facebook data scandal case study

• Skip to main content
• Keyboard shortcuts for audio player

Facebook parent Meta will pay $725M to settle a privacy suit over Cambridge Analytica

Facebook CEO Mark Zuckerberg walks at the company's headquarters in Menlo Park, Calif., on April 4, 2013. Facebook parent company Meta has agreed to pay $725 million to settle a class-action privacy lawsuit. Marcio Jose Sanchez/AP hide caption

Facebook CEO Mark Zuckerberg walks at the company's headquarters in Menlo Park, Calif., on April 4, 2013. Facebook parent company Meta has agreed to pay $725 million to settle a class-action privacy lawsuit.

Facebook parent company Meta has agreed to pay $725 million to settle a class-action lawsuit claiming it improperly shared users' information with Cambridge Analytica, a data analytics firm used by the Trump campaign.

The proposed settlement is a result of revelations in 2018 that information of up to 87 million people may have been improperly accessed by the third-party firm, which filed for bankruptcy in 2018. This is the largest recovery ever in a data privacy class action and the most Facebook has paid to settle a private class action, the plaintiffs' lawyers said in a court filing Thursday.

Meta did not admit wrongdoing and maintains that its users consented to the practices and suffered no actual damages. Meta spokesperson Dina El-Kassaby Luce said in a statement that the settlement was "in the best interest of its community and shareholders" and that the company has revamped its approach to privacy.

Plaintiffs' lawyers said about 250 million to 280 million people may be eligible for payments as part of the class action settlement. The amount of the individual payments will depend on the number of people who come forward with valid claims.

"The amount of the recovery is particularly striking given that Facebook argued that its users consented to the practices at issue, and that the class suffered no actual damages," the plaintiffs' lawyers said in the court filing.

4 Key Takeaways From Washington's Big Tech Hearing On 'Monopoly Power'

FTC To Hold Facebook CEO Mark Zuckerberg Liable For Any Future Privacy Violations

Facebook's data leak to Cambridge Analytica sparked global backlash and government investigations into the company's privacy practices the past several years.

Facebook CEO Mark Zuckerberg gave high-profile testimonies in 2020 before Congress and as part of the Federal Trade Commission's privacy case for which Facebook also agreed to a $5 billion fine. The tech giant also agreed to pay $100 million to resolve U.S. Securities and Exchange Commission claims that Facebook misled investors about the risks of user data misuse.

Facebook first learned of the leak in 2015, tracing the violation back to a Cambridge University psychology professor who harvested data of Facebook users through an app to create a personality test and passed it on to Cambridge Analytica.

Facebook Pays $643,000 Fine For Role In Cambridge Analytica Scandal

Cambridge Analytica was in the business to create psychological profiles of American voters so that campaigns could tailor their pitches to different people. The firm was used by Texas Sen. Ted Cruz's 2016 presidential campaign and then later by former President Donald Trump's campaign after he secured the Republican nomination.

According to a source close to the Trump campaign's data operations, Cambridge Analytica staffers did not use psychological profiling for his campaign but rather focused on more basic goals, like increasing online fundraising and reaching out to undecided voters.

Whistleblower Christopher Wylie then exposed the firm for its role in Brexit in 2019. He said Cambridge Analytica used Facebook user data to target people susceptible to conspiracy theories and convince British voters to support exiting the European Union. Former Trump adviser Steve Bannon was the vice president and U.S. hedge-fund billionaire Robert Mercer owned much of the firm at the time.

The court has set a hearing for March 2, 2023, when a federal judge is expected to give the settlement final approval.

NPR's Bobby Allyn contributed reporting.

• cambridge analytica

• Share full article

Advertisement

Supported by

Cambridge Analytica and Facebook: The Scandal and the Fallout So Far

Revelations that digital consultants to the Trump campaign misused the data of millions of Facebook users set off a furor on both sides of the Atlantic. This is how The Times covered it.

By Nicholas Confessore

In March, The New York Times, working with The Observer of London and The Guardian, obtained a cache of documents from inside Cambridge Analytica, the data firm principally owned by the right-wing donor Robert Mercer . The documents proved that the firm , where the former Trump aide Stephen K. Bannon was a board member, used data improperly obtained from Facebook to build voter profiles. The news put Cambridge under investigation and thrust Facebook into its biggest crisis ever. Here’s a guide to our coverage.

Harvesting data and testing election law

The Times reported that in 2014 contractors and employees of Cambridge Analytica, eager to sell psychological profiles of American voters to political campaigns, acquired the private Facebook data of tens of millions of users — the largest known leak in Facebook history.

There was more. Our article first showed how Cambridge received warnings from its own lawyer, Laurence Levy, as it employed European and Canadian citizens on campaigns, potentially violating American election law. The Times also found that tranches of raw data still existed beyond Facebook’s control.

Read how researchers may have used your Facebook “likes” to predict your political views.

What was the Russia link?

In a companion piece , The Times reported that people at Cambridge Analytica and its British affiliate, the SCL Group, were in contact with executives from Lukoil, the Kremlin-linked oil giant, as Cambridge built its Facebook-derived profiles. Lukoil was interested in the ways data was used to target American voters, according to two former company insiders. SCL and Lukoil denied that the talks were political in nature and said the oil giant never became a client.

Anger on both sides of the Atlantic

The articles drew an instant response in Washington, where lawmakers demanded that Mark Zuckerberg, Facebook’s chief executive, testify before Congress . Democrats looking into Russian interference in the 2016 election — already interested in Cambridge’s role in providing analytics to the Trump campaign — said they would seek an investigation into the leak. They were echoed by lawmakers in Britain investigating Cambridge Analytica’s role in disinformation and the country’s referendum to leave the European Union.

Bribes, entrapment and a suspension

The Times reported that Cambridge suspended its chief executive, Alexander Nix, after a British television channel released an undercover video in which he suggested that the company had used seduction and bribery to entrap politicians and influence foreign elections. In Washington, the Federal Trade Commission moved to investigate whether Facebook had violated an early agreement to safeguard user data.

Facebook faces a reckoning

The Times reported on a growing number of Facebook users, including the singer Cher, deleting their accounts — and broke news of the departure of Facebook’s top security official , who had clashed with other executives on how to handling discontent over the platform’s role in spreading disinformation. The hashtag #DeleteFacebook began trending on Twitter.

After remaining silent for days — spurring another social media hashtag, #WheresZuck? — Mr. Zuckerberg spoke with The Times about steps Facebook was taking to address users’ anger.

Our columnist Brian X. Chen explains how to protect your Facebook data .

New Trump adviser, old Cambridge connection

As Facebook reeled, The Times delved into the relationship between Cambridge Analytica and John Bolton , the conservative hawk named national security adviser by President Trump . The Times broke the news that in 2014, Cambridge provided Mr. Bolton’s “super PAC” with early versions of its Facebook-derived profiles — the technology’s first large-scale use in an American election.

What about 2016? We examined the skepticism and evidence around the role Cambridge claimed it played in Mr. Trump’s win.

Cambridge Analytica helped develop ads for candidates supported by John Bolton's “super PAC.”

Another look at ‘Brexit’

The Times and The Observer reported allegations that the 2016 “Brexit” campaign used a Cambridge Analytica contractor to help skirt election spending limits. The story implicated two senior advisers to Prime Minister Theresa May. Testifying to Parliament a few days later , a former Cambridge employee, Christopher Wylie, contended that the company helped swing the results in favor of Britain’s withdrawal from the European Union.

The Silicon Valley spy contractor

In another report, The Times showed how an employee at Palantir Technologies — an intelligence contractor founded by the Trump backer and tech investor Peter Thiel — helped Cambridge harvest Facebook data . The article reported that Palantir and Cambridge executives briefly considered a formal partnership to work on political campaigns. Though the deal fell through, a Palantir employee continued working with Cambridge to figure out how to obtain data for psychographic profiles. Palantir officials said the employee did so in a strictly personal capacity.

How many were affected?

The Times originally reported that Cambridge harvested data from over 50 million Facebook users. But at the bottom of a company announcement about new privacy features, Facebook’s chief technology officer, Mike Schroepfer, issued a new estimate for the number of users who were affected: as many as 87 million , most of them in the United States.

Facebook is responding to users’ distrust. Read how the company introduced a central privacy page .

‘You are the product’

Amid the crisis, one set of voices remained notably absent: Facebook users whose data was harvested. So The Times found some , and their reactions ranged from anger to resigned annoyance at how tech giants use personal information. As one of the affected Facebook users put it, “You are the product on the internet.”

The Times also reported new details on the app used to collect data for Cambridge Analytica. It was no simple Facebook quiz, as many had assumed. Rather, it was attached to a lengthy psychology questionnaire hosted by Qualtrics, a company that manages online surveys. The first step for those filling out the questionnaire was to grant access to their Facebook profiles. Once they did, an app then harvested their data and that of their friends.

Zuckerberg speaks to lawmakers

Congress vs. mark zuckerberg: the key moments, in a hearing held in response to revelations of data harvesting by cambridge analytica, mark zuckerberg, the facebook chief executive, faced questions from senators on a variety of issues, from privacy to the company’s business model..

“Mr. Zuckerberg, would you be comfortable sharing with us the name of the hotel you stayed in last night?” “Um — no.” “If you’ve messaged anybody this week, would you share with us the names of the people you’ve messaged?” “Senator, no, I would probably not choose to do that publicly here.” “I think that may be what this is all about.” “In 2015, we heard the report that this developer Aleksandr Kogan had sold data to Cambridge Analytica.” “Did you or senior leadership do an inquiry to find out who at Facebook had this information and did they not have a discussion about whether or not the users should be informed back in December of 2015?” “Senator, in retrospect, I think we clearly view it as a mistake that we didn’t inform people. And we did that based on false information that we thought that the case was closed, and that the data had been deleted.” “So there was a decision made on that basis not to inform the users. Is that correct?” “That’s my understanding, yes.” “I assume Facebook’s been served with subpoenas from the special counsel Mueller’s office. Is that correct?” “Yes. Actually, let me clarify that. I actually am not aware of a subpoena. I believe that there may be. But I know we’re working with them.” “Thank you.” “If I buy a Ford and it doesn’t work well and I don’t like it, I can buy a Chevy. If I’m upset with Facebook, what’s the equivalent product that I can go sign up for?” “The average American uses eight different apps —” “O.K.” “— to communicate with their friends and stay in touch with people —” “O.K.” “— ranging from text apps —” “— which is —” — to email.” “Which is the same service you provide.” “Well, we provide a number of different services.” “Is Twitter the same as what you do?” “It overlaps with a portion of what we do.” “You don’t think you have a monopoly?” “It certainly doesn’t feel like that to me.” “O.K.” [audience laughs] “Do you need to look behind shell corporations in order to find out who is really behind the content that’s being posted? And if you may need to look behind a shell corporation, how will you go about doing that? How will you get back to the true, what lawyers would call ‘beneficial owner’ of the site that is putting out the political material?” “So what we’re going to do is require a valid government identity and we’re going to verify the location. So we’re going to do that, so that way someone sitting in Russia, for example, couldn’t say that they’re in America and therefore able to run an election ad.” “But if they were running through a corporation domiciled in Delaware, you wouldn’t know that they were actually a Russian owner.” “Senator, that’s— that’s correct.”

Mr. Zuckerberg made his first appearance before Congress , testifying to Senate and House committees. First up was the Senate, where he faced tough questions about the company’s mishandling of data, and said Facebook was investigating “tens of thousands of apps” to see what information they harvested.

The next day, he faced an even tougher crowd in the House. There, the consensus was that social media technology — and its potential for abuse — had far outpaced Washington, and that Congress may have to step in to close the gap. Even Mr. Zuckerberg seemed to suggest he could be open to some regulation, but neither he nor lawmakers seemed sure about how exactly to regulate the new breed of companies.

A setback for the Mercers

On the same day as the Senate hearing, The Times reported how the Cambridge furor had impacted the Mercers , particularly Mr. Mercer’s daughter Rebekah, who leads the family’s political network. Shortly after the scandal broke, a friend of hers visited Facebook headquarters to plead the case for Cambridge. Though the Mercers were once Mr. Trump’s leading patrons in conservative politics, their standing in the president’s circle has suffered.

Who audits the auditors?

The Times reported on a series of assessments of Facebook’s privacy programs, conducted by the consulting firm PwC on behalf of federal regulators. In the assessments, mandated by a 2011 consent decree, PwC deemed Facebook’s internal controls effective at protecting users’ privacy — even after the social media giant lost control of a huge trove of user data that was improperly obtained by Cambridge Analytica.

Matthew Rosenberg contributed reporting.

Nicholas Confessore is a New York-based political and investigative reporter at The Times and a writer-at-large at The Times Magazine, covering the intersection of wealth, power and influence in Washington and beyond. He joined The Times in 2004. More about Nicholas Confessore

• Newsletters

Site search

• Israel-Hamas war
• Home Planet
• 2024 election
• Supreme Court
• TikTok’s fate
• All explainers
• Future Perfect

Filed under:

The Facebook and Cambridge Analytica scandal, explained with a simple diagram

A visual of how it all fits together. They’re now shutting down.

Share this story

• Share this on Facebook
• Share this on Twitter
• Share this on Reddit
• Share All sharing options

Share All sharing options for: The Facebook and Cambridge Analytica scandal, explained with a simple diagram

Cambridge Analytica, the political consulting firm that did work for the Trump campaign and harvested raw data from up to 87 million Facebook profiles, is shutting down .

There is a complicated web of relationships that explains how the Trump campaign, Cambridge Analytica, and Facebook are tied together, as my colleague Andrew Prokop explains in this excellent piece .

But if you need a refresher on how all the pieces fit together, this diagram helps make sense of it all.

1) Here’s the very simple version of the story

Facebook exposed data on up to 87 million Facebook users to a researcher who worked at Cambridge Analytica, which worked for the Trump campaign.

2) But how is the Trump campaign connected to Cambridge Analytica?

Cambridge Analytica was created when Steve Bannon approached conservative megadonors Rebekah and Robert Mercer to fund a political consulting firm. Bannon became vice president of Cambridge Analytica, and during the 2016 election, he reached out to the Trump campaign to introduce the two sides.

Bannon, of course, eventually became a senior adviser to Trump before he was fired in August 2017.

So what is the SCL Group, which does the work for Cambridge Analytica? It’s a public relations and messaging firm that has clients all around the world, and as Vox’s Andrew Prokop writes :

SCL tends to describe its capabilities in grandiose and somewhat unsettling language — the company has touted its expertise at ”psychological warfare” and “influence operations.” It’s long claimed that its sophisticated understanding of human psychology helps it target and persuade people of its clients’ preferred message.

This means, as the New York Times writes, Cambridge Analytica is basically a shell for the SCL Group.

3) How did Cambridge Analytica get its data?

Cambridge Analytica CEO Alexander Nix actually reached out to WikiLeaks founder Julian Assange about the emails that were hacked from the Democratic National Committee’s servers, according to the Wall Street Journal .

But the more important part of this story is how Cambridge Analytica got its data from Facebook. And according to a former Cambridge Analytica employee , the firm got it through researcher Aleksandr Kogan, a Russian American who worked at the University of Cambridge.

4) How did Kogan use Facebook to harvest up to 87 million user profiles?

Kogan built a Facebook app that was a quiz.

It not only collected data from people who took the quiz, but as my colleague Aja Romano writes, it exposed a loophole in Facebook API that allowed it to collect data from the Facebook friends of the quiz takers as well.

As Romano points out, Facebook prohibited the selling of data collected with this method, but Cambridge Analytica sold the data anyway.

Why this is a Facebook scandal more than a Cambridge Analytica one

Facebook founder and CEO Mark Zuckerberg wrote in a response to this scandal , “I’ve been working to understand exactly what happened and how to make sure this doesn’t happen again. The good news is that the most important actions to prevent this from happening again today we have already taken years ago. But we also made mistakes, there’s more to do, and we need to step up and do it.”

But former Facebook employees have said that there’s a tension between the security team and the legal/policy team in terms of how they prioritize user protection in their decision-making.

“The people whose job is to protect the user always are fighting an uphill battle against the people whose job is to make money for the company,” Sandy Parakilas, who worked on the privacy side at Facebook, told the New York Times .

Now, there is a decent chance Cambridge Analytica’s work didn’t actually do much to elect Trump; the firm’s reputation in the political consulting community is less than stellar .

But this highlights a larger debate over how much users can trust Facebook with their data. Facebook allowed a third-party developer to engineer an application for the sole purpose of gathering data. And the developer was able to exploit a loophole to gather information on not only people who used the app but all their friends — without them knowing .

Still, it’s Cambridge Analytica paying the price today after losing multiple clients after the last several months of unflattering publicity.

Will you support Vox today?

We believe that everyone deserves to understand the world that they live in. That kind of knowledge helps create better citizens, neighbors, friends, parents, and stewards of this planet. Producing deeply researched, explanatory journalism takes resources. You can support this mission by making a financial gift to Vox today. Will you join us?

We accept credit card, Apple Pay, and Google Pay. You can also contribute via

The Cambridge Analytica Facebook scandal

• The Facebook data breach wasn’t a hack. It was a wake-up call.
• Why investigators think Cambridge Analytica might have helped Russia spread fake news
• 9 questions about Facebook and data sharing you were too embarrassed to ask
• The case against Facebook
• “Psychographic microtargeting”: what’s bullshit and what’s legit 
• Mark Zuckerberg on Facebook’s hardest year, and what comes next
• Mark Zuckerberg runs a nation-state, and he’s the king
• Read Mark Zuckerberg’s prepared statement for congressional testimony
• Mark Zuckerberg has been apologizing for reckless privacy violations since he was a freshman
• I was Zuckerberg’s speechwriter. “Companies over countries” was his early motto.
• What the government could actually do about Facebook
• Why we can’t trust Facebook to police itself
• Lawmakers seem confused about what Facebook does — and how to fix it
• Banks have to know their customers. Shouldn’t Facebook and Twitter?

