UNITED STATES OF AMERICA

BEFORE THE FEDERAL TRADE COMMISSION

COMMISSIONERS: Joseph J. Simons, Chairman 

 Noah Joshua Phillips 

 Rohit Chopra

 Rebecca Kelly Slaughter

 Christine S. Wilson

 In the Matter of

 DOCKET NO. 9383 

Cambridge Analytica, LLC, 

a corporation. 

FINAL ORDER 

The Commission has heard this matter upon Complaint Counsel’s Motion for Summary 

Decision, which has not been opposed by Respondent. For the reasons stated in the 

accompanying Opinion of the Commission, the Commission has determined to GRANT the 

Motion for Summary Decision. Accordingly, 

IT IS ORDERED that the following Order to cease and desist be, and hereby is, entered: 

ORDER

DEFINITIONS

For purposes of this Order, the following definitions shall apply: 

A. “Covered Information” means the following information from or about an 

individual consumer including: (a) a first and last name; (b) a physical address or 

precise geolocation; (c) an email address or other online contact information, such 

as an instant messaging user identifier or a screen name; (d) a telephone number; 

(e) a Social Security number; (f) a driver’s license or other government-issued 

identification number; (g) a financial institution account number; (h) credit or 

debit card information; (i) a persistent identifier, such as a customer number held 

in a “cookie,” a mobile device ID, or processor serial number; (j) data fields that 

can be accessed or collected through Facebook from or about Facebook Users or 

their Friends (e.g., “likes,” “hometowns,” “birthdates,” “photos,” “gender,” 

“educational information,” “religious or political views,” or “marital” or other 

“relationship” status); (k) information that is created, maintained, or accessed by 

the consumer (e.g., “messages”); (l) any data regarding a consumer’s activities 
Public

2 

online (e.g., searches conducted, web pages visited, or content viewed); or (m) 

any user credentials, such as a username and password.

B. “Facebook” means Facebook, Inc., its wholly or partially owned subsidiaries, 

unincorporated divisions, joint ventures, operations under assumed names, and 

affiliates, and all directors, officers, members, employees, agents, consultants, and 

other persons working for or on behalf of the foregoing. 

C. “GSRApp” means all iterations of the GSRApp Facebook application that first 

began operating on the Facebook platform in May 2014. 

D. “Respondent” means Cambridge Analytica, LLC, and its successors and assigns.

I.

PROHIBITION AGAINST MISREPRESENTATIONS ABOUT COVERED 

INFORMATION

IT IS ORDERED that Respondent and Respondent’s officers, agents, employees, and 

attorneys, and all other persons in active concert or participation with any of them, who receive 

actual notice of this Order, whether acting directly or indirectly, in connection with any product 

or service must not misrepresent in any manner, expressly or by implication, the extent to which 

they protect the privacy and confidentiality of any Covered Information, including: 

A. The extent to which they collect, use, share, or sell any Covered Information; and 

B. The purposes for which they collect, use, share, or sell any Covered Information. 

II.

PROHIBITION AGAINST MISREPRESENTATIONS ABOUT PARTICIPATING IN 

PRIVACY OR SECURITY PROGRAMS

IT IS FURTHER ORDERED that Respondent and Respondent’s officers, agents, 

employees, and attorneys, and all other persons in active concert or participation with any of 

them, who receive actual notice of this Order, whether acting directly or indirectly, in connection 

with any product or service must not misrepresent in any manner, expressly or by implication, 

the extent to which Respondent is a member of, adheres to, complies with, is certified by, is 

endorsed by, or otherwise participates in any privacy or security program sponsored by a 

government or any self-regulatory or standard-setting organization, including but not limited to 

the EU-U.S. Privacy Shield framework, the Swiss-U.S. Privacy Shield framework, and the 

APEC Cross-Border Privacy Rules.
Public

3 

III.

REQUIREMENT TO MEET CONTINUING OBLIGATIONS UNDER PRIVACY 

SHIELD

IT IS FURTHER ORDERED that Respondent and Respondent’s officers, agents, 

employees, and attorneys, and all other persons in active concert or participation with any of 

them, who receive actual notice of this Order, whether acting directly or indirectly, in connection 

with any product or service shall not possess or control personal information from European 

Union residents that Respondent received while it participated in the EU-U.S. Privacy Shield 

framework, unless Respondent: 

A. Affirms to the Department of Commerce, within ten (10) days after the effective 

date of this Order and on an annual basis thereafter for as long as it retains such 

information, that it will:

1. Continue to apply the EU-U.S. Privacy Shield framework principles to the 

personal information it received while it participated in the Privacy Shield; 

or 

2. Protect the information by another means authorized under EU (for the 

EU-U.S. Privacy Shield framework) or Swiss (for the Swiss-U.S. Privacy 

Shield framework) law, including by using a binding corporate rule or a 

contract that fully reflects the requirements of the relevant standard 

contractual clauses adopted by the European Commission. 

