Updated October 2026: This post has been expanded from its original April 2018 version with the full story of what Cambridge Analytica collected, how Facebook told affected users, what happened next, and how to check which apps can see your data today. It is a historical account; details describe the time it covers, not today.

A smartphone lying on a table

In April 2018, weeks into the Cambridge Analytica scandal, millions of Facebook users wanted to know one thing: was my data in there? Facebook said it would notify people who were affected, and it also set up a help page where anyone could check for themselves. This post originally pointed readers to that page.

The 2018 checker belongs to history now, but the question behind it has not gone away. This updated version explains what Cambridge Analytica obtained, how Facebook told people, what regulators and courts did afterwards, and how to review which apps and websites can reach your Facebook information today.

What happened

In 2013, a University of Cambridge data scientist named Aleksandr Kogan and his company, Global Science Research, created a Facebook app called "This Is Your Digital Life." It was a personality quiz. People who took it were paid to complete a survey that they were told was for academic research.

The problem was what the app could reach. Under Facebook's platform rules at the time, an app could collect information not only from the people who installed it but also from their Facebook friends. About 270,000 people downloaded the quiz, yet it gathered data on tens of millions of profiles. Kogan's company shared that data with Cambridge Analytica, a British political consulting firm linked to SCL Group, which used it for political advertising work, including for the 2016 U.S. presidential campaigns of Ted Cruz and Donald Trump.

The Guardian first reported in December 2015 that Cambridge Analytica was using harvested Facebook data. The full story broke on March 17, 2018, when The Guardian and The New York Times published simultaneous accounts based on interviews with Christopher Wylie, a former Cambridge Analytica employee. The fallout was immediate. More than $100 billion was knocked off Facebook's market value within days, and the #DeleteFacebook hashtag trended.

How many people were affected

The first reports said 50 million profiles. Cambridge Analytica said it had data on only 30 million. On April 4, 2018, Facebook's chief technology officer, Mike Schroepfer, put the figure at up to 87 million people, mostly in the United States. Facebook later published a state-by-state breakdown.

Facebook users whose data may have been shared (millions)
Worldwide total (up to)
87.0 M
United States
70.6 M
California
6.7 M
Texas
5.6 M
Florida
4.3 M
Source: Facebook estimates, April and May 2018, as reported in Wikipedia's summary of the scandal.

The scandal reached well beyond the U.S. Facebook told Australia that around 300,000 Australians may have been affected, according to ABC News. Most countries outside the U.S. had smaller totals.

How you could check in 2018

Starting April 9, 2018, Facebook placed a notice at the top of every user's News Feed. There were three versions, depending on whether you or your friends had used the quiz. Each linked to a help page at facebook.com/help/yourinfo, which told you whether your information may have been shared.

If you were affected, it was most likely because a friend took the quiz, not you. Facebook said the shared information likely included your public profile, Page likes, birthday and current city. Some people who used the app also gave it access to their News Feed, timeline and messages.

That checker was a one-time tool for a single app. If you missed the notice in 2018, there is little practical value in hunting for it now. The data was taken years ago, and nothing you change today can pull it back. What you can still control is which apps have access now.

What happened next

The scandal led to some of the largest privacy penalties in history.

From the quiz app to the payouts
  1. 2013
    Aleksandr Kogan and his company Global Science Research build the "This Is Your Digital Life" personality quiz.
  2. December 2015
    The Guardian first reports that Cambridge Analytica used Facebook data harvested without consent.
  3. March 17, 2018
    The Guardian and The New York Times publish whistleblower Christopher Wylie's account.
  4. April 4, 2018
    Facebook says data on up to 87 million people may have been shared, and announces new limits on app data access.
  5. April 9 to 10, 2018
    Facebook starts showing notices at the top of News Feed. Mark Zuckerberg testifies before Congress.
  6. May 2018
    Cambridge Analytica files for Chapter 7 bankruptcy.
  7. July 2019
    The FTC announces a $5 billion penalty for Facebook. Facebook also agrees to pay $100 million to settle with the SEC.
  8. October 2019
    Facebook agrees to pay the UK Information Commissioner's Office a £500,000 fine, the maximum then allowed.
  9. December 2022
    Meta agrees to a $725 million class-action settlement in the United States.
  10. August 27, 2025
    After appeals end, a court orders the settlement payments to be distributed.
Sources: Wikipedia, Facebook Newsroom, CNN.