Sign up for the newsletter Today, Explained

Understand the world with a daily explainer plus the most compelling stories of the day.

Thanks for signing up!

Check your inbox for a welcome email.

Oops. Something went wrong. Please enter a valid email and try again.

TechRepublic

Account information.

Share with Your Friends

Facebook data privacy scandal: A cheat sheet

Your email has been sent

A decade of apparent indifference for data privacy at Facebook has culminated in revelations that organizations harvested user data for targeted advertising, particularly political advertising, to apparent success. While the most well-known offender is Cambridge Analytica–the political consulting and strategic communication firm behind the pro-Brexit Leave EU campaign, as well as Donald Trump’s 2016 presidential campaign–other companies have likely used similar tactics to collect personal data of Facebook users.

TechRepublic’s cheat sheet about the Facebook data privacy scandal covers the ongoing controversy surrounding the illicit use of profile information. This article will be updated as more information about this developing story comes to the forefront. It is also available as a download, Cheat sheet: Facebook Data Privacy Scandal (free PDF) .

SEE: Navigating data privacy (ZDNet/TechRepublic special feature) | Download the free PDF version (TechRepublic)

What is the Facebook data privacy scandal?

The Facebook data privacy scandal centers around the collection of personally identifiable information of “ up to 87 million people ” by the political consulting and strategic communication firm Cambridge Analytica. That company–and others–were able to gain access to personal data of Facebook users due to the confluence of a variety of factors, broadly including inadequate safeguards against companies engaging in data harvesting, little to no oversight of developers by Facebook, developer abuse of the Facebook API, and users agreeing to overly broad terms and conditions.

SEE: Information security policy (TechRepublic Premium)

In the case of Cambridge Analytica, the company was able to harvest personally identifiable information through a personality quiz app called thisisyourdigitiallife, based on the OCEAN personality model. Information gathered via this app is useful in building a “psychographic” profile of users (the OCEAN acronym stands for openness, conscientiousness, extraversion, agreeableness, and neuroticism). Adding the app to your Facebook account to take the quiz gives the creator of the app access to profile information and user history for the user taking the quiz, as well as all of the friends that user has on Facebook. This data includes all of the items that users and their friends have liked on Facebook.

Researchers associated with Cambridge University claimed in a paper that it “can be used to automatically and accurately predict a range of highly sensitive personal attributes including: sexual orientation, ethnicity, religious and political views, personality traits, intelligence, happiness, use of addictive substances, parental separation, age, and gender,” with a model developed by the researchers that uses a combination of dimensionality reduction and logistic/linear regression to infer this information about users.

The model–according to the researchers–is effective due to the relationship of likes to a given attribute. However, most likes are not explicitly indicative of their attributes. The researchers note that “less than 5% of users labeled as gay were connected with explicitly gay groups,” but that liking “Juicy Couture” and “Adam Lambert” are likes indicative of gay men, while “WWE” and “Being Confused After Waking Up From Naps” are likes indicative of straight men. Other such connections are peculiarly lateral, with “curly fries” being an indicator of high IQ, “sour candy” being an indicator of not smoking, and “Gene Wilder” being an indicator that the user’s parents had not separated by age 21.

SEE: Can Russian hackers be stopped? Here’s why it might take 20 years (TechRepublic cover story) | download the PDF version

Additional resources

• How a Facebook app scraped millions of people’s personal data (CBS News)
• Facebook reportedly thinks there’s no ‘expectation of privacy’ on social media (CNET)
• Cambridge Analytica: ‘We know what you want before you want it’ (TechRepublic)
• Average US citizen had personal information stolen at least 4 times in 2019 (TechRepublic)
• Facebook: We’ll pay you to track down apps that misuse your data (ZDNet)
• Most consumers do not trust big tech with their privacy (TechRepublic)
• Facebook asks permission to use personal data in Brazil (ZDNet)

What is the timeline of the Facebook data privacy scandal?

Facebook has more than a decade-long track record of incidents highlighting inadequate and insufficient measures to protect data privacy. While the severity of these individual cases varies, the sequence of repeated failures paints a larger picture of systemic problems.

SEE: All TechRepublic cheat sheets and smart person’s guides

In 2005, researchers at MIT created a script that downloaded publicly posted information of more than 70,000 users from four schools. (Facebook only began to allow search engines to crawl profiles in September 2007.)

In 2007, activities that users engaged in on other websites was automatically added to Facebook user profiles as part of Beacon, one of Facebook’s first attempts to monetize user profiles. As an example, Beacon indicated on the Facebook News Feed the titles of videos that users rented from Blockbuster Video, which was a violation of the Video Privacy Protection Act . A class action suit was filed, for which Facebook paid $9.5 million to a fund for privacy and security as part of a settlement agreement.

SEE: The Brexit dilemma: Will London’s start-ups stay or go? (TechRepublic cover story)

In 2011, following an FTC investigation, the company entered into a consent decree, promising to address concerns about how user data was tracked and shared. That investigation was prompted by an incident in December 2009 in which information thought private by users was being shared publicly, according to contemporaneous reporting by The New York Times .

In 2013, Facebook disclosed details of a bug that exposed the personal details of six million accounts over approximately a year . When users downloaded their own Facebook history, that user would obtain in the same action not just their own address book, but also the email addresses and phone numbers of their friends that other people had stored in their address books. The data that Facebook exposed had not been given to Facebook by users to begin with–it had been vacuumed from the contact lists of other Facebook users who happen to know that person. This phenomenon has since been described as “shadow profiles.”

The Cambridge Analytica portion of the data privacy scandal starts in February 2014. A spate of reviews on the Turkopticon website–a third-party review website for users of Amazon’s Mechanical Turk–detail a task requested by Aleksandr Kogan asking users to complete a survey in exchange for money. The survey required users to add the thisisyourdigitiallife app to their Facebook account, which is in violation of Mechanical Turk’s terms of service . One review quotes the request as requiring users to “provide our app access to your Facebook so we can download some of your data–some demographic data, your likes, your friends list, whether your friends know one another, and some of your private messages.”

In December 2015, Facebook learned for the first time that the data set Kogan generated with the app was shared with Cambridge Analytica. Facebook founder and CEO Mark Zuckerberg claims “we immediately banned Kogan’s app from our platform, and demanded that Kogan and Cambridge Analytica formally certify that they had deleted all improperly acquired data. They provided these certifications.”

According to Cambridge Analytica, the company took legal action in August 2016 against GSR (Kogan) for licensing “illegally acquired data” to the company, with a settlement reached that November.

On March 17, 2018, an exposé was published by The Guardian and The New York Times , initially reporting that 50 million Facebook profiles were harvested by Cambridge Analytica; the figure was later revised to “up to 87 million” profiles. The exposé relies on information provided by Christopher Wylie, a former employee of SCL Elections and Global Science Research, the creator of the thisisyourdigitiallife app. Wylie claimed that the data from that app was sold to Cambridge Analytica, which used the data to develop “psychographic” profiles of users, and target users with pro-Trump advertising, a claim that Cambridge Analytica denied.

On March 16, 2018, Facebook threatened to sue The Guardian over publication of the story, according to a tweet by Guardian reporter Carole Cadwalladr . Campbell Brown, a former CNN journalist who now works as head of news partnerships at Facebook, said it was “not our wisest move,” adding “If it were me I would have probably not threatened to sue The Guardian.” Similarly, Cambridge Analytica threatened to sue The Guardian for defamation .

On March 20, 2018, the FTC opened an investigation to determine if Facebook had violated the terms of the settlement from the 2011 investigation.

In April 2018, reports indicated that Facebook granted Zuckerberg and other high ranking executives powers over controlling personal information on a platform that is not available to normal users. Messages from Zuckerberg sent to other users were remotely deleted from users’ inboxes, which the company claimed was part of a corporate security measure following the 2014 Sony Pictures hack . Facebook subsequently announced plans to make available the “unsend” capability “to all users in several months,” and that Zuckerberg will be unable to unsend messages until such time that feature rolls out. Facebook added the feature 10 months later , on February 6, 2019. The public feature permits users to delete messages up to 10 minutes after the messages were sent. In the controversy prompting this feature to be added, Zuckerberg deleted messages months after they were sent.

On April 4, 2018, The Washington Post reported that Facebook announced “malicious actors” abused the search function to gather public profile information of “most of its 2 billion users worldwide.”

In a CBS News/YouGov poll published on April 10, 2018, 61% of Americans said Congress should do more to regulate social media and tech companies. This sentiment was echoed in a CBS News interview with Box CEO Aaron Levie and YML CEO Ashish Toshniwal who called on Congress to regulate Facebook. According to Levie, “There are so many examples where we don’t have modern ways of either regulating, controlling, or putting the right protections in place in the internet age. And this is a fundamental issue that, that we’re gonna have to grapple with as an industry for the next decade.”

On April 18, 2018, Facebook updated its privacy policy .

On May 2, 2018, SCL Group, which owns Cambridge Analytica, was dissolved. In a press release , the company indicated that “the siege of media coverage has driven away virtually all of the Company’s customers and suppliers.”

On May 15, 2018, The New York Times reported that Cambridge Analytica is being investigated by the FBI and the Justice Department. A source indicated to CBS News that prosecutors are focusing on potential financial crimes.

On May 16, 2018, Christopher Wylie testified before the Senate Judiciary Committee . Among other things, Wylie noted that Cambridge Analytica, under the direction of Steve Bannon, sought to “exploit certain vulnerabilities in certain segments to send them information that will remove them from the public forum, and feed them conspiracies and they’ll never see mainstream media.” Wylie also noted that the company targeted people with “characteristics that would lead them to vote for the Democratic party, particularly African American voters.”

On June 3, 2018, a report in The New York Times indicated that Facebook had maintained data-sharing partnerships with mobile device manufacturers, specifically naming Apple, Amazon, BlackBerry, Microsoft, and Samsung. Under the terms of this personal information sharing, device manufacturers were able to gather information about users in order to deliver “the Facebook experience,” the Times quotes a Facebook official as saying. Additionally, the report indicates that this access allowed device manufacturers to obtain data about a user’s Facebook friends, even if those friends had configured their privacy settings to deny information sharing with third parties.

The same day, Facebook issued a rebuttal to the Times report indicating that the partnerships were conceived because “the demand for Facebook outpaced our ability to build versions of the product that worked on every phone or operating system,” at a time when the smartphone market included BlackBerry’s BB10 and Windows Phone operating systems, among others. Facebook claimed that “contrary to claims by the New York Times, friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends. We are not aware of any abuse by these companies.” The distinction being made is partially semantic, as Facebook does not consider these partnerships a third party in this case. Facebook noted that changes to the platform made in April began “winding down” access to these APIs, and that 22 of the partnerships had already been ended.

On June 5, 2018, the The Washington Post and The New York Times reported that the Chinese device manufacturers Huawei, Lenovo, Oppo, and TCL were granted access to user data under this program. Huawei, along with ZTE, are facing scrutiny from the US government on unsubstantiated accusations that products from these companies pose a national security risk .

On July 2, 2018, The Washington Post reported that the US Securities and Exchange Commission, Federal Trade Commission, and Federal Bureau of Investigation have joined the Department of Justice inquiry into the Facebook/Cambridge Analytica data scandal. In a statement to CNET , Facebook indicated that “We’ve provided public testimony, answered questions, and pledged to continue our assistance as their work continues.” On July 11th, the Wall Street Journal reported that the SEC is separately investigating if Facebook adequately warned investors in a timely manner about the possible misuse and improper collection of user data. The same day, the UK assessed a £500,000 fine to Facebook , the maximum permitted by law, over its role in the data scandal. The UK’s Information Commissioner’s Office is also preparing to launch a criminal probe into SCL Elections over their involvement in the scandal.

On July 3, 2018, Facebook acknowledged a “bug” unblocked people that users has blocked between May 29 and June 5.

On July 12, 2018, a CNBC report indicated that a privacy loophole was discovered and closed. A Chrome plug-in intended for marketing research called Grouply.io allowed users to access the list of members for private Facebook groups. Congress sent a letter to Zuckerberg on February 19, 2019 demanding answers about the data leak, stating in part that “labeling these groups as closed or anonymous potentially misled Facebook users into joining these groups and revealing more personal information than they otherwise would have,” and “Facebook may have failed to properly notify group members that their personal health information may have been accessed by health insurance companies and online bullies, among others.”

Fallout from a confluence of factors in the Facebook data privacy scandal has come to bear in the last week of July 2018. On July 25th, Facebook announced that daily active user counts have fallen in Europe, and growth has stagnated in the US and Canada. The following day, Facebook suffered the worst single-day market value decrease for a public company in the US, dropping $120 billion , or 19%. On the July 28th, Reuters reported that shareholders are suing Facebook, Zuckerberg, and CFO David Wehner for “making misleading statements about or failing to disclose slowing revenue growth, falling operating margins, and declines in active users.”

On August 22, 2018, Facebook removed Facebook-owned security app Onavo from the App Store , for violating privacy rules. Data collected through the Onavo app is shared with Facebook.

In testimony before the Senate, on September 5, 2018, COO Sheryl Sandberg conceded that the company “[was] too slow to spot this and too slow to act” on privacy protections. Sandberg, and Twitter CEO Jack Dorsey faced questions focusing on user privacy, election interference, and political censorship. Senator Mark Warner of Virginia even said that, “The era of the wild west in social media is coming to an end,” which seems to indicate coming legislation.

On September 6, 2018, a spokesperson indicated that Joseph Chancellor was no longer employed by Facebook . Chancellor was a co-director of Global Science Research, the firm which improperly provided user data to Cambridge Analytica. An internal investigation was launched in March in part to determine his involvement. No statement was released indicating the result of that investigation.

On September 7, 2018, Zuckerberg stated in a post that fixing issues such as “defending against election interference by nation states, protecting our community from abuse and harm, or making sure people have control of their information and are comfortable with how it’s used,” is a process which “will extend through 2019.”

On September 26, 2018, WhatsApp co-founder Brian Acton stated in an interview with Forbes that “I sold my users’ privacy” as a result of the messaging app being sold to Facebook in 2014 for $22 billion.

On September 28, 2018, Facebook disclosed details of a security breach which affected 50 million users . The vulnerability originated from the “view as” feature which can be used to let users see what their profiles look like to other people. Attackers devised a way to export “access tokens,” which could be used to gain control of other users’ accounts .

A CNET report published on October 5, 2018, details the existence of an “ Internet Bill of Rights ” drafted by Rep. Ro Khanna (D-CA). The bill is likely to be introduced in the event the Democrats regain control of the House of Representatives in the 2018 elections. In a statement, Khanna noted that “As our lives and the economy are more tied to the internet, it is essential to provide Americans with basic protections online.”

On October 11, 2018, Facebook deleted over 800 pages and accounts in advance of the 2018 elections for violating rules against spam and “inauthentic behavior.” The same day, it disabled accounts for a Russian firm called “Social Data Hub,” which claimed to sell scraped user data. A Reuters report indicates that Facebook will ban false information about voting in the midterm elections.

On October 16, 2018, rules requiring public disclosure of who pays for political advertising on Facebook, as well as identity verification of users paying for political advertising, were extended to the UK . The rules were first rolled out in the US in May.

On October 25, 2018, Facebook was fined £500,000 by the UK’s Information Commissioner’s Office for their role in the Cambridge Analytica scandal. The fine is the maximum amount permitted by the Data Protection Act 1998. The ICO indicated that the fine was final. A Facebook spokesperson told ZDNet that the company “respectfully disagreed,” and has filed for appeal .

The same day, Vice published a report indicating that Facebook’s advertiser disclosure policy was trivial to abuse. Reporters from Vice submitted advertisements for approval attributed to Mike Pence, DNC Chairman Tom Perez, and Islamic State, which were approved by Facebook. Further, the contents of the advertisements were copied from Russian advertisements. A spokesperson for Facebook confirmed to Vice that the copied content does not violate rules, though the false attribution does. According to Vice, the only denied submission was attributed to Hillary Clinton.

On October 30, 2018, Vice published a second report in which it claimed that it successfully applied to purchase advertisements attributed to all 100 sitting US Senators, indicating that Facebook had yet to fix the problem reported in the previous week. According to Vice, the only denied submission in this test was attributed to Mark Zuckerberg.

On November 14, 2018, the New York Times published an exposé on the Facebook data privacy scandal, citing interviews of more than 50 people, including current and former Facebook executives and employees. In the exposé, the Times reports:

• In the Spring of 2016, a security expert employed by Facebook informed Chief Security Officer Alex Stamos of Russian hackers “probing Facebook accounts for people connected to the presidential campaigns,” which Stamos, in turn, informed general counsel Colin Stretch.
• A group called “Project P” was assembled by Zuckerberg and Sandberg to study false news on Facebook. By January 2017, this group “pressed to issue a public paper” about their findings, but was stopped by board members and Facebook vice president of global public policy Joel Kaplan, who had formerly worked in former US President George W. Bush’s administration.
• In Spring and Summer of 2017, Facebook was “publicly claiming there had been no Russian effort of any significance on Facebook,” despite an ongoing investigation into the extent of Russian involvement in the election.
• Sandberg “and deputies” insisted that the post drafted by Stamos to publicly acknowledge Russian involvement for the first time be made “less specific” before publication.
• In October 2017, Facebook expanded their engagement with Republican-linked firm Definers Public Affairs to discredit “activist protesters.” That firm worked to link people critical of Facebook to liberal philanthropist George Soros , and “[lobbied] a Jewish civil rights group to cast some criticism of the company as anti-Semitic.”
• Following comments critical of Facebook by Apple CEO Tim Cook , a spate of articles critical of Apple and Google began appearing on NTK Network, an organization which shares an office and staff with Definers. Other articles appeared on the website downplaying the Russians’ use of Facebook.

