Aleksandr Kogan

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF ALEKSANDR KOGAN, AND ALEXANDER NIX CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SECTION 5 OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4694; File No. 182 3107 Complaint, December 18, 2019 Decision, December 18, 2019 This consent order addresses Alexander Nix's use of the GSRApp to harvest certain Facebook user profile data from approximately 250,000 270,000 Facebook users who directly interacted with the app, as well as 50 65 million of the "friends" in those users' Facebook social network. The complaint alleges that respondent's representation to users who installed the GSRApp that they would not "download [their] name or any other identifiable information" was deceptive because the GSRApp collected identifiable information from these users, including their Facebook User IDs. The consent order prohibits Nix from making false or deceptive statements regarding the extent to which he protects the privacy and confidentiality of Covered Information as defined in the Order. Participants For the Commission: Linda Holleran Kopp.

For the Respondents: Kory Langhofer, Statecraft PLLC.

COMPLAINT The Federal Trade Commission, having reason to believe that Aleksandr Kogan, an individual, and Alexander Nix, individually and at the relevant time, Chief Executive Officer of Cambridge Analytica, LLC, (collectively "Respondents") have violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges:

NATURE OF THE CASE 1. This action seeks to hold Respondents responsible for their deceptive acts and practices to harvest personal information from Facebook users for political and commercial targeted advertising purposes. Respondents, along with Cambridge Analytica, LLC, jointly and severally, developed, operated, analyzed, and used data obtained through an application on the Facebook platform called the "GSRApp," also sometimes referred to publicly as the "thisisyourdigitallife" app. Using the Graph application programming interface ("Graph API") Facebook made available to developers on its platform, the GSRApp harvested Facebook user profile data from approximately 250,000 270,000 Facebook users who directly interacted with the app, as well as 50-65 million of the "friends" in those users' social networks. Cambridge Analytica, LLC, Alexander Nix, and Aleksandr Kogan o btained the app users' consent to collect their Facebook profile data through false and deceptive means. Specifically, they falsely NIX, ALEXANDER 777 Complaint represented that the GSRApp did not collect any identifiable information from Facebook users who authorized it.

RESPONDENTS 2. Respondent Aleksandr Kogan ("Kogan") IS an American citizen currently residing in New York. Until September 2018, Kogan was a Senior Research Associate and Lecturer at the Department of Psychology at the University of Cambridge in the United Kingdom, where he established and led the Cambridge Prosociality and Well­ Being Lab ("CPW Lab"). Kogan was also an owner and co -founder of the now-defunct U.K. corporation, Global Science Research, Ltd. ("GSR"). Kogan has been known at times by the married name, Aleksandr Spectre.

3. Respondent, Alexander James Ashburn.er Nix ("Nix") is a British citizen currently residing in the United Kingdom. Until April 30, 2018, Nix was the Chief Executive Officer of Cambridge Analytica and also a director of SCL Elections Limited ("SCL Elections"), a privately held U.K. Corporation that has held an ownership interest in Cambridge Analytica. Individually or in concert with others, Nix formulated, directed, controlled, had the authority to control, or participated in the acts and practices alleged in this complaint. Nix currently resides in London, England. Nix, in connection with the matters alleged herein, transacts or has transacted business throughout the United States.

4. At all times material to this Complaint, acting alone or in concert with Cambridge Analytica, Kogan, or others, Nix purposefully directed his activities to the United States by directing, controlling, or participating in the collection and analysis of data from U.S. consumers and in the use of that data to create marketing products and services that target consumers throughout the United States. Nix's activities directed at the United States gave rise to the deceptive claims alleged herein.

