1 

UNITED STATES OF AMERICA

BEFORE THE FEDERAL TRADE COMMISSION

COMMISSIONERS: Joseph J. Simons, Chairman 

Noah Joshua Phillips 

Rohit Chopra

Rebecca Kelly Slaughter 

Christine S. Wilson 

In the Matter of

DOCKET NO. 9383 

C ambridge Analytica, LLC, 

a corporation. 

OPINION OF THE COMMISSION

By Commissioner Noah Joshua Phillips, for the Commission: 

 Respondent Cambridge Analytica, LLC (“Cambridge Analytica”), a data analytics and 

consulting company, is charged with violating the Federal Trade Commission Act (“FTC Act”) 

by employing false and deceptive tactics to harvest personal information from tens of millions of 

Facebook users through a Facebook application called the “GSRApp,” also known as the 

“thisisyourdigitallife” app. As discussed below, Complaint Counsel move for summary decision. 

Because Cambridge Analytica has neither opposed Complaint Counsel’s motion nor answered 

the Commission’s administrative complaint, we decide this motion based on the undisputed facts 

as set forth in Complaint Counsel’s motion and alleged in the Complaint. 

The Complaint alleges that Cambridge Analytica, acting together with Alexander James 

Ashburner Nix (“Nix”), its Chief Executive Officer, and Aleksandr Kogan (“Kogan”), an 

applications developer who worked with the company, used the GSRApp to obtain Facebook 

user profile data from approximately 250,000–270,000 Facebook users who directly interacted 

with the app (“App Users”), as well as from 50–65 million of the “friends” in those users’ social 

networks. The Complaint charges Cambridge Analytica with obtaining App Users’ consent to 

collect their Facebook profile data by falsely representing that the GSRApp did not collect any 

personally identifiable information from Facebook users who interacted with it, such as their 

Facebook User ID. Cambridge Analytica then used the information collected through the 
2 

Facebook GRSApp for voter-profiling and targeted advertising purposes.1

 

 The Complaint also charges Cambridge Analytica with deceptive acts and practices 

related to its participation in the European Union-United States Privacy Shield framework

(“Privacy Shield”). The Complaint alleges that Cambridge Analytica, via its website, 

disseminated statements that falsely claimed it was a participant in Privacy Shield at a time when 

it had allowed its certification to lapse, and that it represented that it adhered to Privacy Shield 

principles despite failing to affirm to the U.S. Department of Commerce that it would continue to 

apply Privacy Shield protections to personal information collected while it participated in the 

program. 

 In May 2018, Cambridge Analytica filed for Chapter 7 bankruptcy, and those 

proceedings are ongoing. On July 24, 2019, the Commission issued its Complaint which, 

together with a notice order, was served on both Cambridge Analytica at its corporate 

headquarters and on its bankruptcy trustee. Cambridge Analytica failed to file an answer within 

the time required by the Commission’s Rules of Practice, i.e., by August 12, 2019. Under the 

Rules, Cambridge Analytica’s failure to file an answer is deemed a waiver of its right to appear 

and to contest the allegations in the Complaint. 16 C.F.R. § 3.12(c). Rule 3.12(c) authorizes the 

Commission, without further notice to the Respondent, “to find the facts to be as alleged in the 

complaint and to enter a final decision containing appropriate findings and conclusions and a final 

order disposing of the proceeding.” Id.

We now have before us Complaint Counsel’s Motion for Summary Decision.2

Cambridge Analytica did not file an opposition to the Motion when due under the Rules, i.e., by 

September 4, 2019.3 Complaint Counsel seek a determination that Cambridge Analytica made 

 

1 On July 24, 2019, the Commission accepted for public comment consent settlements with Respondents Nix and 

Kogan to address their respective roles in the deceptive acts and practices related to the Facebook GSRApp by 

requiring them, inter alia, to destroy information collected through the GSRApp, as well as algorithms derived from 

such information, and prohibiting them from misrepresenting the extent to which they protect the privacy and 

confidentiality of personally identifiable information that they collect, use, share, or sell about individual consumers 

in the future. Aleksandr Kogan and Alexander Nix, https://www.ftc.gov/enforcement/cases-proceedings/182-3106-

182-3107/aleksandr-kogan-alexander-nix. In a related enforcement action, the Commission settled charges that 

Facebook, Inc. violated its 2012 FTC order by deceiving Facebook users about their ability to control the privacy of 

their personal information. The settlement imposed a $5 billion civil penalty on Facebook and contained injunctive 

relief imposing substantial new changes to its operations. Facebook, Inc., https://www.ftc.gov/enforcement/casesproceedings/092-3184/facebook-inc. 

2 For purposes of this opinion, we use the following abbreviations:

Compl.: Complaint

CCMSD: Complaint Counsel’s Motion for Summary Decision

CCCSUF: Complaint Counsel’s Concise Statement of Undisputed Facts

3 16 C.F.R. §§ 3.24(a)(2), 4.3(c). Complaint Counsel discussed the Motion with Cambridge Analytica’s bankruptcy 

trustee, who is legally authorized to act on behalf of the company. The bankruptcy trustee did not object to the filing 

of the Motion, and provided comments on the notice order attached to the Complaint. CCMSD at 2-3. Based on 

these comments, Complaint Counsel propose certain minor changes to the notice order in a proposed order 

submitted with the Motion for Summary Decision, which we discuss in connection with our remedy determination 

in Section IV.
3 

false or misleading representations in violation of Section 5 of the FTC Act: 

 

• to Facebook users who authorized the GSRApp that it did not collect their personally

identifiable information (Count I);

• that it was a participant in Privacy Shield from May to November 2018, even though it 

had allowed its certification to lapse (Count II); and 

• that it would adhere to Privacy Shield principles, even though it failed to affirm to the 

Department of Commerce, as required, that it would continue to apply those principles to 

personal information it had acquired while participating in the program (Count III).

 As discussed below, we grant Complaint Counsel’s Motion for Summary Decision. 

Because Cambridge Analytica has defaulted and has failed to challenge the facts presented as 

undisputed by Complaint Counsel’s Motion, we find the facts as set forth in the Motion. 