On November 15, 2018, Facebook announced it had terminated its relationship with Definers Public Affairs, though it disputed that either Zuckerberg or Sandberg was aware of the “specific work being done.” Further, a Facebook spokesperson indicated “It is wrong to suggest that we have ever asked Definers to pay for or write articles on Facebook’s behalf, or communicate anything untrue.”

On November 22, 2018, Sandberg acknowledged that work produced by Definers “was incorporated into materials presented to me and I received a small number of emails where Definers was referenced.”

On November 25, 2018, the founder of Six4Three, on a business trip to London, was compelled by Parliament to hand over documents relating to Facebook . Six4Three obtained these documents during the discovery process relating to an app developed by the startup that used image recognition to identify photos of women in bikinis shared on Facebook users’ friends’ pages. Reports indicate that Parliament sent an official to the founder’s hotel with a warning that noncompliance would result in possible fines or imprisonment. Despite the warning, the founder of the startup remained noncompliant, prompting him to be escorted to Parliament, where he turned over the documents.

A report in the New York Times published on November 29, 2018, indicates that Sheryl Sandberg personally asked Facebook communications staff in January to “research George Soros’s financial interests in the wake of his high-profile attacks on tech companies.”

On December 5, 2018, documents obtained in the probe of Six4Three were released by Parliament . Damian Collins, the MP who issued the order compelling the handover of the documents in November, highlighted six key points from the documents:

• Facebook entered into whitelisting agreements with Lyft, Airbnb, Bumble, and Netflix, among others, allowing those groups full access to friends data after Graph API v1 was discontinued. Collins indicates “It is not clear that there was any user consent for this, nor how Facebook decided which companies should be whitelisted or not.”
• According to Collins, “increasing revenues from major app developers was one of the key drivers behind the Platform 3.0 changes at Facebook. The idea of linking access to friends data to the financial value of the developers’ relationship with Facebook is a recurring feature of the documents.”
• Data reciprocity between Facebook and app developers was a central focus for the release of Platform v3, with Zuckerberg discussing charging developers for access to API access for friend lists.
• Internal discussions of changes to the Facebook Android app acknowledge that requesting permissions to collect calls and texts sent by the user would be controversial, with one project manager stating it was “a pretty high-risk thing to do from a PR perspective.”
• Facebook used data collected through Onavo, a VPN service the company acquired in 2013, to survey the use of mobile apps on smartphones. According to Collins, this occurred “apparently without [users’] knowledge,” and was used by Facebook to determine “which companies to acquire, and which to treat as a threat.”
• Collins contends that “the files show evidence of Facebook taking aggressive positions against apps, with the consequence that denying them access to data led to the failure of that business.” Documents disclosed specifically indicate Facebook revoked API access to video sharing service Vine.

In a statement , Facebook claimed, “Six4Three… cherrypicked these documents from years ago.” Zuckerberg responded separately to the public disclosure on Facebook, acknowledging, “Like any organization, we had a lot of internal discussion and people raised different ideas.” He called the Facebook scrutiny “healthy given the vast number of people who use our services,” but said it shouldn’t “misrepresent our actions or motives.”

On December 14, 2018, a vulnerability was disclosed in the Facebook Photo API that existed between September 13-25, 2018, exposing private photos of 6.8 million users. The Photo API bug affected people who use Facebook to log in to third-party services.

On December 18, 2018, The New York Times reported on special data sharing agreements that “[exempted] business partners from its usual privacy rules, naming Microsoft’s Bing search engine, Netflix, Spotify, Amazon, and Yahoo as partners in the report. Partners were capable of accessing data including friend lists and private messages, “despite public statements it had stopped that type of sharing years earlier.” Facebook claimed the data sharing was about “helping people,” and that this was not done without user consent.

On January 17, 2019, Facebook disclosed that it removed hundreds of pages and accounts controlled by Russian propaganda organization Sputnik, including accounts posing as politicians from primarily Eastern European countries.

On January 29, 2019, a TechCrunch report uncovered the “Facebook Research” program , which paid users aged 13 to 35 to receive up to $20 per month to install a VPN application similar to Onavo that allowed Facebook to gather practically all information about how phones were used. On iOS, this was distributed using Apple’s Developer Enterprise Program, for which Apple briefly revoked Facebook’s certificate as a result of the controversy .

Facebook initially indicated that “less than 5% of the people who chose to participate in this market research program were teens,” and on March 1, 2019 amended the statement to “about 18 percent.”

On February 7, 2019, the German antitrust office ruled that Facebook must obtain consent before collecting data on non-Facebook members, following a three-year investigation.

On February 20, 2019, Facebook added new location controls to its Android app that allows users to limit background data collection when the app is not in use .

The same day, ZDNet reported that Microsoft’s Edge browser contained a secret whitelist allowing Facebook to run Adobe Flash, bypassing the click-to-play policy that other websites are subject to for Flash objects over 398×298 pixels. The whitelist was removed in the February 2019 Patch Tuesday update.

On March 6, 2019, Zuckerberg announced a plan to rebuild services around encryption and privacy , “over the next few years.” As part of these changes, Facebook will make messages between Facebook, Instagram, and WhatsApp interoperable. Former Microsoft executive Steven Sinofsky –who was fired after the poor reception of Windows 8–called the move “fantastic,” comparing it to Microsoft’s Trustworthy Computing initiative in 2002.

CNET and CBS News Senior Producer Dan Patterson noted on CBSN that Facebook can benefit from this consolidation by making the messaging platforms cheaper to operate, as well as profiting from users sending money through the messaging platform, in a business model similar to Venmo.

On March 21, 2019, Facebook disclosed a lapse in security that resulted in hundreds of millions of passwords being stored in plain text, affecting users of Facebook, Facebook Lite, and Instagram. Facebook claimed that “these passwords were never visible to anyone outside of Facebook and we have found no evidence to date that anyone internally abused or improperly accessed them.”

Though Facebook’s post does not provide specifics, a report by veteran security reporter Brian Krebs claimed “between 200 million and 600 million” users were affected, and that “more than 20,000 Facebook employees” would have had access.

On March 22, 2019, a court filing by the attorney general of Washington DC alleged that Facebook knew about the Cambridge Analytica scandal months prior to the first public reports in December 2015. Facebook claimed that employees knew of rumors relating to Cambridge Analytica, but the claims relate to a “different incident” than the main scandal, and insisted that the company did not mislead anyone about the timeline of the scandal.

Facebook is seeking to have the case filed in Washington DC dismissed, as well as to seal a document filed in that case.

On March 31, 2019, The Washington Post published an op-ed by Zuckerberg calling for governments and regulators to take a “more active role” in regulating the internet. Shortly after, Facebook introduced a feature that explains why content is shown to users on their news feeds .

On April 3, 2019, over 540 million Facebook-related records were found on two improperly protected AWS servers . The data was collected by Cultura Colectiva, a Mexico-based online media platform, using Facebook APIs. Amazon deactivated the associated account at Facebook’s request.

On April 15, 2019, it was discovered that Oculus, a company owned by Facebook, shipped VR headsets with internal etchings including text such as “ Big Brother is Watching .”

On April 18, 2019, Facebook disclosed the “unintentional” harvesting of email contacts belonging to approximately 1.5 million users over the course of three years. Affected users were asked to provide email address credentials to verify their identity.

On April 30, 2019, at Facebook’s F8 developer conference , the company unveiled plans to overhaul Messenger and re-orient Facebook to prioritize Groups instead of the timeline view, with Zuckerberg declaring “The future is private.”

On May 9, 2019, Facebook co-founder Chris Hughes called for Facebook to be broken up by government regulators, in an editorial in The New York Times. Hughes, who left the company in 2007, cited concerns that Zuckerberg has surrounded himself with people who do not challenge him . “We are a nation with a tradition of reining in monopolies, no matter how well-intentioned the leaders of these companies may be. Mark’s power is unprecedented and un-American,” Hughes said.

Proponents of a Facebook breakup typically point to unwinding the social network’s purchase of Instagram and WhatsApp.

Zuckerberg dismissed Hughes’ appeal for a breakup in comments to France 2, stating in part that “If what you care about is democracy and elections, then you want a company like us to invest billions of dollars a year, like we are, in building up really advanced tools to fight election interference.”

On May 24, 2019, a report from Motherboard claimed “multiple” staff members of Snapchat used internal tools to spy on users .

On July 8, 2019, Apple co-founder Steve Wozniak warned users to get off of Facebook .

On July 18, 2019, lawmakers in a House Committee on Financial Services hearing expressed mistrust of Facebook’s Libra cryptocurrency plan due to its “pattern of failing to keep consumer data private.” Lawmakers had previously issued a letter to Facebook requesting the company pause development of the project.

On July 24, 2019, the FTC announced a $5 billion settlement with Facebook over user privacy violations. Facebook agreed to conduct an overhaul of its consumer privacy practices as part of the settlement. Access to friend data by Sony and Facebook was “immediately” restricted as part of this settlement, according to CNET. Separately, the FTC settled with Aleksandr Kogan and former Cambridge Analytica CEO Alexander Nix , “restricting how they conduct any business in the future, and requiring them to delete or destroy any personal information they collected.” The FTC announced a lawsuit against Cambridge Analytica the same day.

Also on July 24, 2019, Netflix released “The Great Hack,” a documentary about the Cambridge Analytica scandal .

In early July, 2020, Facebook admitted to sharing user data with an estimated 5,000 third-party developers after it access to that data was supposed to expire.

Zuckerberg testified before Congress again on July 29, 2020, as part of an antitrust hearing that included Amazon’s Jeff Bezos, Apple’s Tim Cook, and Google’s Sundar Pichai . The hearing didn’t touch on Facebook’s data privacy scandal, and was instead focused on Facebook’s purchase of Instagram and WhatsApp , as well as its treatment of other competing services.

• Facebook knew of illicit user profile harvesting for 2 years, never acted (CBS News)
• Facebook’s FTC consent decree deal: What you need to know (CNET)
• Australia’s Facebook investigation expected to take at least 8 months (ZDNet)
• Election tech: The truth about Cambridge Analytica’s political big data (TechRepublic)
• Google sued by ACCC for allegedly linking data for ads without consent (ZDNet)
• Midterm elections, social media and hacking: What you need to know (CNET)
• Critical flaw revealed in Facebook Fizz TLS project (ZDNet)
• CCPA: What California’s new privacy law means for Facebook, Twitter users (CNET)

What are the key companies involved in the Facebook data privacy scandal?

In addition to Facebook, these are the companies connected to this data privacy story.

SCL Group (formerly Strategic Communication Laboratories) is at the center of the privacy scandal, though it has operated primarily through subsidiaries. Nominally, SCL was a behavioral research/strategic communication company based in the UK. The company was dissolved on May 1, 2018.

Cambridge Analytica and SCL USA are offshoots of SCL Group, primarily operating in the US. Registration documentation indicates the pair formally came into existence in 2013. As with SCL Group, the pair were dissolved on May 1, 2018.

Global Science Research was a market research firm based in the UK from 2014 to 2017. It was the originator of the thisisyourdigitiallife app. The personal data derived from the app (if not the app itself) was sold to Cambridge Analytica for use in campaign messaging.

Emerdata is the functional successor to SCL and Cambridge Analytica. It was founded in August 2017, with registration documents listing several people associated with SCL and Cambridge Analytica, as well as the same address as that of SCL Group’s London headquarters.

AggregateIQ is a Canadian consulting and technology company founded in 2013. The company produced Ripon, the software platform for Cambridge Analytica’s political campaign work, which leaked publicly after being discovered in an unprotected GitLab bucket .

Cubeyou is a US-based data analytics firm that also operated surveys on Facebook, and worked with Cambridge University from 2013 to 2015. It was suspended from Facebook in April 2018 following a CNBC report .

Six4Three was a US-based startup that created an app that used image recognition to identify photos of women in bikinis shared on Facebook users’ friends’ pages. The company sued Facebook in April 2015, when the app became inoperable after access to this data was revoked when the original version of Facebook’s Graph API was discontinued .

Onavo is an analytics company that develops mobile apps. They created Onavo Extend and Onavo Protect, which are VPN services for data protection and security, respectively. Facebook purchased the company in October 2013 . Data from Onavo is used by Facebook to track usage of non-Facebook apps on smartphones .

The Internet Research Agency is a St. Petersburg-based organization with ties to Russian intelligence services. The organization engages in politically-charged manipulation across English-language social media, including Facebook.

• If your organization advertises on Facebook, beware of these new limitations (TechRepublic)
• Data breach exposes Cambridge Analytica’s data mining tools (ZDNet)
• Was your business’s Twitter feed sold to Cambridge Analytica? (TechRepublic)
• US special counsel indicts 13 members of Russia’s election meddling troll farm (ZDNet)

Who are the key people involved in the Facebook data privacy scandal?

Nigel Oakes is the founder of SCL Group, the parent company of Cambridge Analytica. A report from Buzzfeed News unearthed a quote from 1992 in which Oakes stated, “We use the same techniques as Aristotle and Hitler. … We appeal to people on an emotional level to get them to agree on a functional level.”

Alexander Nix was the CEO of Cambridge Analytica and a director of SCL Group. He was suspended following reports detailing a video in which Nix claimed the company “offered bribes to smear opponents as corrupt,” and that it “campaigned secretly in elections… through front companies or using subcontractors.”

Robert Mercer is a conservative activist, computer scientist, and a co-founder of Cambridge Analytica. A New York Times report indicates that Mercer invested $15 million in the company. His daughters Jennifer Mercer and Rebekah Anne Mercer serve as directors of Emerdata.

Christopher Wylie is the former director of research at Cambridge Analytica. He provided information to The Guardian for its exposé of the Facebook data privacy scandal. He has since testified before committees in the US and UK about Cambridge Analytica’s involvement in this scandal.

Steve Bannon is a co-founder of Cambridge Analytica, as well as a founding member and former executive chairman of Breitbart News, an alt-right news outlet. Breitbart News has reportedly received funding from the Mercer family as far back as 2010. Bannon left Breitbart in January 2018. According to Christopher Wylie, Bannon is responsible for testing phrases such as “ drain the swamp ” at Cambridge Analytica, which were used extensively on Breitbart.

Aleksandr Kogan is a Senior Research Associate at Cambridge University and co-founder of Global Science Research, which created the data harvesting thisisyourdigitiallife app. He worked as a researcher and consultant for Facebook in 2013 and 2015. Kogan also received Russian government grants and is an associate professor at St. Petersburg State University, though he claims this is an honorary role .

Joseph Chancellor was a co-director of Global Science Research, which created the data harvesting thisisyourdigitiallife app. Around November 2015, he was hired by Facebook as a “quantitative social psychologist.” A spokesperson indicated on September 6, 2018, that he was no longer employed by Facebook.

Michal Kosinski , David Stillwell , and Thore Graepel are the researchers who proposed and developed the model to “psychometrically” analyze users based on their Facebook likes. At the time this model was published, Kosinski and Stillwell were affiliated with Cambridge University, while Graepel was affiliated with the Cambridge-based Microsoft Research. (None have an association with Cambridge Analytica, according to Cambridge University .)

Mark Zuckerberg is the founder and CEO of Facebook. He founded the website in 2004 from his dorm room at Harvard.

Sheryl Sandberg is the COO of Facebook. She left Google to join the company in March 2008. She became the eighth member of the company’s board of directors in 2012 and is the first woman in that role.

Damian Collins is a Conservative Party politician based in the United Kingdom. He currently serves as the Chair of the House of Commons Culture, Media and Sport Select Committee. Collins is responsible for issuing orders to seize documents from the American founder of Six4Three while he was traveling in London, and releasing those documents publicly.

Chris Hughes is one of four Facebook co-founders, who originally took on beta testing and feedback for the website, until leaving in 2007. Hughes is the first to call for Facebook to be broken up by regulators.

• Facebook investigates employee’s ties to Cambridge Analytica (CBS News)
• Aleksandr Kogan: The link between Cambridge Analytica and Facebook (CBS News)
• Video: Cambridge Analytica shuts down following data scandal (CBS News)

How have Facebook and Mark Zuckerberg responded to the data privacy scandal?

Each time Facebook finds itself embroiled in a privacy scandal, the general playbook seems to be the same: Mark Zuckerberg delivers an apology, with oft-recycled lines, such as “this was a big mistake,” or “I know we can do better.” Despite repeated controversies regarding Facebook’s handling of personal data, it has continued to gain new users. This is by design–founding president Sean Parker indicated at an Axios conference in November 2017 that the first step of building Facebook features was “How do we consume as much of your time and conscious attention as possible?” Parker also likened the design of Facebook to “exploiting a vulnerability in human psychology.”

On March 16, 2018, Facebook announced that SCL and Cambridge Analytica had been banned from the platform. The announcement indicated, correctly, that “Kogan gained access to this information in a legitimate way and through the proper channels that governed all developers on Facebook at that time,” and passing the information to a third party was against the platform policies.

The following day, the announcement was amended to state:

The claim that this is a data breach is completely false. Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent. People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked.

On March 21, 2018, Mark Zuckerberg posted his first public statement about the issue, stating in part that:

“We have a responsibility to protect your data, and if we can’t then we don’t deserve to serve you. I’ve been working to understand exactly what happened and how to make sure this doesn’t happen again.”

