ELECTRONICALLY FILED

3/23/2018 6:55 PM
2018-CH-03868
CALENDAR: 11
PAGE 1 of 25
CIRCUIT COURT OF
COOK COUNTY, ILLINOIS
IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS
CHANCERY DIVISION
COUNTY DEPARTMENT, CHANCERY DIVISION CLERK DOROTHY BROWN

PEOPLE OF THE STATE OF ILLINOIS, ex rel. Case No.

Kimberly M. Foxx, State’s Attorney of Cook
County, Illinois,

Plaintiff,

v.

FACEBOOK, INC., a Delaware corporation,

SCL GROUP LIMITED, a United Kingdom
private limited company, and CAMBRIDGE
ANALYTICA LLC, a Delaware limited liability
company,

Defendants.

COMPLAINT AND DEMAND FOR JURY TRIAL

Plaintiff People of the State of Illinois brings this Complaint and Demand for Jury Trial

against Facebook, Inc. (“Facebook”), and SCL Group Limited and Cambridge Analytica LLC

(collectively referred to as “Cambridge Analytica,” unless otherwise specified), and alleges as

follows:

NATURE OF THE ACTION

1. In 2014, Cambridge Analytica—a London-based electioneering firm—exfiltrated

the personal data of more than 50 million Facebook users in the United States, including millions

of users in Illinois. This data trove included Facebook users’ ages, interests, pages they’ve liked,

groups they belong to, physical locations, political affiliation, religious affiliation, relationships,

and photos, as well as their full names, phone numbers, email addresses, and physical addresses.1

1
Craig Timberg, et al., Bannon Oversaw Cambridge Analytica's Collection of Facebook
Data, According to Former Employee, WASH. POST (Mar. 20, 2018), https://wapo.st/2FYS1kE.

1
 2. Though this data was supposedly private and protected from disclosure by

Facebook’s user and developer policies, Cambridge Analytica knew that it could access this

nearly unlimited trove of data using Facebook’s existing developer tools, an open secret that was

well known to developers.2

3. Posing as an academic researcher, Cambridge Analytica identified American

Facebook users on “Mechanical Turk”—an online marketplace where people around the world

contract with others to perform various tasks—and offered to pay them to download and use a

personality quiz app it developed on Facebook called thisisyourdigitallife.

4. About 270,000 American voters installed the app and took the personality quiz in

return for $1 to $2. But Cambridge Analytica wasn’t interested in just the answers. What it really
ELECTRONICALLY FILED

wanted—and what it got by virtue of being a developer on the Facebook platform—was the
3/23/2018 6:55 PM
2018-CH-03868
PAGE 2 of 25

ability to collect Facebook data from each quiz taker and all of their Facebook friends. In this

way, Cambridge Analytica parlayed 270,000 personality quiz submissions into a comprehensive

dataset on more than 50 million unwitting Facebook users.

5. This kind of mass data collection was not only allowed but encouraged by

Facebook, which sought to keep developers building on its platform and provide companies with

all the tools they need to influence and manipulate user behavior. That’s because Facebook is not

a social media company; it is the largest data mining operation in existence.

6. To be sure, Cambridge Analytica’s data grab of 50 million users was eventually

flagged and investigated by Facebook in 2014.3 But when it learned that the harvesting of data

2
See, e.g., Emil Protalinski, Stalkbook: Stalk Anyone, Even If You’re Not Facebook
Friends, CNET (July 23, 2012), https://www.cnet.com/news/stalkbook-stalk-anyone-even-if-
youre-not-facebook-friends/.
3
Chloe Aiello, Developer Behind The App At The Center Of Data Scandal Disputes
Facebook's Story, CNBC (Mar. 21, 2018), https://www.cnbc.com/2018/03/21/aleksander-kogan-
2
 was intended to build personality profiles for academic uses, Facebook allowed the data

collection to resume. A year later, Facebook discovered that the data was being used for

electioneering purposes and discreetly asked Cambridge Analytica to delete the data. Notably, it

never confirmed that the data was actually deleted or notified its users of the privacy breach.

7. In the meantime, Cambridge Analytica was mining the data it collected on 50

million Facebook users to create “psychographic profiles” for the 2016 American presidential

election. These profiles—which included each user’s name, home address, phone number,

education, birthday, voter records, and political tendencies, alongside a sophisticated personality

analysis—allowed Cambridge Analytica to “identify the most persuadable voters” and target

them with so-called “fake news” on various platforms, including Facebook.4 By its own
ELECTRONICALLY FILED

admission, this combination of misappropriated data, psychographic profiling, and fake news
3/23/2018 6:55 PM
2018-CH-03868
PAGE 3 of 25

enabled Cambridge Analytica—an overseas electioneering firm—to exert “significant influence

on the outcome of the 2016 presidential election.”5

8. While Facebook has, a full three years later, condemned Cambridge Analytica’s

unauthorized data collection, its actions are far more consistent with Facebook’s mission than

Facebook wants to let on. Though it may have started as a social network, Facebook’s business

model has shifted over the years into what is now one of the biggest data mining companies in

the world. Facebook now uses its platform—which has essentially become a data aggregation

machine disguised as a social network—to manipulate users into making the decisions that

facebook-shouldve-known-how-app-data-was-being-used.html.
4
How Facebook Could Profile Voters For Manipulation, ASSOCIATED PRESS (Mar. 20,
2018), https://bit.ly/2uhKp7v; Hilary Osborne, What Is Cambridge Analytica? The Firm At The
Centre Of Facebook's Data Breach, GUARDIAN (Mar. 18, 2018), https://bit.ly/2prhWXb.
5
CAMBRIDGE ANALYTICA, Make America Number 1, https://ca-
political.com/casestudies/casestudymakeamericanumber12016 (last visited Mar. 23, 2018).

