IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS
COUNTY DEPARTMENT, CHANCERY DIVISION
PEOPLE OF THE STATE OF ILLINOIS, ex rel.
Kimberly M. Foxx, State’s Attorney of Cook
County, Illinois,

Case No.

Plaintif
,
v.
FACEBOOK, INC., a Delaware corporation,
SCL GROUP LIMITED, a United Kingdom
private limited company, and CAMBRIDGE
ANALYTICA LLC, a Delaware limited liability
company,
.
Defendants
COMPLAINT AND DEMAND FOR JURY TRIAL
Plaintiff People of the State of Illinois brings this Complaint and Demand for Jury Trial
against Facebook, Inc. (“Facebook”), and SCL Group Limited and Cambridge Analytica LLC
(collectively referred to as “Cambridge Analytica,” unless otherwise specified), and alleges as
follows:
NATURE OF THE ACTION
1.

In 2014, Cambridge Analytica—a London-based electioneering firm—exfiltrated

the personal data of more than 50 million Facebook users in the United States, including millions
of users in Illinois. This data trove included Facebook users’ ages, interests, pages they’ve liked,
groups they belong to, physical locations, political affiliation, religious affiliation, relationships,
and photos, as well as their full names, phone numbers, email addresses, and physical addresses. 1
1

Craig Timberg, et al., Bannon Oversaw Cambridge Analytica's Collection of Facebook
Data, According to Former Employee
, WASH. POST (Mar. 20, 2018), https://wapo.st/2FYS1kE.

1

 2.

Though this data was supposedly private and protected from disclosure by

Facebook’s user and developer policies, Cambridge Analytica knew that it could access this
nearly unlimited trove of data using Facebook’s existing developer tools, an open secret that was
well known to developers.2
3.

Posing as an academic researcher, Cambridge Analytica identified American

Facebook users on “Mechanical Turk”—an online marketplace where people around the world
contract with others to perform various tasks—and offered to pay them to download and use a
personality quiz app it developed on Facebook called thisisyourdigitallife
.
4.

About 270,000 American voters installed the app and took the personality quiz in

return for $1 to $2. But Cambridge Analytica wasn’t interested in just the answers. What it really
wanted—and what it got by virtue of being a developer on the Facebook platform—was the
ability to collect Facebook data from each quiz taker and all of their Facebook friends. In this
way, Cambridge Analytica parlayed 270,000 personality quiz submissions into a comprehensive
dataset on more than 50 million
unwitting Facebook users.
5.

This kind of mass data collection was not only allowed but encouraged by

Facebook, which sought to keep developers building on its platform and provide companies with
all the tools they need to influence and manipulate user behavior. That’s because Facebook is not
a social media company; it is the largest data mining operation in existence.
6.

To be sure, Cambridge Analytica’s data grab of 50 million users was eventually

flagged and investigated by Facebook in 2014. 3 But when it learned that the harvesting of data

2

See, e.g.
, Emil Protalinski, Stalkbook: Stalk Anyone, Even If You’re Not Facebook
, CNET (July 23, 2012), https://www.cnet.com/news/stalkbook-stalk-anyone-even-ifFriends
youre-not-facebook-friends/.
3

Chloe Aiello, Developer Behind The App At The Center Of Data Scandal Disputes
Facebook's Story
, CNBC (Mar. 21, 2018), https://www.cnbc.com/2018/03/21/aleksander-kogan2

 was intended to build personality profiles for academic uses, Facebook allowed the data
collection to resume. A year later, Facebook discovered that the data was being used for
electioneering purposes and discreetly asked Cambridge Analytica to delete the data. Notably, it
never confirmed that the data was actually deleted or notified its users of the privacy breach.
7.

In the meantime, Cambridge Analytica was mining the data it collected on 50

million Facebook users to create “psychographic profiles” for the 2016 American presidential
election. These profiles—which included each user’s name, home address, phone number,
education, birthday, voter records, and political tendencies, alongside a sophisticated personality
—allowed Cambridge Analytica to “identify the most persuadable voters” and target
analysis
them with so-called “fake news” on various platforms, including Facebook. 4 By its own
admission, this combination of misappropriated data, psychographic profiling, and fake news
enabled Cambridge Analytica—an overseas electioneering firm—to exert “significant influence
on the outcome of the 2016 presidential election.” 5
8.

While Facebook has, a full three years later, condemned Cambridge Analytica’s

unauthorized data collection, its actions are far more consistent with Facebook’s mission than
Facebook wants to let on. Though it may have started as a social network, Facebook’s business
model has shifted over the years into what is now one of the biggest data mining companies in
the world. Facebook now uses its platform—which has essentially become a data aggregation
machine disguised as a social network—to manipulate users into making the decisions that

facebook-shouldve-known-how-app-data-was-being-used.html.
4

How Facebook Could Profile Voters For Manipulation
, A SSOCIATED PRESS (Mar. 20,
2018), https://bit.ly/2uhKp7v; Hilary Osborne, What Is Cambridge Analytica? The Firm At The
Centre Of Facebook's Data Breach
, GUARDIAN (Mar. 18, 2018), https://bit.ly/2prhWXb.
5

CAMBRIDGE ANALYTICA , Make America Number
, https://ca1
political.com/casestudies/casestudymakeamericanumber12016 (last visited Mar. 23, 2018).
3

 Facebook and its business partners want them to make.6
9.