On March 26, 2018, Facebook placed full-page ads stating : “This was a breach of trust, and I’m sorry we didn’t do more at the time. We’re now taking steps to ensure this doesn’t happen again,” in The New York Times, The Washington Post, and The Wall Street Journal, as well as The Observer, The Sunday Times, Mail on Sunday, Sunday Mirror, Sunday Express, and Sunday Telegraph in the UK.

In a blog post on April 4, 2018, Facebook announced a series of changes to data handling practices and API access capabilities. Foremost among these include limiting the Events API, which is no longer able to access the guest list or wall posts. Additionally, Facebook removed the ability to search for users by phone number or email address and made changes to the account recovery process to fight scraping.

On April 10, 2018, and April 11, 2018, Mark Zuckerberg testified before Congress. Details about his testimony are in the next section of this article.

On April 10, 2018, Facebook announced the launch of its data abuse bug bounty program. While Facebook has an existing security bug bounty program, this is targeted specifically to prevent malicious users from engaging in data harvesting. There is no limit to how much Facebook could potentially pay in a bounty, though to date the highest amount the company has paid is $40,000 for a security bug.

On May 14, 2018, “around 200” apps were banned from Facebook as part of an investigation into if companies have abused APIs to harvest personal information. The company declined to provide a list of offending apps.

On May 22, 2018, Mark Zuckerberg testified, briefly, before the European Parliament about the data privacy scandal and Cambridge Analytica. The format of the testimony has been the subject of derision, as all of the questions were posed to Zuckerberg before he answered. Guy Verhofstadt, an EU Parliament member representing Belgium, said , “I asked you six ‘yes’ and ‘no’ questions, and I got not a single answer.”

What did Mark Zuckerberg say in his testimony to Congress?

In his Senate testimony on April 10, 2018, Zuckerberg reiterated his apology, stating that “We didn’t take a broad enough view of our responsibility, and that was a big mistake. And it was my mistake. And I’m sorry. I started Facebook, I run it, and I’m responsible for what happens here,” adding in a response to Sen. John Thune that “we try not to make the same mistake multiple times.. in general, a lot of the mistakes are around how people connect to each other, just because of the nature of the service.”

Sen. Amy Klobuchar asked if Facebook had determined whether Cambridge Analytica and the Internet Research Agency were targeting the same users. Zuckerberg replied, “We’re investigating that now. We believe that it is entirely possible that there will be a connection there.” According to NBC News , this was the first suggestion there is a link between the activities of Cambridge Analytica and the Russian disinformation campaign.

On June 11, 2018, nearly 500 pages of new testimony from Zuckerberg was released following promises of a follow-up to questions for which he did not have sufficient information to address during his Congressional testimony. The Washington Post notes that the release, “in some instances sidestepped lawmakers’ questions and concerns,” but that the questions being asked were not always relevant, particularly in the case of Sen. Ted Cruz, who attempted to bring attention to Facebook’s donations to political organizations, as well as how Facebook treats criticism of “Taylor Swift’s recent cover of an Earth, Wind and Fire song.”

• Facebook gave Apple, Samsung access to data about users — and their friends (CNET)
• Zuckerberg doubles down on Facebook’s fight against fake news, data misuse (CNET)
• Tech execs react to Mark Zuckerberg’s apology: “I think he’s sorry he has to testify” (CBS News)
• On Facebook, Zuckerberg gets privacy and you get nothing (ZDNet)
• 6 Facebook security mistakes to fix on Data Privacy Day (CNET)
• Zuckerberg takes Facebook data apology tour to Washington (CNET)
• Zuckerberg’s Senate hearing highlights in 10 minutes (CNET via YouTube)
• Russian politicians call on Facebook’s Mark Zuckerberg to testify on privacy (CNET)

What is the 2016 US presidential election connection to the Facebook data privacy scandal?

In December 2015, The Guardian broke the story of Cambridge Analytica being contracted by Ted Cruz’s campaign for the Republican Presidential Primary. Despite Cambridge Analytica CEO Alexander Nix’s claim i n an interview with TechRepublic that the company is “fundamentally politically agnostic and an apolitical organization,” the primary financier of the Cruz campaign is Cambridge Analytica co-founder Robert Mercer, who donated $11 million to a pro-Cruz Super PAC. Following Cruz’s withdrawal from the campaign in May 2016, the Mercer family began supporting Donald Trump.

In January 2016, Facebook COO Sheryl Sandberg told investors that the election was “a big deal in terms of ad spend,” and that through “using Facebook and Instagram ads you can target by congressional district, you can target by interest, you can target by demographics or any combination of those.”

In October 2017, Facebook announced changes to its advertising platform, requiring identity and location verification and prior authorization in order to run electoral advertising. In the wake of the fallout from the data privacy scandal, further restrictions were added in April 2018, making “issue ads” regarding topics of current interest similarly restricted .

In secretly recorded conversations by an undercover team from Channel 4 News, Cambridge Analytica’s Nix claimed the firm was behind the “defeat crooked Hillary” advertising campaign, adding, “We just put information into the bloodstream of the internet and then watch it grow, give it a little push every now and again over time to watch it take shape,” and that “this stuff infiltrates the online community, but with no branding, so it’s unattributable, untrackable.” The same exposé quotes Chief Data Officer Alex Tayler as saying, “When you think about the fact that Donald Trump lost the popular vote by 3 million votes but won the electoral college vote, that’s down to the data and the research.”

• How Cambridge Analytica used your Facebook data to help elect Trump (ZDNet)
• Facebook takes down fake accounts operated by ‘Roger Stone and his associates’ (ZDNet)
• Facebook, Cambridge Analytica and data mining: What you need to know (CNET)
• Civil rights auditors slam Facebook stance on Trump, voter suppression (ZDNet)
• The Trump campaign app is tapping a “gold mine” of data about Americans (CBS News)

What is the Brexit tie-in to the Facebook data privacy scandal?

AggregateIQ was retained by Nigel Farage’s Vote Leave organization in the Brexit campaign , and both The Guardian and BBC claim that the Canadian company is connected to Cambridge Analytica and its parent organization SCL Group. UpGuard, the organization that found a public GitLab instance with code from AggregateIQ, has extensively detailed its connection to Cambridge Analytica and its involvement in Brexit campaigning .

Additionally, The Guardian quotes Wylie as saying the company “was set up as a Canadian entity for people who wanted to work on SCL projects who didn’t want to move to London.”

• Brexit: A cheat sheet (TechRepublic)
• Facebook suspends another data analytics firm, AggregateIQ (CBS News)
• Lawmakers grill academic at heart of Facebook scandal (CBS News)

How is Facebook affected by the GDPR?

Like any organization providing services to users in European Union countries, Facebook is bound by the EU General Data Protection Regulation ( GDPR ). Due to the scrutiny Facebook is already facing regarding the Cambridge Analytica scandal, as well as the general nature of the social media giant’s product being personal information, its strategy for GDPR compliance is similarly receiving a great deal of focus from users and other companies looking for a model of compliance.

While in theory the GDPR is only applicable to people residing in the EU, Facebook will require users to review their data privacy settings. According to a ZDNet article , Facebook users will be asked if they want to see advertising based on partner information–in practice, websites that feature Facebook’s “Like” buttons. Users globally will be asked if they wish to continue sharing political, religious, and relationship information, while users in Europe and Canada will be given the option of switching automatic facial recognition on again.

Facebook members outside the US and Canada have heretofore been governed by the company’s terms of service in Ireland. This has reportedly been changed prior to the start of GDPR enforcement, as this would seemingly make Facebook liable for damages for users internationally, due to Ireland’s status as an EU member.

• Google, Facebook hit with serious GDPR complaints: Others will be soon (ZDNet)
• Facebook rolls out changes to comply with new EU privacy law (CBS News)
• European court strikes down EU-US Privacy Shield user data exchange agreement as invalid (ZDNet)
• GDPR security pack: Policies to protect data and achieve compliance (TechRepublic Premium)
• IT pro’s guide to GDPR compliance (free PDF) (TechRepublic)

What are Facebook “shadow profiles?”

“Shadow profiles” are stores of information that Facebook has obtained about other people–who are not necessarily Facebook users. The existence of “shadow profiles” was discovered as a result of a bug in 2013. When a user downloaded their Facebook history, that user would obtain not just his or her address book, but also the email addresses and phone numbers of their friends that other people had stored in their address books.

Facebook described the issue in an email to the affected users. This is an excerpt of the email, according to security site Packet Storm:

When people upload their contact lists or address books to Facebook, we try to match that data with the contact information of other people on Facebook in order to generate friend recommendations. Because of the bug, the email addresses and phone numbers used to make friend recommendations and reduce the number of invitations we send were inadvertently stored in their account on Facebook, along with their uploaded contacts. As a result, if a person went to download an archive of their Facebook account through our Download Your Information (DYI) tool, which included their uploaded contacts, they may have been provided with additional email addresses or telephone numbers.

Because of the way that Facebook synthesizes data in order to attribute collected data to existing profiles, data of people who do not have Facebook accounts congeals into dossiers, which are popularly called a “shadow profile.” It is unclear what other sources of input are added to said “shadow profiles,” a term that Facebook does not use, according to Zuckerberg in his Senate testimony.

• Shadow profiles: Facebook has information you didn’t hand over (CNET)
• Finally, the world is getting concerned about data privacy (TechRepublic)
• Firm: Facebook’s shadow profiles are ‘frightening’ dossiers on everyone (ZDNet)

What are the possible implications for enterprises and business users?

Business users and business accounts should be aware that they are as vulnerable as consumers to data exposure. Because Facebook harvests and shares metadata–including SMS and voice call records–between the company’s mobile applications, business users should be aware that their risk profile is the same as a consumer’s. The stakes for businesses and employees could be higher, given that incidental or accidental data exposure could expose the company to liability, IP theft, extortion attempts, and cybercriminals.

Though deleting or deactivating Facebook applications won’t prevent the company from creating so-called advertising “shadow profiles,” it will prevent the company from capturing geolocation and other sensitive data. For actional best practices, contact your company’s legal counsel.

• Social media policy (TechRepublic Premium)
• Want to attain and retain customers? Adopt data privacy policies (TechRepublic)
• Hiring kit: Digital campaign manager (TechRepublic Premium)
• Photos: All the tech celebrities and brands that have deleted Facebook (TechRepublic)

How can I change my Facebook privacy settings?

According to Facebook, in 2014 the company removed the ability for apps that friends use to collect information about an individual user. If you wish to disable third-party use of Facebook altogether–including Login With Facebook and apps that rely on Facebook profiles such as Tinder–this can be done in the Settings menu under Apps And Websites. The Apps, Websites And Games field has an Edit button–click that, and then click Turn Off.

Facebook has been proactively notifying users who had their data collected by Cambridge Analytica, though users can manually check to see if their data was shared by going to this Facebook Help page .

Facebook is also developing a Clear History button, which the company indicates is “their database record of you.” CNET and CBS News Senior Producer Dan Patterson noted on CBSN that “there aren’t a lot of specifics on what that clearing of the database will do, and of course, as soon as you log back in and start creating data again, you set a new cookie and you start the process again.”

To gain a better understanding of how Facebook handles user data, including what options can and cannot be modified by end users, it may be helpful to review Facebook’s Terms of Service , as well as its Data Policy and Cookies Policy .

• Ultimate guide to Facebook privacy and security (Download.com)
• Facebook’s new privacy tool lets you manage how you’re tracked across the web (CNET)
• Securing Facebook: Keep your data safe with these privacy settings (ZDNet)
• How to check if Facebook shared your data with Cambridge Analytica (CNET)

Note: This article was written and reported by James Sanders and Dan Patterson. It was updated by Brandon Vigliarolo.

Subscribe to the Cybersecurity Insider Newsletter

Strengthen your organization's IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays

Create a TechRepublic Account

Get the web's best business technology news, tutorials, reviews, trends, and analysis—in your inbox. Let's start with the basics.

* - indicates required fields

Sign in to TechRepublic

Lost your password? Request a new password

Reset Password

Please enter your email adress. You will receive an email message with instructions on how to reset your password.

Check your email for a password reset link. If you didn't receive an email don't forgot to check your spam folder, otherwise contact support .

Welcome. Tell us a little bit about you.

This will help us provide you with customized content.

Want to receive more TechRepublic news?

You're all set.

Thanks for signing up! Keep an eye out for a confirmation email from our team. To ensure any newsletters you subscribed to hit your inbox, make sure to add [email protected] to your contacts list.

Award winner: Facebook-Cambridge Analytica Data Scandal

This case won the Ethics and Social Responsibility  category at The Case Centre Awards and Competitions 2024 . #CaseAwards2024

Author perspective

Instructor viewpoint, who – the protagonist.

Mark Zuckerberg, founder and CEO of social networking giant Facebook.

This case follows the public anger that erupted when news broke in March 2018 that the personal information of 87 million Facebook users had been accessed inappropriately by a British consulting firm, Cambridge Analytica, to create targeted political advertising during the election campaign of US president, Donald Trump.  

The scandal was the latest in a long line of data related incidents and public trust in Facebook and CEO Zuckerberg was at an all-time low. The #DeleteFacebook movement was sweeping the internet and the company’s share value declined sharply, falling 17% in two days which amounted to approximately US$90 billion in market value. The company was also facing multiple lawsuits filed against it by users and shareholders and much criticism among analysts that it could have acted sooner and more pro-actively in protecting users’ privacy. 

Facebook, now known as Meta , is headquartered in California, United States but has users across the world.

The case is set in the wake of the Cambridge Analytica scandal in March 2018, and follows the history of Facebook from its inception in 2004 to becoming one of the world’s most popular social networking sites.

Facebook needed to regain the trust of its users and redeem its reputation going forward. Although Zuckerberg apologised for the ‘major breach of trust’ the question remained, was that enough to reassure users and shareholders?

AUTHOR PERSPECTIVE 

This is the third award win for Syeda, who has previously won Outstanding Case Writer in 2019 and the Knowledge, Information and Communication Systems Management award in 2021, and the first win for Geeta. ICFAI Business School have now won 19 awards and this is the second time they have won the Ethics and Social Responsibility.

Winning the award

Geeta and Syeda said: “It is always an honour to win a prestigious award from The Case Centre!  We are glad that our case was adopted by many business schools worldwide. The impact of the Ethics and Social Responsibility category is far-reaching as it shapes the values, decision-making abilities, and leadership qualities of future business professionals.”

Case popularity

They explained: “The case deals with the highly topical issue of customer data privacy and protection and ethical business practices. Broadly, it allows instructors to bring ethical issues related to data breaches to the classroom and prepares students to speak up when confronted with such dilemmas. 

“We think this case has been so popular because it stimulates rich classroom discussions, triggers students’ analytical and problem-solving capabilities, and makes them apply their theoretical expertise in practice by presenting a real public relations crisis scenario.” 

Writing the case

Geeta and Syeda reflected: “One of the challenges was describing how the scandal was perpetrated without becoming too biased towards any entity. Writing this case required meticulous planning where we had to keep an open mind, conduct thorough research and present the ethical issues arising out of the data breach scandal clearly.” 

Case writing advice

They commented: “To begin with, a case has to have a hook, an overriding managerial issue or decision that requires immediate attention. It should create a strong and interesting learning experience for students by including contentious issues and multiple perspectives. This can be challenging as the writer needs to explore various theoretical sources and integrate his/her ideas well.  

“End the case with a decision-making scenario where students could use their analytical skills to conclude their recommendations.”

Teaching the case

Geeta and Syeda reflected: “The case works well in the classroom as it explores the causes of organisational misconduct, ethical business practices and cyber security issues. The case resonates well with students as Facebook is the most popular social media platform worldwide. 

“We observed great interest among students to learn and explore the ethical issues arising out of the data breach scandal.” 

They added: “If you are looking for a follow-up case on data breaches, check out the Data Security Breach at Virgin Media case which helps students understand the importance of information security systems in organisations and the issues arising out of a data security breach.”

INSTRUCTOR VIEWPOINT 

Discover how this case works in the classroom.

The authors

The protagonist

Educators can login to view a free educator preview copy of this case.

View all the 2024 winners

Don't miss a thing - join our case community today.

Benefits include: lower prices for teaching materials, a 50% discount on Learning with Cases: An Interactive Study Guide , royalties on case sales, free attendance at the annual Members' Case Forum, discounted case workshop places and much more!

Discover more

• International edition
• Australia edition
• Europe edition

Facebook-Cambridge Analytica data breach lawsuit ends in 11th hour settlement

Dramatic move shows Mark Zuckerberg ‘desperate to avoid being questioned over cover-up’, says Observer journalist who exposed scandal

Facebook has dramatically agreed to settle a lawsuit seeking damages for allowing Cambridge Analytica access to the private data of tens of millions of users, four years after the Observer exposed the scandal that mired the tech giant in repeated controversy.

A court filing reveals that Meta, Facebook’s parent company, has in principle settled for an undisclosed sum a long-running lawsuit that claimed Facebook illegally shared user data with the UK analysis firm.

It follows revelations of mass data misuse made by a Cambridge Analytica whistleblower to the Observer in 2018, an exposé that forced chief executive Mark Zuckerberg to testify before Congress and led to the social media firm receiving a multibillion-pound fine. Days after the story was published, Facebook’s share price fell by the equivalent of more than $100bn.

However, some expressed dismay that the timing of the potential settlement would prevent Zuckerberg and Meta’s outgoing chief operating officer, Sheryl Sandberg, being made to testify during up to six hours of questioning by plaintiffs’ lawyers next month.

Carole Cadwalladr, the Observer journalist whose investigations into Facebook and Cambridge Analytica also helped inspire the Netflix film The Great Hack , said: “It is a measure of how desperate Zuckerberg is to avoid answering questions about Facebook’s cover-up of the Cambridge Analytica data breach that Facebook has settled this case just days away from him being cross-examined under oath for six hours.”

