Download the PDF version here.

Point of view on Cambridge Analytica scandal

Last week the Cambridge Analytica data scandal sparked a widespread privacy debate and put Facebook in the eye of a PR storm. Automatically this raises questions from an advertisers perspective. ‘Should we gear up for an audience decrease and reshuffle budget?’ Not really. No advertiser data has been affected and this is mainly an issue on user level, so Facebook already implemented actions to solidify the privacy of its users which is a benefit for advertisers too.

No data breach, no current topic

It was a former staff member who claimed that Cambridge Analytica mined personal information of approximately 50 million people in the US in 2014.

The data was strategically used through Facebook’s API during the 2016 presidential race (in support of its eventual winner).
Even though this story was previously published in 2017, it has recently become breaking news, although it quickly evolved into a rather one-dimensional discussion without proper fact checks.
For instance, it’s not correct to classify this as a data breach. While Cambridge Analytica did engage with an untrustworthy party, the information was gathered with consent of the users, and no systems were infiltrated nor any data such as mail addresses or phone numbers were stolen.

Immediate actions from Facebook

In response to the event, Facebook reacted with a set of ready-to-roll-out action points, In addition to the steps they made since 2014 in terms of GDPR’s governance.

  • Review the platform. All apps that had access to large amounts of information before the 2014 platform change will be investigated. A full audit will be conducted of any app with suspicious activity.
  • Tell people about data misuse. Extra transparency towards people affected by apps that have misused data.
  • Turn off access for unused apps: If someone hasn’t used an app within the last three months, the app’s access to user information will be disabled.
  • Restrict Facebook Login data: The data that an app can request will be limited to name, profile photo and email address. Requesting other information will require approval.
  • Encourage people to manage the apps they use: Facebook will make it significantly easier for users to manage apps and permissions.
  • Reward people who find vulnerabilities: Expansion of the Bug Bounty Program.

Implications for Facebook and Cambridge Analytica

From our point of view, implications vary for both actors.

  • Cambridge Analytica, the real guilty party in the story, will face prosecution and possibly a business shutdown, as the investigation on the British firm has begun.
  • Facebook suffered a blow to its reputation, and the recently announced ‘meaningful changes’ are just a prelude of many challenges. The platform shifted from content sharing to a valuable data hub, and it needs to act on that responsibility. The company will shift to red alert-mode, refocus profits and increase privacy-guarding manpower and R&D.

Limited impact for advertisers

Without minimizing the news, we dare to presume that the cluster of networks (Facebook, Instagram, Messenger, WhatsApp) are here to stay for quite some time.

It’s the principle solution to a global sentiment of FOMO. Most users built a Facebook presence and habit for years and they aren’t planning to give up on that.
This explains why the mediatized global call-to-action #DeleteFacebook, plunged immediately after one day (as this French market statistic indicates). A large decrease of audience size, which could affect business objectives, is unlikely to happen. Neither do we expect an advertiser backlash as Google experienced in 2017 when several brands suspended their ads due to YouTube’s selection of unwanted content placements.
In addition to the privacy improvements for users, Facebook announced that it’s no longer possible to estimate reach for Custom Audiences. While this will definitely up the game for media buyers to come up with versatile plans, there’s no need to panic. Facebook’s richness lies in its Core Audience attributes: behaviours, demographics and interests.

And what about the Facebook users?

The public opinion sure was sharp, but at some point people need to be (re-)educated on two levels. First of all, there’s a deeprooted culture of users that opt-in too easily without reading the fine print. Furthermore, the level of maintenance of applications that demand data and revoking permissions is rather low. The best things in life are free, but they are sometimes built on data and balancing is key, for all parties involved.


  • Cambridge Analytica misused data between 2014 and 2016 and faces severe consequences
  • The story is PR-driven and the focus on data privacy has been going on for much longer
  • Facebook won’t suffer a huge audience decrease but will need to invest heavily in data privacy and a transparent communication of scope and guidelines for users and advertisers
  • Points of improvement for users and advertisers have already been installed
  • The impact is rather low for advertisers who will benefit from the improved user journey and standard targeting options