(Section I). Based on our analysis of the undisputed facts under applicable legal standards and 

precedent, we conclude that Cambridge Analytica is liable on all three Counts of the Complaint. 

(Section III). Finally, we discuss the order we issue against Cambridge Analytica and its 

successors and assigns to remedy Cambridge Analytica’s violations of Section 5 of the FTC Act. 

(Section IV). 

I. FACTS

Cambridge Analytica is a private Delaware limited liability corporation that was formed 

in December 2013, and had a principal office or place of business at 597 Fifth Avenue, 7th Floor, 

New York, NY 10017. CCCSUF ¶ 1; Compl. ¶ 2. Cambridge Analytica is part of the SCL Group 

Ltd. family of companies, as is SCL Elections Limited (“SCL Elections”),4

 a privately held U.K. 

Corporation, which has held an ownership interest in Cambridge Analytica. CCCSUF ¶ 2; 

Compl. ¶ 2. Cambridge Analytica has operated as a data analytics and consulting company that 

provides voter-profiling and marketing services. Cambridge Analytica describes itself on its 

website as “a data-science consultancy and marketing agency” that is “politically neutral”. 

CCCSUF ¶ 3; Compl. ¶ 2. In May 2018, Cambridge Analytica filed for bankruptcy, which 

proceedings are still ongoing. CCCSUF ¶ 4; Compl. ¶ 2. 

During the relevant time period, Cambridge Analytica and SCL Elections conducted their 

business practices through an interrelated network of companies that have common business 

functions, ownership, officers, and employees. For example, Nix was both the head of SCL 

Elections and also the Chief Executive Officer of Cambridge Analytica. SCL Elections was 

placed into liquidation on April 17, 2019. CCCSUF ¶ 5; Compl. ¶ 3. 

Cambridge Analytica, together with SCL Elections (Compl. ¶¶ 1-3) and two other 

relevant parties, Nix and Kogan (Compl. ¶¶ 4-5), engaged in the conduct alleged in Count I of 

the Complaint (Compl. ¶¶ 38-39). Nix is a British citizen currently residing in the United 

 

4 See Complaint ¶ 5, Aleksandr Kogan and Alexander Nix, https://www.ftc.gov/enforcement/cases-proceedings/182-

3106-182-3107/aleksandr-kogan-alexander-nix. 
4

Kingdom. Until April 30, 2018, Nix was the Chief Executive Officer of Cambridge Analytica 

and a director of SCL Elections. Nix currently resides in London, England, and in connection 

with the matters alleged herein, transacts or has transacted business throughout the United States. 

Compl. ¶ 5. Kogan is an American citizen currently residing in New York. Until September 

2018, Kogan was a Senior Research Associate and Lecturer at the Department of Psychology at 

the University of Cambridge in the United Kingdom, where he established and led the 

Cambridge Prosociality and Well-Being Lab (“CPW Lab”). Kogan was also an owner and cofounder of the now-defunct U.K. corporation, Global Science Research, Ltd. (“GSR”). Compl. 

¶ 4.5

 

A. The Agreement to Harvest Facebook User Profile Data for Commercial

Purposes

In late 2013 or early 2014, Cambridge Analytica, along with Nix and SCL Elections, 

became aware of research by individuals at the Psychometrics Centre at the University of 

Cambridge that found that Facebook profile information could be used to successfully predict an 

individual’s personality traits according to the “OCEAN” scale, a psychometric model that 

measures an individual’s openness to experiences, conscientiousness, extraversion, 

agreeableness, and neuroticism. CCCSUF ¶ 8; Compl. ¶ 7. Specifically, researchers developed 

an algorithm that could predict an individual’s personality based on the individual’s “likes” of 

public Facebook pages. For example, liking Facebook pages related to How to Lose a Guy in 10 

Days, George W. Bush, and rap and hip-hop could be linked with a conservative and 

conventional personality. The researchers asserted that their algorithm, which was more accurate 

for individuals who had more public Facebook page “likes,” could potentially predict an 

individual’s personality better than the person’s co-workers, friends, family, and even spouse.

CCCSUF ¶ 9; Compl. ¶ 8.

Cambridge Analytica, along with Nix and SCL Elections, was interested in this research 

because Cambridge Analytica intended to offer voter-profiling, microtargeting, and other 

marketing services to U.S. political campaigns and other U.S.-based clients. CCCSUF ¶ 10; 

Compl. ¶ 9. Through mutual contacts, representatives of SCL Elections (who had dual roles at 

Cambridge Analytica) reached out to Kogan and academics affiliated with the Psychometrics 

Centre in early 2014 to discuss a potential working relationship to commercialize this research. 

CCCSUF ¶ 11; Compl. ¶ 9. Kogan, who was a Senior Research Associate and Lecturer at the 

Department of Psychology at the University of Cambridge, had expertise researching and 

analyzing Facebook data through his work at the CPW Lab. CCSUF ¶ 12; Compl. ¶ 10. In 

particular, he had prior research collaborations with Facebook through which he analyzed 

aggregated Facebook data relating to how people worldwide connect and express emotions. Id.

Kogan was willing to enter into a commercial venture with SCL Elections, and after several 

months of discussion, the parties reached agreement about the scope of work (the “Project”). 

CCCSUF ¶ 13; Compl. ¶ 10.

By that point, Kogan already had a Facebook app that was registered on the Facebook 

platform—the CPW Lab app—and could be repurposed to collect profile data from Facebook 

 5 Kogan has been known at times by the married name, Aleksandr Spectre. Id.
5

users and their “friends” through Facebook’s developer tool, Graph API (v.1). CCCSUF ¶ 14; 

Compl. ¶ 11. Facebook’s Graph API (v.1) allowed developers to collect Facebook profile data 

from users who directly installed or otherwise interacted with the developer’s application or 

website through a Facebook Login, as well as from these users’ Facebook “friends” (“Affected 

Friends”). CCCSUF ¶ 15; Compl. ¶ 12. Facebook allowed this data collection even though the 

Affected Friends did not have any direct interaction with the app or website. CCCSUF ¶ 15; 

Compl. ¶ 12. While Facebook had announced in April 2014 that it was introducing a new version 

of the Graph API—v.2—that would allow developers to collect profile data only from the App 

Users themselves, and not from Affected Friends, existing apps had one year before these 

limitations went into effect, whereas new apps would automatically be limited. CCCSUF ¶ 15; 

Compl. ¶ 12. Thus, Kogan’s app was “grandfathered” into the more permissive data collection 

allowable under Graph API (v.1), making Kogan an appealing partner for Cambridge Analytica, 

Nix, and SCL Elections. CCCSUF ¶ 15; Compl. ¶ 12.

