Cambridge Analytica, LLC

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF CAMBRIDGE ANALYTICA, LLC COMPLAINT, OPINION, AND FINAL ORDER IN REGARD TO ALLEGED VIOLATIONS OF SECTION 5 OF THE FEDERAL TRADE COMMISSION ACT Docket No. 9383; File No. 182 3107 Complaint, July 22, 2019 Decision, November 25, 2019 This case addresses Cambridge Analytica, LLC's use of the GSRApp to harvest certain Facebook user profile data from approximately 250,000 270,000 Facebook users who directly interacted with the app, as well as 50 65 million of the "friends" in those users' Facebook social network. The complaint alleges that respondents' representation to users who installed the GSRApp that they would not "download [their] name or any other identifiable information" was deceptive because the GSRApp collected identifiable information from these users, including their Facebook User IDs. The complaint also alleges that Cambridge Analytica misrepresented its participation in the EU-U.S. Privacy Shield framework and its adherence to the framework's requirements. When respondent failed to timely file an Answer, Complaint Counsel filed a Motion for Summary Decision. The Commission granted Complaint Counsel's motion and issued an Order to Cease and Desist. Participants For the Commission: Linda Holleran Kopp.

For the Respondents: Adam Harris and Kristine Manoukian, Schulte Roth & Zabel LLP. COMPLAINT The Federal Trade Commission, having reason to believe that Cambridge Analytica, LLC, a corporation, ("Respondent") has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges:

NATURE OF THE CASE 1. This action seeks to hold Respondent responsible for its deceptive acts and practices to harvest personal information from Facebook users for political and commercial targeted advertising purposes. Respondent, along with Alexander Nix and Aleksandr Kogan, jointly and severally, developed, operated, analyzed, and used data obtained through an application on the Facebook platform called the "GSRApp," also sometimes referred to publicly as the "thisisyourdigitallife" app. Using the Graph application programming interface ("Graph API") Facebook made available to developers on its platform, the GSRApp harvested Facebook user profile data from approximately 250,000 270,000 Facebook users who directly interacted with the app, as well as 50-65 million of the "friends" in those users' social networks. Cambridge Analytica, LLC, Alexander Nix, and Aleksandr Kogan obtained the app users' consent to collect their Facebook profile data through false and deceptive means. Specifically, they falsely represented that the GSRApp did not collect any identifiable information from the Facebook users who authorized it.

VOLUME 168 Complaint RESPONDENT 2. Respondent Cambridge Analytica, LLC ("Cambridge Analytica") 1s a private Delaware limited liability company that was formed in December 2013, and had a principal office or place of business at 597 Fifth Avenue, 7th Floor, New York, NY 10017. Cambridge Ana lytica is part of the SCL Group Ltd. family of companies. SCL Elections Limited ("SCL Elections"), a privately held U.K. Corporation, has held an ownership interest in Cambridge Analytica. Cambridge Analytica has operated as a data analytics and consulting company that provides voter-profiling and marketing services. Cambridge Analytica describes itself on its website as "a data- science consultancy and marketing agency" that is "politically neutral." In May 2018, Cambridge Analytica filed for bankruptcy, which proceedings are still ongoing. 3. During the relevant time period, Cambridge Analytica and SCL Elections conducted the business practices described below through an interrelated network of companies that have common business functions, ownership, officers, and employees. For example, Alexander Nix was both the head of SCL Elections and also the Chief Executive Officer of Cambridge Analytica. SCL Elections was placed into liquidation on April 17, 2019. RELATED PARTIES 4. Aleksandr Kogan ("Kogan") is an A american citizen currently residing in New York. Until September 2018, Kogan was a Senior Research Associate and Lecturer at the Department of Psychology at the University of Cambridge in the United Kingdom, where he established and led the Cambridge Prosociality and Well- Being Lab ("CPW Lab"). Kogan was also an owner and co-founder of the now-defunct U.K. corporation, Global Science Research, Ltd. ("GSR"). Kogan has been known at times by the married name, Aleksandr Spectre. 5. Alexander James Ashburner Nix ("Nix") is a British citizen currently residing in the United Kingdom. Until April 30, 2018, Nix was the Chief Executive Officer of Cambridge Analytica and also a director of SCL Elections. Individually or in concert with others, Nix formulated, directed, controlled, had the authority to control, or participated in the acts and practices alleged in this complaint. Nix currently resides in London, England. Nix, in connection with the matters alleged herein, transacts or has transacted business throughout the United States.

JURISDICTION 6. The acts or practices of Respondent alleged in this complaint have been in or affecting commerce, as "commerce" is defined in Section 4 of the Federal Trade Commission Act, and constitute "deceptive acts or practices involving foreign commerce" as set forth in Section 5 of the FTC Act.

CAMBRIDGE ANALYTICA, LLC 715 Complaint RELEVANT BUSINESS PRACTICES A. Agreement to Harvest Facebook User Profile Data for Commercial Purposes 7. In late 2013 or early 2014, Nix, SCL Elections, and Cambridge Analytica became aware of research by individuals at the Psychometrics Centre within the University of Cambridge that found that Facebook profile information could be used to successfully predict an individual's personality traits according to the "OCEAN" scale, a psychometric model that measures an individual's openness to expenences, conscientiousness, extraversion, agreeableness, and neuroticism.

8. Specifically, researchers developed an algorithm that could predict an individual's personality based on the individual's "likes" of pub lic Facebook pages. For example, liking Facebook pages related to How to Lose a Guy in 10 Days, George W. Bush, and rap and hip-hop could be linked with a conservative and conventional personality. The researchers argued that their algorithm, which was more accurate for individuals who had more public Facebook page "likes," could potentially predict an individual's personality better than the person's co -workers, friends, family, and even spouse.

9. Nix, SCL Elections, and Cambridge Analytica were interested in this research because Cambridge Analytica intended to offer voter profiling, microtargeting, and other marketing services to U.S. campaigns and other U.S.-based clients. Through mutual contacts, representatives of SCL Elections (who had dual roles at Cambridge Analytica) reached out to Kogan and academics affiliated with the Psychometrics Centre in early 2014 to discuss a potential working relationship to commercialize this research. 10. Kogan had expertise researching and analyzing Facebook data through his work at the CPW Lab, as well as his prior research collaborations with Facebook that analyzed aggregated Facebook data relating to how people worldwide connect and express emotions. Kogan was willing to enter into a commercial venture with SCL Elections, and after several months of discussion, the parties reached agreement about the scope of work (the "Project"). 11. Importantly, Kogan already had a Facebook app that was registered on the Facebook platform, the CPW Lab app, that could be repurposed to collect profile data from Facebook users and their "friends" through Facebook's developer tool, Graph API (v.l). 12. Facebook's Graph API (v.1) allowed developers to collect Facebook profile data from users who directly installed or otherwise interacted with the de veloper's application or website through a Facebook Login ("App Users"), as well as from these users' Facebook "friends." Facebook allowed this data collection even though the "friends" did not have any direct interaction with the app or website ("Affected Friends"). While Facebook had announced in April 2014 that it was introducing a new version of the Graph API v.2 that would no longer allow developers to collect profile data from Affected Friends, only from the App Users themselves, existing apps had one year before these limitations went into effect, whereas new apps would automatically be limited. Kogan's app was, thus, "grandfathered" into the more VOLUME 168 Complaint permissive data collection allowable under Graph API (v.1), making Kogan an appealing partner for Nix, Cambridge Analytica, and SCL Elections.

13. On May 29, 2014, Kogan incorporated GSR to carry out the Project, separate and apart from his duties at the University of Cambridge. Kogan was the Chief Executive Officer of GSR at all relevant times, and worked on all aspects of GSR' s products and services before it was dissolved in October 2017.

14. On June 4, 2014, GSR and SCL Elections entered into a GS Data and Technology Subscription Agreement (the "June 2014 Agreement"). Nix signed this agreement for SCL Elections. Under this agreement, GSR agreed to harvest Facebook profile data from App Users and Affected Friends in 11 U.S. states, generate personality scores for these individuals, and then match these profiles to U.S. voter records provided to GSR by SCL Elections. GSR would then send these matched records along with the associated personality scores back to SCL Elections. GSR retained the original data set and granted SCL Elections a license to access the data and to use the proprietary GSR personality scores. Following the creation of GSR and the signing of the June 2014 Agreement, Kogan repurposed the CPW Lab app to become the "GSRApp." 15. Although SCL Elections is the entity that entered into the agreement with GSR, it was acting for and on behalf of Cambridge Analytica. SCL Elections entered into a Services Agreement with Cambridge Analytica whereby SCL Elections agreed, among other things, to (a) acquire, for and on behalf of Cambridge Analytica, demographic, transactional, lifestyle, and behavioral data about consumers in target populations; (b) identify and build target voter lists; (c) apply research techniques to understand better the habits and daily lives of target voter groups; and (d) apply psychological profiles to target groups of voters. In a separate agreement, SCL Elections also agreed to license all of its intellectual property to Cambridge Analytica. 16. SCL Elections and Cambridge Analytica played a significant and direct role in the development and implementation of the GSRApp, as well as in the analysis of the data the GSRApp collected. For example:

a. SCL Elections and Cambridge Analytica revised the terms of use for the GSRApp from the original CPW Lab app;

b. SCL Elections and Cambridge Analytica paid all costs totaling over five hundred thousand dollars related to implementing the GSRApp and analyzing the resulting data, including paying U.S.-based survey panel providers to specifically target Facebook users located in the United States to take the GSRApp surveys;

c. SCL Elections and Cambridge Analytica inserted specific questions to be included in some of the surveys, including a number of questions about national security in the United States because this was a particular topic of interest for one of Cambridge Analytica's U.S. -based clients; CAMBRIDGE ANALYTICA, LLC 717 Complaint d. SCL Elections and Cambridge Analytica directly communicated with the U.S.-based survey panel provider about the timing and focus of the GSRApp surveys; and e. SCL Elections and Cambridge Analytica actively assisted in the matching of data harvested from App Users and Affected Friends located in the U.S. and Kogan's personality scores with U.S. voter registration records. 17. Nix was personally involved in the data harvesting Project. In addition to signing the June 2014 Agreement, he directly communicated and met with Kogan about the Project, personally authorized payment for Project-related costs, reviewed survey questions and specifically requested certain Facebook data or analysis, and directed internal actions within SCL Elections and Cambridge Analytica related to implementing the GSRApp, analyzing the GSRApp data, and using the GSRApp data for Cambridge Analytica clients in the United States. B. The GSRApp Harvested Large Quantities of Facebook Profile Data from App Users and Affected Friends Through False and Deceptive Means 18. The GSRApp asked users to answer survey questions and consent to their Facebook profile data being collected, including public Facebook page "likes." Kogan then used the initial participants' survey responses and Facebook "likes" to train his algorithm so that it could predict the users' personality traits based solely on the Facebook "likes" data. This process, which was inspired by original research by others at the University of Cambridge, allowed Kogan to provide personality scores for the Affected Friends, from whom he collected Facebook data but had no survey responses.