Facebook shifted its business model in this way because it recognized that it can

be even more profitable if it could harness and sell the ability to dependably influence its users’
behavior to third parties. Facebook therefore encouraged developers and researchers to collect
and analyze Facebook user data so that it could better learn how to manipulate its own users’
moods and influence what they purchase and even how they vote. Facebook even conducted
experiments on its own users, including experiments aimed at influencing their moods and
manipulating their voting habits.7
10.

This lawsuit seeks to right the wrongs created by Cambridge Analytica’s and

Facebook’s blatant disregard and misuse of sensitive, personal data belonging to the People of
the State of Illinois. Accordingly, the People of the State of Illinois, by and through Cook County
State’s Attorney Kimberly M. Foxx, seeks civil penalties and all appropriate injunctive relief to
address, remedy, and prevent harm to Illinois residents resulting from Defendants’ misconduct.
PARTIES
11.

Plaintiff People of the State of Illinois, by and through Kimberly M. Foxx, State’s

Attorney of Cook County, Illinois, brings this action in the public interest for and on behalf of
the People of the State of Illinois.
12.

Defendant Facebook, Inc. is a corporation existing under the laws of the State of

Delaware, with its principal place of business located at 1 Hacker Way, Menlo Park, California
94025.
6

, Sam Machkovech, Report: Facebook Helped Advertisers Target Teens Who
See, e.g.
Feel “Worthless”
, A RSTECHNICA (last updated May 1, 2017.), https://bit.ly/2pBgf9G.
7

, Kasmir Hill, 10 Other Facebook Experiments On Users, Rated On A HighlySee, e.g.
, FORBES (July 10, 2014),
Scientific WTF Scale
https://www.forbes.com/sites/kashmirhill/2014/07/10/facebook-experiments-onusers/#254ffa9b1c3d.
4

 13.

Defendant SCL Group Limited is a UK private limited company with offices

located in London, England. Defendant SCL Group Limited is the parent company of Defendant
Cambridge Analytica LLC.
14.

Defendant Cambridge Analytica LLC is a limited liability company organized

under the laws of the State of Delaware, with offices located in New York City and Washington,
D.C. Defendant Cambridge Analytica LLC is a subsidiary of Defendant SCL Group Limited.
JURISDICTION AND VENUE
15.

Pursuant to the Illinois Constitution art. VI, §9, this Court has subject matter

jurisdiction over Plaintiff’s claims.
16.

This Court has jurisdiction over Defendants pursuant to 735 ILCS 5/2-209

because they conduct business transactions in Illinois, have committed tortious acts in Illinois,
and have transacted substantial business in Illinois that caused harm in Illinois.
17.

Venue is proper in Cook County because Defendants conduct business

transactions in Cook County and the causes of action arose, in part, in Cook County.
COMMON FACTUAL ALLEGATIONS
I.

An Overview of Cambridge Analytica.
18.

Cambridge Analytica is a political consulting firm that promises to provide its

customers the ability to use big data to change voter behavior. 8
19.

Unfortunately, until recently, Cambridge Analytica’s business practices were

largely a secret to the general public. On March 18, 2018, one of its senior programmers—
Christopher Wylie—exposed the company’s unlawful and deceptive business practices,
including its role in “hijacking” the profiles of millions of Facebook users in order to influence
8

SeeMatthew Rosenberg, et al., How Trump Consultants Exploited The Facebook Data
Of Millions
, N.Y. TIMES (Mar. 17, 2018), https://nyti.ms/2HH74vA.
5

 the 2016 United States Presidential election.9
20.

Cambridge Analytica’s efforts to engage in mass data mining on behalf of

American political campaigns began in 2013, when its now-suspended Chief Executive Officer
Alexander Nix was still heading the elections division of SCL Group Limited. 10 At the time, Nix
set out create a team of data analysts, psychologists, and political operatives that could
successfully use data analytics to model U.S. voter behavior, and assess how American voters’
inherent psychological traits affected their voting decisions. Using that data, the company would,
in turn, sell it to political campaigns seeking to influence or change votes. 11
21.

The group—not yet formally organized, but still an entity within SCL Group

Limited—received significant initial funding from billionaire Robert Mercer, a well-known
funder of conservative- and Republican-connected political causes throughout the United
States.12 Mercer helped the group finance a $1.5 million pilot test of their psychographic
profiling-based messaging in the Commonwealth of Virginia’s 2013 gubernatorial election on
behalf of Republican candidate Ken Cuccinelli. 13
22.

On December 31, 2013, this internal team at SCL Group formally organized in

9

Carole Cadwalladr, ‘I Made Steve Bannon’s Psychological Warfare Tool’: Meet The
Data War Whistleblower
, GUARDIAN (Mar. 18, 2018), https://bit.ly/2HGFvCD.
10

SCL Group similarly provides data, analytics and strategy-related consulting, but
primarily offers its services to governments and military organizations throughout the world.
SCL Group boasts having conducted “behavior change programs” in over 60 countries ( i.e.,
psychological warfare).
11

Rosenberg et al., supranote 8.

12

Sasha Issenberg, Cruz-Connected Data Miner Aims To Get Inside Voters’
,
Heads
BLOOMBERG (Nov. 12, 2015), https://www.bloomberg.com/news/features/2015-11-12/is-therepublican-party-s-killer-data-app-for-real- (describing Robert Mercer as the “fourth-largest”
individual political donor in the United States).
13

Rosenberg et al., supranote 8.
6

 the United States as Cambridge Analytica. 14
II.

To Help Its Customers Influence U.S. Political Elections, Cambridge Analytic
Developed A Fraudulent Scheme To Harvest The Data Of Millions of Americ
Voters.
23.

