Cambridge Analytica deceived users: US FTC

More than one and a half year after the Cambridge Analytica scandal first became public, US regulators have said that the now-defunct British data analytics and consulting company engaged in deceptive practices to harvest personal information from tens of millions of Facebook users for voter profiling and targeting.

The US Federal Trade Commission on Friday said it also found that Cambridge Analytica engaged in deceptive practices relating to its participation in the EU-US Privacy Shield framework -- a pact which allows companies to transfer consumer data legally from European Union countries to the US.

The ruling has come after Facebook in July agreed to pay record-breaking $5 billion to the FTC as fine for users' privacy violations in the Cambridge Analytica data scandal involving millions of users.

The FTC ruling prohibits Cambridge Analytica from making misrepresentations about the extent to which it protects the privacy and confidentiality of personal information, as well as its participation in the EU-US Privacy Shield framework and other similar regulatory or standard-setting organizations.

An administrative complaint issued in July alleged that Cambridge Analytica and its then-CEO Alexander Nix and app developer Aleksandr Kogan deceived consumers, the FTC said.

Nix and Kogan agreed to settle the FTC's allegations. Cambridge Analytica, which filed for bankruptcy in 2018, did not respond to the complaint, or to a motion submitted for summary judgment of the allegations.

The administrative complaint alleged that Kogan worked with Nix and Cambridge Analytica to enable Kogan's GSRApp to collect Facebook data from app users and their Facebook friends.

The complaint alleged that app users were falsely told the app would not collect users' names or other identifiable information.

The GSRApp, however, collected users' Facebook User ID, which connects individuals to their Facebook profiles.

The complaint also alleged that Cambridge Analytica claimed it participated in the EU-US Privacy Shield after allowing its certification to lapse.

The US regulators found that Cambridge Analytica violated the FTC Act through the deceptive conduct alleged in the complaint.