It emerged that Zuckerberg and Sandberg, who recently announced she would be stepping down in the autumn , would face questioning, with the depositions scheduled to take place from 20 September.

The latest developments follow a separate lawsuit last year that claimed Facebook paid $4.9bn more than necessary to the US Federal Trade Commission (FTC) in a settlement over the Cambridge Analytica scandal in order to protect Zuckerberg.

The lawsuit alleged that the size of the $5bn settlement was motivated by a desire to prevent Facebook’s founder from being named in the FTC complaint.

Cadwalladr added: “Facebook has proved that they are prepared to pay almost any sum of money to avoid their executives answering these questions. This settlement comes on top of the $5bn they already paid the FTC.

“The truth will come out one day – but today is not that day.”

In the new court filing, disclosed late on Friday, financial terms or details of the preliminary settlement are not given.

The Observer asked Facebook and its lawyers to share more details of the in-principle settlement but it declined to respond.

However, the filing does ask the judge in the San Francisco federal court to put the class action lawsuit on hold for 60 days until the lawyers for both plaintiffs and Facebook finalise a written settlement.

The four-year-old lawsuit, brought by a group of Facebook users, alleged that Facebook violated consumer privacy laws by sharing personal data of users with other firms such as Cambridge Analytica , which declared itself bankrupt two months after the Observer exposé.

Facebook users sued the company in 2018 after it emerged the British analytics firm connected to former US president Donald Trump’s successful 2016 campaign for the White House gained access to the data of as many as 87 million of the social media network’s subscribers.

It was thought that Meta could have been made to pay hundreds of millions of dollars had it lost the case.

Facebook has previously said its privacy practices are consistent with its disclosures and “do not support any legal claims”.

• The Observer
• Social networking
• Cambridge Analytica
• Mark Zuckerberg

Most viewed

To revisit this article, visit My Profile, then View saved stories .

• Backchannel
• Newsletters
• WIRED Insider
• WIRED Consulting

Louise Matsakis Issie Lapowsky

Everything We Know About Facebook's Massive Security Breach

Facebook’s privacy problems severely escalated Friday when the social network disclosed that an unprecedented security issue, discovered September 25, impacted almost 50 million user accounts. Unlike the Cambridge Analytica scandal, in which a third-party company erroneously accessed data that a then-legitimate quiz app had siphoned up, this vulnerability allowed attackers to directly take over user accounts.

The bugs that enabled the attack have since been patched, according to Facebook. The company says that the attackers could see everything in a victim's profile, although it's still unclear if that includes private messages or if any of that data was misused. As part of that fix, Facebook automatically logged out 90 million Facebook users from their accounts Friday morning, accounting both for the 50 million that Facebook knows were affected, and an additional 40 million that potentially could have been. Later Friday, Facebook also confirmed that third-party sites that those users logged into with their Facebook accounts could also be affected .

Facebook says that affected users will see a message at the top of their News Feed about the issue when they log back into the social network. "Your privacy and security are important to us," the update reads. "We want to let you know about recent action we've taken to secure your account." The message is followed by a prompt to click and learn more details. If you were not logged out but want to take extra security precautions, you can check this page to see the places where your account is currently logged in, and log them out.

Facebook has yet to identify the hackers, or where they may have originated. “We may never know,” Guy Rosen, Facebook’s vice president of product, said on a call with reporters Friday. The company is now working with the Federal Bureau of Investigation to identify the attackers. A Taiwanese hacker named Chang Chi-yuan had earlier this week promised to live-stream the deletion of Mark Zuckerberg's Facebook account, but Rosen said Facebook was "not aware that that person was related to this attack."

“If the attacker exploited custom and isolated vulnerabilities, and the attack was a highly targeted one, there simply might be no suitable trace or intelligence allowing investigators to connect the dots,” says Lukasz Olejnik, a security and privacy researcher and member of the W3C Technical Architecture Group.

On the same call, Facebook CEO Mark Zuckerberg reiterated previous statements he has made about security being an “arms race.”

“This is a really serious security issue, and we’re taking it really seriously,” he said. “I’m glad that we found this, and we were able to fix the vulnerability and secure the accounts, but it definitely is an issue that it happened in the first place.”

The social network says its investigation into the breach began on September 16, when it saw an unusual spike in users accessing Facebook. On September 25, the company’s engineering team discovered that hackers appear to have exploited a series of bugs related to a Facebook feature that lets people see what their own profile looks like to someone else. The " View As " feature is designed to allow users to experience how their privacy settings look to another person.

The first bug prompted Facebook's video upload tool to mistakenly show up on the "View As" page. The second one caused the uploader to generate an access token—what allows you to remain logged into your Facebook account on a device, without having to sign in every time you visit—that had the same sign-in permissions as the Facebook mobile app. Finally, when the video uploader did appear in "View As" mode, it triggered an access code for whoever the hacker was searching for.

Aarian Marshall

Sofia Barnett

Vittoria Elliott

Eric Geller

“This is a complex interaction of multiple bugs,” Rosen said, adding that the hackers likely required some level of sophistication.

That also explains Friday morning's logouts; they served to reset the access tokens of both those directly affected and any additional accounts “that have been subject to a View As look-up” in the last year, Rosen said. Facebook has temporarily turned off "View As," as it continues to investigate the issue.

“It’s easy to say that security testing should have caught this, but these types of security vulnerabilities can be extremely difficult to spot or catch since they rely on having to dynamically test the site itself as it’s running,” says David Kennedy, the CEO of the cybersecurity firm TrustedSec.

The vulnerability couldn’t have come at a worse time for Facebook, whose executives are still reeling from a series of scandals that unfolded in the wake of the 2016 US presidential election. A widespread Russian disinformation campaign leveraged the platform unnoticed, followed by revelations that third-party companies like Cambridge Analytica had collected user data without their knowledge.

The social network already faces multiple federal investigations into its privacy and data-sharing practices, including one probe by the Federal Trade Commission and another conducted by the Securities and Exchange Commission. Both have to do with its disclosures around Cambridge Analytica.

It also faces the specter of more aggressive regulation from Congress, on the heels of a series of occasionally contentious hearings about data privacy. After Facebook’s announcement Friday, Senator Mark Warner (D-Virginia), who serves as vice chairman of the Senate Intelligence Committee, called for a “full investigation” into the breach. “Today’s disclosure is a reminder about the dangers posed when a small number of companies like Facebook or the credit bureau Equifax are able to accumulate so much personal data about individual Americans without adequate security measures,” Warner said in a statement. “This is another sobering indicator that Congress needs to step up and take action to protect the privacy and security of social media users.”

Facebook may also face unprecedented scrutiny in Europe, where the new General Data Protection Regulation , or GDPR, requires companies to disclose a breach to a European agency within 72 hours of it occurring. In cases of high risk to users, the regulation also requires that they be notified directly. Facebook says it has notified the Irish Data Protection Commission about the issue.

This is the second security vulnerability that Facebook has disclosed in recent months. In June, the company announced it had discovered a bug that made up to 14 million people’s posts publicly viewable to anyone for days. This is the first time in Facebook’s history, though, that users’ entire accounts may have been compromised by outside hackers. Its response to this vulnerability—and the speed and comprehensiveness of the important disclosures ahead—will likely be of serious importance. Once again, all eyes are on Mark Zuckerberg.

Additional reporting by Lily Hay Newman.

• Everyone wants to go to the moon— logic be damned
• College Humor gives comedy subscription a serious effort
• Tips to get the most out of Screen Time controls on iOS 12
• Tech disrupted everything. Who's shaping the future ?
• An oral history of Apple's Infinite Loop
• Looking for more? Sign up for our daily newsletter and never miss our latest and greatest stories

Andy Greenberg

David Nield

Matt Burgess

Dell Cameron

Facebook stealing data

Over the past week or so, I have seen countless  headlines regarding Facebook and Cambridge Analytica . Yet, none of them have helped me fully understand what happened. On a basic sense I knew that my, and many other  Facebook users, data was being misused . But after reading every article, I still felt like I didn’t understand the gravity of it–or the facts surrounding the scandal.

After School Tutoring Persists Despite “Double-Reduction” Policy

Hung Nguyen and Haoxin Feng

In this piece, Hung Nguyen and Haoxin Feng investigate how the “Double -Reduction” policy — instituted two years ago to reduce Chinese students’ excessive homework and after-school tutoring — continues to be flagrantly flaunted around the country. And his time, in the school system itself…

In early 2018, the Cambridge Analytica scandal erupted, casting a long shadow over Facebook’s handling of user data. The incident not only sparked global debates over privacy rights but also prompted a reevaluation of data security measures across the digital landscape.

Cambridge Analytica, a political consulting firm, accessed the data of approximately 87 million Facebook users without their consent. This data was purportedly used to influence voter behavior in the 2016 U.S. presidential election and other political campaigns. The breach was facilitated through a seemingly harmless personality quiz app, which collected personal data from not only those who used the app but also from their Facebook friends.

The revelation of the data breach led to widespread outrage among the public and regulators. Facebook faced significant backlash, both in terms of public trust and financial implications. The scandal highlighted the vulnerabilities inherent in the social media platform’s data privacy policies and the broader implications for data security in the tech industry.

In response to the scandal, regulatory bodies around the world heightened their scrutiny of data practices among tech giants. The European Union’s General Data Protection Regulation (GDPR), which came into effect shortly after the scandal was revealed, underscored the shift towards more stringent data protection standards. Meanwhile, in the United States, Facebook was subjected to a $5 billion fine by the Federal Trade Commission (FTC) for its privacy lapses.

University students who have been through public high schools in China and prepared for the rigorous “Gaokao,” (高考)the Chinese college entrance exam, in the last several years say that the number of high school students taking these extra – and theoretically banned – classes remain high in the education system.

Zihan Chen, Xiaotong Zha and Peixin Li, three DKU students and recent high school graduates, all agreed that 70 to 80% of their friends attended additional tutoring hours at their public high schools in different provinces, suggesting the popularity of the services despite the government ban. “Schools offering extra classes has become a new norm. Classes run after official school hours. We had these lessons every day,” Li shared. Lessons seem to be offered at no additional cost in the form of complementary but compulsory self-study sessions under teachers’ supervision. Some high schools in Suzhou have even asked students to attend school and take exams every Sunday.

This extended service, which aims at providing academic support and enhancing students’ grades through self-directed learning sessions, serves as an alternative to private tutoring. Oftentimes, students are required to stay for over two hours after regular classes to complete daily homework and attend regular assessments. When questioned about the continued provision of extra classes despite government restrictions, Li simply commented, “Neijuan is too severe!” Neijuan (内卷), or involution, refers to the state of current cutthroat competition within the Chinese education system and labor markets. Hundred million of students have found themselves ensnared in an inescapable race for a limited number of coveted spots at prestigious universities. In this fierce battle, no one wants to be left behind, and everyone wants to get a step ahead, many Chinese students and families believe. Extra academic support therefore continues to be sought after. Academic pressure is one factor, but peer pressure to keep up with other kids and gain an edge is another.

The situation can be summed up the way one of the tutoring agencies in China used to advertise themselves: “Let us train your children, or we will train their competitors.”

Shutting down private tutoring strove to reduce parents’ burden on the education arms race, per the government report. According to an investigation by Peking University in 2021, a Chinese family spends an average of about 233,000 yuan on a child’s education, from preschool to college. The Guardian also reports that the average cost of raising a child in China until the age of 18 is 538,000 yuan (£59,275) – more than 6.3 times as high as its GDP per capita, compared with 4.11 times in the US or 4.26 times in Japan, potentially contributing to a declining birthrate and shrinking population. By implementing the double reduction policy, the government had hoped to reduce parental concerns over rising childrearing costs and mitigate financial burdens. Xinhua News Agency also points out that as the policy aims to deemphasize the role of private tutoring and improve the quality of public education, it also sends a message that a normal school curriculum should be sufficient without the need for any extracurricular academic classes. However, as reality shows, the existing academic pressure and education competition create the need for learning and continue to foster tutoring services even when private agencies no longer exist. A middle school teacher in Suzhou who went through the implementation of the double reduction policy explains: “There is a demand, there is a market, and no matter what kind of education system there is, an elimination mechanism always exists. No one wants to be eliminated.”

As millions of high school graduates compete in the national university entrance exam, the gaokao, every year, no parents want their children to step into the test underprepared. “My parents were anxious that I would not be prepared enough for the gaokao, so they forced me to attend after-school classes,” confessed Zha, a DKU student who said his parents’ expectations were so overwhelming he chose to live on campus to avoid their pressure.

Chinese students preparing for the Gaokao. Photo by China Yucai Education.

High demand coupled with the scarcity of private tutoring because of double reduction policies have led to schools offering extra classes. “Before the policy, tutoring services were prevalent, and finding a tutor was easy. It is much harder now. Fewer teachers want to do it because of the risk, and tutoring agencies now simply do not exist,” explained Zha, whose mother is a primary school teacher. She also confirmed that teachers in school are not allowed to run extra classes outside the class. But they often do, in response to families’ desire for supplementary academic pursuits. The scarcity of teaching resources, combined with enormous pressure from parents, students, and the gaokao exam itself, have driven public schools and their teachers to continue the services. While teachers and schools do not receive direct payment for lessons outside office hours, an enhanced reputation when students perform well is the main motivation. “The high scores in the exam may be considered as verbal encouragement or praise. If the scores are low, we will be asked about the reasons, but there is no punishment,” commented a middle school teacher from Suzhou, who wished to remain anonymous due to the sensitivity of the issue.

Double reduction has yet to mitigate the intense academic pressure throughout China – despite its noble intentions, a number of sources say. The middle school teacher further pointed out that the government’s initiative had a beneficial intent – hoping to reduce the burden on students.

Nevertheless, students have yet to reap the positive effects the government intended. “Nothing really changed for me,” said Li, a DKU student who recently took the national university entrance exam, “Pressure was immense, and there was a lot of anxiety too. I still needed to do a ton of work in preparation for the gaokao when I was in high school. Seven days a week, I studied up to 2 a.m. for six of them, and sat for exams at school every week, even on holidays.”

When asked what can be done to curb the academic pressure instead, another DKU student, Chen, sighed, and said: “I don’t know. Double Reduction is a brave attempt. But for sure as long as the content of the gaokao stays the same, competition, anxiety and pressure will still be there, and we will still seek ‘tutoring’ one way or another.”

By the Intersections Team:

Giulia de Cristofaro

Xinyue Wang

 John Noonan

Sophia Zhou

Austin Woerner

credit: https://www.nngroup.com/articles/livestream-ecommerce-china/

Create an account

Create a free IEA account to download our reports or subcribe to a paid service.

Trends in electric cars

• Executive summary

Electric car sales

Electric car availability and affordability.

• Electric two- and three-wheelers
• Electric light commercial vehicles
• Electric truck and bus sales
• Electric heavy-duty vehicle model availability
• Charging for electric light-duty vehicles
• Charging for electric heavy-duty vehicles
• Battery supply and demand
• Battery prices
• Electric vehicle company strategy and market competition
• Electric vehicle and battery start-ups
• Vehicle outlook by mode
• Vehicle outlook by region
• The industry outlook
• Light-duty vehicle charging
• Heavy-duty vehicle charging
• Battery demand
• Electricity demand
• Oil displacement
• Well-to-wheel greenhouse gas emissions
• Lifecycle impacts of electric cars

Cite report

IEA (2024), Global EV Outlook 2024 , IEA, Paris https://www.iea.org/reports/global-ev-outlook-2024, Licence: CC BY 4.0

Share this report

• Share on Twitter Twitter
• Share on Facebook Facebook
• Share on LinkedIn LinkedIn
• Share on Email Email
• Share on Print Print

Report options

Nearly one in five cars sold in 2023 was electric.

Electric car sales neared 14 million in 2023, 95% of which were in China, Europe and the United States

Almost 14 million new electric cars 1 were registered globally in 2023, bringing their total number on the roads to 40 million, closely tracking the sales forecast from the 2023 edition of the Global EV Outlook (GEVO-2023). Electric car sales in 2023 were 3.5 million higher than in 2022, a 35% year-on-year increase. This is more than six times higher than in 2018, just 5 years earlier. In 2023, there were over 250 000 new registrations per week, which is more than the annual total in 2013, ten years earlier. Electric cars accounted for around 18% of all cars sold in 2023, up from 14% in 2022 and only 2% 5 years earlier, in 2018. These trends indicate that growth remains robust as electric car markets mature. Battery electric cars accounted for 70% of the electric car stock in 2023.

Global electric car stock, 2013-2023

While sales of electric cars are increasing globally, they remain significantly concentrated in just a few major markets. In 2023, just under 60% of new electric car registrations were in the People’s Republic of China (hereafter ‘China’), just under 25% in Europe, 2 and 10% in the United States – corresponding to nearly 95% of global electric car sales combined. In these countries, electric cars account for a large share of local car markets: more than one in three new car registrations in China was electric in 2023, over one in five in Europe, and one in ten in the United States. However, sales remain limited elsewhere, even in countries with developed car markets such as Japan and India. As a result of sales concentration, the global electric car stock is also increasingly concentrated. Nevertheless, China, Europe and the United States also represent around two-thirds of total car sales and stocks, meaning that the EV transition in these markets has major repercussions in terms of global trends.