On May 29, 2014, Kogan incorporated a now-defunct U.K. corporation, Global Science 

Research, Ltd., to carry out the Project, separate and apart from his duties at the University of 

Cambridge. CCCSUF ¶ 16; Compl. ¶ 13. Kogan was a founder and Chief Executive Officer of 

GSR, and worked on all aspects of GSR’s products and services before it was dissolved in 

October 2017. CCCSUF ¶ 16; Compl. ¶ 13. On June 4, 2014, GSR and SCL Elections entered 

into the GS Data and Technology Subscription Agreement (the “June 2014 Agreement”). Nix 

signed this agreement for SCL Elections. CCCSUF ¶ 17; Compl. ¶ 14. Under this agreement, 

GSR agreed to harvest Facebook profile data from App Users and Affected Friends in 11 U.S. 

states, generate personality scores for these individuals, and then match these profiles to U.S. 

voter records provided to GSR by SCL Elections. CCCSUF ¶ 18; Compl. ¶ 14. GSR would then 

send these matched records along with the associated personality scores back to SCL Elections. 

CCCSUF ¶ 19; Compl. ¶ 14. GSR retained the original data set and granted SCL Elections a 

license to access the data and to use the proprietary GSR personalityscores. CCCSUF ¶ 19; 

Compl. ¶ 14. Following the creation of GSR and the signing of the June 2014 Agreement, Kogan 

repurposed the CPW Lab app to become the GSRApp. CCCSUF ¶ 20; Compl. ¶ 14. 

Although SCL Elections is the entity that entered into the agreement with GSR, it was 

acting for and on behalf of Cambridge Analytica. CCCSUF ¶ 21; Compl. ¶ 15. SCL Elections 

entered into a Services Agreement with Cambridge Analytica whereby SCL Elections agreed, 

among other things, to (a) acquire, for and on behalf of Cambridge Analytica, demographic,

transactional, lifestyle, and behavioral data about consumers in target populations; (b) identify 

and build target voter lists; (c) apply research techniques to understand better the habits and daily

lives of target voter groups; and (d) apply psychological profiles to target groups of voters. In a 

separate agreement, SCL Elections also agreed to license all of its intellectual property to 

Cambridge Analytica. Id.

Cambridge Analytica and SCL Elections played a significant and direct role in the 

development and implementation of the GSRApp, as well as in the analysis of the data the 

GSRApp collected. CCCSUF ¶ 22; Compl. ¶ 16. Among other things, Cambridge Analytica and 

SCL Elections revised the terms of use for the GSRApp from the original CPW Lab app. 

CCCSUF ¶ 23; Compl. ¶ 16.a. Cambridge Analytica and SCL Elections also paid all costs, 

totaling over $500,000, related to implementing the GSRApp and analyzing the resulting data, 
6

including paying U.S.-based survey panel providers specifically to target Facebook users located 

in the United States to take the GSRApp surveys. CCCSUF ¶ 24; Compl. ¶ 16.b. Cambridge 

Analytica and SCL Elections also inserted specific questions to be included in some of the 

surveys, including a number of questions about national security in the United States, as this was 

a particular topic of interest for one of Cambridge Analytica’s U.S.-based clients. CCCSUF ¶ 25; 

Compl. ¶ 16.c. Cambridge Analytica and SCL Elections also directly communicated with the 

U.S.-based survey panel provider about the timing and focus of the GSRApp surveys. CCCSUF 

¶ 26; Compl. ¶ 16.d. Cambridge Analytica and SCL Elections also actively assisted in the 

matching of data harvested from App Users and Affected Friends located in the United States

and Kogan’s personality scores with U.S. voter registration records. CCCSUF ¶ 27; Compl. ¶ 

16.e.

Nix was personally involved in the data-harvesting Project. In addition to signing the 

June 2014 Agreement, he directly communicated and met with Kogan about the Project;

personally authorized payment for Project-related costs; reviewed survey questions and 

specifically requested certain Facebook data or analysis; and directed internal actions within SCL 

Elections and Cambridge Analytica related to implementing the GSRApp, analyzing the 

GSRApp data, and using the GSRApp data for Cambridge Analytica clients in the United States. 

CCCSUF ¶ 28; Compl. ¶ 17.

B. The GSRApp Harvested Large Quantities of Facebook Profile Data from 

App Users and Affected Friends

The GSRApp asked users to answer survey questions and consent to their Facebook 

profile data being collected, including public Facebook page “likes.” Kogan then used the initial 

participants’ survey responses and Facebook “likes” to train his algorithm so that it could predict 

the users’ personality traits based solely on the Facebook “likes” data. This process allowed 

Kogan to provide personality scores for the Affected Friends, from whom he collected Facebook 

data but had no survey responses. CCCSUF ¶ 29; Compl. ¶ 18.

Kogan then assigned a confidence level to each personality score based on the number of 

public page “likes” for each U.S.-based App User and Affected Friend, generally requiring a 

Facebook user to have “liked” at least 10 public Facebook pages to be confident of the 

personality score. CCCSUF ¶ 30; Compl. ¶ 19. Cambridge Analytica, Nix, and Kogan then 

conducted a small trial to determine how well Facebook profile information could be matched 

with U.S. voter records and information from other public databases. The Project would have 

had little value to Cambridge Analytica and SCL Elections if the personality scores could not be 

matched with actual U.S. voters. CCCSUF ¶ 31; Compl. ¶ 20.