In 2014, Cambridge Analytica sought out a relationship with U.S. Senator Ted

Cruz’s planned campaign for the Republican presidential nomination. At the time, the company
realized it did not possess nearly enough data about American voters for a U.S. presidential
campaign.15
24.

The company needed a vast amount of data on virtually every American voter and

knew it could not simply purchase that information. As such, Cambridge Analytica engineered a
deceptive scheme to surreptitiously siphon that data from Facebook.
A.

Defendants hire Cambridge University professor Aleksandr Kogan to
deceptively harvest data on 50 million Facebook users under the guis
“Academic Research.”

25.

In June 2014, Defendants entered into an arrangement with Cambridge University

researcher Aleksandr Kogan and his company Global Science Research to collect the data they
needed to create “psychographic profiles” on American voters. 16
26.

Kogan was the key to gathering the quantity and quality of data Defendants

sought because he could do it through a Facebook application 17 he created called
“thisisyourdigitallife
.”18
14

Andy Kroll, Cloak and Data: The Real Story Behind Cambridge Analytica’s Rise and
Fall, MOTHER JONES (Mar. 2018), https://www.motherjones.com/politics/2018/03/cloak-anddata-cambridge-analytica-robert-mercer/.
15

Rosenberg et al., supranote 8.

16

Id.

17

A Facebook application is an interactive software application developed to run on and
utilize the Facebook platform.
18

Id.
7

 27.

Facebook being one of the largest data mining companies in the world,

Cambridge Analytica knew it could take advantage of its developer platform—and, in particular,
its Graph API 19—to gather swaths of data about every user and their friends
who took the
quiz.
thisisyourdigitallife
i.
28.

Facebook’s Developer Platform.

Although primarily recognized for its eponymous social network, Facebook is

also one of the largest data mining companies in the world. With over 200 million users in the
United States alone, Facebook has exclusive access to an exorbitant amount of personal
consumer data.20
29.

Facebook is uniquely able to directly link the data it accumulates on individuals’

digital behaviors with the additional personal data that it extracts from users’ Facebook accounts.
The result is that Facebook obtains a holistic look at specific consumers’ online and offline
behaviors.21 Facebook, in turn, receives significant monetary gain by permitting targeted
advertising to its users through its platform. 22 It is therefore in Facebook’s interests to encourage
third party developers to utilize its platform so that it can gather even more information about
users’ online activities.
19

Graph API refers to Facebook’s application programming interface, which is what allows
third party developers to interact with Facebook’s servers in order to access Facebook user data.
20

Kurt Wagner & Rani Molla, Facebook Is Not Getting Any Bigger In The United
,
States
RECODE (Mar. 1, 2018), https://www.recode.net/2018/3/1/17063208/facebook-us-growth-pewresearch-users (“More than two-thirds of Americans” use Facebook).
21

Nathan Ingraham, Facebook Buys Data On Users’ Offline Habits For Better
,
Ads
ENDGAGET (Dec. 30, 2016), https://www.engadget.com/2016/12/30/facebook-buys-data-onusers-offline-habits-for-better-ads/; Cade Metz, How Facebook Knows When Its Ads Influence
Your Offline Purchases
, WIRED (Dec. 11, 2014), https://www.wired.com/2014/12/facebookknows-ads-influence-offline-purchases/.
22

, TBehavior
Cf. Lisa Lacy, Facebook Lets Brands Target Ads Based On Offline
HE DRUM
(Sept. 21, 2017), http://www.thedrum.com/news/2017/09/21/facebook-lets-brands-target-adsbased-offline-behavior.
8

 30.

That’s where Facebook’s Software Development Kit (“SDK”) 23 comes in.

Facebook’s SDK allows third party developers to add Facebook-related features to their websites
or services. These features permit the developer’s service to interact with Facebook in various
ways. Relevant here is the ability to include a “Facebook Login,” which lets visitors login to a
website using their Facebook credentials.
31.

When an individual visits or uses a service using Facebook’s SDK (e.g., an app

that includes a Facebook Login), information about the individual’s online activities are
transmitted back to Facebook. Facebook benefits from the additional behavioral information it
receives and the app developer, in the Facebook Login example, benefits because its users can
quickly sign in using their Facebook account.
32.

used Facebook’s SDK Facebook Login, meaning that
thisisyourdigitallife

individuals seeking to take the personality quiz had to use their Facebook account credentials to
access it.
ii.
33.

Cambridge Analytica intentionally used Facebook Login to gather data o
over 50,000,000 Facebook. users

Under the false pretense of operating a personality test for academic research

purposes, Kogan was able to get 270,000 Facebook users to take his personality quiz.
34.

To be clear, Cambridge Analytica, by way of Kogan, paid the majority of the

270,000 individuals to take his personality quiz. Kogan used a service called Amazon
Mechanical Turk—which is an online platform that allows developers to hire people (sometimes
called “turkers”) to do simple tasks for small fees—to pay individuals $1 or $2 to complete the

23

An SDK generally refers to a set of software development tools that allow programmers
to develop applications that interface with a specific software platform. Here, Facebook’s SDK
allows Facebook to release code for third party developers to use in order to interact with
Facebook’s platform.
9

 test.
35.

There were two conditions: First, turkers had to be American. Second, turkers had

to use their Facebook account credentials to log into the quiz.
36.

By having turkers use Facebook Login to log into the personality quiz,

Defendants were able capitalize on the unguarded nature of Facebook’s developer platform. That
meant developers were able to collect data on the Facebook user taking the test andinformation
about that user’s friends. 24
37.

