Last updated on November 1st, 2026 at 09:53 am
Christopher Wylie and Cambridge Analytica became shorthand for everything people feared about social media after March 2018, and the honest answer to “what really happened” is messier than the headlines made it sound. Wylie, a Canadian data scientist and former research director at the British firm, told the Observer and Channel 4 News that more than 50 million Facebook profiles had been harvested.
Facebook later raised the figure to 87 million, paid the US Federal Trade Commission a record $5 billion and later agreed to a $725 million class action settlement.
Yet the part of Wylie’s story that aged best was not the talk of psychological mind control. It was his warning about how loosely Facebook once guarded your data.
Below, I separate what was proven from what was oversold, put a source on every claim, and ask what has actually changed for you.
Christopher Wylie Exposed Cambridge Analytica at a glance
- Who: Christopher Wylie, a Canadian data scientist who helped build Cambridge Analytica’s data operation and went public on 17 March 2018.
- What happened: A personality quiz app was installed by about 270,000 people, yet it also collected data on their friends. Facebook’s own estimate reached 87 million accounts.
- What it cost Facebook: A £500,000 UK fine in 2018, a $5 billion FTC penalty and a $100 million SEC settlement in 2019, and a $725 million class action finalised in 2025.
- The catch: In 2020 the UK regulator said Cambridge Analytica’s methods were exaggerated and built from off-the-shelf tools, and found no evidence the firm was involved in the EU referendum.
- My reading: The data practices were real and expensive. The “mind control” story was oversold. The business model that made both possible is still here.
Who is Christopher Wylie, and why did a data scientist take on Facebook?
Wylie is a Canadian from Victoria, British Columbia. CBC’s profile reports that he quit school at 16 without graduating, and he was 28 when he went public. Press reports at the time said he came up with the idea behind Cambridge Analytica at 24. He left the firm in 2014, and Facebook later described him as working for Eunoia Technologies, a company he set up on his own after leaving in late 2014.
I find that résumé more interesting than the lone hero story. Wylie was not an outsider who stumbled on wrongdoing. He helped build the machine, and he said so. “I do feel responsible for it and it’s something that I regret,” he told the Observer in a video interview. That mix of insider knowledge and visible guilt made him believable to some listeners and suspect to others, and I think both reactions were fair.
How did Cambridge Analytica get the Facebook data?
The data came through a quiz. Aleksandr Kogan, a Cambridge University academic, built an app called “thisisyourdigitallife” through his company Global Science Research. It offered personality predictions in exchange for access to a user’s Facebook data. Only about 270,000 people installed it. However, under Facebook’s rules at the time, the app could also pull information about the friends of each person who installed it, and that is how a few hundred thousand installs became tens of millions of profiles.
Do the arithmetic and the scale is hard to ignore. Eighty-seven million accounts divided by 270,000 installs is roughly 320 people exposed for every single person who tapped “install”. Your friends never saw a consent screen, and neither did their friends.
The timeline matters. The Observer saw a contract dated 4 June 2014 in which SCL, Cambridge Analytica’s affiliate, hired Kogan’s company for a project built on harvesting and processing Facebook data. Cambridge Analytica spent nearly $1 million on the collection, and it produced more than 50 million profiles that could be matched to electoral rolls. Wylie told the Observer’s reporter his records showed the harvest ran between June and August 2014.
That was also the moment Facebook was winding down the loophole. At its 2014 developer conference it announced it would close the friends data API within a year, and the shutdown arrived on 30 April 2015. In other words, the specific hole had already been plugged by the time the story broke. The damage, however, was already done, and the data was out.
What did Facebook know, and when?
Facebook had known about the Kogan and Cambridge Analytica data since 2015, when it demanded that both delete it. The UK Information Commissioner’s Office later found that after the misuse was discovered in December 2015, Facebook did not do enough to make sure those holding the data had deleted it. Wylie also gave authorities a letter from Facebook’s lawyers dated August 2016 asking him to destroy any GSR data he held.
Mark Zuckerberg conceded the point to senators in April 2018. Accepting Cambridge Analytica’s word that the data was gone was clearly a mistake, he said. Facebook considered it a closed case at the time.
Kogan told a different story about who was to blame. He argued that his terms of service said he could transfer and sell the data and that nobody at Facebook objected. He also called harvesting friends’ data a “core feature” of the platform for years. Facebook, for its part, rejected the word “breach”, saying the people who signed up to the app had consented. That defence skips the obvious problem: the friends had not.
