Analysis of Proposed Consent Order to Aid Public Comment

In the Matter of Aleksandr Kogan and Alexander Nix, individuals

File Nos. 182 3106 and 182 3107

The Federal Trade Commission (“Commission”) has accepted, subject to final 

approval, two agreements containing consent orders from Aleksandr Kogan and 

Alexander Nix, individuals.

The proposed consent orders have been placed on the public record for thirty (30) 

days for receipt of comments by interested persons. Comments received during this 

period will become part of the public record. After thirty (30) days, the Commission will 

again review the agreements and the comments received, and will decide whether it 

should withdraw from the agreements and take appropriate action or make final the 

agreements’ proposed orders.

Aleksandr Kogan, until September 2018, was a Senior Research Associate and 

Lecturer at the Department of Psychology at the University of Cambridge in the United 

Kingdom. Kogan was also the developer of a Facebook application called the GSRApp, 

sometimes publicly referred to as the “thisisyourdigitallife” app. 

Alexander Nix, until April 2018, was the Chief Executive Officer of Cambridge 

Analytica LLC and the head of SCL Elections Ltd.

The Commission’s proposed complaint alleges that Kogan, together with the data 

analytics company, Cambridge Analytica, LLC, and its Chief Executive Officer, 

Alexander Nix, used the GSRApp to harvest certain Facebook user profile data from 

approximately 250,000–270,000 Facebook users who directly interacted with the app

(“App Users”), as well as 50–65 million of the “friends” in those users’ Facebook social 

network. The proposed complaint alleges that Respondents obtained the App Users’ 

consent to collect their Facebook profile data through false and deceptive means. 

The Commission’s proposed complaint alleges a violation of Section 5(a) of the 

Federal Trade Commission Act, specifically that Respondents’ representation to App 

Users that it would not “download [their] name or any other identifiable information” 

was deceptive because the GSRApp, in fact, collected identifiable information from these 

users, including their Facebook User ID.1

 1 The Commission also issued an administrative complaint against Cambridge Analytica alleging a similar 

deception count as well as two additional counts related to its participation in Privacy Shield, a framework 

that allows companies to transfer personal data lawfully from the European Union to the United States. 

The complaint alleges that representations on Cambridge Analytica’s website that Cambridge Analytica 

participated in Privacy Shield after May 2018 were deceptive because the company did not take the steps 

necessary to renew Cambridge Analytica’s certification when it expired in May 2018. The complaint also 

alleges that representations on Cambridge Analytica’s website that Cambridge Analytica adheres to Privacy 

Shield’s principles were deceptive because Cambridge Analytica failed to comply with Privacy Shield’s 

requirement to affirm to the Commerce Department that the company would continue to apply the 

principles to personal information that it received during the time it participated in the program.
The proposed consent orders contain injunctive provisions addressing Kogan’s 

and Nix’s alleged unlawful conduct. Part I of the proposed consent orders prohibits 

Kogan and Nix from making false or deceptive statements regarding the extent to which 

they protect the privacy and confidentiality of Covered Information as defined in the 

proposed consent orders, including:

A. The extent to which they collect, use, share, or sell any Covered Information; 

and

B. The purposes for which they collect, use, share, or sell any Covered 

Information. 

Part II of the proposed consent orders relates to the deletion and destruction of 

Covered Information collected through the GSRApp, and any information or work 

product, including any algorithms, derived from such Covered Information, and requires

Kogan and Nix to: 

A. Provide a written statement, sworn under penalty of perjury, with the name, 

address, and phone number for each person with whom they shared any 

Covered Information collected from consumers through GSRApp, and any 

information or work product that originated, in whole or in part, from this 

Covered Information; and

B. Delete or destroy all Covered Information collected from consumers though 

the GSRApp, and any information or work product, including any algorithms 

or equations, that originated, in whole or in part, from this Covered 

Information, which destruction must generally occur within ten (10) days 

from the effective date of the proposed orders. Kogan and Nix must then 

provide a statement, sworn under penalty of perjury, confirming that the data 

has been destroyed or deleted.

Parts III through VII of the proposed consent orders are reporting and compliance 

provisions, which include recordkeeping requirements and provisions requiring 

Respondents to provide information or documents necessary for the Commission to 

monitor compliance. The proposed consent orders will be in effect for twenty (20) years. 

The purpose of this analysis is to aid public comment on the proposed orders. It 

is not intended to constitute an official interpretation of the proposed complaint or 

proposed orders, or to modify in any way the proposed orders’ terms.