19. Kogan then assigned a confidence level to each personality score based on the number of public page "likes" for each U.S. -based App User and Affected Friend, generally requiring a Facebook user to have "liked" at least 10 public Facebook pages to be confident of the personality score.

20. Cambridge Analytica, Nix, and Kogan then conducted a small trial to determine how well Facebook profile information could be matched with U.S. voter records and information from other public databases. The Project would have little value to SCL Elections and Cambridge Analytica if the personality scores could not be matched with actual U.S. voters. 21. The initial trial was a success and showed that the Facebook profile data could be matched with U.S. voter records. Based on this success, Cambridge Analytica, Nix, and Kogan implemented the GSRApp on a wider scale using the Qualtrics survey platform, based in Provo, Utah.

22. Qualtrics recruited U.S.-based consumers through four waves of survey panels over the summer of 2014. Each wave asked different questions of the participants such that Kogan's personality scores covered a broad range of topics, including political enthusiasm, political orientation, frequency in voting, consistency in voting for the same political party, and views on particular controversial issues. Survey participants who completed the survey and VOLUME 168 Complaint authorized the GSRApp to harvest their Facebook profile information were paid a nominal fee of a few dollars for participating in the survey.

23. At the point in every survey in which the GSRApp asked U.S. consumers to authorize the app to collect their Facebook data, the GSRApp made the following representation: In this part, we would like to download some of your Facebook data using our Facebook app. We want you to know that we will NOT download your name or any other identifiable information we are interested in your demographics and likes.

24. Contrary to this representation, the GSRApp collected the Facebook User ID of those users who authorized it. A Facebook User ID is a persistent, unique identifier that connects individuals to their Facebook profiles. Cambridge Analytica, Nix, and Kogan included this representation after finding that half of the survey participants initially refused to grant the GSRApp permission to collect their Facebook profile data. 25. Cambridge Analytica, Nix, and Kogan harvested a significant amount of Facebook profile data from App Users and the Affected Friends located in the U.S. through the GSRApp. Specifically, they harvested the following Facebook profile data from App Users: Facebook User ID; gender; birthdate; location ("current city"); friends list; and "likes" of public Facebook pages. They harvested from Affected Friends their Facebook User ID; name; gender; birthdate; location ("current city"); and "likes" of public Facebook pages. 26. Over the course of the Project, Cambridge Analytica, Nix, and Kogan harvested Facebook profile data from approximately 250,000 270,000 App Users located in the U.S., and harvested profile data from approximately 50 65 million Affected Friends, including at least 30 million identifiable U.S. consumers.

27. In January 2015, GSR and SCL Elections entered into a supplemental agreement ("January 2015 Agreement") regarding additional data from the Project that SCL Elections and Cambridge Analytica wanted. Pursuant to the January 2015 Agreement, GSR provided data and analysis for App Users and Affected Friends for the remaining 39 U.S. states. GSR also provided a more limited set of personality analyses for these consumers than it had provided for consumers in the initial 11 U.S. states.

28. In April 2015, GSR and SCL Elections entered into an addendum to the January 2015 Agreement ("Addendum"), pursuant to which GSR provided SCL Elections and Cambridge Analytica with the underlying Facebook data used to "train" the algorithm that generated the OCEAN personality scores. GSR also provided SCL Elections and Cambridge Analytica with additional information about whether the App Users and Affected Friends included in the second set of data provided pursuant to the January 2015 Agreement had "likes" for about 500 specific pages identified by SCL Elections and Cambridge Analytica. 29. Nix, SCL Elections, and Cambridge Analytica reported to Kogan that they had very positive feedback from their clients and had expressed an interest in continuing to work CAMBRIDGE ANALYTICA, LLC 719 Complaint with Kogan and GSR on other similar projects. While Kogan and GSR were interested in working on follow-up projects, the parties could not reach an agreement and discontinued their work together after GSR transferred the data agreed to in the Addendum in May 2015. 30. In December 2015, several news reports were published regarding Cambridge Analytica's use of Facebook data. Following these reports, Facebook demanded that Kogan, Cambridge Analytica, and its SCL affiliates delete all Facebook data in their possession. While Kogan and SCL Elections certified to Facebook that they had deleted the data obtained through the GSRApp, individuals or other entities still possess this data and/or data models based on this data.

C. Cambridge Analytica Deceptively Claimed it Participated in the EU-U.S. Privacy Shield Framework and that it Adhered to its Principles 31. The EU- U.S. Privacy Shield framework ("Privacy Shield") was designed by the U.S. Department of Commerce ("Commerce") and the European Commission to provide a mechanism for U.S. companies to transfer personal data outside of the EU that is consistent with the requirements of the European Union Directive on Data Protection. Enacted in 1995, the Directive set forth EU requirements for privacy and the protection of personal data. Among other things, it requires EU Member States to implement legislation that prohibits the transfer of personal data outside the EU, with exceptions, unless the European Commission has made a determination that the recipient jurisdiction's laws ensure the protection of such personal data. This determination is referred to commonly as meeting the EU' s "adequacy" standard. 32. To satisfy the EU adequacy standard for certain commercial transfers, Commerce and the European Commission negotiated the EU-U.S. Privacy Shield framework, which went into effect in July 2016. The EU-U.S. Privacy Shield framework allows companies to transfer personal data lawfully from the EU to the United States. To join the EU-U.S. Privacy Shield framework, a company must self-certify to Commerce that it complies with the Privacy Shield Principles and related requirements that have been deemed to meet the EU' s adequacy standard. Any company that voluntarily withdraws or lets its self-certification lapse must continue to apply the Privacy Shield principles to the personal information it received while a participant in the Privacy Shield and affirm to Commerce on an annual basis its commitment to do so, for as long as it retains such information.

33. Companies under the enforcement jurisdiction of the FTC, as well as the U.S. Department of Transportation, are eligible to join the EU-U.S. Privacy Shield framework. A company under the FTC's jurisdiction that claims it has self-certified to the Privacy Shield Principles, but failed to self-certify to Commerce, may be subject to an enforcement action based on the FTC's deception authority under Section 5 of the FTC Act. 34. Commerce maintains a public website, https://www.privacyshield.gov/welcome, where it posts the names of companies that have self-certified to the EU-U.S. Privacy Shield framework. The listing of companies, https://www.privacyshield.gov/list, indicates whether the company's self-certification is current.

VOLUME 168 Complaint 35. On May 11, 2017, Cambridge Analytica joined Privacy Shield. While the Facebook data harvested through the GSRApp predated its participation in Privacy Shield and is therefore not subject to its protections, Cambridge Analytica continued to collect Facebook and other data from or about U.S. and European consumers after it joined Privacy Shield. 36. Until at least November 27, 2018, Cambridge Analytica disseminated or caused to be disseminated privacy policies and statements on https://cambridgeanalytica.org including, but not limited to, the following statements:

IS CAMBRIDGE ANALYTICA PART OF THE PRIVACY SHIELD FRAMEWORK? Yes: Cambridge Analytica adheres to the EU-US Privacy Shield Principles for the transfer of EU data we use to provide our services, including the onward transfer liability provisions. With respect to personal data received or transferred pursuant to the Privacy Shield Framework, Cambridge Analytica is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. More information on the principles are available at the Privacy Shield website: https://www.privacyshield.gov/.

37. Cambridge Analytica, however, did not complete the steps necessary to renew Cambridge Analytica' s participation in Privacy Shield after that certification expired on or about May 11, 2018, nor did they withdraw and affirm their commitment to protect any personal information they had acquired while in the program. After allowing Cambridge Analytica' s certification to lapse, Cambridge Analytica continued to claim, as indicated in Paragraph 36, that it participates in Privacy Shield.

VIOLATIONS OF THE FTC ACT Deceptive Claim Concerning the Collection of Personal Identifiable Information (Count I) 38. Through the means described in Paragraph 23, Cambridge Analytica represented, directly or indirectly, expressly or by implication, that the GSRApp did not collect any identifiable information from Facebook users who authorized the app. 39. In fact, as described in Paragraphs 24-25, the GSRApp collected identifiable information from Facebook users who authorized the App, including the Facebook User ID of those users who used it. Therefore, the representation set forth in Paragraph 38 is false or misleading.

CAMBRIDGE ANALYTICA, LLC 721 Complaint Deceptive Claim by Cambridge Analytica Concerning Participation in Privacy Shield (Count II) 40. As described in Paragraph 36, Cambridge Analytica represented, directly or indirectly, expressly or by implication, that it was a participant in Privacy Shield until at least November 27, 2018.

41. In fact, as described in Paragraph 37, Cambridge Analytica did not renew its participation in Privacy Shield and allowed its certification to lapse in May 2018. Therefore, the representation set forth in Paragraph 40 is false or misleading. Deceptive Claim by Cambridge Analytica Concerning Compliance with Continuing Obligations in Privacy Shield (Count III) 42. As described in Paragraph 36, Cambridge Analytica represented that Cambridge Analytica adheres to the Privacy Shield principles. These principles include a requirement that if a company ceases to participate in Privacy Shield, it must affirm to Commerce that it will continue to apply the principles to personal information that it received during the time it participated in the program.

43. In fact, as described in Paragraph 37, Cambridge Analytica has not affirmed to Commerce that they will continue to apply the principles to personal information that Cambridge Analytica received during the time Cambridge Analytica participated in the program. Therefore, the representation set forth in Paragraph 42 is false or misleading. NOTICE You are notified that on March 24, 2020, at 10:00 a.m., at the Federal Trade Commission offices, 600 Pennsylvania Avenue, NW, Room 532-H, Washington, D.C. 20580, an Administrative Law Judge of the Federal Trade Commission, will hold a hearing on the charges set forth in this Complaint. At that time and place, you will have the right under the Federal Trade Commission Act to appear and show cause why an order should not be entered requiring you to cease and desist from the violations of law charged in this Complaint. You are notified that you are afforded the opportunity to file with the Federal Trade Commission ("Commission") an answer to this Complaint on or before the 14th day after service of the Complaint upon you. An answer in which the allegations of the Complaint are contested must contain a concise statement of the facts constituting each ground of defense; and specific admission, denial, or explanation of each fact alleged in the Complaint or, if you are without knowledge thereof, a statement to that effect. Allegations of the Complaint not thus answered will be deemed to have been admitted.