What did Wylie reveal in March 2018, and who heard it first?
The story broke on 17 March 2018 through the Observer and the Guardian, with the New York Times and Channel 4 News running parallel reports. Wylie handed reporters a dossier of emails, invoices, contracts and bank transfers. “We exploited Facebook to harvest millions of profiles,” he told the Observer, according to the Guardian’s account.
The timing carried its own irony. The day before publication, Facebook announced it was suspending Cambridge Analytica and Kogan, and it suspended Wylie as well, despite his role as the source. His accounts on Facebook and Instagram were blocked. The Guardian also reported that Facebook’s outside lawyers warned the Observer it was making “false and defamatory” allegations. Cambridge Analytica threatened to sue the Guardian too.
Wylie then took the story to lawmakers. On 27 March 2018 he told the UK parliament’s media committee that he believed AggregateIQ, a Canadian firm, had drawn on Cambridge Analytica’s databases for its Brexit work, and he described himself as “incredibly remorseful”. What he told lawmakers ran directly against what his former boss, Alexander Nix, had told the same committee. On 16 May 2018 he testified to the US Senate Judiciary Committee, where he said the company set out to trigger paranoia and racial biases.
Channel 4 added a second blow. Its filming of Cambridge Analytica executives, as NBC News later summarised, caught them talking about sex workers, bribes, former spies and fake news as ways to help clients win elections abroad. Cambridge Analytica announced on 2 May 2018 that it was closing and starting insolvency proceedings, after losing clients and facing mounting legal fees. TechRadar noted at the time that there were indications the company had been rebranded as Emerdata, though that remained an indication, not a finding.
Did Wylie exaggerate? What the UK regulator found later
Partly, and this is the section most retellings skip. In October 2020 the UK Information Commissioner, Elizabeth Denham, wrote to a parliamentary committee to close the ICO’s investigation. Her letter said the firm’s models were exaggerated and likely inaccurate.
The company’s pitch about having over 5,000 data points on 230 million adult Americans may have been inflated, and its techniques were built from “off the shelf” tools.
Here the tension with Wylie shows. In 2018 he told the Guardian that the firm had created psychological profiles of 230 million Americans. The regulator, in contrast, treated that kind of claim as sales talk. On Brexit, Denham found no evidence that Cambridge Analytica was involved in the EU referendum, and she said its data was mostly about US voters. The New Statesman concluded that evidence had piled up against the claim that the company decisively swung the Trump or Brexit votes.
Nevertheless, the letter did not clear the company. Denham confirmed that SCL and Cambridge Analytica bought large volumes of commercial personal data and combined it with the Facebook-derived data from Kogan. She also reported evidence that the firm was drawing up plans to move its data offshore to avoid regulatory scrutiny before it collapsed. And she warned that the tools and techniques it claimed could tip elections are not going away.
Not everyone accepted the letter as the last word. Former MP Ian Lucas, who sat on the parliamentary sub-committee on disinformation, argued in Byline Times that it was limited in scope. The Spectator Australia, on the other side, ran a piece titled “The collapse of the Cambridge Analytica conspiracy theory”. Both camps read the same letter and drew opposite conclusions, which tells you how contested this story remains.
I read it as two scandals sharing one name. The first was about psychological wizardry, and it is the one the evidence supports least. The second was about a platform that handed third parties a back door to personal data, and then took the word of the people it had been handed to. That second scandal is the one that cost money, and in my view it is the one that matters.
How did Facebook respond, and what did it pay?
Facebook paid in apologies first and money later. The table below follows the main penalties.
| When | Who acted | What happened |
|---|---|---|
| 10 April 2018 | US Senate | Zuckerberg testified for nearly five hours and said “It was my mistake, and I’m sorry” |
| 25 October 2018 | UK Information Commissioner | £500,000 fine, the maximum under the older 1998 law |
| 24 July 2019 | US Federal Trade Commission | $5 billion penalty and tighter privacy oversight |
| 2019 | US Securities and Exchange Commission | $100 million settlement over claims Facebook misled investors |
| December 2022 | Users’ class action | $725 million settlement, with no admission of wrongdoing |
| 22 May 2025 | US federal court | Settlement finalised; payments began after a distribution order in August |
Adding the FTC, SEC and class action figures gives about $5.8 billion in US penalties and settlements. That total is my own arithmetic, not a figure any agency published.