For purposes of this subprovision, Respondent does not possess or control 

personal information in the possession of a government regulatory or law 

enforcement agency, including the United Kingdom’s Information 

Commissioner’s Office; or

B. Returns or deletes the information within ten (10) days after the effective date of 

this Order; or if, as of the effective date of this Order, the information is in the 

possession of a government regulatory or law enforcement agency, including the 

United Kingdom’s Information Commissioner’s Office, returns or deletes the 

information within ten (10) days after the information is returned to Respondent. 

IV.

REQUIRED DELETION OF DATA

IT IS FURTHER ORDERED that Respondent, and Respondent’s officers, agents, 

employees, and attorneys, and all other persons in active concert or participation with any of 

them, who receive actual notice of this Order, whether acting directly or indirectly, must: 

A. Provide, within ten (10) days from the effective date of this Order, the 

Commission with a written statement, sworn under penalty of perjury, providing 

the name, address, and phone number for each person with whom Respondent 

shared any Covered Information collected from consumers through GSRApp, and 
Public

4 

any information that originated, in whole or in part, from this Covered 

Information; 

B. Delete or destroy all Covered Information collected from consumers through 

GSRApp, and any information or work product, including any algorithms or 

equations, that originated, in whole or in part, from this Covered Information. 

Such deletion or destruction must occur within ten (10) days of the effective date 

of this Order, or if such information is in the possession of a government 

regulatory or law enforcement agency, including the United Kingdom’s 

Information Commissioner’s Office, as of the effective date of this Order, within 

ten (10) days after the Covered Information is returned to Respondent. Provided, 

however, that such Covered Information, or any information that originated in 

whole or in part from such Covered Information, need not be deleted or destroyed 

for so long as requested by a government agency or otherwise required by 

regulation, court order or other legal obligation; and 

C. Provide a written statement to the Commission, sworn under penalty of perjury, 

confirming the foregoing. This statement must be provided: (1) within thirty (30) 

days after the effective date of the Order; or, if applicable, (2) within thirty (30) 

days after the Covered Information is returned to Respondent from a government 

regulatory or law enforcement agency, or within thirty (30) days after any legal 

obligation to preserve the Covered Information has ended. 

V.

DUTY TO PROTECT COVERED INFORMATION

IT IS FURTHER ORDERED that Respondent, and Respondent’s officers, agents, 

employees, and attorneys, and all other persons in active concert or participation with any of 

them, who receive actual notice of this Order, whether acting directly or indirectly, are 

permanently restrained and enjoined from disclosing, using, selling, or receiving any benefit 

from Covered Information or any information that originated, in whole or in part, from this 

Covered Information.

VI.

ACCESS TO CORPORATE DOCUMENTS AND DATA

IT IS FURTHER ORDERED that Respondent shall make available to the Commission, 

for inventory and copying, all correspondence, email, financial data including tax returns, and 

any other documents, computer equipment, and electronically stored information, in 

Respondent’s possession, custody, or control, that contain information about Respondent’s role 

and assets at the Commission’s expense. The Commission shall return each item produced for 

inventory or copying to Respondent within ten (10) business days from the date and time of 

Respondent’s delivery of each such item.

IT IS FURTHER ORDERED that Respondent, to the extent it has possession, custody, 

or control of computer equipment or electronically stored information described above, shall 

provide the Commission with any necessary means of access to the computer equipment or 
Public

5 

electronically stored information, including, but not limited to, computer access codes and 

passwords. 

IT IS FURTHER ORDERED that Respondent shall provide notice to the Commission 

of the proposed abandonment of any corporate books or records of Respondent. 

VII.

ORDER EFFECTIVE DATES

IT IS FURTHER ORDERED that the final and effective date of this Order is the 60th 

day after this Order is served. This Order will terminate on November 25, 2039, or twenty (20) 

years from the most recent date that the United States or the Commission files a complaint (with 

or without an accompanying settlement) in federal court alleging any violation of this Order, 

whichever comes later; provided, however, that the filing of such a complaint will not affect the 

duration of: 

A. Any Provision in this Order that terminates in less than twenty (20) years; 

B. This Order’s application to any Respondent that is not named as a defendant in 

such complaint; and 

C. This Order if such complaint is filed after the Order has terminated pursuant to 

this Provision. 

Provided, further, that if such complaint is dismissed or a federal court rules that the Respondent 

did not violate any Provision of the Order, and the dismissal or ruling is either not appealed or 

upheld on appeal, then the Order will terminate according to this Provision as though the 

complaint had never been filed, except that the Order will not terminate between the date such 

complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date 

such dismissal or ruling is upheld on appeal. 

By the Commission.

April J. Tabor 

Acting Secretary

SEAL:

ISSUED: November 25, 2019