That is, at that time, developers only needed permission from the user of the app

to access their friend’s list. Once armed with this permission, a developer could then gather the
profile information of all the app user’s Facebook friends 25 simply by querying the Graph API. 26
38.

Kogan’s academic research cover allowed him to gather the data at a rapid rate for

Cambridge Analytica.
39.

In fact, Cambridge Analytica’s data grab of 50 million users was eventually

flagged and investigated by Facebook in 2014. But when it learned that the harvesting of this
data was to build personality profiles for academic purposes, Facebook allowed the data
collection to resume.27

24

Sue Halpern, Cambridge Analytica, Facebook, and the Revelations of Open
New Secrets,
Yorker, https://www.newyorker.com/news/news-desk/cambridge-analytica-facebook-and-therevelations-of-open-secrets (last visited March 23, 2018).
25

Jonathan Albright, The Graph API: Key Points in the Facebook and Cambridge
Medium, https://medium.com/tow-center/the-graph-api-key-points-in-theAnalytica Debacle,
facebook-and-cambridge-analytica-debacle-b69fe692d747 (last visited March 23, 2018).
26

For this reason, it is also likely that Facebook’s unrestricted developer tools were used by
thousands of other companies to collect user data without consent. SeeIraklis Symeonidis et al.,
, ICT
Collateral Damage of Facebook Apps: Friends, Providers, and Privacy Interdependence
Sys. Sec. & Privacy Prot. IFIP Advances in Info. & Commc’n Tech. 194–208 (2016), available
at https://eprint.iacr.org/2015/456.pdf.
27

In 2015, Facebook learned the truth about why Cambridge Analytica was collecting the
10

 40.

Through these unfair and deceptive practices, Defendants were able to eventually

use the Facebook Login portal to gather the personal information of over 50 million Facebook
users, including their ages, interests, pages they’ve liked, groups they belong to, physical
locations, political affiliation, religious affiliation, relationships, and photos, as well as their full
names, phone numbers, email addresses, and physical addresses. And for the 270,000 survey
takers, Cambridge Analytica even had access to their private messages on Facebook. 28
41.

This data was exactly what Defendants needed: rich personal data about users that

was not only extremely valuable for “psychographic profiling” as explained in Section III below,
but also detailed enough so that it could be matched to other records already in Cambridge
Analytica’s possession. With this information in hand, Cambridge Analytica could—and did—
embark on its primary mission: creating a psychographic profile of every American adult in
order to provide data analytics and messaging-related support for U.S. federal election
campaigns.29

data—to influence and manipulate voters in the 2016 presidential election. In response,
Facebook approached Cambridge Analytica requesting it delete the trove of data it had amassed.
While Cambridge Analytica informed Facebook that it deleted the information, it never verified
this fact and simply took the word of a company which had knowingly and intentionally violated
Facebook’s policies to steal 50 million users’ information. And most importantly, Facebook
nevernotified the 50 million affected Facebook users of the major privacy breach.
28

Greg Price, Facebook Did Nothing To Stop Cambridge Analytica Data Breaches, New
Newsweek, http://www.newsweek.com/facebookClass-Action Federal Lawsuit Claims,
cambridge-analytica-data-lawsuit-855600(last visited March 23, 2018).
29

In many ways, Cambridge Analytica’s use of the data aligned with Facebook’s own
intentions with its users’ information. As noted, Facebook has a long history of performing
experiments on its user base without their knowledge or consent. Facebook has sought to
manipulate users’ moods, actions on the website, interactions with Facebook “friends,” and
voting behaviors. See, e.g.
, Robinson Meyer, Everything We Know About Facebook’s Secret
, THE ATLANTIC (June 28, 2014), http://theatln.tc/2l8BoZt;
Mood Manipulation Experiment
Robert M. Bond, et al., A 61-Million-Person Experiment In Social Influence And Political
Mobilization
, NATURE (Sept. 13, 2012), available at
https://bit.ly/2G4c9hd.
11

 II.

Facebook Has A Rich History of Experimenting On Its Users.
42.

Facebook employs a “Core Data Science” team composed of programmers,

statisticians, and psychologists to capitalize upon its access to vast amount of user data. Since as
early as 2012, the Core Data Science team been conducting psychological experiments known as
human subject research – actively intervening in people’s (online) environments, measuring the
behavioral impact of those interventions, and publishing the results in scientific journals.
43.

For example, over a one-week period in January 2012, Facebook manipulated the

News Feeds30 of nearly 700,000 Facebook users so that they contained proportionally fewer
posts containing either positive or negative content, depending on which experimental group the
participant was assigned to. This manipulation was, in some cases, drastic. Some participants, for
example, had ninetypercent of posts containing positive emotional content removed from their
News Feed.
44.

To measure the effect of this experiment (“Emotional Manipulation Experiment”),

Facebook then observed the corresponding emotional content of the participants’ News Feed
posts. The effects were described in an article published in a major, peer-reviewed academic
journal (“the Kramer Article”). 31 And they were, while small, statistically significant. Users
exposed to proportionally fewer positive posts generated less positive content themselves, and
vice versa. In other words, people exposed to more sad content were made sad, and people
exposed to more happy content were made happy. And all of this occurred unbeknownst to the
30

The News Feed is the primary way that users consume content on Facebook. It is a
scrollable series of “stories” generated by a user’s friends, where “stories” may be anything from
photos of friends to textual posts written by friends to linked news articles.
31

Adam D.I. Kramer, Jamie E. Guillory, and Jeffrey T. Hancock, Experimental Evidence of
Massive-Scale Emotional Contagion Trough Social Networks, 111 Proc. Nat’l Acad. Sci. USA
8788 (2014), available at http://www.pnas.org/content/111/24/8788.full.html (last accessed
October 1, 2014).
12

 participants – the experiment showed “that emotional states can be transferred to others via
emotional contagion, leading people to experience the same emotions without their
.”32
awareness
45.