If you elect not to contest the allegations of fact set forth in the Complaint, the answer should consist of a statement that you admit all of the material facts to be true. Such an answer will constitute a waiver of hearings as to the facts alleged in the Complaint and, together with the Complaint, will provide a record basis on which the Commission may issue a final decision VOLUME 168 Complaint containing appropriate findings and conclusions and a final order disposing of the proceeding. In such answer, you may, however, reserve the right to submit proposed findings of fact and conclusions of law under FTC Rule § 3.46.

Failure to answer timely will be deemed to constitute a waiver of your right to appear and contest the allegations of the Complaint. It will also authorize the Commission, without further notice to you, to find the facts to be as alleged in the Complaint and to enter a final decision containing appropriate findings and conclusions and a final order disposing of the proceeding. The Administrative Law Judge will hold an initial prehearing scheduling conference to be held not later than 10 days after the answer is filed by the Respondent. Unless otherwise directed by the Administrative Law Judge, the scheduling conference and further proceedings will take place at the Federal Trade Commission, 600 Pennsylvania Avenue, NW, Room 532-H, Washington, D.C. 20580. Rule 3.21(a) requires a meeting of the parties' counsel as early as practicable before the prehearing scheduling conference, but in any event no later than 5 days after the answer is filed by the Respondent. Rule 3.31(b) obligates counsel for each party, within 5 days of receiving a Respondent's answer, to make certain initial disclosures without awaiting a formal discovery request.

The following is the form of the order which the Commission has reason to believe should issue if the facts are found to be as alleged in the Complaint. If, however, the Commission concludes from record facts developed in any adjudicative proceedings in this matter that the proposed order provisions as to Respondent[s] might be inadequate to fully protect the consuming public, the Commission may order such other relief as it finds necessary and appropriate.

Moreover, the Commission has reason to believe that, if the facts are found as alleged in the Complaint, it may be necessary and appropriate for the Commission to seek relief to redress injury to consumers[, or other persons, partnerships or corporations. Such relief could be in the form of restitution for past, present, and future consumers and such other types of relief as are set forth in Section 19(b) of the Federal Trade Commission Act. The Commission will determine whether to apply to a court for such relief on the basis of the adjudicative proceedings in this matter and such other factors as are relevant to consider the necessity and appropriateness of such action.

ORDER Definitions For purposes of this Order, the following definitions apply: A. "Covered Information" means the following information from or about an individual consumer including: (a) a first and last name; (b) a physical address or precise geolocation; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name; (d) a telephone number; (e) a Social Security number; (f) a driver's license or other government -issued CAMBRIDGE ANALYTICA, LLC 723 Complaint identification number; (g) a financial institution account number; (h) credit or debit card information; (i) a persistent identifier, such as a customer number held in a "cookie," a mobile device ID, or processor serial number; G) data fields that can be accessed or collected through Facebook from or about Facebook Users or their Friends (e.g. , "likes," "hometowns," "birthdates," "photos," "gender," "educational information," "religious or political views," or "marital" or other "relationship" status); (k) information that is created, maintained, or accessed by the consumer (e.g. , "messages"); (1) any data regarding a consumer's activities online (e.g., searches conducted, web pages visited, or content viewed); or (m) any user credentials, such as a username and password.

B. "Facebook" means Facebook Inc., its wholly or partially owned subsidiaries, unincorporated divisions, joint ventures, operations under assumed names, and affiliates, and all directors, officers, members, employees, agents, consultants, and other persons working for or on behalf of the foregoing.

C. "GSRApp" means all iterations of the GSRApp Facebook a application that first began operating on the Facebook platform in May 2014.

D. "Respondent" means Cambridge Analytica, LLC, and its successors and assigns. E. "Trustee" means Salvatore Lamonica, Esq., appointed Chapter 7 Trustee for Respondent in the United States Bankruptcy Court for the Southern District of New York, Case No. 19-11500 (SHL).

Provisions I. Prohibition against Misrepresentations about Covered Information IT IS ORDERED that Respondent and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service must not misrepresent in any manner, expressly or by implication, the extent to which they protect the privacy and confidentiality of any Covered Information, including: A. The extent to which they collect, use, share, or sell any Covered Information; and B. The purposes for which they collect, use, share, or sell any Covered Information. II. Prohibition against Misrepresentations about Participating in Privacy or Security Programs IT IS FURTHER ORDERED that Respondent and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service must not misrepresent in any manner, expressly or by implication, VOLUME 168 Complaint the extent to which Respondent is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy or security program sponsored by a government or any self-regulatory or standard-setting organization, including but not limited to the EU-U.S. Privacy Shield framework, the Swiss-U.S. Privacy Shield framework, and the APEC Cross-Border Privacy Rules.

III. Requirement to Meet Continuing Obligations Under Privacy Shield IT IS FURTHER ORDERED that Respondent and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service shall not possess or control personal information from European Union residents that Respondent received while it participated in the EU-U.S. Privacy Shield framework, unless Respondent:

A. affirms to the Department of Commerce, within ten (10) days after the effective date of this Order and on an annual basis thereafter for as long as it retains such information, that it will:

1. continue to apply the EU-U.S. Privacy Shield framework principles to the personal information it received while it participated in the Privacy Shield; or 2. protect the information by another means authorized under EU (for the EU-U.S. Privacy Shield framework) or Swiss (for the Swiss-U.S. Privacy Shield framework) law, including by using a binding corporate rule or a contract that fully reflects the requirements of the relevant standard contractual clauses adopted by the European Commission; or For purposes of this subprovision, Respondent does not possess or control personal information in the possession of a government regulatory or law enforcement agency, including the Un ited Kingdom's Information Commissioner's Office. B. returns or deletes the information within ten (10) days after the effective date of this Order; or if, as of the effective date of this Order, the information is in the possession of a government regulatory or law enforcement agency, including the United Kingdom's Information Commissioner's Office, returns or deletes the information within ten (10) days after the information is returned to Respondent. IV. Required Deletion of Data IT IS FURTHER ORDERED that Respondent, and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, must: CAMBRIDGE ANALYTICA, LLC 725 Complaint A. Provide, within ten (10) days from the effective date of this Order, the Commission with a written statement, sworn under penalty of perjury, providing the name, address, and phone number for each person with whom Respondent shared any Covered Information collected from consumers through GSRApp, and any information that originated, in whole or in part, from this Covered Information;

B. Delete or destroy all Covered Information collected from consumers through GSRApp, and any information or work product, including any algorithms or equations, that originated, in whole or in part, from this Covered Information. Such deletion or destruction must occur within ten (10) days of the effective date of this Order, or if such information is in the possession of a government regulatory or l aw enforcement agency, including the United Kingdom's Information Commissioner's Office, as of the effective date of this Order, within ten (10) days after the Covered Information is returned to Respondent. Provided, however, that such Covered Information, or any information that originated in whole or in part from such Covered Information, need not be deleted or destroyed for so long as requested by a government agency or otherwise required by regulation, court order or other legal obligation; and C. Provide a written statement to the Commission, sworn under penalty of perjury, confirming the foregoing. This statement must be provided: (1) within thirty (30) days after the effective date of the Order; or, if applicable, (2) within thirty (30) days after the Covered Information is returned to Respondent from a government regulatory or law enforcement agency, or within thirty (30) days after any legal obligation to preserve the Covered Information has ended. V. Duty to Protect Covered Information IT IS FURTHER ORDERED that Respondent, and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, are permanently restrained and enjoined from disclosing, using, selling, or receiving any benefit from Covered Information or any information that originated, in whole or in part, from this Covered Information.

VI. Access to Corporate Documents and Data IT IS FURTHER ORDERED that the Trustee shall make available to the Commission, for inventory and copying, all correspondence, email, financial data including tax returns, and any other documents, computer equipment, and electronically stored information, in Trustee's possession, custody, or control, that contain information about Respondent's role and assets at the Commission's expense. The Commission shall return each item produced for inventory or copying to the Trustee within ten (10) business days from the data and time of the Trustee's delivery of each such item.

VOLUME 168 Complaint IT IS FURTHER ORDERED that the Trustee, to the extent he has possession, custody, or control of computer equipment or electronically stored information described above, shall provide the Commission with any necessary means of access to the computer equipment or electronically stored information, including, but not limited to, computer access codes and passwords.

IT IS FURTHER ORDERD that the Trustee shall provide notice to the Commission of the proposed abandonment of any corporate books or records of Respondent, and upon the Commission's designation, the Trustee shall transfer such books and records to the Commission. VII. Order Effective Dates IT IS FURTHER ORDERED that the final and effective date of this Order is the 60th day after this Order is served. This Order will terminate twenty (20) years from the date of its issuance (which date may be stated at the end of this Order, near the Commission's seal), or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying settlement) in federal court alleging any violation of this Order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of:

A. Any Provision in this Order that terminates in less than twenty (20) years; B. This Order's application to any Respondent that is not named as a defendant in such complaint; and C. This Order if such complaint is filed after the Order has terminated pursuant to this Provision.

Provided, further, that if such complaint is dismissed or a federal court rules that the Respondent did not violate any Provision of the Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Order will terminate according to this Provision as though the complaint had never been filed, except that the Order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

THEREFORE, the Federal Trade Commission, this twenty-second day of July, 2019, has issued this Complaint against Respondent Cambridge Analytica. By the Commission.