RELATED PARTIES 5. Cambridge Analytica, LLC ("Cambridge Analytica") IS a private Delaware limited liability company that was formed in December 2013, and had a principal office or place of business at 597 Fifth Avenue, 7th Floor, New York, NY 10017. Cambridge Analytica is part of the SCL Group Ltd. family of companies, as is SCL Elections. Cambridge Analytica has operated as a data analytics and consulting company that provides voter-profiling and marketing services. Cambridge Analytica describes itself on its website as "a data -science consultancy and marketing agency" that is "politically neutral." In May 2018, Cambridge Analytica filed for bankruptcy, which proceedings are still ongoing.

6. During the relevant time period, Cambridge Analytica and SCL Elections conducted the business practices described below through an interrelated network of companies that have common business functions, ownership, officers, and employees. For example, Nix was both the head of SCL Elections and also the Chief Executive Officer of Cambridge Analytica. SCL Elections was placed into liquidation on April 17, 2019. VOLUME 168 Complaint JURISDICTION 7. The acts or practices of Respondents alleged in this complaint have been in or affecting commerce, as "commerce" is defined in Section 4 of the Federal Trade Commission Act, and constitute "deceptive acts or practices involving foreign commerce" as set forth in Section 5 of the FTC Act.

RESPONDENTS' BUSINESS PRACTICES A. Agreement to Harvest Facebook User Profile Data for Commercial Purposes 8. In late 2013 or early 2014, Nix, SCL Elections, and Cambridge Analytica became aware of research by individuals at the Psychometrics Centre within the University of Cambridge that found that Facebook profile information could be used to successfully predict an individual's personality traits according to the "OCEAN" scale, a psychometric model that measures an individual's openness to experiences, conscientiousness, extraversion, agreeableness, and neuroticism.

9. Specifically, researchers developed an algorithm that could predict an individual's personality based on the individual's "likes" of public Facebook pages. For example, liking Facebook pages related to How to Lose a Guy in 10 Days, George W. Bush, and rap and hip-hop could be linked with a conservative and conventional personality. The researchers argued that their algorithm, which was more accurate for individuals who had more public Facebook page "likes," could potentially predict an individual's personality better than the person's co -workers, friends, family, and even spouse.

10. Nix, SCL Elections, and Cambridge Analytica were interested in this research because Cambridge Analytica intended to offer voter profiling, microtargeting, and other marketing services to U.S. campaigns and other U.S.-based clients. Through mutual contacts, representatives of SCL Elections (who had dual roles at Cambridge Analytica) reached out to Kogan and academics affiliated with the Psychometrics Centre in early 2014 to discuss a potential working relationship to commercialize this research. 11. Kogan had expertise researching and analyzing Facebook data through his work at the CPW Lab, as well as his prior research collaborations with Facebook that analyzed aggregated Facebook data relating to how people worldwide connect and express emotions. Kogan was willing to enter into a commercial venture with SCL Elections, and after several months of discussion, the parties reached agreement about the scope of work (the "Project"). 12. Importantly, Kogan already had a Facebook app that was registered on the Facebook platform, the CPW Lab app, that could be repurposed to collect profile data from Facebook users and their "friends" through Facebook's developer tool, Graph API (v.l). 13. F acebook's Graph API (v.1) allowed developers to collect Facebook profile data from users who directly installed or otherwise interacted with the developer's application or website through a Facebook Login ("App Users"), as well as from these users' Faceboo k NIX, ALEXANDER 779 Complaint "friends." Facebook allowed this data collection even though the "friends" did not have any direct interaction with the app or website ("Affected Friends"). While Facebook had announced in April 2014 that it was introducing a new version of the Graph API v.2 that would no longer allow developers to collect profile data from Affected Friends, only from the App Users themselves, existing apps had one year before these limitations went into effect, whereas new apps would automatically be limited. Kogan's app was, thus, "grandfathered" into the more permissive data collection allowable under Graph API (v.1), making Kogan an appealing partner for Nix, Cambridge Analytica, and SCL Elections.

14. On May 29, 2014, Kogan incorporated GSR to carry out the Project, separate and apart from his duties at the University of Cambridge. Kogan was the Chief Executive Officer of GSR at all relevant times, and worked on all aspects of GSR's products and services before it was dissolved in October 2017.

