‘The Great Hack’: Cambridge Analytica’s voter data theft

The Great Hack returns to Netflix feeds just as regulators are still sorting through the last of the Cambridge Analytica fallout, reminding viewers how a single app quietly turned Facebook into a political weapon. The 2019 documentary follows the people who uncovered the theft and the systems that made it possible, keeping the focus on verifiable mechanics rather than conspiracy. That focus still matters because the same data pipelines now power newer targeting tools and fresh litigation.

Data collection mechanics

The film traces the harvesting to a personality quiz called thisisyourdigitallife, built by researcher Aleksandr Kogan. Roughly 270,000 users took the quiz and granted access that extended to their friends’ accounts, ultimately reaching 87 million profiles. Cambridge Analytica paid about one million dollars for the data set, then matched the profiles to voter rolls for microtargeting.

Internal documents shown in the film outline how the firm scored users on openness, conscientiousness, and neuroticism to decide which messages would land hardest. The operation was legal under Facebook’s old “friends of friends” permissions, a loophole closed only after the scandal broke.

Because the quiz collected structured personality data rather than simple likes, the targeting moved past standard demographic buckets into psychological framing. That shift is the core technical claim the documentary keeps returning to with primary documents and on-camera explanations.

Whistleblower timelines

Christopher Wylie first contacted journalists in 2018 with internal slides and contracts, triggering The Guardian’s Cambridge Analytica Files series. Brittany Kaiser, then a former business-development director, later added emails and payment ledgers that showed coordination with political clients. The film intercuts their disclosures with contemporaneous news footage to keep the chronology tight.

David Carroll, a New York professor, filed suit in the UK to retrieve his own profile and psychological score. His case became the documentary’s narrative spine, illustrating how individuals could push back against corporate data collection even after the firm declared bankruptcy.

Carole Cadwalladr’s reporting supplied the public record that Wylie and Kaiser could corroborate. The film shows her publishing findings while facing legal threats, underscoring the personal cost of surfacing the data-harvest story.

Political client pipeline

Cambridge Analytica worked for Ted Cruz’s 2016 primary campaign before shifting resources to the Trump effort and Brexit-related groups. The documentary includes internal estimates that the firm needed only a few data points per voter to identify “persuadables” in swing states. Those lists drove ad placement and door-knock priorities.

Steve Bannon’s early involvement is documented through emails and organizational charts. Former staff describe the work as an attempt to weaponize personality science, a phrase the film lets sit without added commentary.

After the 2016 election the firm continued pitching similar services abroad until bankruptcy filings in May 2018. The film notes that the underlying data and code were never fully accounted for once the company dissolved.

Facebook’s platform role

The documentary spends time on the API settings that let the quiz pull data from non-users. Facebook’s 2018 admission that up to 87 million accounts could have been affected is shown alongside Mark Zuckerberg’s congressional testimony. The company suspended Cambridge Analytica in March of that year.

Internal Facebook emails presented in the film reveal staff discussions about restricting data access years earlier. Those messages surface again in later regulatory filings, linking the 2014 harvest to the 2019 FTC settlement of five billion dollars.

Platform changes since the scandal, including tighter third-party review processes, are mentioned only in passing because the film keeps its scope on the original breach rather than later reforms.

Regulatory aftermath

The FTC penalty remains the largest privacy fine levied against any U.S. company. A separate class-action settlement reached 725 million dollars, with payments beginning in 2025. State-level cases continue; a New Mexico jury recently found millions of privacy violations tied to the same data practices.

The film’s release coincided with the FTC order, giving Netflix viewers a real-time view of enforcement. Updates to the documentary’s companion website now link to the latest court dockets, keeping the original reporting current.

EU regulators used the scandal to accelerate GDPR enforcement, though the documentary stops short of assessing those outcomes. The focus stays on the U.S. and UK investigations that directly involved the whistleblowers featured on screen.

Documentary storytelling choices

Directors Karim Amer and Jehane Noujaim structure the film around three intersecting arcs: Carroll’s lawsuit, Kaiser’s testimony, and Cadwalladr’s reporting. Archival footage of campaign rallies is intercut with server-room shots to keep the data trail visible.

The 113-minute runtime premiered at Sundance in January 2019 and landed on Netflix the following July. Reviewers noted the absence of traditional villains; instead the film presents engineers, lawyers, and journalists navigating systems larger than any single actor.

Sound design emphasizes the click of data queries rather than ominous music, a choice that keeps the tone closer to procedural than thriller. That restraint lets primary documents carry the narrative weight.

Cultural ripple effects

The phrase “data rights are human rights” appears in the film’s promotional materials and later became a talking point during state privacy-law debates. Carroll repeats the line in voice-over, framing the scandal as a consumer-rights issue rather than a partisan one.

Streaming metrics show renewed interest whenever new fines or verdicts surface, indicating the documentary still functions as an entry point for viewers tracking platform accountability. Social-media clips of Wylie’s testimony circulate again each election cycle.

Academic syllabi in media-studies and data-science programs now include the film alongside primary-source packets from the FTC docket. That crossover use keeps the material in circulation beyond entertainment platforms.

Current litigation threads

Residual claims from the original class action are still being processed, with some users receiving settlement checks only in recent months. Parallel suits allege that Facebook’s post-scandal disclosures were incomplete, tying back to the same API permissions shown in the documentary.

State attorneys general continue to reference the Cambridge Analytica data set when examining newer analytics vendors. The film’s archival contracts serve as comparative evidence in those ongoing reviews.

No new criminal charges have been filed against former Cambridge Analytica staff, though civil discovery in the New Mexico case has produced additional internal emails not seen in the documentary.

Forward-looking stakes

The Great Hack ends with Carroll asking what happened to the data after bankruptcy. That question remains open as newer microtargeting firms adopt similar personality models under different names. Regulators now require routine audits of political ad libraries, yet the underlying data brokerage market continues to expand.

Viewers returning to the film in 2026 encounter a landscape where the 2016 harvest is no longer an isolated breach but a precedent for how platforms and campaigns share information. The documentary’s strength lies in keeping that precedent legible without speculation about future elections.