How Did the Cambridge Analytica Case Change Meta Ads?

In March 2018 Meta, then Facebook, suspended Cambridge Analytica and SCL Group over data that an app developer passed on. For advertisers, the lasting changes came afterward. Meta announced it would shut down Partner Categories, and from 2 July 2018 it required you to state where customer-list data came from. Keep a record of the origin of every list you upload.

What did Meta say happened in March 2018?

Meta’s post of 16 March 2018 says it was suspending SCL Group, including Cambridge Analytica, along with Christopher Wylie and Aleksandr Kogan, “pending further information”. It says Kogan’s app was downloaded by approximately 270,000 people and that he violated Meta’s platform policies by passing data to a third party.

An update the next morning says: “The claim that this is a data breach is completely false.” Meta’s 4 April post said the Facebook information of up to 87 million people, mostly in the US, may have been improperly shared with Cambridge Analytica. This page reports those statements and does not judge them.

What did Meta change in the weeks after?

On 4 April 2018, Meta’s Chief Technology Officer listed “the nine most important changes” to data access. Most concerned apps: access to the Events, Groups and Pages APIs was narrowed, and Facebook Login required review for more permissions.

One item concerned advertising: “Last week we announced our plans to shut down Partner Categories, a product that lets third-party data providers offer their targeting directly on Facebook.” The post gives no exact date. If an old guide tells you to pick a data-provider category in Ads Manager, check how old the guide is.

What changed for advertisers in 2018?

Meta’s post	What it said
13 June 2018	From 2 July, you must say whether customer-file information was “collected directly from people, provided by partners or a combination of the two”
13 June 2018	From 2 July, sharing a customer-file audience, for example with an agency, needs an audience-sharing relationship in Business Manager and agreement to the Custom Audiences Terms
13 June 2018	Everyone on an ad account who uploads Custom Audiences must accept the terms, not only the admin
22 August 2018	You can “independently work with partners off our platform to create Custom Audiences”, if you have the necessary rights and permissions
21 December 2018	Review of the year says Partner Categories were shut down and new requirements started for businesses that share the pixel and offline event sets

The June post also says the “Why am I seeing this?” menu would show people whether an audience came from the advertiser or a partner. Keep a note of each list’s source so the answer is ready at upload.

How did Meta describe advertising data afterward?

On 23 April 2018 Rob Goldman, Vice President, Ads, wrote: “we do not tell advertisers who you are or sell your information to anyone.” He named three ways advertisers reach people: a person’s use of Facebook, information an advertiser shares, such as customer lists, and information sites and apps send, such as through the Facebook Pixel. Your lists and your pixel are two of the three, so document both.

What did the FTC say in July 2019?

On 24 July 2019 the US Federal Trade Commission announced a “record-breaking $5 billion penalty” against Meta to settle charges that it violated a 2012 FTC order by deceiving users about their ability to control the privacy of their personal information. It also announced separate actions against Cambridge Analytica, its former chief executive Alexander Nix and Aleksandr Kogan.

The order runs 20 years. It requires a privacy review of every new or modified product, service or practice, and greater oversight of third-party apps. These are duties for Meta, so for your own lists the working rules are Meta’s terms and the law where you operate.

What should you do now?

• Record where each customer list came from before you upload it: collected directly, provided by partners, or both. Confirm today’s upload screen in the Help Center.
• If an agency uploads for you, set up audience sharing in Business Manager.
• Read the current Custom Audiences Terms. In 2018 they said you may not sell or transfer your custom audiences, and the wording may have changed.
• With a data partner, make sure the contract gives you the rights and permissions Meta’s August 2018 update asks for.

FAQ

Did the case end third-party data in Meta ad targeting?

It ended Partner Categories, which let data providers offer targeting directly on Facebook. Meta’s August 2018 update says advertisers can still work with partners off its platform to create Custom Audiences, as long as they hold the necessary rights and permissions.

Do I have to say where my customer list came from?

Meta’s June 2018 post says that from 2 July 2018 advertisers must state the origin when they upload a new customer-file audience. The options it named were collected directly, provided by partners, or both. Check the current upload flow in Ads Manager for today’s wording.

Did the FTC settlement set rules for advertisers?

The release lists requirements for Meta: privacy reviews, board oversight and app controls. The only listed requirement that mentions advertising stops Meta from using security phone numbers for ads. It sets no targeting rules for you, so check Meta’s terms and your local privacy law.