The initial trial was a success and showed that the Facebook profile data could be

matched with U.S. voter records. Based on this success, Cambridge Analytica, Nix, and Kogan 

implemented the GSRApp on a wider scale using the Qualtrics survey platform, based in Provo,

Utah. CCCSUF ¶ 32; Compl. ¶ 21. Qualtrics recruited U.S.-based consumers through four waves 

of survey panels during the summer of 2014. Each wave asked different questions of the 

participants such that Kogan’s personality scores covered a broad range of topics, including 

political enthusiasm, political orientation, frequency in voting, consistency in voting for the same 
7

political party, and views on particular controversial issues. Survey participants who completed 

the survey and authorized the GSRApp to harvest their Facebook profile information were paid a 

nominal fee of a few dollars for participating in the survey. CCCSUF ¶ 33; Compl. ¶ 22. 

At the point in every survey in which the GSRApp asked U.S. consumers to authorize the 

app to collect their Facebook data, the GSRApp made the following representation:

In this part, we would like to download some of your Facebook data using our Facebook 

app. We want you to know that we will NOT download your name or any other 

identifiable information—we are interested in your demographics and likes. 

CCCSUF ¶ 34; Compl. ¶ 23. Cambridge Analytica, Nix, and Kogan included this representation 

after finding that half of the survey participants initially refused to grant the GSRApp permission 

to collect their Facebook profile data. CCCSUF ¶ 35; Compl. ¶ 24.

Contrary to this representation, the GSRApp collected the Facebook User ID of those 

App Users who authorized it. CCCSUF ¶ 35; Compl. ¶ 24. A Facebook User ID is a persistent, 

unique identifier that connects individuals to their Facebook profiles. CCCSUF ¶ 35; Compl. ¶ 24.

Cambridge Analytica, Nix, and Kogan harvested a significant amount of Facebook 

profile data from App Users and the Affected Friends located in the U.S. through the GSRApp. 

Specifically, they harvested the following Facebook profile data from App Users: Facebook User 

ID; gender; birthdate; location (“current city”); friends list; and “likes” of public Facebook 

pages. They harvested from Affected Friends their Facebook User ID; name; gender; birthdate; 

location (“current city”); and “likes” of public Facebook pages. CCCSUF ¶ 37; Compl. ¶ 25. 

Over the course of the Project, Cambridge Analytica, Nix, and Kogan harvested Facebook 

profile data from approximately 250,000–270,000 App Users located in the U.S., and harvested 

profile data from approximately 50–65 million Affected Friends, including at least 30 million 

identifiable U.S. consumers. CCCSUF ¶ 38; Compl. ¶ 26.

In January 2015, GSR and SCL Elections entered into a supplemental agreement 

(“January 2015 Agreement”) regarding additional data from the Project that Cambridge 

Analytica and SCL Elections wanted. Pursuant to the January 2015 Agreement, GSR provided 

data and analysis for App Users and Affected Friends for the remaining 39 U.S. states. GSR also 

provided a more limited set of personality analyses for these consumers than it had provided for 

consumers in the initial 11 U.S. states. CCCSUF ¶ 39; Compl. ¶ 27.

In April 2015, GSR and SCL Elections entered into an addendum to the January 2015 

Agreement (“Addendum”), pursuant to which GSR provided Cambridge Analytica and SCL 

Elections with the underlying Facebook data used to “train” the algorithm that generated the 

OCEAN personality scores. GSR also provided Cambridge Analytica and SCL Elections with 

additional information about whether the App Users and Affected Friends included in the second 

set of data provided pursuant to the January 2015 Agreement had “likes” for about 500 specific 

pages identified by Cambridge Analytica and SCL Elections. CCCSUF ¶ 40; Compl. ¶ 28.

Nix, SCL Elections, and Cambridge Analytica reported to Kogan that they had very
8 

positive feedback from their clients and had expressed an interest in continuing to work with 

Kogan and GSR on other similar projects. While Kogan and GSR were interested in working on 

follow-up projects, the parties could not reach an agreement and discontinued their work together 

after GSR transferred the data agreed to in the Addendum in May 2015. CCCSUF ¶ 41; Compl. 

¶ 29. 

 In December 2015, several news reports were published regarding Cambridge 

Analytica’s use of Facebook data. Following these reports, Facebook demanded that Kogan, 

Cambridge Analytica, and its SCL affiliates delete all Facebook data in their possession. While 

Kogan and SCL Elections certified to Facebook that they had deleted the data obtained through 

the GSRApp, individuals or other entities still possess this data and/or data models based on this 

data. CCCSUF ¶ 42; Compl. ¶ 30. 

C. Cambridge Analytica’s Claims that It Participated in the Privacy Shield 

Framework and Adhered to its Principles

1. The Privacy Shield Framework

 The Privacy Shield framework was designed by the U.S. Department of Commerce 

(“Commerce”) and the European Commission to provide a mechanism for U.S. companies to 

transfer personal data outside of the EU that is consistent with the requirements of the European 

Union Directive on Data Protection. Enacted in 1995, the Directive set forth EU requirements for 

privacy and the protection of personal data. CCCSUF ¶ 43; Compl. ¶ 31. Among other things, 

the Directive requires EU Member States to implement legislation that prohibits the transfer of 

personal data outside the EU, with exceptions, unless the European Commission has made a 

determination that the recipient jurisdiction’s laws ensure the protection of such personal data. 

This determination is referred to commonly as meeting the EU’s “adequacy” standard. CCCSUF 

¶ 44; Compl. ¶ 31. 

To satisfy the EU adequacy standard for certain commercial transfers, Commerce and the 

European Commission negotiated the Privacy Shield framework, which went into effect in July 

2016. CCCSUF ¶ 45; Compl. ¶ 32. The Privacy Shield framework allows companies to transfer 

personal data lawfully from the EU to the United States. CCCSUF ¶ 45; Compl. ¶ 32. Companies 

under the enforcement jurisdiction of the Federal Trade Commission, as well as the U.S. 