CAMBRIDGE ANALYTICA, LLC 727 Opinion of the Commission OPINION OF THE COMMISSION By Commissioner Noah Joshua Phillips, for the Commission: Respondent Cambridge Analytica, LLC ("Cambridge Analytica"), a data analytics and consulting company, is charged with violating the Federal Trade Commission Act ("FTC Act") by employing false and deceptive tactics to harvest personal information from tens of millions of Facebook users through a Facebook application called the "GSRApp," also known as the "thisisyourdigitallife" app. As discussed below, Complaint Counsel move for summary decision. Because Cambridge Analytica has neither opposed Complaint Counsel's motion nor answered the Commission's administrative complaint, we decide this motion based on the undisputed facts as set forth in Complaint Counsel's motion and alleged in the Complaint. The Complaint alleges that Cambridge Analytica, acting together with Alexander James Ashburner Nix ("Nix"), its Chief Executive Officer, and Aleksandr Kogan ("Kogan"), an applications developer who worked with the company, used the GSRApp to obtain Facebook user profile data from approximately 250,000 270,000 Facebook users who directly interacted with the app ("App Users"), as well as from 50-65 million of the "friends" in those users' social networks. The Complaint charges Cambridge Analytica with obtaining App Users' consent to collect their Facebook profile data by falsely representing that the GSRApp did not collect any personally identifiable information from Facebook users who interacted with it, such as their Facebook User ID. Cambridge Analytica then used the information collected through the Facebook GRSApp for voter-profiling and targeted advertising purposes.1 The Complaint also charges Cambridge Analytica with deceptive acts and practices related to its participation in the European Union-United States Privacy Shield framework ("Privacy Shield"). The Complaint alleges that Cambridge Analytica, via its w ebsite, disseminated statements that falsely claimed it was a participant in Privacy Shield at a time when it had allowed its certification to lapse, and that it represented that it adhered to Privacy Shield principles despite failing to affirm to the U.S. Department of Commerce that it would continue to apply Privacy Shield protections to personal information collected while it participated in the program.

In May 2018, Cambridge Analytica filed for Chapter 7 bankruptcy, and those proceedings are ongoing. On July 24, 2019, the Commission issued its Complaint which, 1 On July 24, 2019, the Commission accepted for public comment consent settlements with Respondents Nix and Kogan to address their respective roles in the deceptive acts and practices related to the Facebook GSRApp by requiring them, inter alia, to destroy information collected through the GSRApp, as well as algorithms derived from such information, and prohibiting them from misrepresenting the extent to which they protect the privacy and confidentiality of personally identifiable information that they collect, use, share, or sell about individual consumers in the future. Aleksandr Kogan and Alexander Nix, https://www ftc.gov/enforcement/cases-proceedings/182-3106­ 182-3107/aleksandr-kogan-alexander-nix. In a related enforcement action, the Commission settled charges that Facebook, Inc. violated its 2012 FTC order by deceiving Facebook users about their ability to control the privacy of their personal information. The settlement imposed a $5 billion civil penalty on Facebook and contained injunctive relief imposing substantial new changes to its operations. Facebook, Inc., https://www ftc.gov/enforcement/cases­ proceedings/092-3184/facebook-inc.

VOLUME 168 Opinion of the Commission together with a notice order, was served on both Cambridge Analytica at its corporate headquarters and on its bankruptcy trustee. Cambridge Analytica failed to file an answer within the time required by the Commission's Rules of Practice, i.e., by August 12, 2019. Under the Rules, Cambridge Analytica's failure to file an answer is deemed a waiver of its right to appear and to contest the allegations in the Complaint. 16 C.F.R. § 3.12(c). Rule 3.12(c) authorizes the Commission, without further notice to the Respondent, "to find the facts to be as alleged in the complaint and to enter a final decision containing appropriate findings and conclusions and a final order disposing of the proceeding." Id.

W e now have before us Complaint Counsel's Motion for Summary Decision .2 Cambridge Analytica did not file an opposition to the Motion when due under the Rules, i.e., by September 4, 2019.3 Complaint Counsel seek a determination that Cambridge Analytica made false or misleading representations in violation of Section 5 of the FTC Act: • to Facebook users who authorized the GSRApp that it did not collect their personally identifiable information (Count I);

• that it was a participant in Privacy Shield from May to November 2018, even though it had allowed its certification to lapse (Count II); and • that it would adhere to Privacy Shield principles, even though it failed to affirm to the Department of Commerce, as required, that it would continue to apply those principles to personal information it had acquired while participating in the program (Count III).

As discussed below, we grant Complaint Counsel's Motion for Summary Decision. Because Cambridge Analytica has defaulted and has failed to challenge the facts presented as undisputed by Complaint Counsel's Motion, we find the facts as set forth in the Motion. (Section I). Based on our analysis of the undisputed facts under applicable legal standards and precedent, we conclude that Cambridge Analytica is liable on all three Counts of the Complaint. (Section III). Finally, we discuss the order we issue against Cambridge Analytica and its successors and assigns to remedy Cambridge Analytica's violations of Section 5 of the FTC Act. (Section IV). 2 For purposes of this opinion, we use the following abbreviations: Compl.: Complaint CCMSD: Complaint Counsel's Motion for Summary Decisi on CCCSUF: Complaint Counsel's Concise Statement of Undisputed Facts 3 16 C.F.R. §§ 3.24(a)(2), 4.3(c). Complaint Counsel discussed the Motion with Cambridge Analytica's bankruptcy trustee, who is legally authorized to act on behalf of the company. The bankruptcy trustee did not object to the filing of the Motion, and provided comments on the notice order attached to the Complaint. CCMSD at 2-3. Based on these comments, Complaint Counsel propose certain minor changes to the notice order in a proposed order submitted with the Motion for Summary Decision, which we discuss in connection with our remedy determination in Section IV.

CAMBRIDGE ANALYTICA, LLC 729 Opinion of the Commission I. FACTS Cambridge Analytica is a private Delaware limited liability corporation that was formed in December 2013, and had a principal office or place of business at 597 Fifth Avenue, 7th Floor, New York, NY 10017. CCCSUF ¶ 1; Compl. ¶ 2. Cambridge Analytica is part of the SCL Group Ltd. family of companies, as is SCL Elections Limited ("SCL Elections"), 4 a privately held U.K. Corporation, which has held an ownership interest in Cambridge Analytica. CCCSUF ¶ 2; Compl. ¶ 2. Cambridge Analytica has operated as a data analytics and consulting company that provides voter-profiling and marketing services. Cambridge Analytica describes itself on its website as "a data- science consultancy and marketing agency" that is "politically neutral". CCCSUF ¶ 3; Compl. ¶ 2. In May 2018, Cambridge Analytica filed for bankruptcy, which proceedings are still ongoing. CCCSUF ¶ 4; Compl. ¶ 2.

During the relevant time period, Cambridge Analytica and SCL Elections conducted their business practices through an interrelated network of companies that have common business functions, ownership, officers, and employees. For example, Nix was both the head of SCL Elections and also the Chief Executive Officer of Cambridge Analytica. SCL Elections was placed into liquidation on April 17, 2019. CCCSUF ¶ 5; Compl. ¶ 3. Cambridge Analytica, together with SCL Elections (Compl. ¶¶ 1-3) and two other relevant parties, Nix and Kogan (Compl. ¶¶ 4-5), engaged in the conduct alleged in Count I of the Complaint (Compl. ¶¶ 38-39). Nix is a British citizen currently residing in the United Kingdom. Until April 30, 2018, Nix was the Chief Executive Officer of Cambridge Analytica and a director of SCL Elections. Nix currently resides in London, England, and in connection with the matters alleged herein, transacts or has transacted business throughout the United States. Compl. ¶ 5. Kogan is an American citizen currently residing in New York. Until September 2018, Kogan was a Senior Research Associate and Lecturer at the Department of Psychology at the University of Cambridge in the United Kingdom, where he established and led the Cambridge Prosociality and Well- Being Lab ("CPW Lab"). Kogan was also an owner and co founder of the now- defunct U.K. corporation, Global Science Research, Ltd. ("GSR"). Compl. ,r 4.5 A. The Agreement to Harvest Facebook User Profile Data for Commercial Purposes In late 2013 or early 2014, Cambridge Analytica, along with Nix and SCL Elections, became aware of research by individuals at the Psychometrics Centre at the University of Cambridge that found that Facebook profile information could be used to successfully predict an individual's personality traits according to the "OCEAN" scale, a psychometric model that measures an individual's openness to expenences, conscientiousness, extraversion, 4 See Complaint ¶ 5, Aleksandr Kogan and Alexander Nix, https://www.ftc.gov/enforcement/cases-proceedings/182­ 3106-182-3107/aleksandr-kogan-alexander-nix.

5 Kogan has been known at times by the married name, Aleksandr Spectre. Id. VOLUME 168 Opinion of the Commission agreeableness, and neuroticism. CCCSUF ¶ 8; Compl. ¶ 7. Specifically, researchers developed an algorithm that could predict an individual's personality based on the individual's "likes" of public Facebook pages. For example, liking Facebook pages related to How to Lose a Guy in 10 Days, George W. Bush, and rap and hip-hop could be linked with a conservative and conventional personality. The researchers asserted that their algorithm, which was more accurate for individuals who had more public Facebook page "likes," could potentially predict an individual's personality better than the person's co -workers, friends, family, and even spouse. CCCSUF ¶ 9; Compl. ¶ 8.

Cambridge Analytica, along with Nix and SCL Elections, was interested in this research because Cambridge Analytica intended to offer voter-profiling, microtargeting, and other marketing services to U.S. political campaigns and other U.S.-based clients. CCCSUF ¶ 10; Compl. ¶ 9. Through mutual contacts, representatives of SCL Elections (who had dual roles at Cambridge Analytica) reached out to Kogan and academics affiliated with the Psychometrics Centre in early 2014 to discuss a potential working relationship to commercialize this research. CCCSUF ¶ 11; Compl. ¶ 9. Kogan, who was a Senior Research Associate and Lecturer at the Department of Psychology at the University of Cambridge, had expertise researching and analyzing Facebook data through his work at the CPW Lab. CCSUF ¶ 12; Compl. ¶ 10. In particular, he had prior research collaborations with Facebook through which he analyzed aggregated Facebook data relating to how people worldwide connect and express emotions. Id. Kogan was willing to enter into a commercial venture with SCL Elections, and after several months of discussion, the parties reached ag reement about the scope of work (the "Project"). CCCSUF ¶ 13; Compl. ¶ 10.