3
 Facebook and its business partners want them to make.6

9. Facebook shifted its business model in this way because it recognized that it can

be even more profitable if it could harness and sell the ability to dependably influence its users’

behavior to third parties. Facebook therefore encouraged developers and researchers to collect

and analyze Facebook user data so that it could better learn how to manipulate its own users’

moods and influence what they purchase and even how they vote. Facebook even conducted

experiments on its own users, including experiments aimed at influencing their moods and

manipulating their voting habits.7

10. This lawsuit seeks to right the wrongs created by Cambridge Analytica’s and

Facebook’s blatant disregard and misuse of sensitive, personal data belonging to the People of
ELECTRONICALLY FILED

the State of Illinois. Accordingly, the People of the State of Illinois, by and through Cook County
3/23/2018 6:55 PM
2018-CH-03868
PAGE 4 of 25

State’s Attorney Kimberly M. Foxx, seeks civil penalties and all appropriate injunctive relief to

address, remedy, and prevent harm to Illinois residents resulting from Defendants’ misconduct.

PARTIES

11. Plaintiff People of the State of Illinois, by and through Kimberly M. Foxx, State’s

Attorney of Cook County, Illinois, brings this action in the public interest for and on behalf of

the People of the State of Illinois.

12. Defendant Facebook, Inc. is a corporation existing under the laws of the State of

Delaware, with its principal place of business located at 1 Hacker Way, Menlo Park, California

94025.

6
See, e.g., Sam Machkovech, Report: Facebook Helped Advertisers Target Teens Who
Feel “Worthless”, ARSTECHNICA (last updated May 1, 2017.), https://bit.ly/2pBgf9G.
7
See, e.g., Kasmir Hill, 10 Other Facebook Experiments On Users, Rated On A Highly-
Scientific WTF Scale, FORBES (July 10, 2014),
https://www.forbes.com/sites/kashmirhill/2014/07/10/facebook-experiments-on-
users/#254ffa9b1c3d.

4
 13. Defendant SCL Group Limited is a UK private limited company with offices

located in London, England. Defendant SCL Group Limited is the parent company of Defendant

Cambridge Analytica LLC.

14. Defendant Cambridge Analytica LLC is a limited liability company organized

under the laws of the State of Delaware, with offices located in New York City and Washington,

D.C. Defendant Cambridge Analytica LLC is a subsidiary of Defendant SCL Group Limited.

JURISDICTION AND VENUE

15. Pursuant to the Illinois Constitution art. VI, §9, this Court has subject matter

jurisdiction over Plaintiff’s claims.

16. This Court has jurisdiction over Defendants pursuant to 735 ILCS 5/2-209
ELECTRONICALLY FILED

because they conduct business transactions in Illinois, have committed tortious acts in Illinois,
3/23/2018 6:55 PM
2018-CH-03868
PAGE 5 of 25

and have transacted substantial business in Illinois that caused harm in Illinois.

17. Venue is proper in Cook County because Defendants conduct business

transactions in Cook County and the causes of action arose, in part, in Cook County.

COMMON FACTUAL ALLEGATIONS

I. An Overview of Cambridge Analytica.

18. Cambridge Analytica is a political consulting firm that promises to provide its

customers the ability to use big data to change voter behavior.8

19. Unfortunately, until recently, Cambridge Analytica’s business practices were

largely a secret to the general public. On March 18, 2018, one of its senior programmers—

Christopher Wylie—exposed the company’s unlawful and deceptive business practices,

including its role in “hijacking” the profiles of millions of Facebook users in order to influence

8
See Matthew Rosenberg, et al., How Trump Consultants Exploited The Facebook Data
Of Millions, N.Y. TIMES (Mar. 17, 2018), https://nyti.ms/2HH74vA.

5
 the 2016 United States Presidential election.9

20. Cambridge Analytica’s efforts to engage in mass data mining on behalf of

American political campaigns began in 2013, when its now-suspended Chief Executive Officer

Alexander Nix was still heading the elections division of SCL Group Limited.10 At the time, Nix

set out create a team of data analysts, psychologists, and political operatives that could

successfully use data analytics to model U.S. voter behavior, and assess how American voters’

inherent psychological traits affected their voting decisions. Using that data, the company would,

in turn, sell it to political campaigns seeking to influence or change votes.11

21. The group—not yet formally organized, but still an entity within SCL Group

Limited—received significant initial funding from billionaire Robert Mercer, a well-known

ELECTRONICALLY FILED

funder of conservative- and Republican-connected political causes throughout the United

3/23/2018 6:55 PM
2018-CH-03868
PAGE 6 of 25

States.12 Mercer helped the group finance a $1.5 million pilot test of their psychographic

profiling-based messaging in the Commonwealth of Virginia’s 2013 gubernatorial election on

behalf of Republican candidate Ken Cuccinelli.13

22. On December 31, 2013, this internal team at SCL Group formally organized in

9
Carole Cadwalladr, ‘I Made Steve Bannon’s Psychological Warfare Tool’: Meet The
Data War Whistleblower, GUARDIAN (Mar. 18, 2018), https://bit.ly/2HGFvCD.
10
SCL Group similarly provides data, analytics and strategy-related consulting, but
primarily offers its services to governments and military organizations throughout the world.
SCL Group boasts having conducted “behavior change programs” in over 60 countries (i.e.,
psychological warfare).
11
Rosenberg et al., supra note 8.
12
Sasha Issenberg, Cruz-Connected Data Miner Aims To Get Inside Voters’ Heads,
BLOOMBERG (Nov. 12, 2015), https://www.bloomberg.com/news/features/2015-11-12/is-the-
republican-party-s-killer-data-app-for-real- (describing Robert Mercer as the “fourth-largest”
individual political donor in the United States).
13
Rosenberg et al., supra note 8.