Department of Transportation, are eligible to join the Privacy Shield framework. CCCSUF ¶ 46; 

Compl. ¶ 33. To join the Privacy Shield framework, a company must self-certify to Commerce 

that it complies with the Privacy Shield principles and related requirements that have been 

deemed to meet the EU’s adequacy standard. CCCSUF ¶ 46; Compl. ¶ 32. 

Commerce maintains a public website, https://www.privacyshield.gov/welcome, where it 

posts the names of companies that have self-certified to the Privacy Shield framework. The 

listing of companies, https://www.privacyshield.gov/list, indicates whether the company’s selfcertification is current. CCCSUF ¶ 48; Compl. ¶ 34. Any company that voluntarily withdraws or 

lets its self-certification lapse must continue to apply the Privacy Shield principles to the 

personal information it received while a participant in Privacy Shield, and affirm to Commerce 

on an annual basis its commitment to do so, for as long as it retains such information. CCCSUF 
9 

¶ 47; Compl. ¶ 32. 

2. Cambridge Analytica’s Claims Regarding its Participation in Privacy 

Shield

 On May 11, 2017, Cambridge Analytica joined Privacy Shield. CCCSUF ¶ 50; Compl. 

¶ 35. While the Facebook data harvested through the GSRApp predated its participation in 

Privacy Shield and is therefore not subject to its protections, Cambridge Analytica continued to 

collect Facebook and other data from or about U.S. and European consumers after it joined 

Privacy Shield. CCCSUF ¶ 50; Compl. ¶ 35. 

 Until at least November 27, 2018, Cambridge Analytica disseminated or caused to be 

disseminated privacy policies and statements on its website at https://cambridgeanalytica.org

including, but not limited to, the following statements that it participated in the Privacy Shield 

framework and that it adhered to the Privacy Shield principles: 

IS CAMBRIDGE ANALYTICA PART OF THE PRIVACY SHIELD 

FRAMEWORK?

Yes: Cambridge Analytica adheres to the EU-US Privacy Shield Principles for the 

transfer of EU data we use to provide our services, including the onward transfer liability 

provisions. With respect to personal data received or transferred pursuant to the Privacy 

Shield Framework, Cambridge Analytica is subject to the regulatory enforcement powers 

of the U.S. Federal Trade Commission. More information on the principles are available 

at the Privacy Shield website: https://www.privacyshield.gov/.

CCCSUF ¶ 51; Compl. ¶ 36. 

Cambridge Analytica, however, did not complete the steps necessary to renew its 

participation in Privacy Shield after that certification expired on or about May 11, 2018. 

CCCSUF ¶ 52; Compl. ¶ 37. After allowing its certification to lapse, Cambridge Analytica 

continued to claim on its website that it was participating in Privacy Shield until at least 

November 27, 2018. CCCSUF ¶ 52; Compl. ¶ 37. 

Cambridge Analytica also failed to comply with the Privacy Shield principle that required 

it to affirm to Commerce, after its certification had lapsed, its commitment to protect any 

personal information that it had acquired while a participant in Privacy Shield for so long as it 

retained the data. CCCSUF ¶ 54; Compl. ¶ 37. Notwithstanding its failure to affirm to 

Commerce its commitment to continue to protect the personal data it had acquired while a 

participant in Privacy Shield, Cambridge Analytica continued to disseminate or cause to be 

disseminated privacy policies and statements on its website (https://cambridgeanalytica.org) 

asserting that it was part of the Privacy Shield framework and that it adhered to the Privacy 

Shield principles for the transfer of EU data. CCCSUF ¶¶ 51, 54; Compl. ¶¶ 36-37. 
10 

 

II. LEGAL STANDARDS

A. Standard for Summary Decision

 We review Complaint Counsel’s Motion for Summary Decision pursuant to Rule 3.24 of 

the Commission’s Rules of Practice, 16 C.F.R. § 3.24, the provisions of which “are virtually 

identical to the provisions of Fed. R. Civ. P. 56, governing summary judgment in the federal 

courts.” Polygram Holding, Inc., 2002 WL 31433923, at *1 (F.T.C. Feb. 26, 2002) (order 

denying motion for summary decision). Consistent with Rule 56(a), a party moving for summary 

decision must show that “there is no genuine dispute as to any material fact.” Id.; see Jerk, LLC, 

159 F.T.C. 885, 889 (2015). We may therefore rely on authority applying the federal summary 

judgment standard. See, e.g., Fanning v. FTC, 821 F.3d 164, 170 (1st Cir. 2016) (under FTC 

rules, summary decision is reviewed “under the same standard as summary judgment before a 

district court”). 

 As the moving party, Complaint Counsel bear the initial burden of identifying evidence 

that demonstrates the absence of any genuine issue of material fact. See Celotex Corp. v. Catrett, 

477 U.S. 317, 323 (1986). When a motion for summary decision is made and supported, the 

“party opposing the motion may not rest upon the mere allegations or denials of his or her 

pleading; the response, by affidavits or as otherwise provided in this rule, must set forth specific 

facts showing that there is a genuine issue of material fact for trial.” 16 C.F.R. § 3.24(a)(3); see 

also Celotex, 477 U.S. at 323. We are required to resolve all factual ambiguities and draw all 

justifiable inferences in the light most favorable to Cambridge Analytica. 

In this case, there is no material fact at issue by virtue of Cambridge Analytica’s default, 

16 C.F.R. § 3.12(c), and its failure to oppose Complaint Counsel’s Motion for Summary 

Decision. Accordingly, we base our determination whether Cambridge Analytica violated 

Section 5 of the FTC Act on an analysis of the undisputed facts as submitted with Complaint 

Counsel’s Motion for Summary Decision and alleged in the Complaint under the legal standards 

for evaluating deceptive acts and practices.6

B. Standard for Deception

 Section 5 of the FTC Act prohibits “unfair or deceptive acts or practices in or affecting 

commerce.” 15 U.S.C § 45. The Complaint charges Cambridge Analytica only with alleged

deception; there are no allegations of unfair acts or practices.