15. On June 4, 2014, GSR and SCL Elections entered into a GS Data and Technology Subscription Agreement (the "June 2014 Agreement"). Nix signed this agreement for SCL Elections. Under this agreement, GSR agreed to harvest Facebook profile data from App Users and Affected Friends in 11 U.S. states, generate personality scores for these individuals, and then match these profiles to U.S. voter records provided to GSR by SCL Elections. GSR would then send these matched records along with the associated personality scores back to SCL Elections. GSR retained the original data set and granted SCL Elections a license to access the data and to use the proprietary GSR personality scores. Following the creation of GSR and the signing of the June 2014 Agreement, Kogan repurposed the CPW Lab app to be come the "GSRApp." 16. Although SCL Elections is the entity that entered into the agreement with GSR, it was acting for and on behalf of Cambridge Analytica. SCL Elections entered into a Services Agreement with Cambridge Analytica whereby SCL Elections agreed, among other things, to (a) acquire, for and on behalf of Cambridge Analytica, demographic, transactional, lifestyle, and behavioral data about consumers in target populations; (b) identify and build target voter lists; (c) apply research techniques to understand better the habits and daily lives of target voter groups; and (d) apply psychological profiles to target groups of voters. In a separate agreement, SCL Elections also agreed to license all of its intellectual property to Cambridge Analytica. 17. SCL Elections and Cambridge Analytica played a significant and direct role in the development and implementation of the GSRApp, as well as in the analysis of the data the GSRApp collected. For example:

a. SCL Elections and Cambridge Analytica revised the terms of use for the GSRApp from the original CPW Lab app;

b. SCL Elections and Cambridge Analytica paid all costs totaling over five hundred thousand dollars related to implementing the GSRApp and analyzing the resulting data, including paying U.S.-based survey panel providers to specifically target Facebook users located in the United States to take the GSRApp surveys;

VOLUME 168 Complaint c. SCL Elections and Cambridge Analytica inserted specific questions to be included in some of the surveys, including a number of questions about national security in the United States because this was a particular topic of interest for one of Cambridge Analytica's U.S. -based clients; d. SCL Elections and Cambridge Analytica directly communicated with the U.S.- based survey panel provider about the timing and focus of the GSRApp surveys; and e. SCL Elections and Cambridge Analytica actively assisted in the matching of data harvested from App Users and Affected Friends located in the U.S. and Kogan's personality scores with U.S. voter registration records. 18. Nix was personally involved in the data harvesting Project. In addition to signing the June 2014 Agreement, he directly communicated and met with Kogan about the Project, personally authorized payment for Project-related costs, reviewed survey questions and specifically requested certain Facebook data or analysis, and directed internal actions within SCL Elections and Cambridge Analytica related to implementing the GSRApp, analyzing the GSRApp data, and using the GSRApp data for Cambridge Analytica clients in the United States. B. The GSRApp Harvested Large Quantities of Facebook Profile Data from App Users and Affected Friends Through False and Deceptive Means 19. The GSRApp asked users to answer survey questions and consent to their Facebook profile data being colle cted, including public Facebook page "likes." Kogan then used the initial participants' survey responses and Facebook "likes" to train his algorithm so that it could predict the users' personality traits based solely on the Facebook "likes" data. This process, which was inspired by original research by others at the University of Cambridge, allowed Kogan to provide personality scores for the Affected Friends, from whom he collected Facebook data but had no survey responses.

20. Kogan then assigned a confidence level to each personality score based on the number of public page "likes" for each U.S. -based App User and Affected Friend, generally requiring a Facebook user to have "liked" at least 10 public Facebook pages to be confident of the personality score.

