 2016 https://twitter.com/... Harry McCracken / @harrymccracken : What if Facebook tried to make less money? Would that put society at less risk? Zuckerberg: “People tell us if they're going to see ads, they want the ads to be good.” That requires collecting data and targeting. Verne Kopytoff / @vkopytoff : Facebook on privacy: March 21: We must protect user data or '"we don't deserve to serve you" April 4: “we believe most people on Facebook could have had their public profile scraped” James Titcomb / @jamestitcomb : Er talk about burying the lede. At the bottom of this long FB post - “In total, we believe the Facebook information of up to 87 million people — mostly in the US — may have been improperly shared with Cambridge Analytica.” http://newsroom.fb.com/... Shira Ovide / @shiraovide : So, I guess only irresponsible Facebook will have unfettered access to information from Facebook users, and not irresponsible third parties? https://newsroom.fb.com/... See also Mediagazer
Context & Ripple Effects
The number keeps climbing. Two weeks after the story broke, Facebook has nearly doubled its own estimate of how many people Cambridge Analytica improperly obtained data on — from the originally reported ~50M to as many as 87M, mostly in the US. That revision lands while two former FTC officials argue Facebook may have violated its 2011 privacy consent decree and US and UK politicians are demanding answers from Zuckerberg personally.
It also complicates the company's defense. Zuckerberg has maintained Facebook was unaware of widespread developer misuse, a framing critics already found implausible; meanwhile Cambridge Analytica claims its voter models built from 2014 data require no further Facebook data, meaning even a full wipe of raw profiles would leave the derived targeting capability intact.
First-order effects
- Facebook's legal exposure under the 2011 FTC consent decree grows with each upward revision — an 87M figure strengthens the case that this was a systemic failure of developer oversight rather than a one-off app violation.
- Zuckerberg's 'we didn't know' position gets harder to hold: a scope this large, disclosed only after reporting, undercuts the claim that Facebook lacked awareness of widespread data misuse by outside developers.
Second-order effects
- Cambridge Analytica's defense that it no longer needs Facebook data becomes a liability rather than an escape hatch — if models trained on the harvested profiles persist, deleting raw data does not end the harm, keeping pressure on the stalled forensics audit that was halted at the UK ICO's request.
- Every other major platform with a third-party app ecosystem now faces the same question about historical data access, forcing audits and tightened developer permissions across the industry.
Third-order effects
- If the pattern holds — estimates revised upward, defenses narrowing to 'the models survive the deletion' — regulation will target not just data collection but retention and model-training rights over user data, a structural shift in what platforms can promise to delete.
- The escalating numbers ahead of Zuckerberg's congressional appearance signal a new enforcement posture where consent decrees become the primary lever for policing platform data practices, with per-violation liability scaled to affected users.
The trend: Platform data scandals are entering an escalation phase where each disclosure begets a larger revised estimate, pushing regulators from policing collection toward policing retention and derivative models.