6
 the United States as Cambridge Analytica.14

II. To Help Its Customers Influence U.S. Political Elections, Cambridge Analytica
Developed A Fraudulent Scheme To Harvest The Data Of Millions of American
Voters.

23. In 2014, Cambridge Analytica sought out a relationship with U.S. Senator Ted

Cruz’s planned campaign for the Republican presidential nomination. At the time, the company

realized it did not possess nearly enough data about American voters for a U.S. presidential

campaign.15

24. The company needed a vast amount of data on virtually every American voter and

knew it could not simply purchase that information. As such, Cambridge Analytica engineered a

deceptive scheme to surreptitiously siphon that data from Facebook.

ELECTRONICALLY FILED

A. Defendants hire Cambridge University professor Aleksandr Kogan to

3/23/2018 6:55 PM

deceptively harvest data on 50 million Facebook users under the guise of

2018-CH-03868
PAGE 7 of 25

“Academic Research.”

25. In June 2014, Defendants entered into an arrangement with Cambridge University

researcher Aleksandr Kogan and his company Global Science Research to collect the data they

needed to create “psychographic profiles” on American voters.16

26. Kogan was the key to gathering the quantity and quality of data Defendants

sought because he could do it through a Facebook application17 he created called

“thisisyourdigitallife.”18

14
Andy Kroll, Cloak and Data: The Real Story Behind Cambridge Analytica’s Rise and
Fall, MOTHER JONES (Mar. 2018), https://www.motherjones.com/politics/2018/03/cloak-and-
data-cambridge-analytica-robert-mercer/.
15
Rosenberg et al., supra note 8.
16
Id.
17
A Facebook application is an interactive software application developed to run on and
utilize the Facebook platform.
18
Id.

7
 27. Facebook being one of the largest data mining companies in the world,

Cambridge Analytica knew it could take advantage of its developer platform—and, in particular,

its Graph API19—to gather swaths of data about every user and their friends who took the

thisisyourdigitallife quiz.

i. Facebook’s Developer Platform.

28. Although primarily recognized for its eponymous social network, Facebook is

also one of the largest data mining companies in the world. With over 200 million users in the

United States alone, Facebook has exclusive access to an exorbitant amount of personal

consumer data.20

29. Facebook is uniquely able to directly link the data it accumulates on individuals’
ELECTRONICALLY FILED

digital behaviors with the additional personal data that it extracts from users’ Facebook accounts.
3/23/2018 6:55 PM
2018-CH-03868
PAGE 8 of 25

The result is that Facebook obtains a holistic look at specific consumers’ online and offline

behaviors.21 Facebook, in turn, receives significant monetary gain by permitting targeted

advertising to its users through its platform.22 It is therefore in Facebook’s interests to encourage

third party developers to utilize its platform so that it can gather even more information about

users’ online activities.

19
Graph API refers to Facebook’s application programming interface, which is what allows
third party developers to interact with Facebook’s servers in order to access Facebook user data.
20
Kurt Wagner & Rani Molla, Facebook Is Not Getting Any Bigger In The United States,
RECODE (Mar. 1, 2018), https://www.recode.net/2018/3/1/17063208/facebook-us-growth-pew-
research-users (“More than two-thirds of Americans” use Facebook).
21
Nathan Ingraham, Facebook Buys Data On Users’ Offline Habits For Better Ads,
ENDGAGET (Dec. 30, 2016), https://www.engadget.com/2016/12/30/facebook-buys-data-on-
users-offline-habits-for-better-ads/; Cade Metz, How Facebook Knows When Its Ads Influence
Your Offline Purchases, WIRED (Dec. 11, 2014), https://www.wired.com/2014/12/facebook-
knows-ads-influence-offline-purchases/.
22
Cf. Lisa Lacy, Facebook Lets Brands Target Ads Based On Offline Behavior, THE DRUM
(Sept. 21, 2017), http://www.thedrum.com/news/2017/09/21/facebook-lets-brands-target-ads-
based-offline-behavior.

8
 30. That’s where Facebook’s Software Development Kit (“SDK”)23 comes in.

Facebook’s SDK allows third party developers to add Facebook-related features to their websites

or services. These features permit the developer’s service to interact with Facebook in various

ways. Relevant here is the ability to include a “Facebook Login,” which lets visitors login to a

website using their Facebook credentials.

31. When an individual visits or uses a service using Facebook’s SDK (e.g., an app

that includes a Facebook Login), information about the individual’s online activities are

transmitted back to Facebook. Facebook benefits from the additional behavioral information it

receives and the app developer, in the Facebook Login example, benefits because its users can

quickly sign in using their Facebook account.

ELECTRONICALLY FILED

32. thisisyourdigitallife used Facebook’s SDK Facebook Login, meaning that

3/23/2018 6:55 PM
2018-CH-03868
PAGE 9 of 25

individuals seeking to take the personality quiz had to use their Facebook account credentials to

access it.

ii. Cambridge Analytica intentionally used Facebook Login to gather data on

over 50,000,000 Facebook users.

33. Under the false pretense of operating a personality test for academic research

purposes, Kogan was able to get 270,000 Facebook users to take his personality quiz.

34. To be clear, Cambridge Analytica, by way of Kogan, paid the majority of the

270,000 individuals to take his personality quiz. Kogan used a service called Amazon

Mechanical Turk—which is an online platform that allows developers to hire people (sometimes

called “turkers”) to do simple tasks for small fees—to pay individuals $1 or $2 to complete the

23
An SDK generally refers to a set of software development tools that allow programmers
to develop applications that interface with a specific software platform. Here, Facebook’s SDK
allows Facebook to release code for third party developers to use in order to interact with
Facebook’s platform.

9
 test.

35. There were two conditions: First, turkers had to be American. Second, turkers had

to use their Facebook account credentials to log into the quiz.