21. Cambridge Analytica, Nix, and Kogan then conducted a small trial to determine how well Facebook profile information could be matched with U.S. voter records and information from other public databases. The Project would have little value to SCL Elections and Cambridge Analytica if the personality scores could not be matched with actual U.S. voters. 22. The initial trial was a success and showed that the Facebook profile data could be matched with U.S. voter records. Based on this success, Respondents implemented the GSRApp on a wider scale using the Qualtrics survey platform, based in Provo, Utah. NIX, ALEXANDER 781 Complaint 23. Qualtrics recruited U.S.-based consumers through four waves of survey panels over the summer of 2014. Each wave asked different questions of the participants such that K ogan's personality scores covered a broad range of topics, including political enthusiasm, political orientation, frequency in voting, consistency in voting for the same political party, and views on particular controversial issues. Survey participants who completed the survey and authorized the GSRApp to harvest their Facebook profile information were paid a nominal fee of a few dollars for participating in the survey.

24. At the point in every survey in which the GSRApp asked U.S. consumers to authorize the GSRApp to collect their Facebook data, the GSRApp made the following representation:

In this part, we would like to download some of your Facebook data using our Facebook app. We want you to know that we will NOT download your name or any other identifiable information we are interested in your demographics and likes.

25. Contrary to this representation, the GSRApp collected the Facebook User ID of those users who authorized it. A Facebook User ID is a persistent, unique identifier that connects individuals to their Facebook profiles. Cambridge Analytica, Nix, and Kogan included this representation after finding that half of the survey participants initially refused to grant the GSRApp permission to collect their Facebook profile data. 26. Cambridge Analytica, Nix, and Kogan harvested a significant amount of Facebook profile data from App Users and the Affected Friends located in the U.S. through the GSRApp. Specifically, they harvested the following Facebook profile data from App Users: Facebook User ID; gender; birthdate; location ("current city"); friends list; and "likes" of public Facebook pages. They harvested from Affected Friends their Facebook User ID; name; gender; birthdate; location ("current city"); and "likes" of public Facebook pages. 27. Over the course of the Project, Cambridge Analytica, Nix, and Kogan harvested Facebook profile data from approximately 250,000 270,000 App Users located in the U.S., and harvested profile data from approximately 50 65 million Affected Friends, including at least 30 million identifiable U.S. consumers.

28. In January 2015, GSR and SCL Elections entered into a supplemental agreement ("January 2015 Agreement") regarding additional data from the Project that SCL Elections and Cambridge Analytica wanted. Pursuant to the January 2015 Agreement, GSR provided data and analysis for App Users and Affected Friends for the remaining 39 U.S. states. GSR also provided a more limited set of personality analyses for these consumers than it had provided for consumers in the initial 11 U.S. states.

29. In April 2015, GSR and SCL Elections entered into an addendum to the January 2015 Agreement ("Addendum"), pursuant to which GSR provided SCL Elections and Cambridge Analytica with the underlying Facebook data used to "train" the algorithm that generated the OCEAN personality scores. GSR also provided SCL Elections and Cambridge VOLUME 168 Decision and Order Analytica with additional information about whether the App Users and Affected Friends included in the second set of data provided pursuant to the January 2015 Agreement had "likes" for about 500 specific pages identified by SCL Elections and Cambridge Analytica. 30. Nix, SCL Elections, and Cambridge Analytica reported to Kogan that they had very positive feedback from their clients and had expressed an interest in continuing to work with Kogan and GSR on other similar projects. While Kogan and GSR were interested in working on follow-up projects, the parties could not reach an agreement and discontinued their work together after GSR transferred the data agreed to in the Addendum in May 2015. 31. In December 2015, several news reports were published regarding Cambridge Analytica's use of Facebook data. Following these reports, Facebook demanded that Kogan, Cambridge Analytica, and its SCL affiliates delete all Facebook data in their possession. While Kogan and SCL Elections certified to Facebook that they had deleted the data obtained through the GSRApp, individuals or other entities still possess this data and/or data models based on this data.