By that point, Kogan already had a Facebook app that was registered on the Facebook platform the CPW Lab app and could be repurposed to collect profile data from Facebook users and their "friends" through Facebook's developer tool, Graph API (v.l). CCCSUF ,r 14; Compl. ,r 11. Facebook's Graph API (v.1) allowed developers to collect Facebook profile data from users who directly installed or otherwise interacted with the developer's appl ication or website through a Facebook Login, as well as from these users' Facebook "friends" ("Affected Friends"). CCCSUF ,r 15; Compl. ,r 12. Facebook allowed this data collection even though the Affected Friends did not have any direct interaction with the app or website. CCCSUF ¶ 15; Compl. ¶ 12. While Facebook had announced in April 2014 that it was introducing a new version of the Graph API v.2 that would allow developers to collect profile data only from the App Users themselves, and not from Affected Friends, existing apps had one year before these limitations went into effect, whereas new apps would automatically be limited. CCCSUF ¶ 15; Compl. ,r 12. Thus, Kogan's app was "grandfathered" into the more permissive data collection allowable under Graph API (v.1), making Kogan an appealing partner for Cambridge Analytica, Nix, and SCL Elections. CCCSUF ¶ 15; Compl. ¶ 12.

On May 29, 2014, Kogan incorporated a now-defunct U.K. corporation, Global Science Research, Ltd., to carry out the Project, separate and apart from his duties at the University of Cambridge. CCCSUF ¶ 16; Compl. ¶ 13. Kogan was a founder and Chief Executive Officer of GSR, and worked on all aspects of GSR's products and services before it was dissolved in October 2017. CCCSUF ¶ 16; Compl. ¶ 13. On June 4, 2014, GSR and SCL Elections entered CAMBRIDGE ANALYTICA, LLC 731 Opinion of the Commission into the GS Data and Technology Subscription Agreement (the "June 2014 Agreement"). Nix signed this agreement for SCL Elections. CCCSUF ¶ 17; Compl. ¶ 14. Under this agreement, GSR agreed to harvest Facebook profile data from App Users and Affected Friends in 11 U.S. states, generate personality scores for these individuals, and then match these profiles to U.S. voter records provided to GSR by SCL Elections. CCCSUF ¶ 18; Compl. ¶ 14. GSR would then send these matched records along with the associated personality scores back to SCL Elections. CCCSUF ¶ 19; Compl. ¶ 14. GSR retained the original data set and granted SCL Elections a license to access the data and to use the proprietary GSR personality scores. CCCSUF ¶ 19; Compl. ¶ 14. Following the creation of GSR and the signing of the June 2014 Agreement, Kogan repurposed the CPW Lab app to become the GSRApp. CCCSUF ¶ 20; Compl. ¶ 14. Although SCL Elections is the entity that entered into the agreement with GSR, it was acting for and on behalf of Cambridge Analytica. CCCSUF ¶ 21; Compl. ¶ 15. SCL Elections entered into a Services Agreement with Cambridge Analytica whereby SCL Elections agreed, among other things, to (a) acquire, for and on behalf of Cambridge Analytica, demographic, transactional, lifestyle, and behavioral data about consumers in target populations; (b) identify and build target voter lists; (c) apply research techniques to understand better the habits and daily lives of target voter groups; and (d) apply psychological profiles to target groups of voters. In a separate agreement, SCL Elections also agreed to license all of its intellectual property to Cambridge Analytica. Id.

Cambridge Analytica and SCL Elections played a significant and direct role in the development and implementation of the GSRApp, as well as in the analysis of the data the GSRApp collected. CCCSUF ¶ 22; Compl. ¶ 16. Among other things, Cambridge Analytica and SCL Elections revised the terms of use for the GSRApp from the original CPW Lab app. CCCSUF ¶ 23; Compl. ¶ 16.a. Cambridge Analytica and SCL Elections also paid all costs, totaling over $500,000, related to implementing the GSRApp and analyzing the resulting data, including paying U.S.-based survey panel providers specifically to target Facebook users located in the United States to take the GSRApp surveys. CCCSUF ¶ 24; Compl. ¶ 16.b. Cambridge Analytica and SCL Elections also inserted specific questions to be included in some of the surveys, including a number of questions about national security in the United States, as this was a particular topic of interest for one of Cambridge Analytica's U.S. -based clients. CCCSUF ¶ 25; Compl. ¶ 16.c. Cambridge Analytica and SCL Elections also directly communicated with the U.S.-based survey panel provider about the timing and focus of the GSRApp surveys. CCCSUF ¶ 26; Compl. ¶ 16.d. Cambridge Analytica and SCL Elections also actively assisted in the matching of data harvested from App Users and Affected Friends located in the United States and Kogan's personality scores with U.S. voter registration records. CCCSUF ,r 27; Compl. ,r 16.e.

Nix was personally involved in the data-harvesting Project. In addition to signing the June 2014 Agreement, he directly communicated and met with Kogan about the Project; personally authorized payment for Project-related costs; reviewed survey questions and specifically requested certain Facebook data or analysis; and directed internal actions within SCL Elections and Cambridge Analytica related to implementing the GSRApp, analyzing the VOLUME 168 Opinion of the Commission GSRApp data, and using the GSRApp data for Cambridge Analytica clients in the United States. CCCSUF ¶ 28; Compl. ¶ 17.

B. The GSRApp Harvested Large Quantities of Facebook Profile Data from App Users and Affected Friends The GSRApp asked users to answer survey questions and consent to their Facebook profile data being collected, including public Facebook page "likes." Kogan then used the initial participants' survey responses and Facebook "likes" to train his algorithm so that it could predict the users' personality traits based solely on the Facebook "likes" data. lbis process allowed Kogan to provide personality scores for the Affected Friends, from whom he collected Facebook data but had no survey responses. CCCSUF ¶ 29; Compl. ¶ 18. Kogan then assigned a confidence level to each personality score based on the number of public page "likes" for each U.S. -based App User and Affected Friend, generally requiring a Facebook user to have "liked" at least 10 public Facebook pages to be confident of the personality score. CCCSUF ¶ 30; Compl. ¶ 19. Cambridge Analytica, Nix, and Kogan then conducted a small trial to determine how well Facebook profile information could be matched with U.S. voter records and information from other public databases. The Project would have had little value to Cambridge Analytica and SCL Elections if the personality scores could not be matched with actual U.S. voters. CCCSUF ¶ 31; Compl. ¶ 20. The initial trial was a success and showed that the Facebook profile data could be matched with U.S. voter records. Based on this success, Cambridge Analytica, Nix, and Kogan implemented the GSRApp on a wider scale using the Qualtrics survey platform, based in Provo, Utah. CCCSUF ¶ 32; Compl. ¶ 21. Qualtrics recruited U.S.-based consumers through four waves of survey panels during the summer of 2014. Each wave asked different questions of the participants such that Kogan's personality scores covered a broad range of topics, including political enthusiasm, political orientation, frequency in voting, consistency in voting for the same political party, and views on particular controversial issues. Survey participants who completed the survey and authorized the GSRApp to harvest their Facebook profile information were paid a nominal fee of a few dollars for participating in the survey. CCCSUF ¶ 33; Compl. ¶ 22. At the point in every survey in which the GSRApp asked U.S. consumers to authorize the app to collect their Facebook data, the GSRApp made the following representation: In this part, we would like to download some of your Facebook data using our Facebook app. We want you to know that we will NOT download your name or any other identifiable information we are interested in your demographics and likes. CCCSUF ¶ 34; Compl. ¶ 23. Cambridge Analytica, Nix, and Kogan included this representation after finding that half of the survey participants initially refused to grant the GSRApp permission to collect their Facebook profile data. CCCSUF ¶ 35; Compl. ¶ 24. Contrary to this representation, the GSRApp collected the Facebook User ID of those App Users who authorized it. CCCSUF ¶ 35; Compl. ¶ 24. A Facebook User ID is a persistent, CAMBRIDGE ANALYTICA, LLC 733 Opinion of the Commission unique identifier that connects individuals to their Facebook profiles. CCCSUF ¶ 35; Compl. ¶ 24.

Cambridge Analytica, Nix, and Kogan harvested a significant amount of Facebook profile data from App Users and the Affected Friends located in the U.S. through the GSRApp. Specifically, they harvested the following Facebook profile data from App Users: Facebook User ID; gender; birthdate; location ("current city"); friends list; and "likes" of public Facebook pages. They harvested from Affected Friends their Facebook User ID; name; gender; birthdate; location ("current city"); and "likes" of public Facebook pages. CCCSUF ¶ 37; Compl. ¶ 25. Over the course of the Project, Cambridge Analytica, Nix, and Kogan harvested Facebook profile data from approximately 250,000 270,000 App Users located in the U.S., and harvested profile data from approximately 50 65 million Affected Friends, including at least 30 million identifiable U.S. consumers. CCCSUF ¶ 38; Compl. ¶ 26.

In January 2015, GSR and SCL Elections entered into a supplemental agreement ("January 2015 Agreement") regarding additional data from the Project that Cambridge Analytica and SCL Elections wanted. Pursuant to the January 2015 Agreement, GSR provided data and analysis for App Users and Affected Friends for the remaining 39 U.S. states. GSR also provided a more limited set of personality analyses for these consumers than it had provided for consumers in the initial 11 U.S. states. CCCSUF ¶ 39; Compl. ¶ 27. In April 2015, GSR and SCL Elections entered into an addendum to the January 2015 Agreement ("Addendum"), pursuant to which GSR provided Cambridge Analyt ica and SCL Elections with the underlying Facebook data used to ''train" the algorithm that generated the OCEAN personality scores. GSR also provided Cambridge Analytica and SCL Elections with additional information about whether the App Users and Affected Friends included in the second set of data provided pursuant to the January 2015 Agreement had "likes" for about 500 specific pages identified by Cambridge Analytica and SCL Elections. CCCSUF ¶ 40; Compl. ¶ 28. Nix, SCL Elections, and Cambridge Analytica reported to Kogan that they had very positive feedback from their clients and had expressed an interest in continuing to work with Kogan and GSR on other similar projects. While Kogan and GSR were interested in working on follow-up projects, the parties could not reach an agreement and discontinued their work together after GSR transferred the data agreed to in the Addendum in May 2015. CCCSUF ¶ 41; Compl. ¶ 29.

In December 2015, several news reports were published regarding Cambridge Analytica's use of Face book data. Following these reports, Facebook demanded that Kogan, Cambridge Analytica, and its SCL affiliates delete all Facebook data in their possession. While Kogan and SCL Elections certified to Facebook that they had deleted the data obtained through the GSRApp, individuals or other entities still possess this data and/or data models based on this data. CCCSUF ¶ 42; Compl. ¶ 30.

