What data did Cambridge Analytica obtain from Facebook?

Question

Background:

One of the bigger news stories of this week is that a firm called Cambridge Analytica obtained data from Facebook, which was then analyzed and sold to politicians for the purposes of making targeted ads. Here's an article about it

Most of what I've read and heard about it suggests that they obtained access to any information which you make available to your friends:

The data, a portion of which was viewed by The New York Times, included details on users’ identities, friend networks and “likes.” The idea was to map personality traits based on what people had liked on Facebook, and then use that information to target audiences with digital ads.

Researchers in 2014 asked users to take a personality survey and download an app, which scraped some private information from their profiles and those of their friends, activity that Facebook permitted at the time and has since banned.

---

The issue is that when I talk with people about this issue, I want to be doubly sure that "information you share with your friends" is an accurate description of what was harvested. If there was any information harvested that goes beyond that description I would like to be aware of it so that I don't embarrass myself in front of people.

Exactly what information was made available to Cambridge Analytica? More specifically, Is there anything that you might reasonably expect to be private even from your Friends?

I care primarily about users who didn't interact with the app, however including information for those who did would be a bonus.

Answer 1

In simplest terms, it seems that the answer is that at most any information that a user had opted to share with his/her friends was available to Facebook apps prior to 2014.

The documentation for the "user" object under v1.0 of the Facebook Graph API can still be found on the wayback machine: Facebook documentation 2010. However there is some Javascript on that page that interacts poorly with Archive.org and/or my browser, so I've provided a screenshot of the first part of the table here:

This table continues for a total of almost 30 rows; in summary:

• all users' names, gender, locale, facebook id, and verification status are listed as "Publicly Available", meaning that the app would be able to harvest this information from all of the friends of anyone running the app.
• users email addresses, "bio" and "quotes" sections seem not to be available to apps run by friends regardless of user permissions.
• quite a lot of other info is potentially available, but sharing could be turned off by users in their privacy settings. (see this question)

So depending on user settings (and which fields they had filled out in their profile), the app could also potentially access users':

• birthday
• education and work history
• "about me" blurb
• hometown
• relationship status & desires
• religion & political affiliation

I'm not sure of the status at the time this particular app was active, as Facebook did modify privacy options over time, but I think that most of these permissions were "opt-out" ie. allowed by default. Also I believe at some point users were allowed to share these things with their friends but not with their friends' apps, presumably in order to allow users to address this use case while still being "social" with their friend graph.

I must say that the ability to build a graph of all this information linked to specific peoples' names, locales, and circle of acquaintances would be seriously enticing to marketers of any stripe, even if some of the information were a bit sparse due to users opting out. IMHO it is pretty naive to think that similar data dumps do not exist elsewhere; could be in the hands of just about anyone who was doing any major app deployment on Facebook pre-2014.

Answer 2

The information that was shared was what people liked, who their friends were, and some information about those friends. Medium.com reported :

Users’ FRIENDS info available: About me, actions, activities, b-day, check-ins, education, events, games, groups, hometown, interests, likes, location, notes, online status, tags, photos, questions, relationships, religion/politics, status, subscriptions, website, work history

Apps could continue to collect information over time once consent was given. Consent did not expire. In addition, apps could access private messages in the Facebook mailbox. While that is not explicitly friend information, the app would be able to see both sides of the conversation. I.e. they can't see the friend's mailbox, but they can see messages sent from the friend to the person who gave consent and messages sent to friends.

This was version 1.0 of the Graph API. Since 2014, Facebook has been using version 2.0, which provides less information. In particular, it requires friends to consent to provide their information. So if none of someone's friends have consented, that person's friends' list will show as empty. Newer restrictions include expiring consent from apps that have not been used for three months or more.

People who did not consent to share information but whose friends consented had part of their friend's list shared. This is because friendship is a two-party relationship but only one party's consent was needed. In addition, some information (see quoted block above) was released transitively. If the friend could see the information, then the friend could consent to release that information.

If someone did not consent, Cambridge Analytica would not get their complete friends list, but they would get those parts of it that consented. This is significant even without the transitive information, because there are correlations based on a person's friends. For example, if your friends are rural or urban, then you probably are as well. Same thing with liberal/conservative and other characterizations. That network evaluation was important as well.