Cambridge Analytica: How Your Data Became a Weapon

🗂️ About This Series

This is the first post in our six-part series on how personal data has been weaponised, from Cambridge Analytica to the AI-driven systems profiling you today.

We'll look at how these tools work, who's using them, what they do with your data, and what you can do to push back. Let's start with the case that blew the lid off: Cambridge Analytica.

Not our usual topic, but please read on. I know this isn't about building. But the way AI and big data are being used will shape how we live and plan for the future, and it touches your home too: smart home devices, finance apps and builder portals all collect your data. I think AI is great, and some tools are genuinely incredible, but there's a mountain of hype and self-serving noise. This series is a reality check, not a rant.

Introduction

You probably suspect your phone is listening. One marketing firm has openly pitched exactly that to advertisers (READ ABOUT IT HERE).

But what if every single interaction—from customer calls to social media use—is logged, analysed, and added to a robust AI-assembled profile?

Every app, website and device builds a profile of you, and today those profiles are linked through unique device IDs, cross-referenced and shared.

This isn't science fiction. Remember Cambridge Analytica, the political consultancy that harvested data from up to 87 million Facebook users and turned it into predictive personality scores?

Critics and whistleblowers called it a psychological weapon used to sway elections. It shocked the world, yet it barely scratched the surface of what today's AI tools can do.

The good news is we can learn from the past: use privacy-preserving tools, demand the right not to be profiled, and push for stronger regulation. The question is whether we act before the weapon becomes too precise to resist.

Apps once reached your friends' data through you, which shows how far personal data can travel.

Cambridge Analytica as a “Data WMD”

So what exactly happened?

In the early 2010s, a Facebook app called “This Is Your Digital Life” harvested data not just from people who installed it, but from their friends too, without their knowledge. Estimates put it at up to 87 million Facebook users, including their likes, friends and interests.

Cambridge Analytica used that data to build psychographic profiles based on the Big Five personality traits (openness, conscientiousness, extraversion and so on). Instead of grouping people by age or location (demographics), they grouped them by behaviour and personality. That's what made it powerful, and dangerous.

💡

A psychographic profile is a way to describe people not by where they live or how much money they make, but by their personality, beliefs, values, and lifestyle. Think of it as a profile built on why you act the way you do—your opinions, daily routines, interests, and even fears.

Unlike demographics—which capture obvious facts such as age or location—psychographics digs deeper into your mindset and motivations. Marketers and firms collect this information through surveys, social media behavior, and digital footprints.

When combined with lots of user data (like Facebook likes or browsing habits), companies like Cambridge Analytica used psychographic profiles to predict—and even try to influence—the way you think or vote. This is why critics labeled it a real-life “data weapon.

Why call it a “Data WMD”?

Whistleblower Christopher Wylie and others called it psychological warfare. Knowing someone's personality, CA could craft messages designed to influence them emotionally, notably around the 2016 US election and the Brexit campaign.

In the words of Wylie: they could determine "what kind of messaging you’d be susceptible to" and push you toward a specific outcome.

So, what were the consequences?

Cambridge Analytica didn't survive. After global outrage and legal pressure, it shut down and filed for bankruptcy in May 2018.

Facebook (now Meta) was fined US$5 billion by the US Federal Trade Commission, one of the largest privacy penalties ever, and settled a separate US class action for US$725 million. Regulators elsewhere took action too: in Australia, Meta agreed to a $50 million settlement with the OAIC for affected Australian users.

And it's not over. In 2025, a court in Washington DC allowed a lawsuit to proceed accusing Meta of misleading consumers over the scandal. Data misuse has a long tail.

Update: In July 2025, Meta shareholders settled their lawsuit against Mark Zuckerberg, Marc Andreessen, Sheryl Sandberg and other current and former executives over the scandal. They had sought about US$8 billion, the terms weren't disclosed, and the settlement meant the executives didn't have to testify. If you did nothing wrong, why settle? Most likely because the money made from the data was far greater than any fine.

🧠 What this case teaches us

The biggest takeaway? Personal data is incredibly powerful, and dangerous, when combined with behavioural science.

Cambridge Analytica is gone, but its playbook has evolved. Psychographic targeting that once took manual analysis can now be done automatically by AI, at scale and in real time.

Even more unsettling, many of the people behind it resurfaced in new companies under new names, doing the same kind of work.

Conclusion

Cambridge Analytica isn't history. Its tactics are still in use, just harder to detect, faster to deploy, and powered by AI instead of spreadsheets.

If we learnt anything from this scandal, it’s this: your data is valuable because it reveals who you are—and that makes it powerful.

In the next post in the series, we’ll look at what happened after Cambridge Analytica collapsed—and how the same people and playbook just moved on under new names.