On 17 March 2018, the New York Times and the London Observer broke the story that the British political consulting company Cambridge Analytica had harvested the data of tens of millions of Facebook users without their knowledge or consent.
How did it happen? In 2014, Cambridge University psychologist Aleksandr Kogan had created a personality test fielded in the form of a Facebook app, called This is Your Digital Life. Only 305,000 people had downloaded the app but, once installed, it hoovered up reams of information about people’s Facebook friends. Even people who had never downloaded the app were not safe. If they had a Facebook friend with the app, their data went straight to Kogan
Thanks to the network effects of Facebook friendship, Kogan’s app captured the personal data of almost 90 million users.
The leak revealed the magic behind otherwise mediocre apps like Kogan’s personality quiz. Facebook had been collecting jaw-drop-ping amounts of data on its users, and the company made that data available to app developers like Kogan. This information was of enormous value to anyone in advertising who wanted to target their message precisely.
Targeted advertising enables advertisers to deliver their messages straight to the people who will be most receptive, or vulnerable to, the pitch. Big pharma companies marketing weight-loss drugs might target those who have searched for diets online and who have a credit card history of ordering ice cream sundaes, for exam-ple. It’s effective, but creepy.
Ian Bogost is a professor and video game designer who also writes for the Atlantic magazine. In 2010, Bogost developed a popular Facebook app called Cow Clicker. When the Cambridge Analytica scandal broke in 2018, he observed that ‘if you played Cow Clicker, even just once, I got enough of your personal data that, for years, I could have assembled a reasonably sophisticated profile of your interests and behaviour.’
Political campaigns and the companies that work for them covet this sort of detailed knowledge of people’s data. It was why Cambridge Analytica acquired Kogan’s data. Cambridge Analytica boasted that it could use the information gleaned from Facebook to allow political campaigns to manipulate the behaviour of voters. Company executives claimed to have been behind Donald Trump’s ‘Defeat crooked Hillary’ campaign message in 2016. CEO Alexander Nix was caught on tape saying, ‘We just put information into the bloodstream of the internet and then watch it grow … And so this stuff infiltrates the online community, but with no branding, so it’s unattributable, untrackable.’
Nix was a better salesman than he was a political campaigner, and there is no evidence his company affected any election outcomes. But Trump’s election victory in 2016 nevertheless gave the Cambridge Analytica story an overtly political angle. Many people don’t care about the privacy of their data in the abstract. But the 2018 revelations linked Facebook’s reckless disregard for consumer privacy directly to a company specializing in the dark arts of micro-targeting voters in close elections. It created a scandal that ricocheted around the world’s democracies, many of whose citizens’ data had been leaked in the affair. But in no country was the effect more explosive than in the United States, home to both Facebook and the largest number of people affected by the data leak.
Public trust in Facebook collapsed after the Cambridge Analytica scandal broke. In June 2018 – three months after the outbreak of the scandal – Georgetown University commissioned the American Institutional Confidence Poll to measure the state of American public opinion. The poll asked 5,400 Americans about their confidence in 20 major institutions, including the technology companies Amazon, Google and Facebook. Amazon and Google were near the top of the list, meaning many people trusted them. The only institution that outscored them in the trust of the American public was the military.
Facebook sat third from bottom – meaning most people distrusted it. It was less trusted than banks and organized labour. In the court of public opinion only political parties and Congress fared worse. By the time the poll was repeated in 2021, Facebook had fallen below even those two reviled institutions. A separate survey that month reported that Americans believed that technology companies should be regulated more heavily.
It is tempting to attribute the public’s disapproval of Facebook directly to the Cambridge Analytica scandal. But as political scientists, we know that correlation is not causation. Just because confidence in Facebook fell far below that of Amazon and Google, and then below even that of Congress, does not mean the Cambridge Analytica scandal caused that drop-off. Furthermore, low confidence is not the same as demand to regulate the excesses of tech companies.
To test that connection between scandal and regulatory politics, we returned to a survey experiment. In Chapter 3, if you remember, we showed how survey experiments work in the same way as a medical drug trial. We start by inviting a representative sample of the population. We then randomly assign those who accept to two groups, each assigned to read one of two different news articles. One reads an article with no content related to a tech scandal. This is the placebo group. The second reads an article about the Cambridge Analytica scandal. Any difference between the groups in their appetite to regulate technology companies can be attributed to reading about the scandal.