Was $5 billion actually a punishment?
The FTC chairman at the time, Joe Simons, said neither the size of the penalty nor the sweeping conduct rules had a precedent at the commission. It was also the commission’s largest privacy penalty ever. The commission approved it by a 3 to 2 vote, with the two Democratic commissioners wanting a harsher result.
Context makes the number look different. According to CBS News, the fine equalled about a month of Facebook’s revenue. Senators Richard Blumenthal and Josh Hawley, from opposite parties, said it would be “a bargain” for the company. The Associated Press added that Facebook’s market value on the day of the settlement was roughly $40 billion above where it stood before the scandal. The commission also brought complaints against Cambridge Analytica, its former chief executive Alexander Nix and Kogan, and Nix and Kogan agreed to restrictions. Facebook’s own executives, by contrast, were not held personally accountable by the commission.
What did ordinary users receive?
Little, and late. Nearly 29 million claims were filed in the class action, and about 18 million were validated as of September 2023, according to Meta’s own 2024 filing as reported by CNN.
Roughly $540 million of the fund was set aside for approved claims. Spread across 18 million validated claims, that is about $30 a claim by my rough arithmetic, although the real payments varied because each person received one allocation point for every month they held a Facebook account between 2007 and 2022.
Payments only began in late summer 2025, eleven years after the harvest itself.
Did anything really change for users?
Some things did, but not the one that matters most. Facebook’s platform rules are tighter than they were in 2014. When it killed the friends API, it reviewed 5,000 of the top apps and added a login review for apps that wanted more than basic profile data. After the scandal, Zuckerberg told Congress that Facebook had about 15,000 people on security and content review and would pass 20,000 by the end of 2018.
The FTC settlement also forced Facebook to restructure its privacy programme and accept independent monitoring.
However, regulators kept finding fault with the way platforms ask for your consent. In January 2022, France’s data watchdog fined Google €150 million and Facebook €60 million because refusing cookies took several clicks, while accepting them took one. The watchdog’s reasoning, as reported at the time, was that rejecting should be as easy as accepting. That is the same weakness Wylie exposed, only dressed in a cookie banner.
My honest verdict is that Facebook closed one door and kept the house. The advertising model, in which your attention and data are the product, is untouched. A fine that equals a month of revenue does not make a company rethink that model. It makes the fine a cost of doing business.
If you want to understand why we keep handing over attention so easily, I wrote about why we become addicted to our phones and about social media, mental health and influencer culture.
Why does the Myanmar chapter belong in this story?
Because it shows the same pattern at a human cost. In March 2018, as the Cambridge Analytica story was breaking, UN investigators said Facebook had played a “determining role” in spreading hate against the Rohingya in Myanmar. The UN’s Myanmar investigator, Yanghee Lee, said “Everything is done through Facebook in Myanmar” and that it had been used to spread hate speech. More than 650,000 Rohingya had by then fled into Bangladesh since the military crackdown of August 2017, according to the same report.
Facebook replied that it does not allow hate speech or calls for violence and works to keep such content off. Myanmar’s government, for its part, rejected the UN reports and questioned the evidence. The mission had been barred from entering the country, so it worked from interviews with refugees and others in Bangladesh, Malaysia and Thailand.
For us in Bangladesh this is not distant. I wrote separately about the Rohingya crisis in Bangladesh, and the link between a platform’s scale and its responsibility is the thread that ties that crisis to Wylie’s warning. In both cases, a company built something huge, profited from attention, and treated the consequences as someone else’s department.
How does Wylie compare with other whistleblowers?
Wylie belongs to a line of people who exposed powerful institutions, but his case differs in an important way. W. Mark Felt, the FBI official, revealed himself as Watergate’s “Deep Throat” in a Vanity Fair article on 31 May 2005, at the age of 91. Edward Snowden, in June 2013, gave journalists documents showing that the NSA was collecting phone records of millions of Verizon customers under Section 215 of the Patriot Act.
In 2015 a federal appeals court ruled that the telephone metadata programme exceeded what Congress had authorised.
