Fifty-three Australians filled in a Facebook personality quiz, one small part of a worldwide group of roughly 300,000 who did the same. Their combined friend lists did the rest: the app ended up touching some 87 million Facebook accounts, one friendship at a time. Australia’s cut of that 87 million came to 311,074 people, drawn from friendships spread across that entire 300,000-strong pool of installers, not just the 53 who happened to be Australian themselves.

None of those 311,074 Australians downloaded the app or approved anything themselves. Facebook’s own rules didn’t require either.

What the quiz actually did

Aleksandr Kogan, a psychologist at Cambridge University, built an app called thisisyourdigitallife in 2013 through a side company, Global Science Research. The pitch was simple: answer some questions, help out with academic research, collect a small payment. Around 300,000 people worldwide took him up on it.

Then the app looked outward.

Facebook’s developer platform in that era let an installed app request information about the installer’s friends as well: names, birthdays, locations, page likes. Those friends were never prompted. Access came through Facebook’s platform rules and the privacy and app settings those users had in place. Chief technology officer Mike Schroepfer eventually put the total at up to 87 million accounts, in the same April 2018 post announcing that the various doors were being bolted shut.

Multiply 300,000 quiz takers by an average friends list and the arithmetic stops being mysterious. Nothing malfunctioned. The plumbing did precisely what it had been built to do.

Consent that travelled sideways

Privacy rules mostly imagine a deal between two parties. Somebody hands over information, a company promises to behave, and the terms cover the person who clicked. Kogan’s app broke that arrangement by treating one person’s tick box as permission to collect data about several hundred others who were never at the table.

Australian numbers show how far a single hop can reach. The regulator’s own enforceable undertaking with Meta puts it plainly: just 53 Facebook users in Australia installed the app, against 311,074 Australians who were directly linked, as a Facebook friend, to one of the app’s installers, regardless of where that installer lived.

Fifty-three people cannot meaningfully speak for a population the size of Newcastle.

None of the harvested material was dramatic on its own. A birthday, a suburb, a few hundred page likes. Fed through a model at scale, though, that sort of thing supports inferences about temperament and politics that the person concerned never volunteered and never could have. Predicting traits from likes alone, without anyone answering a single question, was the entire commercial trick behind paying people to take the quiz in the first place.

Seven years of grinding through courts

Consequences arrived slowly, and mostly in dollars. In July 2019 the Federal Trade Commission imposed a US$5 billion penalty, the largest ever handed to a company for a privacy violation at that point, and forced Facebook to build an independent privacy committee into its board structure. Regulators in the UK and several other countries opened their own cases around the same time. 

Australia’s regulator took considerably longer. An investigation opened in April 2018, not long after the scandal broke, formal Federal Court proceedings followed in March 2020, and the matter didn’t close until December 2024: seven years in total, as the regulator itself counts it. That’s when the Office of the Australian Information Commissioner accepted an enforceable undertaking, a legally binding settlement, from Meta that included an A$50 million payment program. Information Commissioner Elizabeth Tydd framed the sum as the largest amount Australia has ever set aside specifically to address a privacy complaint. Meta admitted no breach of the Privacy Act, and the civil penalty proceedings were withdrawn.

What the commissioner alleged was narrower than the popular version of events. Not that Meta handed data to a political consultancy, but that it disclosed Australians’ personal information to the app to begin with, exposing it to the risk of onward disclosure and political profiling. Meta itself says it has seen no evidence that any Australian’s data actually reached Cambridge Analytica. The material that did reach the firm was mostly American.

Penalties have moved on since. A serious or repeated interference with privacy now exposes a company to the greater of $50 million, three times any benefit gained, or 30 per cent of adjusted turnover for the relevant period. That scale wasn’t in play here: Meta’s A$50 million was a negotiated payment program, agreed to settle the case, rather than a civil penalty imposed by a court.

First payments due in September 2026

Eligibility required a Facebook account held between 2 November 2013 and 17 December 2015, more than 30 days spent in Australia during that window, and either having put the app on their own profile or having been a Facebook friend of someone who had. Claims split into two tiers: a base payment for generalised concern or embarrassment, or a larger sum for anyone who could show specific loss with a direct causal line back to the incident.

Registrations closed on 31 December 2025. Eligible Australians who submitted their bank details by 20 August were told by scheme administrator KPMG to expect a first round of payments in early September 2026. A second round follows in October, for anyone whose first transfer fails or who supplies bank details after the August deadline but before the final cut-off. Claimants who never supply details are struck off.

Nobody has said how much per person, though comparable schemes give a rough shape. Legal academics Graham Greenleaf and Katharine Kemp, writing in The Conversation, point to reports that Americans covered by Meta’s US$725 million class settlement averaged around US$30 each. Whether Australia’s payments will land anywhere near that is unclear. A$50 million divided among however many of the roughly 311,000 eligible Australians actually registered could look very different depending on the count. Anything unclaimed goes to the Commonwealth’s Consolidated Revenue Fund rather than back to Meta.

So what’s a stranger’s birthday, hometown and list of likes actually worth? Nobody in Australia knows yet, and the figure hasn’t been made public. The nearest comparator, that US$30 average, suggests it won’t be much: somewhere in the neighbourhood of a cheap lunch, if the pattern holds. Facebook killed off the friends permission long ago. The assumption underneath it, that one person’s agreement can stand in for everyone they know, has simply moved house.