VOLUME 168 Opinion of the Commission C. Cambridge Analytica's Claims that It Participated in the Privacy Shield Framework and Adhered to its Principles 1. The Privacy Shield Framework The Privacy Shield framework was designed by the U.S. Department of Commerce ("Commerce") and the European Commission to provide a mechanism for U.S. companies to transfer personal data outside of the EU that is consistent with the requirements of the European Union Directive on Data Protection. Enacted in 1995, the Directive set forth EU requirements for privacy and the protection of personal data. CCCSUF ¶ 43; Compl. ¶ 31. Among other things, the Directive requires EU Member States to implement legislation that prohibits the transfer of personal data outside the EU, with exceptions, unless the European Commission has made a determination that the recipient jurisdiction's laws ensure the protection of such personal data. This determination is referred to commonly as meeting the EU' s "adequacy" standard. CCCSUF ¶ 44; Compl. ¶ 31.

To satisfy the EU adequacy standard for certain commercial transfers, Commerce and the European Commission negotiated the Privacy Shield framework, which went into effect in July 2016. CCCSUF ¶ 45; Compl. ¶ 32. The Privacy Shield framework allows companies to transfer personal data lawfully from the EU to the United States. CCCSUF ¶ 45; Compl. ¶ 32. Companies under the enforcement jurisdiction of the Federal Trade Commission, as well as the U.S. Department of Transportation, are eligible to join the Privacy Shield framework. CCCSUF ¶ 46; Compl. ¶ 33. To join the Privacy Shield framework, a company must self-certify to Commerce that it complies with the Privacy Shield principles and related requirements that have been deemed to meet the EU's adequacy standard. CCCSUF ,r 46; Compl. ,r 32. Commerce maintains a public website, https://www.privacyshield.gov/welcome, where it posts the names of companies that have self-certified to the Privacy Shield framework. The listing of companies, https://www.privacyshield.gov/list, indicates whether the company's selfcertification is current. CCCSUF ¶ 48; Compl. ¶ 34. Any company that voluntarily withdraws or lets its self-certification lapse must continue to apply the Privacy Shield principles to the personal information it received while a participant in Privacy Shield, and affirm to Commerce on an annual basis its commitment to do so, for as long as it retains such information. CCCSUF ¶ 47; Compl. ¶ 32.

2. Cambridge Analytica's Claims Regarding its Participation in Privacy Shield On May 11, 2017, Cambridge Analytica joined Privacy Shield. CCCSUF ¶ 50; Compl. ¶ 35. While the Facebook data harvested through the GSRApp predated its participation in Privacy Shield and is therefore not subject to its protections, Cambridge Analytica continued to collect Facebook and other data from or about U.S. and European consumers after it joined Privacy Shield. CCCSUF ¶ 50; Compl. ¶ 35.

Until at least November 27, 2018, Cambridge Analytica disseminated or caused to be disseminated privacy policies and statements on its website at https://cambridgeanalytica.org CAMBRIDGE ANALYTICA, LLC 735 Opinion of the Commission including, but not limited to, the following statements that it participated in the Privacy Shield framework and that it adhered to the Privacy Shield principles: IS CAMBRIDGE ANALYTICA PART OF THE PRIVACY SHIELD FRAMEWORK? Yes: Cambridge Analytica adheres to the EU-US Privacy Shield Principles for the transfer of EU data we use to provide our services, including the onward transfer liability provisions. With respect to personal data received or transferred pursuant to the Privacy Shield Framework, Cambridge Analytica is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. More information on the principles are available at the Privacy Shield website: https://www.privacyshield.gov/. CCCSUF ¶ 51; Compl. ¶ 36.

Cambridge Analytica, however, did not complete the steps necessary to renew its participation in Privacy Shield after that certification expired on or about May 11, 2018. CCCSUF ¶ 52; Compl. ¶ 37. After allowing its certification to lapse, Cambridge Analytica continued to claim on its website that it was participating in Privacy Shield until at least November 27, 2018. CCCSUF ¶ 52; Compl. ¶ 37.

Cambridge Analytica also failed to comply with the Privacy Shield principle that required it to affirm to Commerce, after its certification had lapsed, its commitment to protect any personal information that it had acquired while a participant in Privacy Shield for so long as it retained the data. CCCSUF ¶ 54; Compl. ¶ 37. Notwithstanding its failure to affirm to Commerce its commitment to continue to protect the personal data it had acquired while a participant in Privacy Shield, Cambridge Analytica continued to disseminate or cause to be disseminated privacy policies and statements on its website (https://cambridgeanalytica.org) asserting that it was part of the Privacy Shield framework and that it adhered to the Privacy Shield principles for the transfer of EU data. CCCSUF ¶¶ 51, 54; Compl. ¶¶ 36-37. II. LEGAL STANDARDS A. Standard for Summary Decision We review Complaint Counsel's Motion for Summary Decision pursuant to Rule 3.24 of the Commission's Rules of Practice, 16 C.F.R. § 3.24, the provisions of which "are virtually identical to the provisions of Fed. R. Civ. P. 56, governing summary judgment in the federal courts." Polygram Holding, Inc., 2002 WL 31433923, at *1 (F.T.C. Feb. 26, 2002) (order denying motion for summary decision). Consistent with Rule 56(a), a party moving for summary decision must show that "there is no genuine dispute as to any material fact." Id.; see Jerk, LLC, 159 F.T.C. 885, 889 (2015). We may therefore rely on authority applying the federal summary judgment standard. See, e.g., Fanning v. FTC, 821 F.3d 164, 170 (1st Cir. 2016) (under FTC rules, summary decision is reviewed "under the same standard as summary judgment before a district court").

VOLUME 168 Opinion of the Commission As the moving party, Complaint Counsel bear the initial burden of identifying evidence that demonstrates the absence of any genuine issue of material fact. See Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). When a motion for summary decision is made and supported, the "party opposing the motion may not rest upon the mere allegations or denials of his or her pleading; the response, by affidavits or as otherwise provided in this rule, must set forth specific facts showing that there is a genuine issue of material fact for trial." 16 C.F.R. § 3.24(a)(3); see also Celotex, 477 U.S. at 323. We are required to resolve all factual ambiguities and draw all justifiable inferences in the light most favorable to Cambridge Analytica. In this case, there is no material fact at issue by virtue of Cambridge Analytica' s default, 16 C.F.R. § 3.12(c), and its failure to oppose Complaint Counsel's Motion for Summary Decision. Accordingly, we base our determination whether Cambridge Analytica violated Section 5 of the FTC Act on an analysis of the undisputed facts as submitted with Complaint Counsel's Motion for Summary Decision and alleged in the Complaint under the legal s tandards for evaluating deceptive acts and practices.6 B. Standard for Deception Section 5 of the FTC Act prohibits "unfair or deceptive acts or practices in or affecting commerce." 15 U.S.C § 45. The Complaint charges Cambridge Analytica only with alleged deception; there are no allegations of unfair acts or practices. "An act or practice is deceptive if (1) there is a representation, omission, or practice, (2) that is likely to mislead consumers acting reasonably under the circumstances, and (3) the representation, omission, or practice is material." FTC v. Commerce Planet, Inc., 878 F. Supp. 2d 1048, 1063 (C.D. Cal. 2012) (citing FTC v. Pantron I Corp., 33 F.3d 1088, 1095 (9th Cir. 1994)), aff'd in part, vacated in part, and remanded, 815 F.3d 593 (9th Cir. 2016); accord FTC v. Transnet Wireless Corp., 506 F. Supp. 2d 1247, 1266 (S.D. Fla. 2007) (citing, e.g., FTC v. Tashman, 318 F.3d 1273, 1277 (11th Cir. 2003)); FTC Policy Statement on Deception, appended to Cliffdale Assocs., Inc., 103 F.T.C. 110 (1984) (" Deception Statement "). Thus, in determining whether a representation is deceptive, we conduct a three-step inquiry, determining: (1) what claims are conveyed; (2) whether those claims are false, misleading, or unsubstantiated; and (3) whether the claims are material. See ECM Biofilms, Inc. v. FTC, 851 F.3d 599, 609 (6th Cir. 2017) (finding website content deceptive); Fanning, 821 F.3d at 170 (same); POM Wonderful v. FTC, 777 F. 3d 478, 490 (D.C. Cir. 2015) (finding advertising deceptive). A representation is considered material if it "involves information that is important to consumers and, hence, likely to affect their choice of, or conduct regarding a product." E.g., FTC v. QT, Inc., 448 F. Supp. 2d 908, 960 (N.D. Ill. 2006) (citing Kraft, Inc. v. FTC, 970 F.2d 311, 322 (7th Cir. 1992)), ajf'd, 512 F.3d 858 (7th Cir. 2008); Commerce Planet, 878 F. Supp. 2d at 6 Respondent does not contest the Commission's jurisdiction over it or over the conduct challenged in the Complaint. CCCSUF ¶¶ 1-5, 7; Compl. ¶¶ 1-3. Nor does Respondent dispute that the acts and practices alleged in the Complaint were in or affecting commer ce, as "commerce" is defined in the F TC Act, 15 U.S.C § 44. CCCSUF ¶ 6; Compl. ¶ 6. We therefore find that the Commission has jurisdiction over the Respondent and its conduct as alleged in the Complaint.

CAMBRIDGE ANALYTICA, LLC 737 Opinion of the Commission 1063 (citing FTC v. Cyberspace.com, LLC, 453 F.3d 1196, 1201 (9th Cir. 2006)). The Commission presumes that express claims are material. ECM Biofilms, Inc., 2015 WL 6384951, at *53 (F.T.C. Oct. 19, 2015), pet. for review denied, 851 F.3d 599 (6th Cir. 2017); Jerk, LLC, 159 F.T.C. at 906; POM Wonderful LLC, 155 F.T.C. 1, 62 (2013) (citing Novartis Corp., 127 F.T.C. 580, 686 (1999) (citing Deception Statement, 103 F.T.C. at 182)), ajf'd, 777 F.3d 478 (D.C. Cir. 2015). Express claims encompass not only the explicit statements in the representation, but also necessary implications derived from the statements. FTC v. Bronson Partners, LLC, 564 F. Supp. 2d 119, 126 n.4 (D. Conn. 2008). 7 III. CAMBRIDGE ANAL YTICA'S LIABILITY Due to Cambridge Analytica' s failure to file an answer to the Complaint or to oppose Complaint Counsel's Motion for Summary Decision, there is no genuine issue of material fact in this case. Therefore, summary decision is appropriate. We determine whether, based on the undisputed facts, Cambridge Analytica is liable for engaging in deceptive acts and practices in violation of Section 5 of the FTC Act by analyzing: (1) whether it made the claims alleged in the Complaint; (2) whether those claims were false or misleading; and (3) whether the claims were material.