36. By having turkers use Facebook Login to log into the personality quiz,

Defendants were able capitalize on the unguarded nature of Facebook’s developer platform. That

meant developers were able to collect data on the Facebook user taking the test and information

about that user’s friends.24

37. That is, at that time, developers only needed permission from the user of the app

to access their friend’s list. Once armed with this permission, a developer could then gather the

profile information of all the app user’s Facebook friends25 simply by querying the Graph API.26
ELECTRONICALLY FILED

38. Kogan’s academic research cover allowed him to gather the data at a rapid rate for
3/23/2018 6:55 PM
2018-CH-03868
PAGE 10 of 25

Cambridge Analytica.

39. In fact, Cambridge Analytica’s data grab of 50 million users was eventually

flagged and investigated by Facebook in 2014. But when it learned that the harvesting of this

data was to build personality profiles for academic purposes, Facebook allowed the data

collection to resume.27

24
Sue Halpern, Cambridge Analytica, Facebook, and the Revelations of Open Secrets, New
Yorker, https://www.newyorker.com/news/news-desk/cambridge-analytica-facebook-and-the-
revelations-of-open-secrets (last visited March 23, 2018).
25
Jonathan Albright, The Graph API: Key Points in the Facebook and Cambridge
Analytica Debacle, Medium, https://medium.com/tow-center/the-graph-api-key-points-in-the-
facebook-and-cambridge-analytica-debacle-b69fe692d747 (last visited March 23, 2018).
26
For this reason, it is also likely that Facebook’s unrestricted developer tools were used by
thousands of other companies to collect user data without consent. See Iraklis Symeonidis et al.,
Collateral Damage of Facebook Apps: Friends, Providers, and Privacy Interdependence, ICT
Sys. Sec. & Privacy Prot. IFIP Advances in Info. & Commc’n Tech. 194–208 (2016), available
at https://eprint.iacr.org/2015/456.pdf.
27
In 2015, Facebook learned the truth about why Cambridge Analytica was collecting the
10
 40. Through these unfair and deceptive practices, Defendants were able to eventually

use the Facebook Login portal to gather the personal information of over 50 million Facebook

users, including their ages, interests, pages they’ve liked, groups they belong to, physical

locations, political affiliation, religious affiliation, relationships, and photos, as well as their full

names, phone numbers, email addresses, and physical addresses. And for the 270,000 survey

takers, Cambridge Analytica even had access to their private messages on Facebook.28

41. This data was exactly what Defendants needed: rich personal data about users that

was not only extremely valuable for “psychographic profiling” as explained in Section III below,

but also detailed enough so that it could be matched to other records already in Cambridge

Analytica’s possession. With this information in hand, Cambridge Analytica could—and did—
ELECTRONICALLY FILED

embark on its primary mission: creating a psychographic profile of every American adult in
3/23/2018 6:55 PM
2018-CH-03868
PAGE 11 of 25

order to provide data analytics and messaging-related support for U.S. federal election

campaigns.29

data—to influence and manipulate voters in the 2016 presidential election. In response,
Facebook approached Cambridge Analytica requesting it delete the trove of data it had amassed.
While Cambridge Analytica informed Facebook that it deleted the information, it never verified
this fact and simply took the word of a company which had knowingly and intentionally violated
Facebook’s policies to steal 50 million users’ information. And most importantly, Facebook
never notified the 50 million affected Facebook users of the major privacy breach.
28
Greg Price, Facebook Did Nothing To Stop Cambridge Analytica Data Breaches, New
Class-Action Federal Lawsuit Claims, Newsweek, http://www.newsweek.com/facebook-
cambridge-analytica-data-lawsuit-855600(last visited March 23, 2018).
29
In many ways, Cambridge Analytica’s use of the data aligned with Facebook’s own
intentions with its users’ information. As noted, Facebook has a long history of performing
experiments on its user base without their knowledge or consent. Facebook has sought to
manipulate users’ moods, actions on the website, interactions with Facebook “friends,” and
voting behaviors. See, e.g., Robinson Meyer, Everything We Know About Facebook’s Secret
Mood Manipulation Experiment, THE ATLANTIC (June 28, 2014), http://theatln.tc/2l8BoZt;
Robert M. Bond, et al., A 61-Million-Person Experiment In Social Influence And Political
Mobilization, NATURE (Sept. 13, 2012), available at https://bit.ly/2G4c9hd.

11
 II. Facebook Has A Rich History of Experimenting On Its Users.

42. Facebook employs a “Core Data Science” team composed of programmers,

statisticians, and psychologists to capitalize upon its access to vast amount of user data. Since as

early as 2012, the Core Data Science team been conducting psychological experiments known as

human subject research – actively intervening in people’s (online) environments, measuring the

behavioral impact of those interventions, and publishing the results in scientific journals.

43. For example, over a one-week period in January 2012, Facebook manipulated the

News Feeds30 of nearly 700,000 Facebook users so that they contained proportionally fewer

posts containing either positive or negative content, depending on which experimental group the

participant was assigned to. This manipulation was, in some cases, drastic. Some participants, for
ELECTRONICALLY FILED

example, had ninety percent of posts containing positive emotional content removed from their
3/23/2018 6:55 PM
2018-CH-03868
PAGE 12 of 25

News Feed.

44. To measure the effect of this experiment (“Emotional Manipulation Experiment”),

Facebook then observed the corresponding emotional content of the participants’ News Feed

posts. The effects were described in an article published in a major, peer-reviewed academic

journal (“the Kramer Article”).31 And they were, while small, statistically significant. Users

exposed to proportionally fewer positive posts generated less positive content themselves, and

vice versa. In other words, people exposed to more sad content were made sad, and people

exposed to more happy content were made happy. And all of this occurred unbeknownst to the

30
The News Feed is the primary way that users consume content on Facebook. It is a
scrollable series of “stories” generated by a user’s friends, where “stories” may be anything from
photos of friends to textual posts written by friends to linked news articles.
31
Adam D.I. Kramer, Jamie E. Guillory, and Jeffrey T. Hancock, Experimental Evidence of
Massive-Scale Emotional Contagion Trough Social Networks, 111 Proc. Nat’l Acad. Sci. USA
8788 (2014), available at http://www.pnas.org/content/111/24/8788.full.html (last accessed
October 1, 2014).