Highlighting the significance of the experiment, the Kramer Article noted that

“given the massive scale of social networks such as Facebook, even small effects [like the
manipulation of Facebook News Feeds] can have large aggregated consequences” and concluded
that “the well-documented connection between emotions and physical well-being suggests the
importance of these findings for public health
.”33
46.

This “Emotional Manipulation Experiment” is just the tip of the iceberg.

Facebook has conducted and published scores of similar experiments in the past, and intends to
continue conducting and publishing similar experiments in the future.
47.

Facebook has conducted and continues to conduct a wide array of human subject

research experiments. For example, in one experiment conducted in 2010, Facebook tested how
much of an effect it could have on a user’s likelihood to vote. 34 For that experiment (the “Voting
Manipulation Experiment”), every single American who signed onto Facebook on voting day—
approximately 60 million people—was a participant.
48.

Other published Facebook experiments have tested things ranging from the effect

of hiding links that friends shared with each other (approximately 253 million experiment
subjects) (the “Link Manipulation Experiment”), 35 to the effect of automatically broadcasting

32

Id. (emphasis added).

33

Id. at 8790 (emphasis added).

34

Robert M. Bond et al., A 61-Million-Person Experiment in Social Influence and Political
, 489 NATURE 295 (2012), available at
Mobilization
http://cameronmarlow.com/media/massive_turnout.pdf (last accessed October 1, 2014).
35

Eytan Bakshy, The Role of Social Networks in Information ,Difusion
WWW: Int’l World
13

 users’ online shopping purchases (approximately 1.2 million experiment subjects), 36 to the effect
of having user names and likenesses automatically “endorse” advertisements (approximately 29
million experiment subjects).37
49.

At one point, Facebook was running so many experiments on its users that “some

[members of the Core Data Science Team] worried that the same users, who were anonymous,
might be used in more than one experiment, tainting the results.” 38
50.

Facebook intends to continue conducting human subject research without

obtaining informed consent. Sheryl Sandberg, for example, explained that the Emotional
Manipulation Experiment as just “part of ongoing research companies do to test different
products.”39 And Adam D. I. Kramer—lead author of the Emotional Manipulation Experiment—
noted in a Facebook post defending his experiment that Facebook has “been working on
improving [their] internal review policies” for experiments since 2012.
51.

In fact, Facebook issued a blog post defending their ongoing practice of

conducting human subject research without obtaining informed consent. 40 In that post, Facebook

Wide Web Conf. 2012, available at http://cameronmarlow.com/media/bakshy-the_role2012b.pdf (last accessed October 1, 2014).
36

SeeSean J. Taylor, Eytan Bakshy, Sinan Aral, Selection Efects in Online Sharing:
, available for download at
Consequences for Peer Adoption
https://www.facebook.com/publications/266725986806102/ (last accessed October 1, 2014).
37

Eytan Bakshy, Dean Eckles, Rong Yan, Itamar Rosenn, Social Influence in Social
Advertising: Evidence from Field Experiments,
available at http://arxiv.org/pdf/1206.4327v1.pdf
(last accessed October 1, 2014).
38

SeeReed Albergotti and Elizabeth Dwoskin, Facebook Study Sparks Soul-Searching and
, Wall St. J.
, June 30, 2014, available at
Ethical Questions
http://online.wsj.com/articles/facebook-study-sparks-ethicalquestions-1404172292.
39

R. Jai Krishna, Sandberg: Facebook Study Was ‘Poorly Communicated’
, available at
http://blogs.wsj.com/digits/2014/07/02/facebooks-sandberg-apologizes-for-news-feedexperiment/ (last accessed October 1, 2014).
40

See“Research at Facebook,” available at
14

 explicitly acknowledges the problematic nature of the Emotional Manipulation Experiment. But
instead of agreeing to abide by the same laws all other research organizations do (and obtain
informed consent from its users), Facebook concludes that a few self-regulated changes to its
research policies will remedy the situation.
52.

And Facebook’s job postings reaffirm their commitment to the continuation of

internal human subject research. One posting, for the position of “Data Scientist, Identity
Research & Modeling” seeks a candidate with a Ph. D. and an expertise in “social psychology”
to help “develop high-quality models of people’s online identity.” 41
53.

The reason that Facebook is conducting these experiments and publishing the

results is to demonstrate its influence over user behavior. Though selling ad space has generated
enormous profits for Facebook already, Facebook knows that advertisers, political campaigns,
and its business partners will pay exponentially more money for the ability to manipulate its
users into making decisions that they want them to make.
54.

Facebook knows that this capability is especially attractive to political campaigns,

which, as Facebook knows, are spending record amounts of money on political ads, even in nonelection years.42 It therefore began developing tools for campaigns that wanted to target certain
segments with political ads, including by tracking users to determine their political leanings and
tendencies. As proof of concept, Facebook demonstrated through its Voting Manipulation
Experiment that it could influence whether its users voted or not.
http://newsroom.fb.com/news/2014/10/research-at-facebook/ (last accessed August 23, 2018).
41

Facebook Job Posting, available at
https://www.facebook.com/careers/department?dept=data&req=a0IA000000CzAeDMAV (last
accessed October 1, 2014).
42

Megan Janetsky, Low transparency, low regulation online political ads
skyrocket
, OPENSECRET , https://www.opensecrets.org/news/2018/03/low-transparency-lowregulation-online-political-ads-skyrocket/ (last visited March 23, 2018).
15

 55.

