Christopher Deason stumbled upon the psychological questionnaire on June 9, 2014. He was taking a lot of online surveys back then, each one earning him a few dollars to help pay the bills. Nothing about this one, which he saw on an online job platform, struck him as “creepy or weird,” he said later.
So at 6:37 that evening, Mr. Deason completed the first step of the survey: He granted access to his Facebook account.
Less than a second later, a Facebook app had harvested not only Mr. Deason’s profile data, but also data from the profiles of 205 of his Facebook friends. Their names, birth dates and location data, as well as lists of every Facebook page they had ever liked, were downloaded — without their knowledge or express consent — before Mr. Deason could even begin reading the first survey question.
The information was added to a huge database being compiled for Cambridge Analytica, the political data firm with links to Donald J. Trump’s 2016 presidential campaign. None of the people whose data was collected knew it had happened, not even Mr. Deason. “I don’t think I would have gone forward with it if I had,” Mr. Deason, 27, said in a recent interview.
Mr. Deason and his Facebook friends became early entries in a database that would ultimately encompass tens of millions of Facebook profiles and is now at the center of a crisis facing the social media giant. News of Cambridge Analytica’s data collection, first reported last month by The New York Times and The Observer of London, has spurred a #DeleteFacebook movement and brought the social network under intensifying scrutiny from lawmakers and regulators in the United States and Britain.
Still, few of the roughly 214 million Americans with Facebook profiles know whether their data was among the information swept up for Cambridge Analytica. Facebook, which learned of the data misuse in December 2015, plans to begin telling affected users on Monday, a day before its founder, Mark Zuckerberg, is to testify before Congress. Records reviewed by The Times show that roughly 300,000 people took the survey, but because of the access to friends’ information allowed at the time, Facebook said that as many as 87 million users could have been affected.
But The Times, which has viewed a set of raw data from the profiles that Cambridge Analytica paid an academic researcher to obtain, contacted nearly two dozen affected Facebook users in recent weeks. Some were angry — one woman compared it to being robbed — while others were annoyed but unsurprised, having grown cynical about tech giants’ use of the data they collect. They are some of the first known affected Facebook users to be publicly identified. And nearly all said the misuse of their data had given them second thoughts about staying on Facebook.
“I’ve come to grips with the fact that you are the product on the internet,” said Mark Snyder, 32, who lives in Pompano Beach, Fla., and was among Mr. Deason’s friends whose data was collected.
“If you sign up for anything and it isn’t immediately obvious how they’re making money, they’re making money off of you,” said Mr. Snyder, who maintains computer networks for a living.
Mr. Zuckerberg has said the misuse of data represented a “breach of trust” by the company. But even he has suggested that other app developers could have done the same.
Until April 2015, Facebook allowed some app developers to collect some private information from the profiles of users who downloaded apps, and from those of their friends. Facebook has said it allowed this kind of data collection to help developers improve the “in-app” experience for users. But Facebook appears to have done little to verify how developers were using the data or whether they were providing any kind of experience on Facebook at all.
The questionnaire used to collect data for Cambridge Analytica was not actually on Facebook. It was hosted by a company called Qualtrics, which provides a platform for online surveys. It consisted of dozens of questions often used by psychology researchers to assess personality, such as whether the respondent prefers to be alone, tries to lead others and loves large parties (the answer choices range from “disagree strongly” to “agree strongly”). The questionnaire took about 10 to 20 minutes to complete.
When respondents authorized access to their Facebook profiles, the app performed its sole function: to take the users’ data and that of their friends. There was no “in-app” experience to speak of; this was not intended to be the sort of cute online quiz that tells users which “Friends” character they most resemble or how their brunch preferences reveal their inner Disney princess.
Facebook has said that people who took the quiz were told that their data would be used only for academic purposes, claiming that it and its users were misled by Cambridge Analytica and the researcher it hired, Aleksandr Kogan, a 28-year-old Russian-American academic. But the fine print that accompanied the questionnaire may have told users that their data could be used for commercial purposes, according to a draft of the survey’s terms of service that was reviewed by The Times.
Selling users’ Facebook data would have been an outright violation of the company’s rules at the time. Yet the company does not appear to have regularly checked to make sure that apps complied with its rules. And the final wording of the survey’s terms of service is now most likely unknowable: Facebook executives said they deleted the app in December 2015 when they found out about the data harvesting.
Cambridge Analytica used the Facebook data to help build tools that it claimed could identify the personalities of American voters and influence their behavior. The firm has said that its so-called psychographic modeling techniques underpinned its work for Mr. Trump’s campaign in 2016, setting off a still-unsettled debate about whether the firm’s technology worked.
The uproar over Cambridge Analytica’s misuse of the data has added to questions Facebook was already confronting over the use of its platform by those seeking to spread Russian propaganda and fake news.
“Cambridge Analytica is the big story on the topic, but there have been numerous stories about Facebook either selling user data or giving third parties access and using it to help advertising,” Mr. Deason said.
He was especially irked by the ways Facebook and other social media directed advertisements based on what users posted or viewed online.
If he recommends, say, a Dell laptop to a friend, he said, “I go to the next page on Facebook and there’s a Dell ad.”
“That bothers me,” he said.
Mr. Deason, who runs a computer business in Roanoke, Va., is probably among Facebook’s more tech-savvy users. He is keeping his account open for now because his business has its own page and he moderates Facebook groups dedicated to computers.
“But if I were just working my 9-to-5 at the local bank or whatever, and coming home and getting on Facebook to check on my friends and whatnot, yeah, I would delete Facebook,” he said.
Many people who took the survey do not have a background in technology, including Jim Symbouras, 56, a municipal worker in New York City.
His data was collected dozens of times after 52 of his Facebook friends were directed to the psychological questionnaire, many by a site called Swagbucks. The site lets people earn gift cards to Amazon and other retailers in exchange for taking surveys or watching video advertisements.
Mr. Symbouras does not personally know any of the Facebook friends who granted the app access to his data. He met them in Facebook groups where Swagbucks users traded tips for finding good deals.
Amy Risner, 52, of Collinwood, Tenn., was one of those Facebook friends. Ms. Risner, who does not work full time, vaguely recalled the questionnaire — “It was real long, that’s what I remember” — but was certain she never saw any notice that her data or that of her friends would be collected.
“If it would have said anything like that about taking my information — my personal information — I would have backed out of it and not done it,” Ms. Risner said.
Facebook, though, is a tough habit to kick. Asked if she was thinking about deleting her account, Ms. Risner said, “I’m just too nosy to stay off it.”