“An act or practice is deceptive if (1) there is a representation, omission, or practice, (2) 

 

6 Respondent does not contest the Commission’s jurisdiction over it or over the conduct challenged in the 

Complaint. CCCSUF ¶¶ 1-5, 7; Compl. ¶¶ 1-3. Nor does Respondent dispute that the acts and practices alleged in 

the Complaint were in or affecting commerce, as “commerce” is defined in the FTC Act, 15 U.S.C § 44. CCCSUF 

¶ 6; Compl. ¶ 6. We therefore find that the Commission has jurisdiction over the Respondent and its conduct as 

alleged in the Complaint.
11

that is likely to mislead consumers acting reasonably under the circumstances, and (3) the 

representation, omission, or practice is material.” FTC v. Commerce Planet, Inc., 878 F. Supp.

2d 1048, 1063 (C.D. Cal. 2012) (citing FTC v. Pantron I Corp., 33 F.3d 1088, 1095 (9th Cir. 

1994)), aff’d in part, vacated in part, and remanded, 815 F.3d 593 (9th Cir. 2016); accord FTC 

v. Transnet Wireless Corp., 506 F. Supp. 2d 1247, 1266 (S.D. Fla. 2007) (citing, e.g., FTC v. 

Tashman, 318 F.3d 1273, 1277 (11th Cir. 2003)); FTC Policy Statement on Deception, appended 

to Cliffdale Assocs., Inc., 103 F.T.C. 110 (1984) (“Deception Statement”). Thus, in determining 

whether a representation is deceptive, we conduct a three-step inquiry, determining: (1) what 

claims are conveyed; (2) whether those claims are false, misleading, or unsubstantiated; and (3) 

whether the claims are material. See ECM BioFilms, Inc. v. FTC, 851 F.3d 599, 609 (6th Cir. 

2017) (finding website content deceptive); Fanning, 821 F.3d at 170 (same); POM Wonderful v. 

FTC, 777 F. 3d 478, 490 (D.C. Cir. 2015) (finding advertising deceptive). 

A representation is considered material if it “involves information that is important to 

consumers and, hence, likely to affect their choice of, or conduct regarding a product.” E.g., FTC 

v. QT, Inc., 448 F. Supp. 2d 908, 960 (N.D. Ill. 2006) (citing Kraft, Inc. v. FTC, 970 F.2d 311, 

322 (7th Cir. 1992)), aff’d, 512 F.3d 858 (7th Cir. 2008); Commerce Planet, 878 F. Supp. 2d at 

1063 (citing FTC v. Cyberspace.com, LLC, 453 F.3d 1196, 1201 (9th Cir. 2006)). The 

Commission presumes that express claims are material. ECM Biofilms, Inc., 2015 WL 6384951, 

at *53 (F.T.C. Oct. 19, 2015), pet. for review denied, 851 F.3d 599 (6th Cir. 2017); Jerk, LLC, 

159 F.T.C. at 906; POM Wonderful LLC, 155 F.T.C. 1, 62 (2013) (citing Novartis Corp., 127 

F.T.C. 580, 686 (1999) (citing Deception Statement, 103 F.T.C. at 182)), aff’d, 777 F.3d 478 

(D.C. Cir. 2015). Express claims encompass not only the explicit statements in the 

representation, but also necessary implications derived from the statements. FTC v. Bronson 

Partners, LLC, 564 F. Supp. 2d 119, 126 n.4 (D. Conn. 2008). 7

III. CAMBRIDGE ANALYTICA’S LIABILITY 

Due to Cambridge Analytica’s failure to file an answer to the Complaint or to oppose 

Complaint Counsel’s Motion for Summary Decision, there is no genuine issue of material fact in 

this case. Therefore, summary decision is appropriate. We determine whether, based on the 

undisputed facts, Cambridge Analytica is liable for engaging in deceptive acts and practices in 

violation of Section 5 of the FTC Act by analyzing: (1) whether it made the claims alleged in the 

Complaint; (2) whether those claims were false or misleading; and (3) whether the claims were 

material. 

A. Count I: Deceptive Claim by Cambridge Analytica Concerning the 

Collection of Personally Identifiable Information 

There is no dispute that Cambridge Analytica made the claim alleged in the Complaint, 

namely, that “Cambridge Analytica represented, directly or indirectly, expressly or by 

implication, that the GSRApp did not collect any identifiable information from Facebook users 

 7 As discussed in Section III below, the representations at issue are express. Since, in the case of express 

representations, “we expect consumers to rely on express statements . . . and to interpret such statements as meaning 

what they say,” California Naturel, Inc., 2016 WL 7228668, at *7 (F.T.C. Dec. 5, 2016), we need not inquire 

separately into how these claims would be interpreted by reasonable consumers.
12 

who authorized the app.” Compl. ¶ 38. Cambridge Analytica launched the Facebook GSRApp on 

a wide scale using the Qualtrics survey platform to recruit U.S.-based consumers to participate in 

surveys and authorize the GSRApp to harvest their Facebook profile information. CCCSUF 

¶ 32-33; Compl. ¶ 21-22. At the point in those surveys at which U.S. consumers were asked to 

authorize the app to collect their Facebook data, Cambridge Analytica, through the GSRApp, 

made the following representation: 

In this part, we would like to download some of your Facebook data using our Facebook 

app. We want you to know that we will NOT download your name or any other 

identifiable information—we are interested in your demographics and likes. 

CCCSUF ¶ 34; Compl. ¶ 23. We therefore find that Cambridge Analytica made the claim alleged 

in the Complaint.

 There is also no dispute that this representation was false and misleading. Contrary to 

Cambridge Analytica’s representation, the GSRApp did in fact collect participating users’

personally identifiable information, notably including their Facebook User IDs. CCCSUF ¶ 35; 

Compl. ¶ 24. We find that Cambridge Analytica’s representations to App Users who authorized 

the GSRApp that it would not download their name or any other identifiable information were 

false and misleading. 

Finally, we find that Cambridge Analytica’s false and misleading representation to App 

Users via the GSRApp that it would not download names or other identifiable information was 

an express claim, and as such is presumptively material. Cambridge Analytica has not rebutted

the legal presumption that this express claim is material.