A. Count I: Deceptive Claim by Cambridge Analytica Concerning the Collection of Personally Identifiable Information There is no dispute that Cambridge Analytica made the claim alleged in the Complaint, namely, that "Cambridge Analytica represented, directly or indirectly, expressly or by implication, that the GSRApp did not collect any identifiable information from Facebook users who authorized the app." Compl., 38. Cambridge Analytica launched the Facebook GSRApp on a wide scale using the Qualtrics survey platform to recruit U.S.-based consumers to participate in surveys and authorize the GSRApp to harvest their Facebook profile information. CCCSUF ¶ 32-33; Compl. ¶ 21-22. At the point in those surveys at which U.S. consumers were asked to authorize the app to collect their Facebook data, Cambridge Analytica, through the GSRApp, made the following representation:

In this part, we would like to download some of your Facebook data using our Facebook app. We want you to know that we will NOT download your name or any other identifiable information we are interested in your demographics and likes. CCCSUF ¶ 34; Compl. ¶ 23. We therefore find that Cambridge Analytica made the claim alleged in the Complaint.

There is also no dispute that this representation was false and misleading. Contrary to Cambridge Analytica's representation, the GSRApp did m fact collect participating users' 7 As discussed in Section III below, the representations at issue are express. Since, in the case of express representations, ''we expect consumers to rely on express statements ... and to interpret such statements as meaning what they say," California Naturel, Inc., 2016 WL 7228668, at *7 (F.T.C. Dec. 5, 2016), we need not inquire separately into how these claims would be interpreted by reasonable consumers. VOLUME 168 Opinion of the Commission personally identifiable information, notably including their Facebook User IDs. CCCSUF ¶ 35; Compl. ,r 24. We find that Cambridge Analytica's representations to App Users who authorized the GSRApp that it would not download their name or any other identifiable information were false and misleading.

Finally, we find that Cambridge Analytica' s false and misleading representation to App Users via the GSRApp that it would not download names or other identifiable information was an express claim, and as such is presumptively material. Cambridge Analytica has not rebutted the legal presumption that this express claim is material.8 We conclude that Cambridge Analytica's representation to App Users who authorized the GSRApp that it would not collect their identifiable information was a false and material, and hence deceptive, claim. Accordingly, we grant Complaint Counsel's Motion for Summary Decision on Count I.

B. Count II: Deceptive Claim by Cambridge Analytica Concerning Its Participation in Privacy Shield We turn now to Cambridge Analytica's representations regarding its participation in and compliance with the Privacy Shield framework. Cambridge Analytica joined the Privacy Shield program on May 11, 2017. CCCSUF ¶ 50; Compl. ¶ 35. There is no dispute that thereafter, and continuously until at least November 27, 2018, Cambridge Analytica made statements and representations on its website at http://cambridgeanalytic.org that affirmed it was a participant in the Privacy Shield program and adhered to the Privacy Shield principles. CCCSUF ¶ 51; Compl. ¶ 36. For example, Cambridge Analytica displayed the following statement on its website: IS CAMBRIDGE ANALYTICA PART OF THE PRIVACY SHIELD FRAMEWORK? Yes: Cambridge Analytica adheres to the EU-US Privacy Shield Principles for the transfer of EU data we use to provide our services, including the onward transfer liability provisions. With respect to personal data received or transferred pursuant to the Privacy Shield Framework, Cambridge Analytica is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. More information on the principles are available at the Privacy Shield website: https://www.privacyshield.gov/. 8 Other evidence supports this conclusion. Notably, Cambridge Analytica included the representation at the point in the surveys where the GSRApp reque sted App Users' permission to collect "some" of their Facebook data after learning that half of the survey participants had refused to grant any permission to the GSRApp absent such an assurance. CCCSUF ¶¶ 34-35; Compl. ¶¶ 23-24. We can infer from these undisputed facts that Cambridge Analytica subsequently included the false statement, "[w]e want you to know that we will NOT download your name or any other identifiable information," as a means of inducing survey participants to allow the GSRApp to collect their Facebook profile data. We can also infer that the assurances provided by Cambridge Analytica's representation likely affected the choices and changed the decisions of a substantial number of App Users. CAMBRIDGE ANALYTICA, LLC 739 Opinion of the Commission CCCSUF ¶ 51; Compl. ¶ 36. We find that, from May 2017 until at least November 27, 2018, Cambridge Analytica made the claim that it was a participant in Privacy Shield. The undisputed facts further establish that Cambridge Analytica did not complete the steps necessary to renew its participation in Privacy Shield after its certification expired on or about May 11, 2018. CCCSUF ,r 52; Compl. ,r 37. We find that Cambridge Analytica's continued representation that it was participating in Privacy Shield from May to November 2018, when it had in fact allowed its Privacy Shield certification to lapse, was a false and misleading claim. Cambridge Analytica has not rebutted the legal presumption that this express claim was material.

We conclude that Cambridge Analytica's express representation that it remained a participant in the Privacy Shield framework after its certification had lapsed was false and material, and hence deceptive. Accordingly, we grant Complaint Counsel's Motion fo r Summary Decision on Count II.

C. Count III: Deceptive Claim by Cambridge Analytica Concerning Its Adherence to Privacy Shield Principles Among the requirements imposed by Privacy Shield on companies that self-certify as compliant participants in the Privacy Shield program is that, if the company withdraws from the program or allows its self-certification to lapse, it must affirm to the U.S. Department of Commerce on an annual basis its commitment to continue to apply Privacy Shield principles and protections to the personal information it has received while a participant in Privacy Shield for as long as it retains such information. CCCSUF ¶ 47; Compl. ¶ 32. The undisputed facts establish that, beginning on or about May 11, 2017, Cambridge Analytica expressly represented on its website that it adhered to Privacy Shield principles. Cambridge Analytica continued to represent on its website that it adhered to Privacy Shield principles even after its certification had lapsed on or after May 11, 2018. CCCSUF ¶¶ 51, 54; Compl. ¶¶ 36-37. We find that, by representing that it was compliant with Privacy Shield principles, Cambridge Analytica necessarily represented that it was complying with the Privacy Shield requirement to affirm to Commerce its commitment to continue to apply Privacy Shield protections to the personal information it had collected for as long as it retained this data. This claim was false and misleading because Cambridge Analytica had, in fact, failed to make the required affirmation to Commerce after its Privacy Shield certification lapsed. CCCSUF ¶ 54; Compl. ¶ 37.9 Cambridge Analytica has not rebutted the legal presumption that this express claim was material.

9 Neither the Complaint nor Complaint Counsel's Motion expressly allege any facts regarding the status of the data that Cambridge Analytica had collected from consumers while a participant in Privacy Shield after its Privacy Shield certification lapsed on May 11, 2018. However, both the Complaint and Motion allege that Cambridge Analytica received such information (CCCSUF ¶ 50; Compl. ¶ 35), and allege no facts suggesting such information was deleted or returned upon the lapse of its Privacy Shield certification. Indeed, Complaint Counsel's notice order provides that we require the Respondent, defined to include Cambridge Analytica and its successors and assigns, to delete information collected by the Respondent from consumers. Moreover, Cambridge Analytica has not denied VOLUME 168 Opinion of the Commission We therefore conclude that Cambridge Analytica's representation that it was m compliance with Privacy Shield principles was false and material, and hence deceptive. We grant Complaint Counsel's Motion for Summary Decision on Count III. IV. REMEDY The FTC Act authorizes the Commission to issue an order that requires the Respondent to cease and desist its deceptive acts or practices. 15 U.S.C. § 45(b); see also FTC v. Nat 'I Lead Co. , 352 U.S. 419, 428 (1957). Moreover, "[t]he Commission is not limited to prohibiting the illegal practice in the precise form in which it is found to have existed in the past." FTC v. Colgate-Palmolive Co., 380 U.S. 374, 395 (1965) (quoting FTC v. Ruberoid, 343 U.S. 470, 473 (1952)). The Commission m ay "frame its order broadly enough to prevent respondents from engaging in similarly illegal practices in [the] future." Id. at 395. The Complaint in this matter attached a notice of the form of order that might issue if the facts were found to be as alleged. We have already found to be established the facts as set forth m Complaint Counsel's Motion for Summary Decision and as alleged m the Complaint. Complaint Counsel observe that Rule 3.12 (c) authorizes the Commission to enter an order consistent with the notice order attached to the Complaint sua sponte, but propose several minor changes to the notice order based on comments Complaint Counsel received from Cambridge Analytica's bankruptcy trustee. CCMSD 2 -3. Specifically, the proposed order accompanying the Motion incorporates certain changes related to the records access provisions, given the practical and legal constraints imposed by Cambridge Analytica' s bankruptcy proceedings. We agree that the changes Complaint Counsel propose are appropriate.10 Paragraph 43 of the Complaint, which states that Cambridge Analytica's representation of adherence to Privacy Shield principles was false and misleading. In these circumstances, there is an adequate basis for us to find that Cambridge Analytica misrepresented its continued adherence to Privacy Shield principles after its certification had lapsed.

10 Thus, we a dopt Complaint Counsel's proposals to delete the defmition of"Trustee," which appeared in the notice order and substitute "Respondent" for "Trustee" in Paragraph VI of the Final Orde r, which addresses the Commission's access to Cambridge Analytica's corporate documents and data. This change avoid s the need for the Commission to seek leave of the bankruptcy court for any actions that would have been required by Cambridge Analytica's bankruptcy trustee. CCMSD 2 -3. Cf. McIntire v. China MediaExpress Holdings, Inc., 113 F. Supp. 3d 769, 772 (S.D.N.Y. 2015) (explaining that under the Barton doctrine, any suit naming and requiring action by a court-appointed receiver personally, rather than the debtor, requires leave of the appointing court); Barton v. Barbour, 104 U.S. 126, 136-37 (1881). We also adopt the proposal to delete the language, "and upon the Commission's designation, the Trustee shall transfer such [abandoned corporate] books and records to the Commission" from the third sub -paragraph in Paragraph VI of the notice order, in recognition of the fact that, under bankruptcy regulations, Cambridge Analytica's bankruptcy trustee cannot transfer Cambridge Analytica's abandoned corporate books and records to the Commission. CCMSD 2-3. Bankruptcy regulations require the trustee to return corporate books and records to the estate after the bankruptcy court has entered its final order dissolving the company. See 11 U.S.C. § 554(d). Th ese changes are necessary to accommodate Cambridge Analytica's bankruptcy proceedings. We note, however, that the corporate books and records referenced in the provisions of Paragraph VI of the Final Order would not include the data or work product that Respondent is required to delete by Paragraph IV of the Final Order.