In China, the number of new electric car registrations reached 8.1 million in 2023, increasing by 35% relative to 2022. Increasing electric car sales were the main reason for growth in the overall car market, which contracted by 8% for conventional (internal combustion engine) cars but grew by 5% in total, indicating that electric car sales are continuing to perform as the market matures. The year 2023 was the first in which China’s New Energy Vehicle (NEV) 3 industry ran without support from national subsidies for EV purchases, which have facilitated expansion of the market for more than a decade. Tax exemption for EV purchases and non-financial support remain in place, after an extension , as the automotive industry is seen as one of the key drivers of economic growth. Some province-led support and investment also remains in place and plays an important role in China’s EV landscape. As the market matures, the industry is entering a phase marked by increased price competition and consolidation. In addition, China exported over 4 million cars in 2023, making it the largest auto exporter in the world, among which 1.2 million were EVs. This is markedly more than the previous year – car exports were almost 65% higher than in 2022, and electric car exports were 80% higher. The main export markets for these vehicles were Europe and countries in the Asia Pacific region, such as Thailand and Australia.

In the United States, new electric car registrations totalled 1.4 million in 2023, increasing by more than 40% compared to 2022. While relative annual growth in 2023 was slower than in the preceding two years, demand for electric cars and absolute growth remained strong. The revised qualifications for the Clean Vehicle Tax Credit, alongside electric car price cuts, meant that some popular EV models became eligible for credit in 2023. Sales of the Tesla Model Y, for example, increased 50% compared to 2022 after it became eligible for the full USD 7 500 tax credit. Overall, the new criteria established by the Inflation Reduction Act (IRA) appear to have supported sales in 2023, despite earlier concerns that tighter domestic content requirements for EV and battery manufacturing could create immediate bottlenecks or delays, such as for the Ford F-150 Lightning . As of 2024, new guidance for the tax credits means the number of eligible models has fallen to less than 30 from about 45, 4 including several trim levels of the Tesla Model 3 becoming ineligible. However, in 2023 and 2024, leasing business models enable electric cars to qualify for the tax credits even if they do not fully meet the requirements, as leased cars can qualify for a less strict commercial vehicle tax credit and these tax credit savings can be passed to lease-holders. Such strategies have also contributed to sustained electric car roll-out.

In Europe, new electric car registrations reached nearly 3.2 million in 2023, increasing by almost 20% relative to 2022. In the European Union, sales amounted to 2.4 million, with similar growth rates. As in China, the high rates of electric car sales seen in Europe suggest that growth remains robust as markets mature, and several European countries reached important milestones in 2023. Germany, for example, became the third country after China and the United States to record half a million new battery electric car registrations in a single year, with 18% of car sales being battery electric (and another 6% plug-in hybrid).

However, the phase-out of several purchase subsidies in Germany slowed overall EV sales growth. At the start of 2023, PHEV subsidies were phased out, resulting in lower PHEV sales compared to 2022, and in December 2023, all EV subsidies ended after a ruling on the Climate and Transformation Fund. In Germany, the sales share for electric cars fell from 30% in 2022 to 25% in 2023. This had an impact on the overall electric car sales share in the region. In the rest of Europe, however, electric car sales and their sales share increased. Around 25% of all cars sold in France and the United Kingdom were electric, 30% in the Netherlands, and 60% in Sweden. In Norway, sales shares increased slightly despite the overall market contracting, and its sales share remains the highest in Europe, at almost 95%.

Electric car registrations and sales share in China, United States and Europe, 2018-2023

Sales in emerging markets are increasing, albeit from a low base, led by southeast asia and brazil.

Electric car sales continued to increase in emerging market and developing economies (EMDEs) outside China in 2023, but they remained low overall. In many cases, personal cars are not the most common means of passenger transport, especially compared with shared vans and minibuses, or two- and three-wheelers (2/3Ws), which are more prevalent and more often electrified, given their relative accessibility and affordability. The electrification of 2/3Ws and public or shared mobility will be key to achieve emissions reductions in such cases (see later sections in this report). While switching from internal combustion engine (ICE) to electric cars is important, the effect on overall emissions differs depending on the mode of transport that is displaced. Replacing 2/3Ws, public and shared mobility or more active forms of transport with personal cars may not be desirable in all cases.

In India, electric car registrations were up 70% year-on-year to 80 000, compared to a growth rate of under 10% for total car sales. Around 2% of all cars sold were electric. Purchase incentives under the Faster Adoption and Manufacturing of Electric Vehicles (FAME II) scheme, supply-side incentives under the Production Linked Incentive (PLI) scheme, tax benefits and the Go Electric campaign have all contributed to fostering demand in recent years. A number of new models also became popular in 2023, such as Mahindra’s XUV400, MG’s Comet, Citroën’s e-C3, BYD’s Yuan Plus, and Hyundai’s Ioniq 5, driving up growth compared to 2022. However, if the forthcoming FAME III scheme includes a subsidy reduction, as has been speculated in line with lower subsidy levels in the 2024 budget, future growth could be affected. Local carmakers have thus far maintained a strong foothold in the market, supported by advantageous import tariffs , and account for 80% of electric car sales in cumulative terms since 2010, led by Tata (70%) and Mahindra (10%).

In Thailand, electric car registrations more than quadrupled year-on-year to nearly 90 000, reaching a notable 10% sales share – comparable to the share in the United States. This is all the more impressive given that overall car sales in the country decreased from 2022 to 2023. New subsidies, including for domestic battery manufacturing, and lower import and excise taxes, combined with the growing presence of Chinese carmakers , have contributed to rapidly increasing sales. Chinese companies account for over half the sales to date, and they could become even more prominent given that BYD plans to start operating EV production facilities in Thailand in 2024, with an annual production capacity of 150 000 vehicles for an investment of just under USD 500 million . Thailand aims to become a major EV manufacturing hub for domestic and export markets, and is aiming to attract USD 28 billion in foreign investment within 4 years, backed by specific incentives to foster investment.

In Viet Nam, after an exceptional 2022 for the overall car market, car sales contracted by 25% in 2023, but electric car sales still recorded unprecedented growth: from under 100 in 2021, to 7 000 in 2022, and over 30 000 in 2023, reaching a 15% sales share. Domestic front-runner VinFast, established in 2017, accounted for nearly all domestic sales. VinFast also started selling electric sports utility vehicles (SUVs) in North America in 2023, as well as developing manufacturing facilities in order to unlock domestic content-linked subsidies under the US IRA. VinFast is investing around USD 2 billion and targets an annual production of 150 000 vehicles in the United States by 2025. The company went public in 2023, far exceeding expectations with a debut market valuation of around USD 85 billion, well beyond General Motors (GM) (USD 46 billion), Ford (USD 48 billion) or BMW (USD 68 billion), before it settled back down around USD 20 billion by the end of the year. VinFast also looks to enter regional markets, such as India and the Philippines .

In Malaysia, electric car registrations more than tripled to 10 000, supported by tax breaks and import duty exemptions, as well as an acceleration in charging infrastructure roll-out. In 2023, Mercedes-Benz marketed the first domestically assembled EV, and both BYD and Tesla also entered the market.

In Latin America, electric car sales reached almost 90 000 in 2023, with markets in Brazil, Colombia, Costa Rica and Mexico leading the region. In Brazil, electric car registrations nearly tripled year-on-year to more than 50 000, a market share of 3%. Growth in Brazil was underpinned by the entry of Chinese carmakers, such as BYD with its Song and Dolphin models, Great Wall with its H6, and Chery with its Tiggo 8, which immediately ranked among the best-selling models in 2023. Road transport electrification in Brazil could bring significant climate benefits given the largely low-emissions power mix, as well as reducing local air pollution. However, EV adoption has been slow thus far, given the national prioritisation of ethanol-based fuels since the late 1970s as a strategy to maintain energy security in the face of oil shocks. Today, biofuels are important alternative fuels available at competitive cost and aligned with the existing refuelling infrastructure. Brazil remains the world’s largest producer of sugar cane, and its agribusiness represents about one-fourth of GDP. At the end of 2023, Brazil launched the Green Mobility and Innovation Programme , which provides tax incentives for companies to develop and manufacture low-emissions road transport technology, aggregating to more than BRA 19 billion (Brazilian reals) (USD 3.8 billion) over the 2024-2028 period. Several major carmakers already in Brazil are developing hybrid ethanol-electric models as a result. China’s BYD and Great Wall are also planning to start domestic manufacturing, counting on local battery metal deposits, and plan to sell both fully electric and hybrid ethanol-electric models. BYD is investing over USD 600 million in its electric car plant in Brazil – its first outside Asia – for an annual capacity of 150 000 vehicles. BYD also partnered with Raízen to develop charging infrastructure in eight Brazilian cities starting in 2024. GM, on the other hand, plans to stop producing ICE (including ethanol) models and go fully electric, notably to produce for export markets. In 2024, Hyundai announced investments of USD 1.1 billion to 2032 to start local manufacturing of electric, hybrid and hydrogen cars.

In Mexico, electric car registrations were up 80% year-on-year to 15 000, a market share just above 1%. Given its proximity to the United States, Mexico’s automotive market is already well integrated with North American partners, and benefits from advantageous trade agreements, large existing manufacturing capacity, and eligibility for subsidies under the IRA. As a result, local EV supply chains are developing quickly, with expectations that this will spill over into domestic markets. Tesla, Ford, Stellantis, BMW, GM, Volkswagen (VW) and Audi have all either started manufacturing or announced plans to manufacture EVs in Mexico. Chinese carmakers such as BYD, Chery and SAIC are also considering expanding to Mexico. Elsewhere in the region, Colombia and Costa Rica are seeing increasing electric car sales, with around 6 000 and 5 000 in 2023, respectively, but sales remain limited in other Central and South American countries.

Throughout Africa, Eurasia and the Middle East, electric cars are still rare, accounting for less than 1% of total car sales. However, as Chinese carmakers look for opportunities abroad, new models – including those produced domestically – could boost EV sales. For example, in Uzbekistan , BYD set up a joint venture with UzAuto Motors in 2023 to produce 50 000 electric cars annually, and Chery International established a partnership with ADM Jizzakh. This partnership has already led to a steep increase in electric car sales in Uzbekistan, reaching around 10 000 in 2023. In the Middle East, Jordan boasts the highest electric car sales share, at more than 45%, supported by much lower import duties relative to ICE cars, followed by the United Arab Emirates, with 13%.

Strong electric car sales in the first quarter of 2024 surpass the annual total from just four years ago

Electric car sales remained strong in the first quarter of 2024, surpassing those of the same period in 2023 by around 25% to reach more than 3 million. This growth rate was similar to the increase observed for the same period in 2023 compared to 2022. The majority of the additional sales came from China, which sold about half a million more electric cars than over the same period in 2023. In relative terms, the most substantial growth was observed outside of the major EV markets, where sales increased by over 50%, suggesting that the transition to electromobility is picking up in an increasing number of countries worldwide.

Quarterly electric car sales by region, 2021-2024

From January to March of this year, nearly 1.9 million electric cars were sold in China, marking an almost 35% increase compared to sales in the first quarter of 2023. In March, NEV sales in China surpassed a share of 40% in overall car sales for the first time, according to retail sales reported by the China Passenger Car Association. As witnessed in 2023, sales of plug-in hybrid electric cars are growing faster than sales of pure battery electric cars. Plug-in hybrid electric car sales in the first quarter increased by around 75% year-on-year in China, compared to just 15% for battery electric car sales, though the former started from a lower base.

In Europe, the first quarter of 2024 saw year-on-year growth of over 5%, slightly above the growth in overall car sales and thereby stabilising the EV sales share at a similar level as last year. Electric car sales growth was particularly high in Belgium, where around 60 000 electric cars were sold, almost 35% more than the year before. However, Belgium represents less than 5% of total European car sales. In the major European markets – France, Germany, Italy and the United Kingdom (together representing about 60% of European car sales) – growth in electric car sales was lower. In France, overall EV sales in the first quarter grew by about 15%, with BEV sales growth being higher than for PHEVs. While this is less than half the rate as over the same period last year, total sales were nonetheless higher and led to a slight increase in the share of EVs in total car sales. The United Kingdom saw similar year-on-year growth (over 15%) in EV sales as France, about the same rate as over the same period last year. In Germany, where battery electric car subsidies ended in 2023, sales of electric cars fell by almost 5% in the first quarter of 2024, mainly as a result of a 20% year-on-year decrease in March. The share of EVs in total car sales was therefore slightly lower than last year. As in China, PHEV sales in both Germany and the United Kingdom were stronger than BEV sales. In Italy, sales of electric cars in the first three months of 2024 were more than 20% lower than over the same period in 2023, with the majority of the decrease taking place in the PHEV segment. However, this trend could be reversed based on the introduction of a new incentive scheme , and if Chinese automaker Chery succeeds in appealing to Italian consumers when it enters the market later this year.

In the United States, first-quarter sales reached around 350 000, almost 15% higher than over the same period the year before. As in other major markets, the sales growth of PHEVs was even higher, at 50%. While the BEV sales share in the United States appears to have fallen somewhat over the past few months, the sales share of PHEVs has grown.

In smaller EV markets, sales growth in the first months of 2024 was much higher, albeit from a low base. In January and February, electric car sales almost quadrupled in Brazil and increased more than sevenfold in Viet Nam. In India, sales increased more than 50% in the first quarter of 2024. These figures suggest that EVs are gaining momentum across diverse markets worldwide.

Since 2021, first-quarter electric car sales have typically accounted for 15-20% of the total global annual sales. Based on this observed trend, coupled with policy momentum and the seasonality that EV sales typically experience, we estimate that electric car sales could reach around 17 million in 2024. This indicates robust growth for a maturing market, with 2024 sales to surpass those of 2023 by more than 20% and EVs to reach a share in total car sales of more than one-fifth.

Electric car sales, 2012-2024

The majority of the additional 3 million electric car sales projected for 2024 relative to 2023 are from China. Despite the phase-out of NEV purchase subsidies last year, sales in China have remained robust, indicating that the market is maturing. With strong competition and relatively low-cost electric cars, sales are to grow by almost 25% in 2024 compared to last year, reaching around 10 million. If confirmed, this figure will come close to the total global electric car sales in 2022. As a result, electric car sales could represent around 45% of total car sales in China over 2024.

In 2024, electric car sales in the United States are projected to rise by 20% compared to the previous year, translating to almost half a million more sales, relative to 2023. Despite reporting of a rocky end to 2023 for electric cars in the United States, sales shares are projected to remain robust in 2024. Over the entire year, around one in nine cars sold are expected to be electric.

Based on recent trends, and considering that tightening CO 2 targets are due to come in only in 2025, the growth in electric car sales in Europe is expected to be the lowest of the three largest markets. Sales are projected to reach around 3.5 million units in 2024, reflecting modest growth of less than 10% compared to the previous year. In the context of a generally weak outlook for passenger car sales, electric cars would still represent about one in four cars sold in Europe.

Outside of the major EV markets, electric car sales are anticipated to reach the milestone of over 1 million units in 2024, marking a significant increase of over 40% compared to 2023. Recent trends showing the success of both homegrown and Chinese electric carmakers in Southeast Asia underscore that the region is set to make a strong contribution to the sales of emerging EV markets (see the section on Trends in the electric vehicle industry). Despite some uncertainty surrounding whether India’s forthcoming FAME III scheme will include subsidies for electric cars, we expect sales in India to remain robust, and to experience around 50% growth compared to 2023. Across all regions outside the three major EV markets, electric car sales are expected to represent around 5% of total car sales in 2024, which – considering the high growth rates seen in recent years – could indicate that a tipping point towards global mass adoption is getting closer.

There are of course downside risks to the 2024 outlook for electric car sales. Factors such as high interest rates and economic uncertainty could potentially reduce the growth of global electric car sales in 2024. Other challenges may come from the IRA restrictions on US electric car tax incentives, and the tightening of technical requirements for EVs to qualify for the purchase tax exemption in China. However, there are also upside potentials to consider. New markets may open up more rapidly than anticipated, as automakers expand their EV operations and new entrants compete for market share. This could lead to accelerated growth in electric car sales globally, surpassing the initial estimations.

More electric models are becoming available, but the trend is towards larger ones

The number of available electric car models nears 600, two-thirds of which are large vehicles and SUVs

In 2023, the number of available models for electric cars increased 15% year-on-year to nearly 590, as carmakers scaled up electrification plans, seeking to appeal to a growing consumer base. Meanwhile, the number of fully ICE models (i.e. excluding hybrids) declined for the fourth consecutive year, at an average of 2%. Based on recent original equipment manufacturer (OEM) announcements, the number of new electric car models could reach 1 000 by 2028. If all announced new electric models actually reach the market, and if the number of available ICE car models continues to decline by 2% annually, there could be as many electric as ICE car models before 2030.

As reported in GEVO-2023, the share of small and medium electric car models is decreasing among available electric models: in 2023, two-thirds of the battery-electric models on the market were SUVs, 5 pick-up trucks or large cars. Just 25% of battery electric car sales in the United States were for small and medium models, compared to 40% in Europe and 50% in China. Electric cars are following the same trend as conventional cars, and getting bigger on average. In 2023, SUVs, pick-up trucks and large models accounted for 65% of total ICE car sales worldwide, and more than 80% in the United States, 60% in China and 50% in Europe.

Several factors underpin the increase in the share of large models. Since the 2010s, conventional SUVs in the United States have benefited from less stringent tailpipe emissions rules than smaller models, creating an incentive for carmakers to market more vehicles in that segment. Similarly, in the European Union, CO 2 targets for passenger cars have included a compromise on weight, allowing CO 2 leeway for heavier vehicles in some cases. Larger vehicles also mean larger margins for carmakers. Given that incumbent carmakers are not yet making a profit on their EV offer in many cases, focusing on larger models enables them to increase their margins. Under the US IRA, electric SUVs can qualify for tax credits as long as they are priced under USD 80 000, whereas the limit stands at USD 55 000 for a sedan, creating an incentive to market SUVs if a greater margin can be gathered. On the demand side, there is now strong willingness to pay for SUVs or large models. Consumers are typically interested in longer-range and larger cars for their primary vehicles, even though small models are more suited to urban use. Higher marketing spend on SUVs compared to smaller models can also have an impact on consumer choices.