Mark Zuckerberg testified before Congress on April 10, 2018. Cambridge Analytica filed for bankruptcy in May 2018. In July 2019, the U.S. Federal Trade Commission voted 3 to 2 to approve a $5 billion settlement with Facebook. The FTC said Facebook had violated a 2012 privacy order, and the settlement put the company under a new 20-year order. The FTC also brought a case against Kogan and Cambridge Analytica's former chief executive, Alexander Nix. Both agreed to orders that limit their future business dealings and require them to delete the data and anything made from it. In the same month, Facebook agreed to pay $100 million to the Securities and Exchange Commission over allegations that it misled investors about the risks of user data misuse.

In the UK, the Information Commissioner's Office fined Facebook £500,000, the maximum allowed under the law at the time of the breach. Facebook agreed to pay in October 2019. The official UK investigation also concluded that Cambridge Analytica was not involved in the 2016 Brexit referendum beyond some initial inquiries.

The $725 million settlement

Private lawsuits took longer. In December 2022, Meta agreed to pay $725 million to settle a U.S. class action over Facebook's sharing of user data with Cambridge Analytica and other third parties. It covered U.S. users with an active account at any time between May 24, 2007 and December 22, 2022. The claims deadline was August 25, 2023. About 29 million claims were filed, according to CNN. Appeals delayed payments until 2025. The settlement became final in May 2025, and a court ordered distribution on August 27, 2025. Payments are based on how many months each claimant had an active account during that period. Anyone who did not file a claim by the 2023 deadline cannot join now.

How Facebook changed its platform

In its April 4, 2018 announcement, Facebook described nine changes to limit what apps could access. Apps lost access to event guest lists and group member lists. Facebook said it would review every app asking for data such as check-ins, likes, photos and posts. Apps could no longer request details such as religious or political views, relationship status or education history. Facebook also turned off the ability to look up people by phone number or email address. It said malicious actors had used that feature to scrape public profiles and that most users could have been affected. Apps people had not used in three months would also lose access to their data.

How to check which apps can see your data today

The real lesson of Cambridge Analytica is that a quiz you took years ago can keep a door open to your data long after you forget it. A quick review once or twice a year closes those doors. Menu labels change often, so look for these names in your app's settings.

  1. Review apps logged in with Facebook. In Facebook, go to Settings & privacy, then Settings, and find Apps and websites. You will see the apps and sites you have logged in to with Facebook. Remove any you no longer use. When you remove one, Facebook gives you the option to delete posts, photos or videos it published on your behalf.
  2. Disconnect off-Meta activity. In Meta's Accounts Center, under Your information and permissions, open Your activity off Meta technologies. You can disconnect specific apps and websites that share your activity with Meta, or turn off future activity altogether.
  3. Check other sign-in providers. The same risk applies to "Sign in with Google" and "Sign in with Apple." Your Google Account and Apple Account settings each list the third-party apps connected to them.
  4. Tighten what friends can expose. Facebook's platform rules are much tighter than they were in 2013. Even so, limit who can see your posts, friends list and personal details, so less is exposed if something goes wrong.
  5. Be skeptical of quizzes. Personality tests and "which celebrity are you" games are an easy way to collect data. If one asks you to log in with a social account, think about what it actually needs.

Cambridge Analytica collapsed in 2018, but the business of collecting personal data did not. Checking your connected apps takes five minutes, and it is the one part of this story you can still control.

Sources

Top image: "Smartphone running Facebook app" by Johan Larsson, CC BY 2.0, via Wikimedia Commons (resized). Charts by Thank You Robot.