Tue Dec 17

Tech giant Meta will pay Australians $50 million for enabling the Cambridge Analytica scandal

Written by Katharine Kemp, Associate Professor, Faculty of Law & Justice; Lead, UNSW Public Interest Law & Tech Initiative, UNSW Sydney

The Australian Information Commissioner today announced ^[1] a settlement with tech giant Meta over its involvement in the Cambridge Analytica scandal.

The settlement will see Meta establish a A$50 million payment program for Australian Facebook users who had their personal data harvested by the British political consulting firm.

The commissioner, Elizabeth Tydd, said ^[2]:

Today’s settlement represents the largest ever payment dedicated to addressing concerns about the privacy of individuals in Australia.

However, details of the payment scheme remain uncertain. And it’s not yet clear whether it will send a strong enough message to other organisations to be more careful when handling sensitive personal information.

What was the Cambridge Analytica scandal?

Cambridge Analytica was a British political consulting firm founded in 2013.

Five years later, it became an infamous household name, thanks to revelations it harvested the personal information of tens of millions ^[3] of Facebook users. The firm then used this data to target messaging for political campaigns, including the 2016 US presidential election, won by Donald Trump.

The firm harvested sensitive data of Facebook users through a third-party app called This is Your Digital Life, created in November 2013 by Aleksandr Kogan, a professor at Cambridge University. It was enabled to do this by Meta, which three years earlier had changed its software to allow third-party apps to access Facebook users’ personal data.

Only 53 people in Australia installed the app.

However, Australia’s information commissioner estimates ^[4] that an additional 311,074 Facebook users who were Facebook “friends” of people who installed the app may also have had their personal information compromised.

Man with pink hair speaking into a megaphone.

Cambridge Analytica whistleblower Chris Wylie. Neil Hall/EPA

How will the payment scheme work?

The payment scheme is the culmination of a protracted legal battle between Australia’s privacy regulator and Meta, which have been locked in court proceedings in Australia since 2020. As part of the agreement, the regulator has dropped proceedings against Meta in the Federal Court.

The payment scheme will be set up by Meta but administered by an independent third party. It will be open to people who:

had a Facebook account between November 2 2013 and December 17 2015
were present in Australia for at least 30 days during that period
either installed the This is Your Digital Life app using Facebook login or were Facebook friends with an individual who installed the app.

People can check whether they are eligible on a help page ^[5] on the Facebook website. The information commissioner anticipates ^[6] those who are eligible will be able to submit applications “in the second quarter of 2025”.

According to the undertaking, it could take two years for eligible claimants to receive a payment from Meta.

Several uncertainties

Several aspects of the payment scheme remain uncertain. This is because a number of elements will be determined by “scheme instructions” to be given by Meta or left to the absolute discretion of the third-party administrator.

For instance, we don’t yet know:

the set amount that will be paid to any eligible person who experienced “a generalised concern or embarrassment”, or
what will be regarded as sufficient evidence that such a person also experienced “specific” loss or damage that entitles them to further compensation.

If the administrator decides on a total amount of compensation for eligible claimants which is less than A$50 million, the remaining funds will be paid to the Australian government’s consolidated revenue fund.

Long overdue

Australia’s privacy commissioner Carly Kind has called this settlement “groundbreaking ^[7]”. But such enforcement action is long overdue.

When the information commissioner originally brought these proceedings in 2020, it was the first time the regulator had sought a civil penalty order under the Privacy Act. But it has had that power since 2014 ^[8].

The commissioner was also following in the footsteps of privacy and consumer protection regulators in other countries that had already taken action against Meta over the Cambridge Analytica scandal.

For instance, the UK privacy regulator fined Facebook the maximum £500,000 ^[9] (A$997,167). The US Federal Trade Commission also settled with Meta on a record-breaking US$5 billion ^[10] (A$7.86 billion) payment.

These precedents help in understanding the limited deterrent effect the Office of the Australian Information Commissioner case is likely to have on Meta. When the US$5 billion settlement was announced in 2019, Facebook’s share price increased ^[11].

The settlement between Meta and the Australian information commissioner represents roughly 0.02% of the tech giant’s US$130 billion global revenue for 2023 ^[12].

A Meta spokesperson said ^[13] the company had settled on a “no admission basis” and that the allegations “relate to past practices no longer relevant to how Meta’s products or systems work today”.

However, this is far from the only privacy breach by Meta ^[14], with the Australian Competition & Consumer Commission last year reaching a A$20 million settlement with Meta companies over claims that its Onavo VPN service misled users about how their data would be used.