VIOLATION OF THE FTC ACT Deceptive Claim Concerning the Collection of Personal Identifiable Information 32. Through the means described in Paragraph 24, Respondents represented, directly or indirectly, expressly or by implication, that the GSRApp did not collect any identifiable information from Facebook users who authorized the app.

33. In fact, as described in Paragraphs 25-26, the GSRApp collected identifiable information from Facebook users who authorized the App, including the Facebook User ID of those users who used it. Therefore, the representation set forth in Paragraph 32 is false or misleading.

THEREFORE, the Federal Trade Commission, this Eighteenth day of December, 2019, has issued this Complaint against the Respondents.

By the Commission.

DECISION The Federal Trade Commission ("Commission") initiated an investigation of certain acts and practices of the Respondents named in the caption. The Commission's Bureau of Consumer Protection ("BCP" ) prepared and furnished to Respondents a draft Complaint. BCP proposed to present the draft Complaint to the Commission for its consideration. If issued by the NIX, ALEXANDER 783 Decision and Order Commission, the draft Complaint would charge the Respondent Alexander James Ahburner Nix ( "Respondent") with violations of the Federal Trade Commission Act. Respondent and BCP thereafter executed an Agreement Containing Consent Order ("Consent Agreement"). The Consent Agreement includes: (l) statements by Respondent that he neither admits nor denies any of the allegations in the Complaint, except as specifically stated in this Decision and Order, and that only for purposes of this action, he admits the facts necessary to establish jurisdiction; and (2) waivers and other provisions as required by the Commission's Rules.

The Commission considered the matter and determined that it had reason to believe that Respondent has violated the Federal Trade Commission Act, and that a Complaint should issue stating its charges in that respect. The Commission accepted the executed Consent Agreement and placed it on the public record for a period of 30 days for the receipt and consideration of public comments. The Commission duly considered any comments received from interested persons pursuant to Section 2.34 of its Rules. 16 C.F.R. § 2.34. Now, in further conformity with the procedure prescribed in Rule 2.34, the Commission issues its Complaint, makes the following Findings, and issues the following Order:

Findings l. The Respondent is Alexander James Ashbumer Nix ("Nix"), a British citizen currently residing in the United Kingdom.

2. The Commission has jurisdiction over the subject matter of this proceeding and over Respondent, and the proceeding in the public interest. ORDER Definitions For purposes of this Order the following definitions apply: A. "Covered Information" means the following information from or about an individual consumer, including: (a) a first and last name; (b) a physical address or precise geolocation; (c) an email address or other online contact information such as an instant messaging user identifier or a screen name; (d) a telephone number; (c) a Social Security number; (f) a driver's license or other government -issued identification number (g) a financial institution account number (h) credit or debit card information: (i) a persistent identifier, such as a customer number held in a "cookie," a mobile device ID, or processor serial number; G) data fields that can be accessed or collected through Facebook from or about Facebook Users or their Friends (e.g. "likes," "hometowns," "birthdates," "photos,"· "gender," "educational information," "religious or political views" or "marital" or other "relationship" status); (k) information that is created, maintained, or accessed by the consumer (e.g. "messages"); (1) any data regarding a consumer's activities VOLUME 168 Decision and Order online (e g.. searches conducted. web pages visited, or content viewed); or (m) any user credentials, such as a username and password.

B. "Facebook'' means Facebook Inc., its wholly or partially owned subsidiaries, unincorporated divisions, joint ventures, operations under assumed names, and affiliates, and all directors, officers, members, employees. agents, consultants, and other persons working for or on behalf of the foregoing. C. '·GSRApp" means all iterations of the GSRApp Facebook applic ation that first began operating on the Facebook platform in May 2014.

D. "Respondent" means Alexander James Ashburner Nix.

E. "U.S. Entity" means any business entity that Respondent, individually or collectively with any other Respondents, is the majority owner or controls directly or indirectly, and that is domiciled, incorporated, maintains a physical presence, or transacts business in the United States, or collects or uses Covered Information from or about individuals known to be domiciled in the United States.