This demonstration sent a signal to the public at large that it has the ability to

influence and manipulate the behavior of users on its platform, especially with respect to voting.
56.

By doing so, Facebook tacitly invited electioneering companies like Cambridge

Analytica to harvest its data for purposes of profiling users and targeting them with tailored
messaging that would dependably influence and manipulate their behavior. It is through this lens
that the relationship between Facebook and Cambridge Analytica must be viewed.
III.

Armed With Swaths of Misappropriated Data, Cambridge Analytica Created
“Psychographic Profiles” On Every American Adult, Which It Claims Helped
Have Significant Influence On The Outcome Of The 2016 Presidential Electi
57.

Armed with Facebook’s own political targeting tools and a trove of sensitive data

it was not supposed to have access to, Cambridge Analytica was able to create “psychographic
profiles” on millions of American voters that it used to “significantly influence . . . the outcome
of the 2016 presidential election.” 43
58.

Broadly speaking, psychographic profiling is a marketing tool that combines a

detailed psychological analysis of an individual using various data points about their interests,
activities, opinions, and motivations. These data points can then be layered on top of
demographic information such as race, gender, and age.
59.

Psychographic profiling tools—including Cambridge Analytica’s—can combine

assessments of a person’s innate personality characteristics with predictions of, for instance, their
voting behavior, to create hyper-focused predictions about not only what people will do, but
what will motivate them to do it.
60.

The personality traits that Cambridge Analytica has claimed can be predicted

43

, CAMBRIDGE
ANALYTICA
Make America Number
1
http://cambridgeanalytica.org/casestudies/casestudymakeamericanumber12016+&cd=1&hl=en&
ct=clnk&gl=us (last visited Mar. 23, 2018).
16

 through psychographic profiling included, most importantly, a person’s OCEAN ratings, a
common personality type classification method that looks at five factors: Openness,
Conscientiousness, Extraversion, Agreeableness, and Neuroticism. 44 In addition, Cambridge
Analytica has claimed to be able to predict—based on the data it possesses—an individual’s age,
political views, religion, profession, whether they are fair-minded or suspicious of others, and
even (ironically) whether they prefer to disclose facts about themselves to others or value their
privacy.
61.

According to Cambridge Analytica, this allowed its clients to bypass individuals’

cognitive defenses by appealing directly to their emotions, using increasingly segmented and
sub-grouped personality type designations and precisely targeted messaging based on those
designations.45
62.

Using these techniques, Cambridge Analytica claims to have “provided the

Donald J. Trump for President campaign with the expertise and insight that helped win the White
House.”46 Cambridge Analytica provided the Donald J. Trump for President campaign with its
Facebook data-enabled psychographic profiling tool to help, on information and belief, with
voter identification and outreach, advertising spending decisions, voter turnout modeling, and
even helping to set then-candidate Trump’s travel schedule based on where Cambridge Analytica
believed he would be most likely to drum up support within the “swing states” crucial to his
44

Erin Brodwin, Here’s the personality test Cambridge Analytica had Facebook users
take,BUSINESS INSIDER , http://www.businessinsider.com/facebook-personality-test-cambridgeanalytica-data-trump-election-2018-3
45

Nina Burleigh, How Big Data Mines Personal Info To Craft Fake News And Manipulate
Voters
, NEWSWEEK (June 8, 2017), http://www.newsweek.com/2017/06/16/big-data-minespersonal-info-manipulate-voters-623131.html.
46

, CAMBRIDGE ANALYTICA ,
Donald J. Trump for President
https://political.production.k8s.e.cambridgeanalytica.org/casestudies (last visited March 23,
2018).
17

 securing of the presidency.
63.

The data was not just used for purposes of motivating enthusiastic Trump

supporters, or even just to target and convince skeptical or undecided voters. Rather, Cambridge
Analytica used its data to also engage in a broad voter suppression campaign to discourage
supporters (or potential supporters) of Trump’s opponent, Hillary Clinton, from voting. For
example, Cambridge Analytica used its psychographic profiling tool to help generate a brand of
negative “Defeat Crooked Hillary” advertisements that—through the promotional help of a
Trump-affiliated super PAC, Make America Number 1—was watched over 30 million times
during the campaign.47
64.

Broadly, this psychographic mapping tool was crucial to Trump’s campaign

strategy, and thus, its ultimate success: Trump was elected president, and Cambridge Analytica
walked away millions of dollars richer, with a clear confirmation that its psychographic mapping
was working.

FIRST CAUSE OF ACTION
Violation of the Illinois Consumer Fraud and Deceptive Business Practices A
815 ILCS 505, et seq.
(On Behalf of Plaintiff People of the State of Illinois Against Cambridge Analy
65.

Plaintiff People of the State of Illinois incorporates the foregoing allegations as if

fully set forth herein.
66.