12
 participants – the experiment showed “that emotional states can be transferred to others via

emotional contagion, leading people to experience the same emotions without their

awareness.”32

45. Highlighting the significance of the experiment, the Kramer Article noted that

“given the massive scale of social networks such as Facebook, even small effects [like the

manipulation of Facebook News Feeds] can have large aggregated consequences” and concluded

that “the well-documented connection between emotions and physical well-being suggests the

importance of these findings for public health.”33

46. This “Emotional Manipulation Experiment” is just the tip of the iceberg.

Facebook has conducted and published scores of similar experiments in the past, and intends to
ELECTRONICALLY FILED

continue conducting and publishing similar experiments in the future.

3/23/2018 6:55 PM
2018-CH-03868
PAGE 13 of 25

47. Facebook has conducted and continues to conduct a wide array of human subject

research experiments. For example, in one experiment conducted in 2010, Facebook tested how

much of an effect it could have on a user’s likelihood to vote.34 For that experiment (the “Voting

Manipulation Experiment”), every single American who signed onto Facebook on voting day—

approximately 60 million people—was a participant.

48. Other published Facebook experiments have tested things ranging from the effect

of hiding links that friends shared with each other (approximately 253 million experiment

subjects) (the “Link Manipulation Experiment”),35 to the effect of automatically broadcasting

32
Id. (emphasis added).
33
Id. at 8790 (emphasis added).
34
Robert M. Bond et al., A 61-Million-Person Experiment in Social Influence and Political
Mobilization, 489 NATURE 295 (2012), available at
http://cameronmarlow.com/media/massive_turnout.pdf (last accessed October 1, 2014).
35
Eytan Bakshy, The Role of Social Networks in Information Diffusion, WWW: Int’l World
13
 users’ online shopping purchases (approximately 1.2 million experiment subjects),36 to the effect

of having user names and likenesses automatically “endorse” advertisements (approximately 29

million experiment subjects).37

49. At one point, Facebook was running so many experiments on its users that “some

[members of the Core Data Science Team] worried that the same users, who were anonymous,

might be used in more than one experiment, tainting the results.”38

50. Facebook intends to continue conducting human subject research without

obtaining informed consent. Sheryl Sandberg, for example, explained that the Emotional

Manipulation Experiment as just “part of ongoing research companies do to test different

products.”39 And Adam D. I. Kramer—lead author of the Emotional Manipulation Experiment—

ELECTRONICALLY FILED

noted in a Facebook post defending his experiment that Facebook has “been working on
3/23/2018 6:55 PM
2018-CH-03868
PAGE 14 of 25

improving [their] internal review policies” for experiments since 2012.

51. In fact, Facebook issued a blog post defending their ongoing practice of

conducting human subject research without obtaining informed consent.40 In that post, Facebook

Wide Web Conf. 2012, available at http://cameronmarlow.com/media/bakshy-the_role-
2012b.pdf (last accessed October 1, 2014).
36
See Sean J. Taylor, Eytan Bakshy, Sinan Aral, Selection Effects in Online Sharing:
Consequences for Peer Adoption, available for download at
https://www.facebook.com/publications/266725986806102/ (last accessed October 1, 2014).
37
Eytan Bakshy, Dean Eckles, Rong Yan, Itamar Rosenn, Social Influence in Social
Advertising: Evidence from Field Experiments, available at http://arxiv.org/pdf/1206.4327v1.pdf
(last accessed October 1, 2014).
38
See Reed Albergotti and Elizabeth Dwoskin, Facebook Study Sparks Soul-Searching and
Ethical Questions, Wall St. J., June 30, 2014, available at
http://online.wsj.com/articles/facebook-study-sparks-ethicalquestions-1404172292.
39
R. Jai Krishna, Sandberg: Facebook Study Was ‘Poorly Communicated’, available at
http://blogs.wsj.com/digits/2014/07/02/facebooks-sandberg-apologizes-for-news-feed-
experiment/ (last accessed October 1, 2014).
40
See “Research at Facebook,” available at
14
 explicitly acknowledges the problematic nature of the Emotional Manipulation Experiment. But

instead of agreeing to abide by the same laws all other research organizations do (and obtain

informed consent from its users), Facebook concludes that a few self-regulated changes to its

research policies will remedy the situation.

52. And Facebook’s job postings reaffirm their commitment to the continuation of

internal human subject research. One posting, for the position of “Data Scientist, Identity

Research & Modeling” seeks a candidate with a Ph. D. and an expertise in “social psychology”

to help “develop high-quality models of people’s online identity.”41

53. The reason that Facebook is conducting these experiments and publishing the

results is to demonstrate its influence over user behavior. Though selling ad space has generated
ELECTRONICALLY FILED

enormous profits for Facebook already, Facebook knows that advertisers, political campaigns,
3/23/2018 6:55 PM
2018-CH-03868
PAGE 15 of 25

and its business partners will pay exponentially more money for the ability to manipulate its

users into making decisions that they want them to make.