Provisions I. Prohibition against Misrepresentations about Covered Information IT IS ORDERED that Respondent, and Respondents officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service must not misrepresent in any manner, expressly or by implication, the extent to which they protect the privacy and confidentiality of any Covered Information, including: A. The extent to which they collect use, share, or sell any Covered Information; and B. The purpose for which they collect, use, share, or sell any Covered Information. II. Required Deletion of Data IT IS FURTHER ORDERED that Respondent, and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly must: A. Provide, within ten (10) days from the effective date of this Order, the Commission with a written statement, sworn under penalty of perjury, providing the name, address, and phone number for each person with whom Respondent shared any Covered Information collected from consumers through GSRApp, and any information that originated, in whole or in part, from this Covered Information.

NIX, ALEXANDER 785 Decision and Order B. Delete or destroy all Covered Information collected from consumers though GSRApp, and any information or work product, including any algorithm or equations, that originated, in whole or in part, from this Covered Information. Such deletion or destruction must occur within ten (10) days of the effective date of this Order, or if such information is in the possession of a government regulatory or law enforcement agency, including the United Kingdom's Information Commissioner's Office, as of the effective dat e of this Order, within ten (10) days after the Covered Information is returned to Respondent. Provided, however, that such Covered Information, or any information that originated in whole or in part from such Covered Information, need not be deleted or destroyed for so long as requested by a government agency or otherwise required by regulation, court order or other legal obligation; and C. Provide a written statement to the Commission. sworn under penalty of perjury, confirming the foregoing. This statement must be provided: (1) within thirty (10) days after the effective date of the Order; or, if applicable, (2) within thirty (30) days after the Covered Information is returned to Respondent from a government regulatory or law enforcement agency, or within thirty (30) days after any legal obligation to preserve the Covered Information has ended. III. Acknowledgments of the Order IT IS FURTHER ORDERED that Respondent obtain acknowledgments of the receipt of this Order:

A. Respondent, within ten (10) days after the effective date of this Order. must submit to the Commission an acknowledgment of receipt of this Order sworn under penalty of perjury.

B. For five (5) years after the issuance dale of this Order, Respondent for any business that is a U.S. Entity, must deliver a copy of this Order to: (1) all principals, officers, directors and LLC managers and members; (2) all employees having managerial responsibilities for conduct related to the subject matter of the Order and all agents and representatives who participate in conduct related to the subject matter of the Order; and (3) any business entity resulting from any change in structure as set forth in the Provision titled Compliance Report and Notices. Delivery must occur, within ten (10) days after the effective date of this Order for current personnel. For all others. delivery must occur before they assume their responsibilities.

C. From each individual or entity to which Respondent delivered a copy of this Order, he must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order.

VOLUME 168 Decision and Order IV. Compliance Report and Notices IT IS FURTHER ORDERED that Respondent make timely submissions to the Commission:

A. One year after the issuance date of this Order, Respondent must submit a compliance report, sworn under penalty of perjury. in which: 1. Respondent must: (a) identify all his telephone numbers and all his physical, postal. email and Internet addresses. including all residences; (b) identify all his business activities with U,S. Entities, including any business for which he performs services, whether as an employee or otherwise. and any entity in which he has any ownership interest: (c) describe in detail his involvement in each such business activity, including title, role, responsibilities, participation, authority, control, and any ownership; (d) identify the primary physical, postal and email address and telephone number, as designated points of contact which representatives of the Commission may use to communicate with Respondent; (e) identify all U.S, Entities by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; (f) describe the activities of each such business, including the goods and services offered, and the means of advertising, marketing, and sales, and the involvement of any other Respondent (which Respondent must describe if he knows or should know due to his own involvement); (g) describe in detail whether and how Respondent is in compliance with each Provision of this Order, including a discussion of all of the changes Respondent made to comply with the Order; and (h) provide a copy of each Acknowledgment of the Order obtained pursuant to this Order, unless previously submitted to the Commission.