Section 2 of the Illinois Consumer Fraud and Deceptive Business Practices Act,

815 ILCS 505, et seq.
(“ICFA”), provides:
Unfair methods of competition and unfair or deceptive acts or practices,
including but not limited to the use or employment of any deception fraud,
false pretense, false promise, misrepresentation or the concealment,
47

, CHANNEL
Exposed: Undercover Secrets Of Trump’s Data
Firm 4 (Mar. 20, 2018),
https://www.channel4.com/news/exposed-undercover-secrets-of-donald-trump-data-firmcambridge-analytica.
18

 suppression or omission of any material fact, with intent that others rely
upon the concealment, suppression or omission of such material fact, or the
use or employment of any practice described in section 2 of the ‘Uniform
Deceptive Trade Practices Act’, approved August 5, 1965, in the conduct of
any trade or commerce are hereby declared unlawful whether any person
has in fact been misled, deceived or damaged thereby. In construing this
section consideration should be given to the interpretations of the Federal
Trade Commission and the federal courts relating to Section 5 (a) of the
Federal Trade Commission Act.
67.

While conducting trade or commerce, Cambridge Analytica has engaged in

conduct constituting a deceptive act or practice declared unlawful under Section 2 of the ICFA,
inasmuch as it knowingly made deceptive and false representations about the nature of its
survey-taking app, the nature of the data it was collecting, and the purposes for which the data
was being collected and would be used.
68.

Cambridge Analytica intended that Facebook and the public, including Illinois

residents, rely on its deceptive representations and communications regarding the supposedly
“academic” purpose of its app and the reasons it was collecting troves of their personal Facebook
data.
69.

Cambridge Analytica also engaged in deceptive and unlawful conduct by

exfiltrating the Facebook data of 50 million users without their consent and in direct violation of
the Facebook user and developer agreements, which expressly require developers to agree to the
following terms:
II. Data Collection and Use
1.

You will only request the data you need to operate your application.

2.

You may cache data you receive through use of the Facebook API in order
to improve your application’s user experience, but you should try to keep
the data up to date. This permission does not give you any rights to such
data.
*

*
19

*

 4.

Until you display a conspicuous link to your privacy policy in your app,
any data accessed by your app (including basic account information) may
only be used in the context of the user’s experience in that app. A user’s
friends’ data can only be used in the context of the user’s experience on
your application.

5. Subject to certain restrictions, including on use and transfer, users give
you their basic account information when they connect with your
application. For all other data obtained through use of the Facebook API,
you must obtain explicit consent from the user who provided the data to us
before using it for any purpose other than displaying it back to the user on
your application.
6.

You will not directly or indirectly transfer any data you receive from us,
including user data or Facebook User IDs, to (or use such data in
connection with) any ad network, ad exchange, data broker, or other
advertising or monetization related toolset, even if a user consents to such
. By indirectly we mean you cannot, for example, transfer
transfer or use
data to a third party who then transfers the data to an ad network. By any
data we mean all data obtained through use of the Facebook Platform
(API, Social Plugins, etc.), including aggregate, anonymous or derivative
data.
*

9.

*

*

You will not sell or purchase any data obtained from usIfby
you
anyone.
are acquired by or merge with a third party, you can continue to use user
data within your application, but you cannot transfer data outside your
application.
*

*

*

11. You cannot use a user’s friend list outside of your application
, even if a
user consents to such use, but you can use connections between users who
have both connected to your application.
(Facebook’s August 20, 2013 Platform Policies) (emphasis added).
70.

Cambridge Analytica violated these mandatory user privacy protections by posing

as an academic researcher, gaining access to Facebook user data under false pretenses, using
such data for psychographic analysis and electioneering, harvesting users’ friend lists for
psychographic analysis and electioneering, disclosing all collected and harvested user data to its

20

 affiliates and clients, and reaping substantial profits therefrom.
71.

This conduct was unlawful because it violated the personal privacy rights of

millions of Illinois residents.
72.

This conduct was also deceptive and unfair. Many other consulting firms attempt

to do what Cambridge Analytica does, but without employing deception—typically by
purchasing and compiling readily-available consumer and voter file data to create detailed voter
profiles.
73.

Instead, Cambridge Analytica sought to gain a leg up on its competition by

illicitly collecting the Facebook data on millions of Illinois residents, through a false promise
that such data would only be used for academic purposes.
74.

Thus, Cambridge Analytica’s conduct constitutes an unfair and deceptive act or

practice under the ICFA.
75.

Pursuant to 815 ILCS 505/7(b), the penalty for violating the ICFA is a sum not to

exceed $50,000, or, if the Court finds that Defendants’ above-described practices were intended
to defraud Illinois residents, $50,000 per violation.
76.

In addition to any other civil penalty provided, if a person is found by the Court to

have engaged in any method, act, or practice declared unlawful under the ICFA, and the
violation was committed against a person 65 years of age or older, the Court may impose an
additional civil penalty in a sum not to exceed $10,000 per violation. 815 ILCS 505/7(c).

SECOND CAUSE OF ACTION
Violation of the Illinois Consumer Fraud and Deceptive Business Practices A
815 ILCS 505, et seq.
(On Behalf of Plaintiff People of the State of Illinois Against Facebook)
77.

Plaintiff People of the State of Illinois incorporates the foregoing allegations as if

fully set forth herein.
21

 78.

The ICFA prohibits conduct that is deceptive or unlawful.

79.

Facebook engaged in unfair and deceptive conduct by making representations to

consumers that were knowingly false. Specifically, Facebook represented to its users that their
personal data would be protected in accordance with its user and developer agreements.
80.

Despite these material representations, Facebook permitted third parties, including

Cambridge Analytica, to collect and harvest its users’ personal data, including such sensitive
information as their private messages, for purposes of profiling and targeting them with tailored
messaging that would dependably influence and manipulate their behavior.
81.