54. Facebook knows that this capability is especially attractive to political campaigns,

which, as Facebook knows, are spending record amounts of money on political ads, even in non-

election years.42 It therefore began developing tools for campaigns that wanted to target certain

segments with political ads, including by tracking users to determine their political leanings and

tendencies. As proof of concept, Facebook demonstrated through its Voting Manipulation

Experiment that it could influence whether its users voted or not.

http://newsroom.fb.com/news/2014/10/research-at-facebook/ (last accessed August 23, 2018).
41
Facebook Job Posting, available at
https://www.facebook.com/careers/department?dept=data&req=a0IA000000CzAeDMAV (last
accessed October 1, 2014).
42
Megan Janetsky, Low transparency, low regulation online political ads
skyrocket, OPENSECRET, https://www.opensecrets.org/news/2018/03/low-transparency-low-
regulation-online-political-ads-skyrocket/ (last visited March 23, 2018).
15
 55. This demonstration sent a signal to the public at large that it has the ability to

influence and manipulate the behavior of users on its platform, especially with respect to voting.

56. By doing so, Facebook tacitly invited electioneering companies like Cambridge

Analytica to harvest its data for purposes of profiling users and targeting them with tailored

messaging that would dependably influence and manipulate their behavior. It is through this lens

that the relationship between Facebook and Cambridge Analytica must be viewed.

III. Armed With Swaths of Misappropriated Data, Cambridge Analytica Created

“Psychographic Profiles” On Every American Adult, Which It Claims Helped It
Have Significant Influence On The Outcome Of The 2016 Presidential Election.

57. Armed with Facebook’s own political targeting tools and a trove of sensitive data

it was not supposed to have access to, Cambridge Analytica was able to create “psychographic
ELECTRONICALLY FILED

profiles” on millions of American voters that it used to “significantly influence . . . the outcome
3/23/2018 6:55 PM
2018-CH-03868
PAGE 16 of 25

of the 2016 presidential election.”43

58. Broadly speaking, psychographic profiling is a marketing tool that combines a

detailed psychological analysis of an individual using various data points about their interests,

activities, opinions, and motivations. These data points can then be layered on top of

demographic information such as race, gender, and age.

59. Psychographic profiling tools—including Cambridge Analytica’s—can combine

assessments of a person’s innate personality characteristics with predictions of, for instance, their

voting behavior, to create hyper-focused predictions about not only what people will do, but

what will motivate them to do it.

60. The personality traits that Cambridge Analytica has claimed can be predicted

43
Make America Number 1, CAMBRIDGE ANALYTICA
http://cambridgeanalytica.org/casestudies/casestudymakeamericanumber12016+&cd=1&hl=en&
ct=clnk&gl=us (last visited Mar. 23, 2018).

16
 through psychographic profiling included, most importantly, a person’s OCEAN ratings, a

common personality type classification method that looks at five factors: Openness,

Conscientiousness, Extraversion, Agreeableness, and Neuroticism.44 In addition, Cambridge

Analytica has claimed to be able to predict—based on the data it possesses—an individual’s age,

political views, religion, profession, whether they are fair-minded or suspicious of others, and

even (ironically) whether they prefer to disclose facts about themselves to others or value their

privacy.

61. According to Cambridge Analytica, this allowed its clients to bypass individuals’

cognitive defenses by appealing directly to their emotions, using increasingly segmented and

sub-grouped personality type designations and precisely targeted messaging based on those
ELECTRONICALLY FILED

designations.45
3/23/2018 6:55 PM
2018-CH-03868
PAGE 17 of 25

62. Using these techniques, Cambridge Analytica claims to have “provided the

Donald J. Trump for President campaign with the expertise and insight that helped win the White

House.”46 Cambridge Analytica provided the Donald J. Trump for President campaign with its

Facebook data-enabled psychographic profiling tool to help, on information and belief, with

voter identification and outreach, advertising spending decisions, voter turnout modeling, and

even helping to set then-candidate Trump’s travel schedule based on where Cambridge Analytica

believed he would be most likely to drum up support within the “swing states” crucial to his

44
Erin Brodwin, Here’s the personality test Cambridge Analytica had Facebook users
take, BUSINESS INSIDER, http://www.businessinsider.com/facebook-personality-test-cambridge-
analytica-data-trump-election-2018-3
45
Nina Burleigh, How Big Data Mines Personal Info To Craft Fake News And Manipulate
Voters, NEWSWEEK (June 8, 2017), http://www.newsweek.com/2017/06/16/big-data-mines-
personal-info-manipulate-voters-623131.html.
46
Donald J. Trump for President, CAMBRIDGE ANALYTICA,
https://political.production.k8s.e.cambridgeanalytica.org/casestudies (last visited March 23,
2018).

17
 securing of the presidency.

63. The data was not just used for purposes of motivating enthusiastic Trump

supporters, or even just to target and convince skeptical or undecided voters. Rather, Cambridge

Analytica used its data to also engage in a broad voter suppression campaign to discourage

supporters (or potential supporters) of Trump’s opponent, Hillary Clinton, from voting. For

example, Cambridge Analytica used its psychographic profiling tool to help generate a brand of

negative “Defeat Crooked Hillary” advertisements that—through the promotional help of a

Trump-affiliated super PAC, Make America Number 1—was watched over 30 million times

during the campaign.47

64. Broadly, this psychographic mapping tool was crucial to Trump’s campaign
ELECTRONICALLY FILED

strategy, and thus, its ultimate success: Trump was elected president, and Cambridge Analytica
3/23/2018 6:55 PM
2018-CH-03868
PAGE 18 of 25

walked away millions of dollars richer, with a clear confirmation that its psychographic mapping

was working.

FIRST CAUSE OF ACTION

Violation of the Illinois Consumer Fraud and Deceptive Business Practices Act
815 ILCS 505, et seq.
(On Behalf of Plaintiff People of the State of Illinois Against Cambridge Analytica)

65. Plaintiff People of the State of Illinois incorporates the foregoing allegations as if

fully set forth herein.