8

 

We conclude that Cambridge Analytica’s representation to App Users who authorized the 

GSRApp that it would not collect their identifiable information was a false and material, and 

hence deceptive, claim. Accordingly, we grant Complaint Counsel’s Motion for Summary 

Decision on Count I. 

B. Count II: Deceptive Claim by Cambridge Analytica Concerning Its

Participation in Privacy Shield 

 We turn now to Cambridge Analytica’s representations regarding its participation in and 

compliance with the Privacy Shield framework. Cambridge Analytica joined the Privacy Shield 

program on May 11, 2017. CCCSUF ¶ 50; Compl. ¶ 35. There is no dispute that thereafter, and 

continuously until at least November 27, 2018, Cambridge Analytica made statements and 

representations on its website at http://cambridgeanalytic.org that affirmed it was a participant in 

 

8 Other evidence supports this conclusion. Notably, Cambridge Analytica included the representation at the point in 

the surveys where the GSRApp requested App Users’ permission to collect “some” of their Facebook data after

learning that half of the survey participants had refused to grant any permission to the GSRApp absent such an 

assurance. CCCSUF ¶¶ 34-35; Compl. ¶¶ 23-24. We can infer from these undisputed facts that Cambridge Analytica 

subsequently included the false statement, “[w]e want you to know that we will NOT download your name or any 

other identifiable information,” as a means of inducing survey participants to allow the GSRApp to collect their 

Facebook profile data. We can also infer that the assurances provided by Cambridge Analytica’s representation 

likely affected the choices and changed the decisions of a substantial number of App Users.
13 

the Privacy Shield program and adhered to the Privacy Shield principles. CCCSUF ¶ 51; Compl. 

¶ 36. For example, Cambridge Analytica displayed the following statement on its website:

IS CAMBRIDGE ANALYTICA PART OF THE PRIVACY SHIELD 

FRAMEWORK?

Yes: Cambridge Analytica adheres to the EU-US Privacy Shield Principles for the 

transfer of EU data we use to provide our services, including the onward transfer liability 

provisions. With respect to personal data received or transferred pursuant to the Privacy 

Shield Framework, Cambridge Analytica is subject to the regulatory enforcement powers 

of the U.S. Federal Trade Commission. More information on the principles are available 

at the Privacy Shield website: https://www.privacyshield.gov/.

CCCSUF ¶ 51; Compl. ¶ 36. We find that, from May 2017 until at least November 27, 2018, 

Cambridge Analytica made the claim that it was a participant in Privacy Shield. 

 The undisputed facts further establish that Cambridge Analytica did not complete the 

steps necessary to renew its participation in Privacy Shield after its certification expired on or 

about May 11, 2018. CCCSUF ¶ 52; Compl. ¶ 37. We find that Cambridge Analytica’s 

continued representation that it was participating in Privacy Shield from May to November 2018, 

when it had in fact allowed its Privacy Shield certification to lapse, was a false and misleading 

claim. Cambridge Analytica has not rebutted the legal presumption that this express claim was 

material. 

We conclude that Cambridge Analytica’s express representation that it remained a

participant in the Privacy Shield framework after its certification had lapsed was false and 

material, and hence deceptive. Accordingly, we grant Complaint Counsel’s Motion for Summary 

Decision on Count II.

C. Count III: Deceptive Claim by Cambridge Analytica Concerning Its 

Adherence to Privacy Shield Principles 

 Among the requirements imposed by Privacy Shield on companies that self-certify as 

compliant participants in the Privacy Shield program is that, if the company withdraws from the 

program or allows its self-certification to lapse, it must affirm to the U.S. Department of 

Commerce on an annual basis its commitment to continue to apply Privacy Shield principles and 

protections to the personal information it has received while a participant in Privacy Shield for as 

long as it retains such information. CCCSUF ¶ 47; Compl. ¶ 32. 

 The undisputed facts establish that, beginning on or about May 11, 2017, Cambridge 

Analytica expressly represented on its website that it adhered to Privacy Shield principles. 

Cambridge Analytica continued to represent on its website that it adhered to Privacy Shield 

principles even after its certification had lapsed on or after May 11, 2018. CCCSUF ¶¶ 51, 54; 

Compl. ¶¶ 36-37. We find that, by representing that it was compliant with Privacy Shield 

principles, Cambridge Analytica necessarily represented that it was complying with the Privacy 

Shield requirement to affirm to Commerce its commitment to continue to apply Privacy Shield 
14

protections to the personal information it had collected for as long as it retained this data. This 

claim was false and misleading because Cambridge Analytica had, in fact, failed to make the 

required affirmation to Commerce after its Privacy Shield certification lapsed. CCCSUF ¶ 54; 

Compl. ¶ 37.9 Cambridge Analytica has not rebutted the legal presumption that this express 

claim was material. 

We therefore conclude that Cambridge Analytica’s representation that it was in 

compliance with Privacy Shield principles was false and material, and hence deceptive. We grant 

Complaint Counsel’s Motion for Summary Decision on Count III.

IV. REMEDY

The FTC Act authorizes the Commission to issue an order that requires the Respondent to 

cease and desist its deceptive acts or practices. 15 U.S.C. § 45(b); see also FTC v. Nat’l Lead 

Co., 352 U.S. 419, 428 (1957). Moreover, “[t]he Commission is not limited to prohibiting the 

illegal practice in the precise form in which it is found to have existed in the past.” FTC v. 

Colgate-Palmolive Co., 380 U.S. 374, 395 (1965) (quoting FTC v. Ruberoid, 343 U.S. 470, 473 

(1952)). The Commission may “frame its order broadly enough to prevent respondents from 

engaging in similarly illegal practices in [the] future.” Id. at 395. 

The Complaint in this matter attached a notice of the form of order that might issue if the 

facts were found to be as alleged. We have already found to be established the facts as set forth 

in Complaint Counsel’s Motion for Summary Decision and as alleged in the Complaint. 