In 2023, five years after the scandal broke out, we conducted a large survey experiment to see whether media coverage of it would affect public opinion. We blended coverage from the New York Times and the Observer/Guardian – the two newspapers that broke the original Cambridge Analytica story – into a summary article about Facebook’s role in the scandal and the subsequent legal chal-lenges. We compared their views with those of the second group, whose members had read an unrelated article about Office Depot, a well-known but innocuous company.
What we found was that reading a single news article about the Cambridge Analytica scandal – five years after the scandal actually became known to the public – increased the demand of Americans for stricter regulation of tech companies. It also increased their perception of the importance of regulating technology. Social science and common sense thus converge on the finding that the Cambridge Analytica scandal made people want tighter regulation of the tech sector.
Alastair Mactaggart and his neighbour Rick Arney didn’t need our survey experiment to understand the effect of the Cambridge Analytica scandal on public opinion. When we left them earlier in this chapter, they had just discovered that the largest tech compa-nies were pouring money into an advertising campaign to defeat their ballot initiative on privacy.
Mactaggart was funding the campaign on his own, having little success raising outside money. Meanwhile, he needed to pay canvassers to go out and collect signatures to secure enough
signatures to get his measure on the ballot. Mactaggart is a multi-millionaire, so he had the resources to hire people to help him collect signatures. But even multimillionaires wince at the amount of money it takes to run an activist campaign without deep-pock-eted financial backers. ‘I am writing hundreds of thousand-dollar checks, every two weeks’, said Mactaggart, for whom the prospect of failure was ever-present. ‘Still to this day, I’ll never forget the stupid hold music on Wells Fargo, where you had to type in your PIN. And you had to repeat that phrase, “My voice gives me access to proceed.” I almost felt like throwing up every time I dialled in to send the money, because it was just terrible. I was terrified.’
Then the Cambridge Analytica scandal hit.
‘Hey, I caught a break here – ray of hope’, Mactaggart reflected. ‘Smart people thought, “Oh, there’s an issue here now.” And it helped in the Legislature because people started paying attention to it.’
For Arney, who was still trying to secure enough signatures to get the initiative on the ballot, the scandal presented an unanticipated gift. Canvassers no longer had to explain why a long-shot initiative measure on privacy was worth supporting. In Arney’s words, ‘after the Cambridge Analytica scandal, all we had to do was say “data privacy”.’18
Ultimately the group collected 629,000 signatures – far more than it needed – which meant the measure would be put to a vote of all Californians in the autumn of 2018.19 Only Mactaggart could withdraw it. With the popular wind in his sails, he had become a kingmaker. California lawmakers scurried to cut a deal with him.
At about the time the Cambridge Analytica scandal broke, Mactaggart had met Bob Hertzberg, a state senator who had previously been a speaker of the California Assembly. Mactaggart was not overwhelmed at first. ‘I thought all of his proposals were just hot air, because he kept on being like, “We’ll take this off the ballot. You can get your signatures. There’s a provision where you can negotiate with us. We’ll pass the law.”’ Battle-hardened by several months of campaigning, Mactaggart was sceptical about the prospects of the captured California legislature passing a privacy law with teeth. But he also doubted he had the resources to win a campaign against the deep pockets of Google and Facebook. ‘At the time, I still thought it was like, a no per cent chance that we’re going to get this thing done with the Legislature. If I could avoid the fight, that would be great. And by this point, I was pretty sure I was going to lose, just because I’m having zero success raising money.’
With both sides worried they might lose, the haggling began. Mactaggart gave the Legislature a deadline of 28 June, the last possible day on which he could withdraw his initiative from the ballot for November, to pass its law.
During the bargaining, Mactaggart got most of what he wanted from the lawmakers in the California State Assembly. But he did concede one important point from his initiative to the tech lobbyists. Consumers would not be able to take companies to court directly for breaches of their privacy. This ability to sue was called the private right of action. Big Tech hated it, and now it was gone. Mactaggart the businessman thought that was a deal worth making. ‘We went back and forth. In the course of that, it transpired that they were willing to give me “See your actual data” and “Delete your data”. And in return for that they wanted [me] to give up the private right of action. So I was like, “That is a pretty good trade, frankly.”’ Mactaggart had only included the private right of action on the suggestion of his attorney, who helped him draft the initiative. ‘I really didn’t think about it very much. I’m really not a lawsuit guy. I’m a business guy. So viscerally I didn’t love it. But then I thought, “Hey, these are big companies. And the average person is not going to have the money to sue them. So, sure, throw one in.”’