The progressive shift towards ICE SUVs has been dramatically limiting fuel savings. Over the 2010-2022 period, without the shift to SUVs, energy use per kilometre could have fallen at an average annual rate 30% higher than the actual rate. Switching to electric in the SUV and larger car segments can therefore achieve immediate and significant CO 2 emissions reductions, and electrification also brings considerable benefits in terms of reducing air pollution and non-tailpipe emissions, especially in urban settings. In 2023, if all ICE and HEV sales of SUVs had instead been BEV, around 770 Mt CO 2 could have been avoided globally over the cars’ lifetimes (see section 10 on lifecycle analysis). This is equivalent to the total road emissions of China in 2023.

Breakdown of battery electric car sales in selected countries and regions by segment, 2018-2023

Nevertheless, from a policy perspective, it is critical to mitigate the negative spillovers associated with an increase in larger electric cars in the fleet.

Larger electric car models have a significant impact on battery supply chains and critical mineral demand. In 2023, the sales-weighted average battery electric SUV in Europe had a battery almost twice as large as the one in the average small electric car, with a proportionate impact on critical mineral needs. Of course, the range of small cars is typically shorter than SUVs and large cars (see later section on ranges). However, when comparing electric SUVs and medium-sized electric cars, which in 2023 offered a similar range, the SUV battery was still 25% larger. This means that if all electric SUVs sold in 2023 had instead been medium-sized cars, around 60 GWh of battery equivalent could have been avoided globally, with limited impact on range. Accounting for the different chemistries used in China, Europe, and the United States, this would be equivalent to almost 6 000 tonnes of lithium, 30 000 tonnes of nickel, almost 7 000 tonnes of cobalt, and over 8 000 tonnes of manganese.

Larger batteries also require more power, or longer charging times. This can put pressure on electricity grids and charging infrastructure by increasing occupancy, which could create issues during peak utilisation, such as at highway charging points at high traffic times.

In addition, larger vehicles also require greater quantities of materials such as iron and steel, aluminium and plastics, with a higher environmental and carbon footprint for materials production, processing and assembly. Because they are heavier, larger models also have higher electricity consumption. The additional energy consumption resulting from the increased mass is mitigated by regenerative braking to some extent, but in 2022, the sales-weighted average electricity consumption of electric SUVs was 20% higher than that of other electric cars. 6

Major carmakers have announced launches of smaller and more affordable electric car models over the past few years. However, when all launch announcements are considered, far fewer smaller models are expected than SUVs, large models and pick-up trucks. Only 25% of the 400+ launches expected over the 2024-2028 period are small and medium models, which represents a smaller share of available models than in 2023. Even in China, where small and medium models have been popular, new launches are typically for larger cars.

Number of available car models in 2023 and expected new ones by powertrain, country or region and segment, 2024-2028

Several governments have responded by introducing policies to create incentives for smaller and lighter passenger cars. In Norway, for example, all cars are subject to a purchase tax based on weight, CO 2 and nitrogen oxides (NO x ) emissions, though electric cars were exempt from the weight-based tax prior to 2023. Any imported cars weighing more than 500 kg must also pay an entry fee for each additional kg. In France, a progressive weight-based tax applies to ICE and PHEV cars weighing above 1 600 kg, with a significant impact on price: weight tax for a Land Rover Defender 130 (2 550 kg) adds up to more than EUR 21 500, versus zero for a Renault Clio (1 100 kg). Battery electric cars have been exempted to date. In February 2024, a referendum held in Paris resulted in a tripling of city parking fees for visiting SUVs, applicable to ICE, hybrid and plug-in hybrid cars above 1 600 kg and battery electric ones above 2 000 kg, in an effort to limit the use of large and/or polluting vehicles. Other examples exist in Estonia, Finland, Switzerland and the Netherlands. A number of policy options may be used, such as caps and fleet averages for vehicle footprint, weight, and/or battery size; access to finance for smaller vehicles; and sustained support for public charging, enabling wider use of shorter-range cars.

Average range is increasing, but only moderately

Concerns about range compared to ICE vehicles, and about the availability of charging infrastructure for long-distance journeys, also contribute to increasing appetite for larger models with longer range.

With increasing battery size and improvements in battery technology and vehicle design, the sales-weighted average range of battery electric cars grew by nearly 75% between 2015 and 2023, although trends vary by segment. The average range of small cars in 2023 – around 150 km – is not much higher than it was in 2015, indicating that this range is already well suited for urban use (with the exception of taxis, which have much higher daily usage). Large, higher-end models already offered higher ranges than average in 2015, and their range has stagnated through 2023, averaging around 360-380 km. Meanwhile, significant improvements have been made for medium-sized cars and SUVs, the range of which now stands around 380 km, whereas it averaged around 150 km for medium cars and 270 km for SUVs in 2015. This is encouraging for consumers looking to purchase an electric car for longer journeys rather than urban use.

Since 2020, growth in the average range of vehicles has been slower than over the 2015-2020 period. This could result from a number of factors, including fluctuating battery prices, carmakers’ attempts to limit additional costs as competition intensifies, and technical constraints (e.g. energy density, battery size). It could also reflect that beyond a certain range at which most driving needs are met, consumers’ willingness to pay for a marginal increase in battery size and range is limited. Looking forward, however, the average range could start increasing again as novel battery technologies mature and prices fall.

More affordable electric cars are needed to reach a mass-market tipping point

An equitable and inclusive transition to electric mobility, both within countries and at the global level, hinges on the successful launch of affordable EVs (including but not limited to electric cars). In this section, we use historic sales and price data for electric and ICE models around the world to examine the total cost of owning an electric car, price trends over time, and the remaining electric premium, by country and vehicle size. 7 Specific models are used for illustration.

Total cost of ownership

Car purchase decisions typically involve consideration of retail price and available subsidies as well as lifetime operating costs, such as fuel costs, insurance, maintenance and depreciation, which together make up the total cost of ownership (TCO). Reaching TCO parity between electric and ICE cars creates important financial incentives to make the switch. This section examines the different components of the TCO, by region and car size.

In 2023, upfront retail prices for electric cars were generally higher than for their ICE equivalents, which increased their TCO in relative terms. On the upside, higher fuel efficiency and lower maintenance costs enable fuel cost savings for electric cars, lowering their TCO. This is especially true in periods when fuel prices are high, in places where electricity prices are not too closely correlated to fossil fuel prices. Depreciation is also a major factor in determining TCO: As a car ages, it loses value, and depreciation for electric cars tends to be faster than for ICE equivalents, further increasing their TCO. Accelerated depreciation could, however, prove beneficial for the development of second-hand markets.

However, the trend towards faster depreciation for electric vehicles might be reversed for multiple reasons. Firstly, consumers are gaining more confidence in electric battery lifetimes, thereby increasing the resale value of EVs. Secondly, strong demand and the positive brand image of some BEV models can mean they hold their value longer, as shown by Tesla models depreciating more slowly than the average petrol car in the United States. Finally, increasing fuel prices in some regions, the roll-out of low-emissions zones that restrict access for the most polluting vehicles, and taxes and parking fees specifically targeted at ICE vehicles could mean they experience faster depreciation rates than EVs in the future. In light of these two possible opposing depreciation trends, the same fixed annual depreciation rate for both BEVs and ICE vehicles has been applied in the following cost of ownership analysis.

Subsidies help lower the TCO of electric cars relative to ICE equivalents in multiple ways. A purchase subsidy lowers the original retail price, thereby lowering capital depreciation over time, and a lower retail price implies lower financing costs through cumulative interest. Subsidies can significantly reduce the number of years required to reach TCO parity between electric and ICE equivalents. As of 2022, we estimate that TCO parity could be reached in most cases in under 7 years in the three major EV markets, with significant variations across different car sizes. In comparison, for models purchased at 2018 prices, TCO parity was much harder to achieve.

In Germany, for example, we estimate that the sales-weighted average price of a medium-sized battery electric car in 2022 was 10-20% more expensive than its ICE equivalent, but 10-20% cheaper in cumulative costs of ownership after 5 years, thanks to fuel and maintenance costs savings. In the case of an electric SUV, we estimate that the average annual operating cost savings would amount to USD 1 800 when compared to the equivalent conventional SUV over a period of 10 years. In the United States, despite lower fuel prices with respect to electricity, the higher average annual mileage results in savings that are close to Germany at USD 1 600 per year. In China, lower annual distance driven reduces fuel cost savings potential, but the very low price of electricity enables savings of about USD 1 000 per year.

In EMDEs, some electric cars can also be cheaper than ICE equivalents over their lifetime. This is true in India , for example, although it depends on the financing instrument. Access to finance is typically much more challenging in EMDEs due to higher interest rates and the more limited availability of cheap capital. Passenger cars have also a significantly lower market penetration in the first place, and many car purchases are made in second-hand markets. Later sections of this report look at markets for used electric cars, as well as the TCO for electric and conventional 2/3Ws in EMDEs, where they are far more widespread than cars as a means of road transport.

Upfront retail price parity

Achieving price parity between electric and ICE cars will be an important tipping point. Even when the TCO for electric cars is advantageous, the upfront retail price plays a decisive role, and mass-market consumers are typically more sensitive to price premiums than wealthier buyers. This holds true not only in emerging and developing economies, which have comparatively high costs of capital and comparatively low household and business incomes, but also in advanced economies. In the United States, for example, surveys suggest affordability was the top concern for consumers considering EV adoption in 2023. Other estimates show that even among SUV and pick-up truck consumers, only 50% would be willing to purchase one above USD 50 000.

In this section, we examine historic price trends for electric and ICE cars over the 2018-2022 period, by country and car size, and for best-selling models in 2023.

Electric cars are generally getting cheaper as battery prices drop, competition intensifies, and carmakers achieve economies of scale. In most cases, however, they remain on average more expensive than ICE equivalents. In some cases, after adjusting for inflation, their price stagnated or even moderately increased between 2018 and 2022.

Larger batteries for longer ranges increase car prices, and so too do the additional options, equipment, digital technology and luxury features that are often marketed on top of the base model. A disproportionate focus on larger, premium models is pushing up the average price, which – added to the lack of available models in second-hand markets (see below) – limits potential to reach mass-market consumers. Importantly, geopolitical tension, trade and supply chain disruptions, increasing battery prices in 2022 relative to 2021, and rising inflation, have also significantly affected the potential for further cost declines.

Competition can also play an important role in bringing down electric car prices. Intensifying competition leads carmakers to cut prices to the minimum profit margin they can sustain, and – if needed – to do so more quickly than battery and production costs decline. For example, between mid-2022 and early-2024, Tesla cut the price of its Model Y from between USD 65 000 and USD 70 000 to between USD 45 000 and USD 55 000 in the United States. Battery prices for such a model dropped by only USD 3 000 over the same period in the United States, suggesting that a profit margin may still be made at a lower price. Similarly, in China, the price of the Base Model Y dropped from CNY 320 000 (Yuan renminbi) (USD 47 000) to CNY 250 000 (USD 38 000), while the corresponding battery price fell by only USD 1 000. Conversely, in cases where electric models remain niche or aimed at wealthier, less price-sensitive early adopters, their price may not fall as quickly as battery prices, if carmakers can sustain greater margins.

Price gap between the sales-weighted average price of conventional and electric cars in selected countries, before subsidy, by size, in 2018 and 2022

In China, where the sales share of electric cars has been high for several years, the sales-weighted average price of electric cars (before purchase subsidy) is already lower than that of ICE cars. This is true not only when looking at total sales, but also at the small cars segment, and is close for SUVs. After accounting for the EV exemption from the 10% vehicle purchase tax, electric SUVs were already on par with conventional ones in 2022, on average.

Electric car prices have dropped significantly since 2018. We estimate that around 55% of the electric cars sold in China in 2022 were cheaper than their average ICE equivalent, up from under 10% in 2018. Given the further price declines between 2022 and 2023, we estimate that this share increased to around 65% in 2023. These encouraging trends suggest that price parity between electric and ICE cars could also be reached in other countries in certain segments by 2030, if the sales share of electric cars continues to grow, and if supporting infrastructure – such as for charging – is sustained.

As reported in detail in GEVO-2023 , China remains a global exception in terms of available inexpensive electric models. Local carmakers already market nearly 50 small, affordable electric car models, many of which are priced under CNY 100 000 (USD 15 000). This is in the same range as best-selling small ICE cars in 2023, which cost from CNY 70 000 to CNY 100 000. In 2022, the best-selling electric car was SAIC’s small Wuling Hongguang Mini EV, which accounted for 10% of all BEV sales. It was priced around CNY 40 000, weighing under 700 kg for a 170-km range. In 2023, however, it was overtaken by Tesla models, among other larger models, as new consumers seek longer ranges and higher-end options and digital equipment.

United States

In the United States, the sales-weighted average price of electric cars decreased over the 2018-2022 period, primarily driven by a considerable drop in the price of Tesla cars, which account for a significant share of sales. The sales-weighted average retail price of electric SUVs fell slightly more quickly than the average SUV battery costs over the same period. The average price of small and medium models also decreased, albeit to a smaller extent.

Across all segments, electric models remained more expensive than conventional equivalents in 2022. However, the gap has since begun to close, as market size increases and competition leads carmakers to cut prices. For example, in 2023-2024, Tesla’s Model 3 could be found in the USD 39 000 to USD 42 000 range, which is comparable to the average price for new ICE cars, and a new Model Y priced under USD 50 000 was launched. Rivian is expecting to launch its R2 SUV in 2026 at USD 45 000, which is much less than previous vehicles. Average price parity between electric and conventional SUVs could be reached by 2030, but it may only be reached later for small and medium cars, given their lower availability and popularity.

Smaller, cheaper electric models have further to go to reach price parity in the United States. We estimate that in 2022, only about 5% of the electric cars sold in the United States were cheaper than their average ICE equivalent. In 2023, the cheapest electric cars were priced around USD 30 000 (e.g. Chevrolet Bolt, Nissan Leaf, Mini Cooper SE). To compare, best-selling small ICE options cost under USD 20 000 (e.g. Kia Rio, Mitsubishi Mirage), and many best-selling medium ICE options between USD 20 000 and USD 25 000 (e.g. Honda Civic, Toyota Corolla, Kia Forte, Hyundai Avante, Nissan Sentra).

Around 25 new all-electric car models are expected in 2024, but only 5 of them are expected below USD 50 000, and none under the USD 30 000 mark. Considering all the electric models expected to be available in 2024, about 75% are priced above USD 50 000, and fewer than 10 under USD 40 000, even after taking into account the USD 7 500 tax credit under the IRA for eligible cars as of February 2024. This means that despite the tax credit, few electric car models directly compete with small mass-market ICE models.

In December 2023, GM stopped production of its best-selling electric car, the Bolt, announcing it would introduce a new version in 2025. The Nissan Leaf (40 kWh) therefore remains the cheapest available electric car in 2024, at just under USD 30 000, but is not yet eligible for IRA tax credits. Ford announced in 2024 that it would move away from large and expensive electric cars as a way to convince more consumers to switch to electric, at the same time as increasing output of ICE models to help finance a transition to electric mobility. In 2024, Tesla announced it would start producing a next-generation, compact and affordable electric car in June 2025, but the company had already announced in 2020 that it would deliver a USD 25 000 model within 3 years. Some micro urban electric cars are already available between USD 5 000 and USD 20 000 (e.g. Arcimoto FUV, Nimbus One), but they are rare. In theory, such models could cover many use cases, since 80% of car journeys in the United States are under 10 miles .

Pricing trends differ across European countries, and typically vary by segment.

In Norway, after taking into account the EV sales tax exemption, electric cars are already cheaper than ICE equivalents across all segments. In 2022, we estimate that the electric premium stood around -15%, and even -30% for medium-sized cars. Five years earlier, in 2018, the overall electric premium was less advantageous, at around -5%. The progressive reintroduction of sales taxes on electric cars may change these estimates for 2023 onwards.

Germany’s electric premium ranks among the lowest in the European Union. Although the sales-weighted average electric premium increased slightly between 2018 and 2022, it stood at 15% in 2022. It is particularly low for medium-sized cars (10-15%) and SUVs (20%), but remains higher than 50% for small models. In the case of medium cars, the sales-weighted average electric premium was as low as EUR 5 000 in 2022. We estimate that in 2022, over 40% of the medium electric cars sold in Germany were cheaper than their average ICE equivalent. Looking at total sales, over 25% of the electric cars sold in 2022 were cheaper than their average ICE equivalent. In 2023, the cheapest models among the best-selling medium electric cars were priced between EUR 22 000 and EUR 35 000 (e.g. MG MG4, Dacia Spring, Renault Megane), far cheaper than the three front-runners priced above EUR 45 000 (VW ID.3, Cupra Born, and Tesla Model 3). To compare, best-selling ICE cars in the medium segment were also priced between EUR 30 000 and EUR 45 000 (e.g. VW Golf, VW Passat Santana, Skoda Octavia Laura, Audi A3, Audi A4). At the end of 2023, Germany phased out its subsidy for electric car purchases, but competition and falling model prices could compensate for this.

In France, the sales-weighted average electric premium stagnated between 2018 and 2022. The average price of ICE cars also increased over the same period, though more moderately than that of electric models. Despite a drop in the price of electric SUVs, which stood at a 30% premium over ICE equivalents in 2022, the former do not account for a high enough share of total electric car sales to drive down the overall average. The electric premium for small and medium cars remains around 40-50%.