Felt and Snowden exposed governments. Wylie exposed a private company and a platform. That shift matters, because the usual tools for holding a government to account, such as courts, elections and oversight committees, fit awkwardly around a company whose customers are also its raw material.
The question of what makes someone speak up at all is one I took up in why good people stay silent.
Is there a newer Facebook whistleblower?
Yes. Sarah Wynn-Williams was Facebook’s director of global public policy from 2011 to 2017, and in March 2025 she published the memoir Careless People. She testified to a Senate Judiciary subcommittee on 9 April 2025, accusing Zuckerberg of shaping Meta’s policies to win favour with powerful governments, including China. Meta denies this and has said her testimony was “divorced from reality”.
Meta obtained an arbitration order that bars her from promoting the book, saying she broke the agreement she signed when she left, and in June 2026 she sued Meta, arguing that order is invalid. Those are her allegations and Meta’s responses, and a court has not ruled on them in anything I have read.
I notice a pattern across the two cases. Facebook suspended Wylie’s accounts and its lawyers warned of defamation claims. Meta, years later, went to arbitration against Wynn-Williams. Companies tend to answer whistleblowers with contracts and account bans before they answer with reform, and that is an observation about the pattern, not a verdict on any single dispute.
Closer to home, my piece on Shahidul Alam’s arrest looks at what happens to people who speak against the state in Bangladesh.
What is Wylie doing now?
He turned the story into a book and then into a broader warning. Mindf*ck: Cambridge Analytica and the Plot to Break America was published by Random House on 8 October 2019, and runs about 270 pages. Random House pitched it as an exposé and a warning about how online information can be used to manipulate people. NPR’s coverage that week said the book stops short of a full apology. I am describing it from publisher and press coverage here, and I am not quoting from the book.
Then, in April 2025, Wylie co-hosted Captured, a six-part Audible Original with Coda Story journalist Isobel Cockerell. Coda Story’s announcement framed it as an investigation into how Silicon Valley’s AI boom has become a quasi-religious movement, released seven years after Wylie’s first revelations. The move from social media data to artificial intelligence makes sense. The question is the same: who gets to shape what people see, believe and buy, and who is accountable when it goes wrong?
Five lessons I take from the Wylie story
1. Consent means little when your friend clicks for you. Roughly 320 people were exposed for every installer of one quiz app. Today the friends loophole is closed, but quizzes, games and “log in with” buttons still ask for more than they need. Before you tap one, ask what it wants and whether a stranger running a quiz really needs it.
2. A fine is a price until it changes behaviour. A $5 billion penalty that equals about a month of revenue teaches shareholders very little. When you judge whether a company has “paid for its mistakes”, look at what it was forced to change, not just the headline figure.
3. Doubt the whistleblower and the denial in equal measure. Facebook denied that this was a breach, and Wylie said the firm profiled 230 million Americans. The regulator’s later findings sit uncomfortably between them. Reading both sides, and reading the final regulator report rather than the first headline, is the only safe habit.
4. Data has a long tail. Facebook accepted a promise of deletion in 2015 and treated the matter as closed, and the fallout surfaced in 2018. Audit the apps and websites connected to your accounts once a year, remove the ones you no longer use, and where privacy law in your country allows it, ask companies to delete what they hold on you.
5. Regulators arrive late, so you have to act early. The harvest happened in 2014, the public heard about it in 2018, the FTC acted in 2019, and class action payments began in 2025. You cannot count on a rescue that arrives in time to help you. The only protection that works today is the one you set up today.
Keep reading on Sopranu: Black Mirror and the reality of AI and technology, 6 reasons robots and AI could threaten humanity’s future and AI deepfakes in schools.
Final thoughts
Christopher Wylie did something unusual. He helped build a data machine, then told the world how it worked, and he paid for it with his reputation, his Facebook access and years of being both praised and doubted. Some of what he claimed was later softened by the UK regulator.
Nevertheless, the core of his warning stood: a platform let outsiders pull personal data from people who never agreed to share it, and it was slow to act when it found out.
Facebook paid billions of dollars, yet on the day the FTC settlement landed the market still valued it higher than before the scandal. Sarah Wynn-Williams’ more recent allegations show that the argument over how the company treats its critics has not gone away.
For you, the useful takeaway is not outrage. It is habit. Check what you have connected to your accounts, treat quizzes and logins with suspicion, and remember that when a product is free, your data is usually doing the paying.