66. Section 2 of the Illinois Consumer Fraud and Deceptive Business Practices Act,

815 ILCS 505, et seq. (“ICFA”), provides:

Unfair methods of competition and unfair or deceptive acts or practices,

including but not limited to the use or employment of any deception fraud,
false pretense, false promise, misrepresentation or the concealment,

47
Exposed: Undercover Secrets Of Trump’s Data Firm, CHANNEL 4 (Mar. 20, 2018),
https://www.channel4.com/news/exposed-undercover-secrets-of-donald-trump-data-firm-
cambridge-analytica.

18
 suppression or omission of any material fact, with intent that others rely
upon the concealment, suppression or omission of such material fact, or the
use or employment of any practice described in section 2 of the ‘Uniform
Deceptive Trade Practices Act’, approved August 5, 1965, in the conduct of
any trade or commerce are hereby declared unlawful whether any person
has in fact been misled, deceived or damaged thereby. In construing this
section consideration should be given to the interpretations of the Federal
Trade Commission and the federal courts relating to Section 5 (a) of the
Federal Trade Commission Act.

67. While conducting trade or commerce, Cambridge Analytica has engaged in

conduct constituting a deceptive act or practice declared unlawful under Section 2 of the ICFA,

inasmuch as it knowingly made deceptive and false representations about the nature of its

survey-taking app, the nature of the data it was collecting, and the purposes for which the data

was being collected and would be used.

ELECTRONICALLY FILED

68. Cambridge Analytica intended that Facebook and the public, including Illinois
3/23/2018 6:55 PM
2018-CH-03868
PAGE 19 of 25

residents, rely on its deceptive representations and communications regarding the supposedly

“academic” purpose of its app and the reasons it was collecting troves of their personal Facebook

data.

69. Cambridge Analytica also engaged in deceptive and unlawful conduct by

exfiltrating the Facebook data of 50 million users without their consent and in direct violation of

the Facebook user and developer agreements, which expressly require developers to agree to the

following terms:

II. Data Collection and Use

1. You will only request the data you need to operate your application.

2. You may cache data you receive through use of the Facebook API in order
to improve your application’s user experience, but you should try to keep
the data up to date. This permission does not give you any rights to such
data.

* * *

19
 4. Until you display a conspicuous link to your privacy policy in your app,
any data accessed by your app (including basic account information) may
only be used in the context of the user’s experience in that app. A user’s
friends’ data can only be used in the context of the user’s experience on
your application.

5. Subject to certain restrictions, including on use and transfer, users give

you their basic account information when they connect with your
application. For all other data obtained through use of the Facebook API,
you must obtain explicit consent from the user who provided the data to us
before using it for any purpose other than displaying it back to the user on
your application.

6. You will not directly or indirectly transfer any data you receive from us,
including user data or Facebook User IDs, to (or use such data in
connection with) any ad network, ad exchange, data broker, or other
advertising or monetization related toolset, even if a user consents to such
transfer or use. By indirectly we mean you cannot, for example, transfer
data to a third party who then transfers the data to an ad network. By any
data we mean all data obtained through use of the Facebook Platform
ELECTRONICALLY FILED

(API, Social Plugins, etc.), including aggregate, anonymous or derivative

3/23/2018 6:55 PM

data.
2018-CH-03868
PAGE 20 of 25

* * *

9. You will not sell or purchase any data obtained from us by anyone. If you
are acquired by or merge with a third party, you can continue to use user
data within your application, but you cannot transfer data outside your
application.

* * *

11. You cannot use a user’s friend list outside of your application, even if a
user consents to such use, but you can use connections between users who
have both connected to your application.

(Facebook’s August 20, 2013 Platform Policies) (emphasis added).

70. Cambridge Analytica violated these mandatory user privacy protections by posing

as an academic researcher, gaining access to Facebook user data under false pretenses, using

such data for psychographic analysis and electioneering, harvesting users’ friend lists for

psychographic analysis and electioneering, disclosing all collected and harvested user data to its

20
 affiliates and clients, and reaping substantial profits therefrom.

71. This conduct was unlawful because it violated the personal privacy rights of

millions of Illinois residents.

72. This conduct was also deceptive and unfair. Many other consulting firms attempt

to do what Cambridge Analytica does, but without employing deception—typically by

purchasing and compiling readily-available consumer and voter file data to create detailed voter

profiles.

73. Instead, Cambridge Analytica sought to gain a leg up on its competition by

illicitly collecting the Facebook data on millions of Illinois residents, through a false promise

that such data would only be used for academic purposes.

ELECTRONICALLY FILED

74. Thus, Cambridge Analytica’s conduct constitutes an unfair and deceptive act or
3/23/2018 6:55 PM
2018-CH-03868
PAGE 21 of 25

practice under the ICFA.

75. Pursuant to 815 ILCS 505/7(b), the penalty for violating the ICFA is a sum not to

exceed $50,000, or, if the Court finds that Defendants’ above-described practices were intended

to defraud Illinois residents, $50,000 per violation.

76. In addition to any other civil penalty provided, if a person is found by the Court to

have engaged in any method, act, or practice declared unlawful under the ICFA, and the

violation was committed against a person 65 years of age or older, the Court may impose an

additional civil penalty in a sum not to exceed $10,000 per violation. 815 ILCS 505/7(c).

SECOND CAUSE OF ACTION

Violation of the Illinois Consumer Fraud and Deceptive Business Practices Act
815 ILCS 505, et seq.
(On Behalf of Plaintiff People of the State of Illinois Against Facebook)

77. Plaintiff People of the State of Illinois incorporates the foregoing allegations as if

fully set forth herein.

21
 78. The ICFA prohibits conduct that is deceptive or unlawful.

79. Facebook engaged in unfair and deceptive conduct by making representations to

consumers that were knowingly false. Specifically, Facebook represented to its users that their

personal data would be protected in accordance with its user and developer agreements.

80. Despite these material representations, Facebook permitted third parties, including

Cambridge Analytica, to collect and harvest its users’ personal data, including such sensitive

information as their private messages, for purposes of profiling and targeting them with tailored

messaging that would dependably influence and manipulate their behavior.

