The Cambridge Analytica lawsuit landscape produced a record $5 billion Federal Trade Commission penalty against Facebook, a $725 million user class-action settlement now being paid out to claimants, a $190 million shareholder derivative settlement against Meta directors, a $100 million SEC penalty distributed through an investor fund, and separate UK regulatory fines. One significant case remains open: a Canadian privacy action against Facebook that the Supreme Court of Canada heard in March 2026, with judgment reserved.
What the Lawsuits Were About
Cambridge Analytica, the U.S. arm of Britain’s SCL Group, obtained Facebook data on as many as 87 million users through a personality-quiz app called “thisisyourdigitallife,” built by Cambridge University researcher Aleksandr Kogan. About 270,000 people took the quiz; Facebook’s Graph API then allowed the app to pull profile data on their friends too, adding 50 to 65 million people who had never interacted with it. The app told users it would “NOT download your name or any other identifiable information,” a line Kogan’s team added after discovering that half of participants refused access without it.1Federal Trade Commission. FTC Complaint: Kogan and Nix Cambridge Analytica used the data to train psychometric models for political clients.
Facebook learned about the transfer in December 2015 and asked Kogan and Cambridge Analytica to delete the data. Both certified they had, but Facebook never verified.2NBC News. Aleksandr Kogan Fires Back at Facebook Over Cambridge Analytica When the full scale became public through The New York Times and The Observer in March 2018, regulators and private plaintiffs on both sides of the Atlantic moved in. Cambridge Analytica itself shut down and entered insolvency proceedings in May 2018, with SCL Elections formally placed into liquidation in April 2019.3Federal Trade Commission. Cambridge Analytica Administrative Complaint
The FTC’s $5 Billion Penalty Against Facebook
On July 24, 2019, the FTC announced a $5 billion penalty against Facebook, at the time the largest civil penalty ever imposed in a U.S. data-privacy case.4Federal Trade Commission. FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook The agency charged that Facebook had violated a 2012 consent order by deceiving users about their ability to control how personal information was shared with third-party apps, including the data that ended up with Cambridge Analytica.
The 20-year settlement order also imposed structural changes on the company:
- An independent board-level privacy committee whose members can only be removed by a supermajority vote, stripping Mark Zuckerberg of unilateral control over privacy decisions.4Federal Trade Commission. FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook
- Quarterly and annual compliance certifications by Zuckerberg and designated compliance officers, with false certifications subject to civil and criminal penalties.
- An independent third-party assessor conducting biennial evaluations of Facebook’s privacy program and reporting to the board’s privacy committee.5U.S. Department of Justice. Facebook Agrees to Pay $5 Billion and Implement Robust New Protections for User Information
- A required privacy review before launching or modifying any product, mandatory password encryption, a ban on using two-factor authentication phone numbers for ad targeting, and reporting of any data compromise affecting 500 or more users within 30 days.
FTC Orders Against Cambridge Analytica, Nix, and Kogan
The same day, the FTC filed a separate administrative complaint against Cambridge Analytica and actions against former CEO Alexander Nix and Kogan.6Federal Trade Commission. FTC Issues Opinion and Order Against Cambridge Analytica for Deceiving Consumers About Collection of Facebook Data Because Cambridge Analytica was already in bankruptcy and did not respond, the Commission issued a unanimous default final order on December 6, 2019, finding the company had violated the FTC Act by deceiving users about the app’s data collection and by falsely claiming participation in the EU-U.S. Privacy Shield after its certification lapsed. The order required deletion of all personal data collected through the app and any algorithms derived from it.
Nix and Kogan settled under separate consent orders finalized December 18, 2019.7Federal Trade Commission. FTC Grants Final Approval to Settlement With Former Cambridge Analytica CEO and App Developer Both were barred from making false statements about how they collect, use, or share personal information, and both had to destroy all data and work product from the app. Nix’s order runs 20 years and imposes ongoing compliance reporting and FTC monitoring.8Federal Trade Commission. Agreement Containing Consent Order as to Alexander Nix Neither order imposed a monetary penalty on the individuals.
The $725 Million User Class-Action Settlement
Dozens of consumer lawsuits were consolidated as In re: Facebook, Inc. Consumer Privacy User Profile Litigation in the Northern District of California. The case began with Cambridge Analytica but expanded to cover Facebook’s broader data-sharing with third-party apps.9Courthouse News Service. Ninth Circuit Upholds $725M Facebook Settlement in Cambridge Analytica Case Facebook agreed to pay $725 million.
District Judge Vince Chhabria granted final approval on October 10, 2023.10BFA Law. Final Approval Granted in $725 Million Facebook Cambridge Analytica Consumer Privacy Class Action The Ninth Circuit upheld the settlement on February 13, 2025, over objectors’ appeals. Attorneys’ fees were set at $180 million, or 25% of the fund.
Any U.S. Facebook user with an active account between May 24, 2007, and December 22, 2022, was eligible to file. The claims deadline was August 25, 2023.11CNN. Facebook Settlement Payments: Privacy Breach Payments were calculated on an allocation-points system: one point per calendar month of active account use during the class period, with the fund divided proportionally. The first round of checks began going out in September 2025, averaging about $29.43 per person.12CBS News. Facebook User Privacy Settlement: Second Check A second round, funded by uncashed checks from the first distribution, began June 9, 2026, for claimants who cashed the initial payment; the administrator estimated those to range from $4.67 to $7.32.13USA Today. Facebook Settlement Second Payment The claims window is closed, so users who did not file by the August 2023 deadline are not eligible.