Complaint Counsel observe that Rule 3.12 (c) authorizes the Commission to enter an order 

consistent with the notice order attached to the Complaint sua sponte, but propose several minor 

changes to the notice order based on comments Complaint Counsel received from Cambridge 

Analytica’s bankruptcy trustee. CCMSD 2-3. Specifically, the proposed order accompanying the 

Motion incorporates certain changes related to the records access provisions, given the practical 

and legal constraints imposed by Cambridge Analytica’s bankruptcy proceedings. We agree that 

 9 Neither the Complaint nor Complaint Counsel’s Motion expressly allege any facts regarding the status of the data 

that Cambridge Analytica had collected from consumers while a participant in Privacy Shield after its Privacy 

Shield certification lapsed on May 11, 2018. However, both the Complaint and Motion allege that Cambridge 

Analytica received such information (CCCSUF ¶ 50; Compl. ¶ 35), and allege no facts suggesting such information 

was deleted or returned upon the lapse of its Privacy Shield certification. Indeed, Complaint Counsel’s notice order 

provides that we require the Respondent, defined to include Cambridge Analytica and its successors and assigns, to 

delete information collected by the Respondent from consumers. Moreover, Cambridge Analytica has not denied 

Paragraph 43 of the Complaint, which states that Cambridge Analytica’s representation of adherence to Privacy 

Shield principles was false and misleading. In these circumstances, there is an adequate basis for us to find that 

Cambridge Analytica misrepresented its continued adherence to Privacy Shield principles after its certification had 

lapsed.
15

the changes Complaint Counsel propose are appropriate.

10

At the outset, we underscore that all of the prohibitions and requirements of our Final 

Order are binding on the “Respondent,” which by definition includes Cambridge Analytica and 

its successors and assigns, and also that the requirements of Paragraphs I-V of the Final Order 

expressly apply to Respondent’s officers, agents, employees, and attorneys, and all other persons 

in active concert or participation with any of them, who receive actual notice of the Final Order. 

That said, for simplification, we refer only to “Respondent” in our discussion of the Final 

Order’s provisions.

Paragraph I of the Final Order prohibits Respondent from making misrepresentations 

regarding the extent to which it protects the privacy and confidentiality of Covered Information 

as defined in the Final Order, including: (1) the extent to which it collects, uses, shares, or sells

any Covered Information; and (2) the purposes for which it collects, uses, shares, or sells any 

Covered Information. 

Paragraph II prohibits Respondent from making misrepresentations, in connection with 

any product or service, regarding the extent to which Respondent participates in any privacy or 

security program sponsored by a government or any self-regulatory or standard-setting 

organization, including, but not limited to, the EU-U.S. Privacy Shield framework, the SwissU.S. Privacy Shield framework, and the APEC Cross-Border Privacy Rules.

Paragraph III imposes additional requirements to address Respondent’s unlawful conduct 

related to its participation in and compliance with the Privacy Shield framework. Specifically, 

Paragraph III prohibits Respondent from possessing or controlling personal information from 

European Union residents that Respondent received while it participated in the EU-U.S. Privacy 

Shield framework unless Respondent complies with the requirements of either Paragraph III.A or 

Paragraph III.B. Paragraph III.A requires Respondent to affirm to Commerce within specified 

time limits that it: (1) will continue to apply Privacy Shield protections to the personal 

information it received while it participated in the Privacy Shield; or (2) will protect such 

information by another means authorized under EU or Swiss law. Alternatively, Paragraph III.B 

 10 Thus, we adopt Complaint Counsel’s proposals to delete the definition of “Trustee,” which appeared in the notice 

order and substitute “Respondent” for “Trustee” in Paragraph VI of the Final Order, which addresses the 

Commission’s access to Cambridge Analytica’s corporate documents and data. This change avoids the need for the 

Commission to seek leave of the bankruptcy court for any actions that would have been required by Cambridge 

Analytica’s bankruptcy trustee. CCMSD 2-3. Cf. McIntire v. China MediaExpress Holdings, Inc., 113 F. Supp. 3d 

769, 772 (S.D.N.Y. 2015) (explaining that under the Barton doctrine, any suit naming and requiring action by a 

court-appointed receiver personally, rather than the debtor, requires leave of the appointing court); Barton v. 

Barbour, 104 U.S. 126, 136-37 (1881). We also adopt the proposal to delete the language, “and upon the 

Commission’s designation, the Trustee shall transfer such [abandoned corporate] books and records to the 

Commission” from the third sub-paragraph in Paragraph VI of the notice order, in recognition of the fact that, under 

bankruptcy regulations, Cambridge Analytica’s bankruptcy trustee cannot transfer Cambridge Analytica’s 

abandoned corporate books and records to the Commission. CCMSD 2-3. Bankruptcy regulations require the trustee 

to return corporate books and records to the estate after the bankruptcy court has entered its final order dissolving 

the company. See 11 U.S.C. § 554(d). These changes are necessary to accommodate Cambridge Analytica’s 

bankruptcy proceedings. We note, however, that the corporate books and records referenced in the provisions of 

Paragraph VI of the Final Order would not include the data or work product that Respondent is required to delete by 

Paragraph IV of the Final Order.
16

requires Respondent to return or delete such personal information within specified time periods.

Paragraph IV of the Final Order relates to the deletion or destruction of Covered 

Information collected from consumers through the GSR App, and any information or work 

product, including any algorithms or equations, derived in whole or in part from such Covered 

Information. Paragraph V permanently enjoins Respondent from disclosing, using, selling, or 

receiving any benefit from any Covered Information or any information that derived in whole or 

in part from it. Paragraph VI imposes access and monitoring requirements, and Paragraph VII 

provides that the Final Order will remain in effect for twenty years.

V. CONCLUSION

For the foregoing reasons, the Commission concludes that Cambridge Analytica violated 

Section 5 of the FTC Act, 15 U.S.C. § 45, by means of its false and deceptive representations to 

Facebook users who authorized the GSRApp, and by false and deceptive statements on its 

website regarding its participation in Privacy Shield and its adherence to Privacy Shield program 

principles. Accordingly, we enter a Final Order to remedy the Respondent’s violations and 

prevent their recurrence.

ISSUED: November 25, 2019