How Facebook's growth banked on users opening doors to their data

Whenever you log into your Facebook account, you voluntarily share hoards of personal data with the company -- which is collected, packaged and sold to other companies for profit.

Selling information about the personal habits of its 1 billion users has been the business practice of Facebook for several years, but it has come under scrutiny in recent weeks, leading to CEO Mark Zuckerberg to appear before House and Senate committees this week.

'Knowingly' providing information

The data controversy stems from 2013, when Aleksandr Kogan, a scientist at Cambridge University, built a personality quiz app called "thisisyourdigitallife" that 270,000 people downloaded. In addition to answering questions about their personality, users voluntarily gave other personal information, like the city they live in and content they liked.

Those users also gave information about people on their friends list who had their privacy settings set to allow it, which ballooned the potential total number of people in Kogan's data set to 87 million.

None of the data collection was illegal, or even against Facebook rules.

"Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent," Facebook said in a March 16 statement. "People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked."

In 2015, Kogan sold that data to Cambridge Analytica, a data analytics firm operating in Britain that later worked on Donald Trump's 2016 presidential campaign. When Cambridge Analytica joined the Trump campaign, it had data points on millions of Americans who likely never heard of the company or interacted with it in any way on Facebook because of the information Kogan's app scooped up three years before

Kogan didn't violate any of Facebook's rules when he collected the data, but the company says he violated their agreement when he sold it to a third party.

The Cambridge University data scientist denies he did anything wrong and told CNN he only did what Facebook does.

"Using users' data for profit is their business model," Kogan said.

Nonetheless, after learning of the data sale, Facebook requested that Cambridge Analytica delete the data it bought from Kogan. Cambridge Analytica said it complied with the request.

But Christopher Wylie, a former employee of Cambridge Analytica, told media organizations last month that the company didn't delete the data and used it when it worked on Trump's campaign.

Britain's Channel 4 reported that it had seen a cache of Cambridge Analytica's data dating from 2014. That data included information on the personalities of about 136,000 people in Colorado -- with rankings on how agreeable, conscientious, neurotic and extroverted they are -- which would then be used to target those people with ads designed to match their personality profile.

Whether or not Cambridge Analytica deleted the data is unclear.

What is known is that a private company obtained data about millions of users who didn't know their data was being collected -- a practice Facebook has allowed companies and political campaigns to do for years.

Helping campaigns use personal data

In 2012, the re-election campaign for President Barack Obama created an app that operated similarly to Kogan's by taking information of all the friends of people who initially accessed it.

Teddy Goff, Obama's digital campaign manager, called it "the most groundbreaking piece of technology developed for the campaign."

Facebook stopped allowing apps to collect information from users' friends lists in 2014, but Hillary Clinton's campaign created a new iOS app that allowed users to give information about their friends who were synched into their iPhone address book.

The Clinton campaign used that data to encourage the app's users to ask friends to donate money or volunteer.

"If we need volunteers in Ohio and you've got a friend in Ohio, we're telling you to do that first," Goff, who also headed Clinton's digital operations, told Politico one month before the 2016 election.

Facebook was well aware of how its platform was used for political purposes. In fact, it encouraged political organizations to use its platform to target voters and had a government division, which employs former political aides to help groups target voters.

Brad Parscale, who led Trump's digital operations in 2016, raised some eyebrows in September when he told CBS' 60 Minutes that Republican employees of Facebook, and other social media companies like Twitter, were "embedded" with the campaign to help him maximize usage of targeting tools.

Facebook didn't deny Parscale's description of its involvement with Trump's digital campaign.

"For candidates across the political spectrum, Facebook offers the same levels of support in key moments to help campaigns understand how best to use the platform," the company said.

Facebook offered the Clinton campaign the same level of support, according to reports.

Top product: personal data

More than 1 billion people around the world use Facebook, including nearly 200 million Americans, who each give personal data whenever they use the platform. Facebook is the world's largest social media company, as well as one of the largest collectors of personal data.

But Facebook makes money by selling that data to advertisers who want to target the people most likely to buy its product or vote for its candidate -- and it's a fast-growing business model.

Advertising accounts for nearly 100 percent of Facebook's revenue. In 2008, that revenue totaled about $300 million. By the end of last year, Facebook's revenue was nearly $13 billion.

Political ad revenue is a large part of the company's growth strategy.

In 2015, some estimates had the company taking in $1 billion in political ad revenue during 2016. The company has not released total figures specifically for its political ad revenue that year.

For a company completely reliant on selling advertisements that target people through their personal data, Facebook is unlikely to stop collecting that data anytime soon. But it has said it will take extra security measures, largely based on placing limits on how app developers obtain and keep user data.

"We need to make sure that developers like Kogan who got access to a lot of information in the past can't get access to as much information going forward," according to a prepared statement from Zuckerberg in advance of his congressional testimony this week.

Zuckerberg said Facebook is removing user data from apps if the user hasn't used the app in more than three months -- limiting data apps can ask for to name, profile photo and email address, and requiring developers to sign a contract that imposes "strict requirements" to ask anyone for access to their posts or other private data.

But Facebook isn't making any changes to how it collects data on users. Other than deleting your Facebook account and removing the app from your mobile devices, there's no foolproof way to stop your data from being harvested and sold.

"What Facebook hasn't done is really restrict or limit the amount of data that Facebook itself collects about people," Bloomberg technology columnist Shira Ovide told NPR. "It is putting some locks on what outsiders can do, and that's good. But Facebook still collects reams of data about you from not just what you do on Facebook but from what you do in the real world -- from purchases that you make, for example, from other websites that you visit all over the Internet."

When News Breaks Out, We Break In. (The 2014 Bloggies Finalist)