## Facts

- Researchers at the University of Cambridge developed methods to predict personality traits based on which public pages a person “liked” on Facebook.
- SCL Elections Limited (SCL), working with Cambridge Analytica, sought to use that research to offer voter profiling, targeting, and related marketing services to political campaigns and commercial clients.
- SCL and Cambridge Analytica contacted Alexsandr Kogan, who had an existing Facebook app that could be repurposed to collect Facebook profile data from app users and their Facebook friends.
- Kogan formed Global Science Research (GSR) for the project, served as its CEO, and reworked and rebranded his app as the “GSRApp” (also publicly referred to as “thisisyourdigitallife”).
- SCL (acting for Cambridge Analytica) entered an agreement with GSR under which GSR would harvest Facebook data, generate personality profiles, and match those profiles to voter records.
- Alexander Nix signed the agreement for SCL, communicated with Kogan about the project, and provided guidance on the categories of data to be collected.
- Users were recruited through survey requests offering a small fee if the user completed a survey and authorized the GSRApp to collect Facebook data.
- When seeking authorization, the GSRApp represented that it would not download a user’s name or other identifying information and would focus on demographic information and page likes.
- That representation was false. The GSRApp collected app users’ Facebook user IDs and other profile attributes such as gender, birthdate, location, friend lists, and page likes.
- The GSRApp also harvested identifying and profile data about each app user’s Facebook friends, including user IDs, names, genders, birthdates, locations, and page likes.
- The project collected data from more than 250,000 app users and tens of millions of their friends. The parties discontinued the project around May 2015.
- After press coverage and public reaction in late 2015, the Federal Trade Commission initiated administrative actions alleging deceptive acts or practices under Section 5(a) of the FTC Act against Kogan and Nix.
- The matters were resolved through consent orders; the respondents did not admit or deny the allegations (except jurisdictional facts) and waived further proceedings and review.

## Issues

1. Whether representing that a Facebook app would not collect a user’s name or other identifying information, when the app in fact collected identifiers such as Facebook user IDs, is a deceptive act or practice under Section 5(a) of the FTC Act.
2. Whether collecting identifying and profile data about app users’ Facebook friends, when the authorization process conveyed limited collection and non-identifiability, contributes to a materially misleading overall impression.
3. Whether the FTC may resolve the alleged deception through consent orders that restrict future privacy and data-collection representations, require deletion (or directed deletion) of data obtained through the challenged practices, and impose long-term compliance reporting and recordkeeping.

## Decision

- The FTC issued final Decisions and Orders as to Kogan (Docket No. C-4693) and Nix (Docket No. C-4694) as administrative consent orders.
- The orders bar misrepresentations about the extent to which the respondents collect, use, disclose, maintain, or delete personal information, including misrepresentations about whether information is identifiable or de-identified.
- The orders address the deception alleged in the complaint: that users were told the app would not download names or other identifying information when it collected identifiers such as Facebook user IDs, and that the project harvested data about users’ friends.
- The orders require deletion, or direction to delete, covered information obtained through the challenged conduct, and restrict the retention or use of such information and related work product as specified in the orders.
- The orders impose standard FTC compliance obligations, including recordkeeping, notice, and periodic compliance reporting.
- The consent orders are time-limited (commonly 20 years) unless modified or terminated earlier by the Commission.

## Legal Principles

- A practice is deceptive under Section 5(a) of the FTC Act when there is a representation or omission that is likely to mislead consumers acting reasonably under the circumstances and that is material.
- Statements about whether data collection involves “identifying information” can be material, because identifiability may affect a consumer’s decision to authorize access to social-media account data.
- A “not identifiable” or “we do not download your name or other identifying information” claim can be deceptive if the app collects persistent identifiers (such as platform user IDs) that can identify or be used to single out a person.
- Collecting data about non-users (such as an app user’s friends) can heighten the significance of accurate disclosures about the scope of collection and who will be affected.
- The FTC may resolve Section 5 deception allegations through administrative consent orders that impose forward-looking restrictions on privacy representations, require deletion or non-use of improperly obtained data, and require ongoing compliance reporting and documentation.
- Individuals can be bound by FTC orders when alleged to have participated in, directed, or controlled the deceptive conduct, including by signing agreements and directing data-collection parameters.

## Conclusion

In the Matter of Alexsandr Kogan and Alexander Nix arose from alleged misrepresentations used to obtain authorization for a Facebook app that collected identifying profile data from hundreds of thousands of users and tens of millions of their friends for profiling and targeting. The FTC resolved the administrative actions through final consent orders barring future misrepresentations about personal-information practices, requiring deletion or directed deletion of covered data obtained through the challenged conduct, and imposing long-term compliance reporting and recordkeeping duties.


In the Matter of Alexsandr Kogan and Alexander Nix, FTC Docket No. C-4693 and C-4694 (2019)