That decision had given him a valuable bargaining chip with the tech companies, who conceded on other privacy issues to get rid of a sweeping private right of action. With that important change, the bill – the California Consumer Privacy Act (CCPA) – passed the legislature unanimously on 28 June, Mactaggart’s deadline. California immediately became the national leader in privacy regulation in the US.
The story did not end there, however. In the heated negotiations over the final bill, the lobbyists for the big tech companies had inserted a little-remarked amendment to the law. They exempted ‘service providers’ from the restrictions on using individual data. Once the law passed, Facebook and the other large tech companies immediately claimed that the ‘service’ they were providing their paying customers was microtargeted advertisements. They were therefore not constrained by the law.
‘I caught a bunch of the things they were trying to do, but I didn’t catch that one’, conceded Mactaggart. The tech companies similarly took advantage of the law’s prohibition on the ‘sale’ of personal data by saying that websites people visited in a Google search were simply ‘sharing’ the data with Google, not ‘selling’ the data to them.
Moreover, because the measure passed as a law and not an initiative, it could be changed by amendment. That was another thing that Alastair Mactaggart had not seen coming. ‘Oh, now I understand why they let me do this’, he recalled, speaking of the tech companies and the politicians that did their bidding in the California Assembly. ‘Because they introduced like thirty-seven amendments that would have just crushed the thing. And I’m sitting there fighting, fighting, fighting, fighting. I spent so much time in Sacramento, so much time in committees.’
Bob Hertzberg was now the majority leader of the state senate, so Mactaggart had powerful allies. But the tech companies were wearing Mactaggart down. ‘I was able to stop a bunch of bad laws in 2019, but it became really apparent to me: “I am screwed. I can’t do this. I can’t keep this pace up”.’
Most of the time, when big company lobbyists render a law toothless by inserting loopholes and amendments, they win. The legislature and the public shift their attention to other subjects, and corporations easily bypass the restrictions in the watered-down law. This is why big companies pay big bucks for lobbying.
That indeed was Mactaggart’s view of how he got his law passed in 2018. ‘My ex-post view of things is that in 2018, Big Tech looked at this [CCPA] and thought, “OK, we’re getting rid of the private right of action. We don’t have to spend a hundred million dollars, we don’t have the reputational hit of spending against privacy post-Cambridge Analytica. And you know what? We’ll clean this up next year, because we own Sacramento.”’
But Facebook and Google and their allies had misjudged the depth of the public’s anger after the Cambridge Analytica scandal. And they had underestimated the determination of Alastair Mactaggart. More than half a million people had signed the petition for Mactaggart’s original ballot initiative, and many of them were still mad.
Mactaggart sat down and wrote a new ballot measure – this one was 52 pages long – to overcome the shortcomings of the CCPA. The new ballot measure was known as Proposition 24, the California Privacy Rights Act (CPRA). It went to the voters in November 2020.
The CPRA fixed three weaknesses of the previous law: loopholes, enforcement and vulnerability to being diluted by subsequent lobbying. It closed the two loopholes on sales and service providers, clarifying that the ban on selling data applied to the ‘sharing’ of data between companies, and that ‘service providers’ were subject to the law’s strictures on treatment of personal data. It also expanded the limited right of private action of the CCPA.
In addition, the 2020 measure created a new regulatory body charged with enforcing the law, the California Privacy Protection Agency (CPPA). And finally, in a move intended to send shivers down the spines of lobbyists everywhere, the CPRA included a measure that the initiative could not be weakened by amendment. Its measures to secure digital privacy could only be strengthened. Proposition 24 passed easily on 3 November 2020, with 56 per cent of Californians voting in favour. The CPRA took effect at the beginning of 2023, giving consumers in California levels of protection roughly equivalent to those afforded by the GDPR in Europe.
The Cambridge Analytica scandal had resulted in a sustained collapse of public confidence in big technology companies in the US.24 The titanic tech companies thought they would simply crush the initiative of Mactaggart and his band of activists. But they ran straight into the iceberg of a distrustful public, enabling Mactaggart to get the CCPA passed in 2018. When he realized his law would be amended to death, he went back to the people of California with another measure in 2020. And he won a convincing victory against the billionaires of Silicon Valley.
From Billionaire Backlash: The Age of Corporate Scandal and How it Could Save Democracy. Used with permission of Bloomsbury Publishing Plc.