81. Facebook had actual knowledge that Cambridge Analytica gained unauthorized

access to its users’ personal data without their knowledge or consent and in express violation of
ELECTRONICALLY FILED

its user and developer agreements, yet did not put a stop to it.
3/23/2018 6:55 PM
2018-CH-03868
PAGE 22 of 25

82. The consequences of these false misrepresentations were further compounded by

Facebook’s decision, upon learning that Cambridge Analytica had misappropriated user data for

political purposes, to conceal the breach from its users and do nothing more than quietly (and

unsuccessfully) ask Cambridge Analytica to delete the data.

83. By concealing this misconduct from its users, Facebook avoided backlash over its

blatant misrepresentations from its users and preserved the strength of its data mining operation

by avoiding a situation where its users reacted by deactivating their accounts.

84. Facebook allowed Cambridge Analytica to secretly harvest its users’ data and

build psychographic profiles of each of them so that it could influence and manipulate their

behavior in the 2016 presidential election.

85. Facebook admits that it violated its users’ privacy rights by allowing Cambridge

Analytica to harvest their data. On March 21, 2018, Facebook’s Chief Executive Officer Mark

22
 Zuckerberg issued a public statement conceding that it breached the trust of “the people who

share their data with us and expect us to protect it.”48 Facebook Chief Operating Officer Sheryl

Sandberg likewise conceded that Facebook committed “a major violation of the people’s trust”

when it allowed Cambridge Analytica to collect user data and that she “deeply regret[s] that

[Facebook] didn’t do enough to deal with it.”49

86. Facebook’s conduct constitutes an unfair and deceptive act or practice under the

ICFA.

87. Pursuant to 815 ILCS 505/7(b), the penalty for violating the ICFA is a sum not to

exceed $50,000, or, if the Court finds that Facebook’s above-described practices were intended

to defraud Illinois residents, $50,000 per violation.

ELECTRONICALLY FILED

88. In addition to any other civil penalty provided, if a person is found by the Court to
3/23/2018 6:55 PM
2018-CH-03868
PAGE 23 of 25

have engaged in any method, act, or practice declared unlawful under the ICFA, and the

violation was committed against a person 65 years of age or older, the Court may impose an

additional civil penalty in a sum not to exceed $10,000 per violation. 815 ILCS 505/7(c).

THIRD CAUSE OF ACTION

Declaratory and Injunctive Relief
(On Behalf of the People of the State of Illinois Against Defendants)

89. Plaintiff People of the State of Illinois incorporates the foregoing allegations as if

fully set forth herein.

90. Pursuant to 735 ILCS 5/2-701, this Court “may make binding declarations of

rights, having the force of final judgments . . . including the determination . . . of the

construction of any statute, municipal ordinance, or other governmental regulation . . . and a

48
Mark Zuckerberg Update on Cambridge Analytica Situation, FACEBOOK, INC. (March 21,
2018), https://www.facebook.com/zuck/posts/10104712037900071.
49
Sheryl Sandberg Post Addressing the Cambridge Analytica News, FACEBOOK, INC.
(March 21, 2018), https://www.facebook.com/sheryl/posts/10160055807270177.

23
 declaration of the rights of the parties interested.”

91. Such a declaration of rights “may be obtained . . . as incident to or part of a

complaint . . . seeking other relief as well.” 735 ILCS 5/2-701(b).

92. Plaintiff People of the State of Illinois seeks a judgment declaring that

Defendants have violated the ICFA.

93. Upon information and belief, Defendants remain in possession of the highly

personal Facebook user data that it unlawfully obtained. Millions of Illinois residents will

continue to suffer or be vulnerable to injury, unless this is rectified through injunctive relief.

PRAYER FOR RELIEF

WHEREFORE, Plaintiff People of the State of Illinois respectfully requests that the
ELECTRONICALLY FILED

Court enter an Order granting the following relief:

3/23/2018 6:55 PM
2018-CH-03868
PAGE 24 of 25

A. Declaring that Defendants’ actions constitute violations of the ICFA;

B. Fining Defendants $50,000 for violating the ICFA or, if the Court finds that

Defendants engaged in the above-described conduct with intent to defraud, $50,000 for each

such violation;

C. Fining Cambridge Analytica an additional $10,000 for each violation described

above involving an Illinois resident 65 years of age or older for each day such violation has

existed and continues to exist;

D. Awarding Plaintiff its reasonable attorneys’ fees and costs;

E. Awarding Plaintiff pre- and post-judgment interest, to the extent allowable;

F. Awarding such and other injunctive and declaratory relief as is necessary; and

G. Awarding such other and further relief as the Court deems reasonable and just.

JURY DEMAND

Plaintiff requests trial by jury of all matters that can be so tried.

24
 Dated: March 23, 2018 Respectfully submitted,

KIMBERLY M. FOXX, Special Assistant State’s Attorneys*

State’s Attorney of Cook County

By: /s/ Kent. S. Ray By: /s/ Jay Edelson

Kent S. Ray Jay Edelson*

Assistant State’s Attorney [email protected]
[email protected] Benjamin H. Richman*
COOK COUNTY STATE’S ATTORNEY’S OFFICE [email protected]
69 W. Washington Street, Suite 3130 Ari J. Scharg*
Chicago, Illinois 60602 [email protected]
Tel: 312.603.8600 David I. Mindell*
Fax: 312.603.9830 [email protected]
Alfred K. Murray II*
[email protected]
EDELSON PC
ELECTRONICALLY FILED

350 N. LaSalle Street, 14th Floor

3/23/2018 6:55 PM

Chicago, Illinois 60654

2018-CH-03868
PAGE 25 of 25

Tel: 312.589.6370
Fax: 312.589.6378
Firm ID: 62075

*Petition for Appointment as Special

State’s Attorney Pending

25