Facebook had actual knowledge that Cambridge Analytica gained unauthorized

access to its users’ personal data without their knowledge or consent and in express violation of
its user and developer agreements, yet did not put a stop to it.
82.

The consequences of these false misrepresentations were further compounded by

Facebook’s decision, upon learning that Cambridge Analytica had misappropriated user data for
political purposes, to conceal the breach from its users and do nothing more than quietly (and
unsuccessfully) ask Cambridge Analytica to delete the data.
83.

By concealing this misconduct from its users, Facebook avoided backlash over its

blatant misrepresentations from its users and preserved the strength of its data mining operation
by avoiding a situation where its users reacted by deactivating their accounts.
84.

Facebook allowed Cambridge Analytica to secretly harvest its users’ data and

build psychographic profiles of each of them so that it could influence and manipulate their
behavior in the 2016 presidential election.
85.

Facebook admits that it violated its users’ privacy rights by allowing Cambridge

Analytica to harvest their data. On March 21, 2018, Facebook’s Chief Executive Officer Mark

22

 Zuckerberg issued a public statement conceding that it breached the trust of “the people who
share their data with us and expect us to protect it.” 48 Facebook Chief Operating Officer Sheryl
Sandberg likewise conceded that Facebook committed “a major violation of the people’s trust”
when it allowed Cambridge Analytica to collect user data and that she “deeply regret[s] that
[Facebook] didn’t do enough to deal with it.” 49
86.

Facebook’s conduct constitutes an unfair and deceptive act or practice under the

87.

Pursuant to 815 ILCS 505/7(b), the penalty for violating the ICFA is a sum not to

ICFA.

exceed $50,000, or, if the Court finds that Facebook’s above-described practices were intended
to defraud Illinois residents, $50,000 per violation.
88.

In addition to any other civil penalty provided, if a person is found by the Court to

have engaged in any method, act, or practice declared unlawful under the ICFA, and the
violation was committed against a person 65 years of age or older, the Court may impose an
additional civil penalty in a sum not to exceed $10,000 per violation. 815 ILCS 505/7(c).
THIRD CAUSE OF ACTION
Declaratory and Injunctive Relief
(On Behalf of the People of the State of Illinois Against Defendants)
89.

Plaintiff People of the State of Illinois incorporates the foregoing allegations as if

fully set forth herein.
90.

Pursuant to 735 ILCS 5/2-701, this Court “may make binding declarations of

rights, having the force of final judgments . . . including the determination . . . of the
construction of any statute, municipal ordinance, or other governmental regulation . . . and a
48

Mark Zuckerberg Update on Cambridge Analytica Situation, F ACEBOOK , INC. (March 21,
2018), https://www.facebook.com/zuck/posts/10104712037900071.
49

Sheryl Sandberg Post Addressing the Cambridge Analytica News, F ACEBOOK , INC.
(March 21, 2018), https://www.facebook.com/sheryl/posts/10160055807270177.
23

 declaration of the rights of the parties interested.”
91.

Such a declaration of rights “may be obtained . . . as incident to or part of a

complaint . . . seeking other relief as well.” 735 ILCS 5/2-701(b).
92.

Plaintiff People of the State of Illinois seeks a judgment declaring that

Defendants have violated the ICFA.
93.

Upon information and belief, Defendants remain in possession of the highly

personal Facebook user data that it unlawfully obtained. Millions of Illinois residents will
continue to suffer or be vulnerable to injury, unless this is rectified through injunctive relief.
PRAYER FOR RELIEF
WHEREFORE, Plaintiff People of the State of Illinois respectfully requests that the
Court enter an Order granting the following relief:
A.

Declaring that Defendants’ actions constitute violations of the ICFA;

B.

Fining Defendants $50,000 for violating the ICFA or, if the Court finds that

Defendants engaged in the above-described conduct with intent to defraud, $50,000 for each
such violation;
C.

Fining Cambridge Analytica an additional $10,000 for each violation described

above involving an Illinois resident 65 years of age or older for each day such violation has
existed and continues to exist;
D.

Awarding Plaintiff its reasonable attorneys’ fees and costs;

E.

Awarding Plaintiff pre- and post-judgment interest, to the extent allowable;

F.

Awarding such and other injunctive and declaratory relief as is necessary; and

G.

Awarding such other and further relief as the Court deems reasonable and just.
JURY DEMAND

Plaintiff requests trial by jury of all matters that can be so tried.
24

 Dated: March 23, 2018

Respectfully submitted,

KIMBERLY M. FOXX,
Special Assistant State’s Attorneys*
State’s Attorney of Cook County
By: /s/ Kent. S. Ray

By: /s/ Jay Edelson

Kent S. Ray
Assistant State’s Attorney
kent.ray@cookcountyil.gov
COOK COUNTY STATE ’S ATTORNEY ’S OFFICE
69 W. Washington Street, Suite 3130
Chicago, Illinois 60602
Tel: 312.603.8600
Fax: 312.603.9830

Jay Edelson*
jedelson@edelson.com
Benjamin H. Richman*
brichman@edelson.com
Ari J. Scharg*
ascharg@edelson.com
David I. Mindell*
dmindell@edelson.com
Alfred K. Murray II*
amurray@edelson.com
EDELSON PC
350 N. LaSalle Street, 14th Floor
Chicago, Illinois 60654
Tel: 312.589.6370
Fax: 312.589.6378
Firm ID: 62075
*Petition for Appointment as Special
State’s Attorney Pending

25