The $190 Million Meta Shareholder Settlement
In 2018, Meta shareholders filed a derivative lawsuit in Delaware’s Court of Chancery alleging that Zuckerberg, former COO Sheryl Sandberg, and current and former directors breached their fiduciary duties by ignoring privacy warning signs and letting the company violate its 2012 FTC consent order.14Forbes. Zuckerberg Reaches Settlement With Meta Shareholders in $8 Billion Privacy Case Plaintiffs sought roughly $8 billion in damages. Named defendants included Zuckerberg, Sandberg, Peter Thiel, Marc Andreessen, Reed Hastings, and other board members.
Before trial, Vice Chancellor Travis Laster sanctioned Sandberg on January 21, 2025, for deleting emails from a personal Gmail account she maintained under a pseudonym. Despite a March 2018 litigation hold requiring preservation, she continued deleting emails older than 30 days and selectively erased others. The court found it “likely that the most sensitive and probative exchanges are gone” and imposed a heightened “clear and convincing evidence” standard on any issue where Sandberg carried the burden of proof, plus an order to pay plaintiffs’ expenses.15Reuters. Meta Ex-COO Sandberg Sanctioned in Investor Lawsuit for Deleting Emails
The case went to a non-jury trial on July 16, 2025. By the next morning, the parties announced a deal. Formal terms filed November 20, 2025, called for the defendant directors and officers to pay $190 million back to Meta.16U.S. Securities and Exchange Commission. In re Facebook Inc. Derivative Litigation: Notice of Pendency The settlement also required governance reforms, including enhancements to Meta’s whistleblower program, a new director code of conduct, removal of Zuckerberg’s authority over director conflict-of-interest decisions, and new insider-trading-plan requirements for executives. The Delaware Court of Chancery granted final approval on April 7, 2026.17Scott+Scott Attorneys at Law. $190M Settlement Secured in Case Against Meta The case was the first “Caremark” claim (alleging directors failed in their oversight duties) ever to reach trial, though the day-two settlement meant it never produced a verdict.18DLA Piper. Settlement Reached in Meta Investors’ Suit Over Privacy Violations Because it is a derivative action, the $190 million goes to Meta itself, not to individual shareholders.
SEC Enforcement and the $100 Million Investor Fair Fund
On July 24, 2019, the SEC also filed an enforcement action against Facebook, alleging the company violated federal securities laws by calling the risk of user-data misuse merely “hypothetical” in public filings between 2016 and March 2018, even though it had known since December 2015 that a researcher had improperly sold data to Cambridge Analytica.19U.S. Securities and Exchange Commission. SEC v. Facebook, Inc. Facebook was ordered to pay a $100 million civil penalty.
On August 17, 2020, the court created a Fair Fund to distribute the money to investors who purchased Facebook stock between January 28, 2016, and March 19, 2018. The court approved a distribution plan on April 25, 2022. As of April 2025, claims administrator RCB Fund Services had completed initial review of all submitted claims and was sending status notices to claimants.20Facebook Fair Fund. Facebook Fair Fund
UK Fines: The ICO and the Electoral Commission
The UK Information Commissioner’s Office fined Facebook £500,000, the maximum possible under the pre-GDPR Data Protection Act 1998, for allowing app developers to harvest user data without informed consent and failing to keep it safe.21UK Parliament. Digital, Culture, Media and Sport Committee Report Facebook appealed but withdrew the appeal in October 2019 and paid the fine without admitting liability.22The Guardian. Facebook Agrees to Pay Fine Over Cambridge Analytica Scandal The ICO noted that under GDPR the fine could have exceeded £1 billion.23Privacy International. Cambridge Analytica, GDPR: 1 Year, a Lot of Words and Some Action The ICO said it would have fined Cambridge Analytica too, but the company was already in administration. SCL Elections was criminally prosecuted for failing to respond to a data subject access request and in January 2019 was fined £15,000 plus £6,000 in costs.
The UK Electoral Commission concluded in 2018 that Vote Leave broke electoral law in the 2016 Brexit referendum by coordinating with the youth group BeLeave to funnel over £675,000 to Canadian digital firm AggregateIQ, which had ties to SCL Group.24BBC. Vote Leave Fined and Referred to Police for Breaking Electoral Law The undeclared spending pushed Vote Leave roughly £500,000 beyond its £7 million statutory limit. Vote Leave was fined £61,000, and its responsible person, David Halsall, was referred to the Metropolitan Police.25UK Electoral Commission. Vote Leave Fined and Referred to Police for Breaking Electoral Law BeLeave founder Darren Grimes was initially fined £20,000 and referred to police, but a county court upheld his appeal and withdrew the fine in July 2019. The ICO separately issued an enforcement notice ordering AggregateIQ to stop processing personal data of UK and EU citizens for political campaigning.
The Canadian Case Still Pending at the Supreme Court
Canada’s Privacy Commissioner brought an action in Federal Court alleging Facebook violated the Personal Information Protection and Electronic Documents Act in the Cambridge Analytica matter. The Federal Court initially dismissed the application, but the Federal Court of Appeal reversed in September 2024, finding Facebook failed to obtain meaningful consent and failed to safeguard user data adequately.26Torys LLP. Federal Court of Appeal Finds That Facebook Breached Obligations Under Federal Privacy Law
Facebook appealed to the Supreme Court of Canada, which granted leave in June 2025 and heard oral arguments on March 19, 2026. As of May 2026, judgment remains reserved.27Supreme Court of Canada. Facebook Inc. v. Privacy Commissioner of Canada, Docket 41538 The case turns on what constitutes valid consent for data disclosure under Canadian privacy law.