B. For five (5) years after the issuance date of this Order, Respondent must submit a compliance notice, sworn under penalty of perjury, within fourteen (14) days of any change in the following information:

1. Respondent must submit notice of any change in: (a) name, including alias or fictitious name, or residence address: (b) title or role in any business activity, including (i) any U.S. Entity for which he performs services whether as an employee or otherwise and (ii) any U.S. Entity in which he has any ownership interest. For each such business activity, also identify its name, physical address. and any Internet address: (c) any designated point of contact or (d) the structure of any entity that Respondent has any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order. NIX, ALEXANDER 787 Decision and Order C. Respondent must submit notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against Respondent within fourteen (14) days of its filing.

D. Any submission to the Commission required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: "I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on: --~" and supplying the date, signatory's full name, title (if applicable), and signature.

E. Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to [email protected] or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: In re Cambridge Analytica, LLC et al., Docket No. C­ V. Recordkeeping IT IS FURTHER ORDERED that Respondent must create certain records for five (5) years after the issuance date of the Order, and retain each such record for five (5) years, unless otherwise specified below. Specifically, for any business that is a U.S. Entity. Respondent must create and retain the following records:

A. Accounting records showing the revenues from all goods or services sold, the costs incurred in generating those revenues. and resulting net profit or loss; B. Personnel records showing, for each person providing services in relation to any aspect of the Order, whether a s an employee or otherwise, that person's: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination;

C. Copies or records of all consumer complaints, whether received directly or indirectly, such as through a third party. and any response; D. A copy of each unique advertisement. other marketing material, or widely disseminated statement making a representations subject to this Order; E. A copy of each widely disseminated representation by Respondent that describes the extent to which Respondent collects, uses, shares, or sells Covered Information or the purpose for which Respondent collects, uses, shares, or sells any Covered Information;

VOLUME 168 Decision and Order F. For 5 years from the date received, copies of all subpoenas and other communications with law enforcement, if such communications relate to Respondent's compliance with this Order; and G. All records necessary to demonstrate full compliance with each Provision of this Order, including all submissions to the Commission.

VI. Compliance Monitoring IT IS FURTHER ORDERED that, for the purpose of monitoring Respondent's compliance with this Order:

A. Within ten (10) days of receipt of a written request from a representative of the Commission, Respondent must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury, and produce records for inspection and copying, provided that such additional compliance reports or other requested information will be limited only to the Respondent individually, U.S. Entities, or any entity that the Commission has reason to believe is a U.S. Entity.

B. For matters concerning this Order, representatives of the Commission are authorized to communicate directly with Respondent. Respondent must permit representatives of the Commission to interview anyone affiliated with any Respondent who has agreed to such an interview. The interviewee may have counsel present.

C. The Commission may use all other lawful means, including posing through its representatives as consumers, suppliers, or other individuals or entities, to Individual Respondent or any individual or entity affiliated with Respondent, without the necessity of identification or prior notice. Nothing in this Order limits the Commission's lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act. 15 U.S.C. §§ 49, 57b-1.

VII. Order Effective Dates IT IS FURTHER ORDERED that this Order is final and effective upon the date of its publication on the Commission's website (fie.gov) as a final order. This Order will terminate twenty (20) years from the date of its issuance (which date may be stated at the end of this Order, ne ar the Commission's seal), or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying settlement) in federal court alleging any violation of this Order, whichever comes later, provided, however, that the filing of such a complaint will not affect the duration of: A. Any Provision in this Order that terminates in less than twenty (20) years; NIX, ALEXANDER 789 Analysis to Aid Public Comment B. This Order's application to any Respondent that is not named as a defendant in such complaint; and C. This Order if such complaint is filed after the Order has terminated pursuant to this Provision.

Provided further. that if such complaint is dismissed or a federal court rules that Respondent did not violate any Provision of the Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Order will terminate according to this Provision as though the complaint had never been filed, except that the Order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

By the Commission.

ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission ("Commission") has accepted, subject to final approval, an agreement containing a consent order from Aleksandr Kogan, an individual. The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement's proposed order. Aleksandr Kogan, until September 2018, was a Senior Research Associate and Lecturer at the Department of Psychology at the University of Cambridge in the United Kingdom. Kogan was also the developer of a Facebook application called the GSRApp, sometimes publicly referred to as the "thisisyourdigitallife" app.

Alexander Nix, until April 2018, was the Chief Executive Officer of Cambridge Analytica LLC and the head of SCL Elections Ltd.

The Commission's proposed complaint alleges that Kogan, together with the data analytics company, Cambridge Analytica, LLC, and its Chief Executive Officer, Alexander Nix, (collectively, "Respondents") used the GSRApp to harvest certain Facebook user profile data from approximately 250,000 270,000 Facebook users who directly interacted with the app ("App Users"), as well as 50--65 million of the "friends" in those users' Facebook social network. The proposed complaint alleges that Respondents obtained the App Users' consent to collect their Facebook profile data through false and deceptive means. VOLUME 168 Analysis to Aid Public Comment The Commission's proposed Complaint alleges three violations of Section 5(a) of the Federal Trade Commission Act, the first of which pertains to all Respondents. Count One of the proposed Complaint alleges that Respondents' representation to users of the GSRApp that it would not "download [their] name or any other identifiable information" was deceptive because the GSRApp, in fact, collected identifiable information from these users, including their Facebook User ID.1 The proposed con sent orders contains injunctive provisions addressing Kogan's and Nix's alleged unlawful conduct. Part I of the proposed consent orders prohibits Kogan and Nix from making false or deceptive statements regarding the extent to which he protects the privacy and confidentiality of Covered Information as defined in the proposed consent order, including: A. The extent to which they collect, use, share, or sell any Covered Information; and B. The purposes for which they collect, use, share, or sell any Covered information. Part II of the proposed consent order relates to the deletion and destruction of Covered Information, and any information or work product, including any algorithms, derived from this Covered Information, and requires Kogan and Nix to:

A. Provide a written statement, sworn under penalty of perjury, with the name, address, and phone number for each person with whom they shared any Covered Information collected from consumers through GSRApp, and any information that originated, in whole or in part, from this Covered Information; and B. Delete or destroy all Covered Information collected from consumers though the GSRApp, and any information or work product, including any algorithms or equations, that originated, in whole or in part, from this Covered Information, which destruction must generally occur within ten (10) days from the effective date of the proposed Order. Kogan and Nix must then provide a statement, sworn under penalty of perjury, confirming that the data has been destroyed or deleted. Parts III through VII of the proposed consent order are reporting, and compliance provisions, which include recordkeeping requirements and provisions requiring Respondent to provide information or documents necessary for the Commission to monitor compliance. The proposed consent order will be in effect for twenty (20) years. 1 The proposed complaint also alleges two Privacy-Shield related counts against Cambridge Analytica. Count Two alleges that Cambridge Analytica's representations on Cambridge Analytica's website that Cambridge Analytica participated in Privacy Shield after May 2018 were deceptive because they did not take the steps necessary to renew Cambridge Analytica's certification when it expired in May 2018. Count Three alleges that Cambridge Analytica's representations on the Cambridge Analytica website that Cambridge Analytica adheres to Privacy Shield's principles were deceptive because Cambridge Analytica failed t o comply with Privacy Shield's requirement to affirm to Commerce that Cambridge Analytica will continue to apply the principles to personal information that it received during the time it participated in the program. NIX, ALEXANDER 791 Analysis to Aid Public Comment The purpose of this analysis is to aid public comment on the proposed order. It is not intended to constitute an official interpretation of the complaint or proposed order, or to modify in any way the proposed order's terms.

INTERLOCUTORY, MODIFYING, VACATING, AND MISCELLANEOUS ORDERS