These trends mirror those of some of the best-selling models. For example, when adjusting prices for inflation, the small Renault Zoe was sold at the same price on average in 2022-2023 as in 2018-2019, or EUR 30 000 (USD 32 000). It could be found for sale at as low as EUR 25 000 in 2015-2016. The earlier models, in 2015, had a battery size of around 20 kWh, which increased to around 40 kWh in 2018‑2019 and 50 kWh in newer models in 2022-2023. Yet European battery prices fell more quickly than the battery size increased over the same period, indicating that battery size alone does not explain car price dynamics.

In 2023, the cheapest electric cars in France were priced between EUR 22 000 and EUR 30 000 (e.g. Dacia Spring, Renault Twingo E-Tech, Smart EQ Fortwo), while best-selling small ICE models were available between EUR 10 000 and EUR 20 000 (e.g. Renault Clio, Peugeot 208, Citroën C3, Dacia Sandero, Opel Corsa, Skoda Fabia). Since mid-2024, subsidies of up to EUR 4 000 can be granted for electric cars priced under EUR 47 000, with an additional subsidy of up to EUR 3 000 for lower-income households.

In the United Kingdom, the sales-weighted average electric premium shrank between 2018 and 2022, thanks to a drop in prices for electric SUVs, as in the United States. Nonetheless, electric SUVs still stood at a 45% premium over ICE equivalents in 2022, which is similar to the premium for small models but far higher than for medium cars (20%).

In 2023, the cheapest electric cars in the United Kingdom were priced from GBP 27 000 to GBP 30 000 (USD 33 000 to 37 000) (e.g. MG MG4, Fiat 500, Nissan Leaf, Renault Zoe), with the exception of the Smart EQ Fortwo, priced at GBP 21 000. To compare, best-selling small ICE options could be found from GBP 10 000 to 17 000 (e.g. Peugeot 208, Fiat 500, Dacia Sandero) and medium options below GBP 25 000 (e.g. Ford Puma). Since July 2022, there has been no subsidy for the purchase of electric passenger cars.

Elsewhere in Europe, electric cars remain typically much more expensive than ICE equivalents. In Poland , for example, just a few electric car models could be found at prices competitive with ICE cars in 2023, under the PLN 150 000 (Polish zloty) (EUR 35 000) mark. Over 70% of electric car sales in 2023 were for SUVs, or large or more luxurious models, compared to less than 60% for ICE cars.

In 2023, there were several announcements by European OEMs for smaller models priced under EUR 25 000 in the near-term (e.g. Renault R5, Citroën e-C3, Fiat e-Panda, VW ID.2all). There is also some appetite for urban microcars (i.e. L6-L7 category), learning from the success of China’s Wuling. Miniature models bring important benefits if they displace conventional models, helping reduce battery and critical mineral demand. Their prices are often below USD 5 000 (e.g. Microlino, Fiat Topolino, Citroën Ami, Silence S04, Birò B2211).

In Europe and the United States, electric car prices are expected to come down as a result of falling battery prices, more efficient manufacturing, and competition. Independent analyses suggest that price parity between some electric and ICE car models in certain segments could be reached over the 2025-2028 period, for example for small electric cars in Europe in 2025 or soon after. However, many market variables could delay price parity, such as volatile commodity prices, supply chain bottlenecks, and the ability of carmakers to yield sufficient margins from cheaper electric models. The typical rule in which economies of scale bring down costs is being complicated by numerous other market forces. These include a dynamic regulatory context, geopolitical competition, domestic content incentives, and a continually evolving technology landscape, with competing battery chemistries that each have their own economies of scale and regional specificities.

Japan is a rare example of an advanced economy where small models – both for electric and ICE vehicles – appeal to a large consumer base, motivated by densely populated cities with limited parking space, and policy support. In 2023, about 60% of total ICE sales were for small models, and over half of total electric sales. Two electric cars from the smallest “Kei” category, the Nissan Sakura and Mitsubishi eK-X, accounted for nearly 50% of national electric car sales alone, and both are priced between JPY 2.3 million (Japanese yen) and JPY 3 million (USD 18 000 to USD 23 000). However, this is still more expensive than best-selling small ICE cars (e.g. Honda N Box, Daihatsu Hijet, Daihatsu Tanto, Suzuki Spacia, Daihatsu Move), priced between USD 13 000 and USD 18 000. In 2024, Nissan announced that it would aim to reach cost parity (of production, not retail price) between electric and ICE cars by 2030.

Emerging market and developing economies

In EMDEs, the absence of small and cheaper electric car models is a significant hindrance to wider market uptake. Many of the available car models are SUVs or large models, targeting consumers of high-end goods, and far too expensive for mass-market consumers, who often do not own a personal car in the first place (see later sections on second-hand car markets and 2/3Ws).

In India, while Tata’s small Tiago/Tigor models, which are priced between USD 10 000 and USD 15 000, accounted for about 20% of total electric car sales in 2023, the average best-selling small ICE car is priced around USD 7 000. Large models and SUVs accounted for over 65% of total electric car sales. While BYD announced in 2023 the goal of accounting for 40% of India’s EV market by 2030, all of its models available in India cost more than INR 3 million (Indian rupees) (USD 37 000), including the Seal, launched in 2024 for INR 4.1 million (USD 50 000).

Similarly, SUVs and large models accounted for the majority share of electric car sales in Thailand (60%), Indonesia (55%), Malaysia (over 85%) and Viet Nam (over 95%). In Indonesia, for example, Hyundai’s Ionic 5 was the most popular electric car in 2023, priced at around USD 50 000. Looking at launch announcements, most new models expected over the 2024-2028 period in EMDEs are SUVs or large models. However, more than 50 small and medium models could also be introduced, and the recent or forthcoming entry of Chinese carmakers suggests that cheaper models could hit the market in the coming years.

In 2022-2023, Chinese carmakers accounted for 40-75% of the electric car sales in Indonesia, Thailand and Brazil, with sales jumping as cheaper Chinese models were introduced. In Thailand, for example, Hozon launched its Neta V model in 2022 priced at THB 550 000 (Thai baht) (USD 15 600), which became a best-seller in 2023 given its relative affordability compared with the cheapest ICE equivalents at around USD 9 000. Similarly, in Indonesia, the market entry of Wuling’s Air EV in 2022-2023 was met with great success. In Colombia, the best-selling electric car in 2023 was the Chinese mini-car, Zhidou 2DS, which could be found at around USD 15 000, a competitive option relative to the country’s cheapest ICE car, the Kia Picanto, at USD 13 000.

Electric car sales in selected countries, by origin of carmaker, 2021-2023

Second-hand markets for electric cars are on the rise.

As electric vehicle markets mature, the second-hand market will become more important

In the same way as for other technology products, second-hand markets for used electric cars are now emerging as newer generations of vehicles progressively become available and earlier adopters switch or upgrade. Second-hand markets are critical to foster mass-market adoption, especially if new electric cars remain expensive, and used ones become cheaper. Just as for ICE vehicles – for which buying second-hand is often the primary method of acquiring a car in both emerging and advanced economies – a similar pattern will emerge with electric vehicles. It is estimated that eight out of ten EU citizens buy their car second-hand, and this share is even higher – around 90% – among low- and middle-income groups. Similarly, in the United States, about seven out of ten vehicles sold are second-hand, and only 17% of lower-income households buy a new car.

As major electric car markets reach maturity, more and more used electric cars are becoming available for resale. Our estimates suggest that in 2023, the market size for used electric cars amounted to nearly 800 000 in China , 400 000 in the United States and more than 450 000 for France, Germany, Italy, Spain, the Netherlands and the United Kingdom combined. Second-hand sales have not been included in the numbers presented in the previous section of this report, which focused on sales of new electric cars, but they are already significant. On aggregate, global second-hand electric car sales were roughly equal to new electric car sales in the United States in 2023. In the United States, used electric car sales are set to increase by 40% in 2024 relative to 2023. Of course, these volumes are dwarfed by second-hand ICE markets: 30 million in the European countries listed above combined, nearly 20 million in China, and 36 million in the United States . However, these markets have had decades to mature, indicating greater longer-term potential for used electric car markets.

Used car markets already provide more affordable electric options in China, Europe and the United States

Second-hand car markets are increasingly becoming a source of more affordable electric cars that can compete with used ICE equivalents. In the United States, for example, more than half of second-hand electric cars are already priced below USD 30 000. Moreover, the average price is expected to quickly fall towards USD 25 000, the price at which used electric cars become eligible for the federal used car rebate of USD 4 000, making them directly competitive with best-selling new and used ICE options. The price of a second-hand Tesla in the United States dropped from over USD 50 000 in early 2023 to just above USD 33 000 in early 2024, making it competitive with a second-hand SUV and many new models as well (either electric or conventional). In Europe , second-hand battery electric cars can be found between EUR 15 000 and EUR 25 000 (USD 16 000‑27 000), and second-hand plug-in hybrids around EUR 30 000 (USD 32 000). Some European countries also offer subsidies for second-hand electric cars, such as the Netherlands (EUR 2 000), where the subsidy for new cars has been steadily declining since 2020, while that for used cars remains constant, and France (EUR 1 000). In China , used electric cars were priced around CNY 75 000 on average in 2023 (USD 11 000).

In recent years, the resale value 8 of electric cars has been increasing. In Europe, the resale value of battery electric cars sold after 12 months has steadily increased over the 2017-2022 period, surpassing that of all other powertrains and standing at more than 70% in mid-2022. The resale value of battery electric cars sold after 36 months stood below 40% in 2017, but has since been closing the gap with other powertrains, reaching around 55% in mid-2022. This is the result of many factors, including higher prices of new electric cars, improving technology allowing vehicles and batteries to retain greater value over time, and increasing demand for second-hand electric cars. Similar trends have been observed in China.

High or low resale values have important implications for the development of second-hand electric car markets and their contributions to the transition to road transport electrification. High resale values primarily benefit consumers of new cars (who retain more of the value of their initial purchase), and carmakers, because many consumers are attracted by the possibility of reselling their car after a few years, thereby fostering demand for newer models. High resale values also benefit leasing companies, which seek to minimise depreciation and resell after a few years.

Leasing companies have a significant impact on second-hand markets because they own large volumes of vehicles for a shorter period (under three years, compared to 3 to 5 years for a private household). Their impact on markets for new cars can also be considerable: leasing companies accounted for over 20% of new cars sold in Europe in 2022.

Overall, a resale value for electric cars on par with or higher than that of ICE equivalents contributes to supporting demand for new electric cars. In the near term, however, a combination of high prices for new electric cars and high resale values could hinder widespread adoption of used EVs among mass-market consumers seeking affordable cars. In such cases, policy support can help bridge the gap with second-hand ICE prices.

International trade for used electric cars to emerging markets is expected to increase

As the EV stock ages in advanced markets, it is likely that more and more used EVs will be traded internationally, assuming that global standards enable technology compatibility (e.g. for charging infrastructure). Imported used vehicles present an opportunity for consumers in EMDEs, who may not have access to new models because they are either too expensive or not marketed in their countries.

Data on used car trade flows are scattered and often contradictory, but the history of ICE cars can be a useful guide to what may happen for electric cars. Many EMDEs have been importing used ICE vehicles for decades. UNEP estimates that Africa imports 40% of all used vehicles exported worldwide, with African countries typically becoming the ultimate destination for used imports. Typical trade flows include Western European Union member states to Eastern European Union member states and to African countries that drive on the right-hand side; Japan to Asia and to African countries that drive on the left-hand side; and the United States to the Middle East and Central America.

Used electric car exports from large EV markets have been growing in recent years. For China, this can be explained by the recent roll-back of a policy forbidding exports of used vehicles of any kind. Since 2019 , as part of a pilot project, the government has granted 27 cities and provinces the right to export second-hand cars. In 2022, China exported almost 70 000 used vehicles, a significant increase on 2021, when fewer than 20 000 vehicles were exported. About 70% of these were NEVs, of which over 45% were exported to the Middle East. In 2023, the Ministry of Commerce released a draft policy on second-hand vehicle export that, once approved, will allow the export of second-hand vehicles from all regions of China. Used car exports from China are expected to increase significantly as a result.

In the European Union, the number of used electric cars traded internationally is also increasing . In both 2021 and 2022, the market size grew by 70% year-on-year, reaching almost 120 000 electric cars in 2022. More than half of all trade takes place between EU member states, followed by trade with neighbouring countries such as Norway, the United Kingdom and Türkiye (accounting for 20% combined). The remainder of used EVs are exported to countries such as Mexico, Tunisia and the United States. As of 2023, the largest exporters are Belgium, Germany, the Netherlands, and Spain.

Last year, just over 1% of all used cars leaving Japan were electric. However these exports are growing and increased by 30% in 2023 relative to 2022, reaching 20 000 cars. The major second-hand electric car markets for Japanese vehicles are traditionally Russia and New Zealand (over 60% combined). After Russia’s invasion of Ukraine in 2022, second-hand trade of conventional cars from Japan to Russia jumped sharply following a halt in operations of local OEMs in Russia, but this trade was quickly restricted by the Japanese government, thereby bringing down the price of second-hand cars in Japan. New Zealand has very few local vehicle assembly or manufacturing facilities, and for this reason many cars entering New Zealand are used imports. In 2023, nearly 20% of all electric cars that entered New Zealand were used imports, compared to 50% for the overall car market.

In emerging economies, local policies play an important role in promoting or limiting trade flows for used cars. In the case of ICE vehicles, for example, some countries (e.g. Bolivia, Côte d’Ivoire, Peru) limit the maximum age of used car imports to prevent the dumping of highly polluting cars. Other countries (e.g. Brazil, Colombia, Egypt, India, South Africa) have banned used car imports entirely to protect their domestic manufacturing industries.

Just as for ICE vehicles, policy measures can either help or hinder the import of used electric cars, such as by setting emission standards for imported used cars. Importing countries will also need to simultaneously support roll-out of charging infrastructure to avoid problems with access like those reported in Sri Lanka after an incentive scheme significantly increased imports of used EVs in 2018.

The median age of vehicle imports tends to increase as the GDP per capita of a country decreases. In some African countries, the median age of imports is over 15 years. Beyond this timeframe, electric cars may require specific servicing to extend their lifetime. To support the availability of second-hand markets for electric cars, it will be important to develop strategies, technical capacity, and business models to swap very old batteries from used vehicles. Today, many countries that import ICE vehicles, including EMDEs, already have servicing capacity in place to extend the lifetimes of used ICE vehicles, but not used EVs. On the other hand, there are typically fewer parts in electric powertrains than in ICE ones, and these parts can even be more durable. Battery recycling capacity will also be needed, given that the importing country is likely to be where the imported EV eventually reaches end-of-life. Including end-of-life considerations in policy making today can help mitigate the risk of longer-term environmental harm that could result from the accumulation of obsolete EVs and associated waste in EMDEs.

Policy choices in more mature markets also have an impact on possible trade flows. For example, the current policy framework in the European Union for the circularity of EV batteries may prevent EVs and EV batteries from leaving the European Union, which brings energy security advantages but might limit reuse. In this regard, advanced economies and EMDEs should strengthen co-operation to facilitate second-hand trade while ensuring adequate end-of-life strategies. For example, there could be incentives or allowances associated with extended vehicle lifetimes via use in second-hand markets internationally before recycling, as long as recycling in the destination market is guaranteed, or the EV battery is returned at end of life.

Throughout this report, unless otherwise specified, “electric cars” refers to both battery electric and plug-in hybrid cars, and “electric vehicles” (EVs) refers to battery electric (BEV) and plug-in hybrid (PHEV) vehicles, excluding fuel cell electric vehicles (FCEV). Unless otherwise specified, EVs include all modes of road transport.

Throughout this report, unless otherwise specified, regional groupings refer to those described in the Annex.

In the Chinese context, the term New Energy Vehicles (NEVs) includes BEVs, PHEVs and FCEVs.

Based on model trim eligibility from the US government website as of 31 March 2024.

SUVs may be defined differently across regions, but broadly refer to vehicles that incorporate features commonly found in off-road vehicles (e.g. four-wheel drive, higher ground clearance, larger cargo area). In this report, small and large SUVs both count as SUVs. Crossovers are counted as SUVs if they feature an SUV body type; otherwise they are categorised as medium-sized vehicles.

Measured under the Worldwide Harmonised Light Vehicles Test Procedure using vehicle model sales data from IHS Markit.

Price data points collected from various data providers and ad-hoc sources cover 65-95% of both electric and ICE car sales globally. By “price”, we refer to the advertised price that the customer pays for the acquisition of the vehicle only, including legally required acquisition taxes (e.g. including Value-Added Tax and registration taxes but excluding consumer tax credits). Prices reflect not only the materials, components and manufacturing costs, but also the costs related to sales and marketing, administration, R&D and the profit margin. In the case of a small electric car in Europe, for example, these mark-up costs can account for around 40% of the final pre-tax price. They account for an even greater share of the final pre-tax price when consumers purchase additional options, or opt for larger models, for which margins can be higher. The price for the same model may differ across countries or regions (e.g. in 2023, a VW ID.3 could be purchased in China at half its price in Europe). Throughout the whole section, prices are adjusted for inflation and expressed in constant 2022 USD.

This metric of depreciation used in second-hand technology markets represents the value of the vehicle when being resold in relation to the value when originally purchased. A resale value of 70% means that a product purchased new will lose 30% of its original value, on average, and sell at such a discount relative to the original price.

Reference 1

Reference 2, reference 3, reference 4, reference 5, reference 6, reference 7, reference 8, subscription successful.

Thank you for subscribing. You can unsubscribe at any time by clicking the link at the bottom of any IEA newsletter.