CAMBRIDGE ANALYTICA, LLC 741 Opinion of the Commission At the outset, we underscore that all of the prohibitions and requirements of our Final Order are binding on the "Respondent," which by definition includes Cambridge Analytica and its successors and assigns, and also that the requirements of Paragraphs I-V of the Final Order expressly apply to Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of the Final Order. That said, for simplification, we refer only to "Respondent" in our discussion of the Final Order's provisions.

Paragraph I of the Final Order prohibits Respondent from making misrepresentations regarding the extent to which it protects the privacy and confidentiality of Covered Information as defined in the Final Order, including: (1) the extent to which it collects, uses, shares, or sells any Covered Information; and (2) the purposes for which it collects, uses, shares, or sells any Covered Information.

Paragraph II prohibits Respondent from making misrepresentations, in connection with any product or service, regarding the extent to which Respondent participates in any privacy or security program sponsored by a government or any self-regulatory or standard-setting organization, including, but not limited to, the EU-U.S. Privacy Shield framework, the Swiss- U.S. Privacy Shield framework, and the APEC Cross-Border Privacy Rules. Paragraph III imposes additional requirements to address Respondent's unlawful conduct related to its participation in and compliance with the Privacy Shield framework. Specifically, Paragraph III prohibits Respondent from possessing or controlling personal information from European Union residents that Respondent received while it participated in the EU-U.S. Privacy Shield framework unless Respondent complies with the requirements of either Paragraph III.A or Paragraph III.B. Paragraph III.A requires Respondent to affirm to Commerce within specified time limits that it: (1) will continue to apply Privacy Shield protections to the personal information it received while it participated in the Privacy Shield; or (2) will protect such information by another means authorized under EU or Swiss law. Alternatively, Paragraph III.B requires Respondent to return or delete such personal information within specified time periods. Paragraph IV of the Final Order relates to the deletion or destruction of Covered Information collected from consumers through the GSR App, and any information or work product, including any algorithms or equations, derived in whole or in part from such Covered Information. Paragraph V permanently enjoins Respondent from disclosing, using, selling, or receiving any benefit from any Covered Information or any information that derived in whole or in part from it. Paragraph VI imposes access and monitoring requirements, and Paragraph VII provides that the Final Order will remain in effect for twenty years. V. CONCLUSION For the foregoing reasons, the Commission concludes that Cambridge Analytica violated Section 5 of the FTC Act, 15 U.S.C. § 45, by means of its false and deceptive representations to Facebook users who authorized the GSRApp, and by false and deceptive statements on its website regarding its participation in Privacy Shield and its adherence to Privacy Shield program VOLUME 168 Final Order principles. Accordingly, we enter a Final Order to remedy the Respondent's violations and prevent their recurrence.

FINAL ORDER The Commission has heard this matter upon Complaint Counsel's Motion for Summary Decision, which has not been opposed by Respondent. For the reasons stated in the accompanying Opinion of the Commission, the Commission has determined to GRANT the Motion for Summary Decision. Accordingly, IT IS ORDERED that the following Order to cease and desist be, and hereby is, entered: ORDER DEFINITIONS For purposes of this Order, the following definitions shall apply: A. "Covered Information" means the following information from or about an individual consumer including: (a) a first and last name; (b) a physical address or precise geolocation; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name; (d) a telephone number; (e) a Social Security number; (f) a driver's license or other government -issued identification number; (g) a financial institution account number; (h) credit or debit card information; (i) a persistent identifier, such as a customer number held in a "cookie," a mobile device ID, or processor serial number; G) data fields that can be accessed or collected through Facebook from or about Facebook Users or their Friends (e.g., "likes," "hometowns," "birthdates," "photos," "gender," "educational information," "religious or political views," or "marital" or other "relationship" status); (k) information that is created, maintained, or accessed by the consumer (e.g., "messages"); (1) any data regarding a consumer's activities online (e.g., searches conducted, web pages visited, or content viewed); or (m) any user credentials, such as a username and password.

B. "Facebook" means Facebook, Inc., its wholly or partially owned subsidiaries, unincorporated divisions, joint ventures, operations under assumed names, and affiliates, and all directors, officers, members, employees, agents, consultants, and other persons working for or on behalf of the foregoing.

C. "GSRApp" means all iterations of the GSRApp Facebook application that first began operating on the Facebook platform in May 2014.

CAMBRIDGE ANALYTICA, LLC 743 Final Order D. "Respondent" means Cambridge Analytica, LLC, and its successors and assigns. I.

PROHIBITION AGAINST MISREPRESENTATIONS ABOUT COVERED INFORMATION IT IS ORDERED that Respondent and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service must not misrepresent in any manner, expressly or by implication, the extent to which they protect the privacy and confidentiality of any Covered Information, including: A. The extent to which they collect, use, share, or sell any Covered Information; and B. The purposes for which they collect, use, share, or sell any Covered Information. II.

PROHIBITION AGAINST MISREPRESENTATIONS ABOUT PARTICIPATING IN PRIVACY OR SECURITY PROGRAMS IT IS FURTHER ORDERED that Respondent and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service must not misrepresent in any manner, expressly or by implication, the extent to which Respondent is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy or security program sponsored by a government or any self-regulatory or standard-setting organization, including but not limited to the EU-U.S. Privacy Shield framework, the Swiss-U.S. Privacy Shield framework, and the APEC Cross-Border Privacy Rules.

III.

REQUIREMENT TO MEET CONTINUING OBLIGATIONS UNDER PRIVACY SHIELD IT IS FURTHER ORDERED that Respondent and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service shall not possess or control personal information from European Union residents that Respondent received while it participated in the EU-U.S. Privacy Shield framework, unless Respondent:

A. Affirms to the Department of Commerce, within ten (10) days after the effective date of this Order and on an annual basis thereafter for as long as it retains such information, that it will:

VOLUME 168 Final Order 1. Continue to apply the EU-U.S. Privacy Shield framework principles to the personal information it received while it participated in the Privacy Shield; or 2. Protect the information by another means authorized under EU (for the EU-U.S. Privacy Shield framework) or Swiss (for the Swiss-U.S. Privacy Shield framework) law, including by using a binding corporate rule or a contract that fully reflects the requirements of the relevant standard contractual clauses adopted by the European Commission.

For purposes of this subprovision, Respondent does not possess or control personal information in the possession of a government regulatory or law enforcement agency, including the United Kingdom's Information Commissioner's Office; or B. Returns or deletes the information within ten (10) days after the effective date of this Order; or if, as of the effective date of this Order, the information is in the possession of a government regulatory or law enforcement agency, including the United Kingdom's Information Commissioner's Office, returns or deletes the information within ten (10) days after the information is returned to Respondent. IV.

REQUIRED DELETION OF DATA IT IS FURTHER ORDERED that Respondent, and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, must: A. Provide, within ten (10) days from the effective date of this Order, the Commission with a written statement, sworn under penalty of perjury, providing the name, address, and phone number for each person with whom Respondent shared any Covered Information collected from consumers through GSRApp, and any information that originated, in whole or in part, from this Covered Information;

B. Delete or destroy all Covered Information collected from consumers through GSRApp, and any information or work product, including any algorithms or equations, that originated, in whole or in part, from this Covered Information. Such deletion or destruction must occur within ten (10) days of the effective date of this Order, or if such information is in the possession of a government regulatory or law enforcement agency, including the United Kingdom's Information Commissioner's Office, as of the effective da te of this Order, within ten (10) days after the Covered Information is returned to Respondent. Provided, however, that such Covered Information, or any information that originated in whole or in part from such Covered Information, need not be deleted or destroyed CAMBRIDGE ANALYTICA, LLC 745 Final Order for so long as requested by a government agency or otherwise required by regulation, court order or other legal obligation; and C. Provide a written statement to the Commission, sworn under penalty of perjury, confirming the foregoing. This statement must be provided: (1) within thirty (30) days after the effective date of the Order; or, if applicable, (2) within thirty (30) days after the Covered Information is returned to Respondent from a government regulatory or law enforcement agency, or within thirty (30) days after any legal obligation to preserve the Covered Information has ended. V.

DUTY TO PROTECT COVERED INFORMATION IT IS FURTHER ORDERED that Respondent, and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, are permanently restrained and enjoined from disclosing, using, selling, or receiving any benefit from Covered Information or any information that originated, in whole or in part, from this Covered Information.

VI.

ACCESS TO CORPORATE DOCUMENTS AND DATA IT IS FURTHER ORDERED that Respondent shall make available to the Commission, for inventory and copying, all correspondence, email, financial data including tax returns, and any other documents, computer equipment, and electronically stored information, in Respondent's possession, custody, or control, that contain information about Respondent's role and assets at the Commission's exp ense. The Commission shall return each item produced for inventory or copying to Respondent within ten (10) business days from the date and time of Respondent's delivery of each such item.

IT IS FURTHER ORDERED that Respondent, to the extent it has possession, custody, or control of computer equipment or electronically stored information described above, shall provide the Commission with any necessary means of access to the computer equipment or electronically stored information, including, but not limited to, computer access codes and passwords.

IT IS FURTHER ORDERED that Respondent shall provide notice to the Commission of the proposed abandonment of any corporate books or records of Respondent. VII.

ORDER EFFECTIVE DATES IT IS FURTHER ORDERED that the final and effective date of this Order is the 60th day after this Order is served. This Order will terminate on November 25, 2039, or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with VOLUME 168 Final Order or without an accompanying settlement) in federal court alleging any violation of this Order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of:

A. Any Provision in this Order that terminates in less than twenty (20) years; B. This Order's application to any Respondent that is not named as a defendant in such complaint; and C. This Order if such complaint is filed after the Order has terminated pursuant to this Provision.

Provided, further, that if such complaint is dismissed or a federal court rules that the Respondent did not violate any Provision of the Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Order will terminate according to this Provision as though the complaint had never been filed, except that the Order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

By the Commission.

UNROLLME INC. 747 Complaint