Canada’s Supreme Court scrutinizes Facebook's role in Cambridge Analytica privacy scandal

MONTREAL (CN) — The Office of the Privacy Commissioner of Canada argued Thursday that Facebook breached provisions of Canada’s private-sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA.

In 2015, a global scandal sparked after a personality quiz app on the major social media platform was found to collect data from users and their friends. That information was shared with Cambridge Analytica, a political consulting firm that used the data for political profiling and targeted advertising.

Between 2018 and 2019, the Privacy Commissioner of Canada investigated Facebook under PIPEDA and concluded users did not give meaningful consent for their data to be shared with third-party apps, and that Facebook failed to implement adequate safeguards to protect that information.

But attorney Michael Feder, representing Facebook before the Supreme Court, said users gave their meaningful consent when signing up and agreeing to Facebook’s terms of use, which he described as presented “in the plainest of language,” “not legalese.”

Feder cited the opening lines of Facebook’s terms: “Just like when you share information by email or elsewhere on the web, information you share on Facebook can be re-shared.”

But Justice Andromache Karakatanis said this consent is too distant.

“You are not just sharing with friends; it’s sharing with friends who have then determined how that information can be shared with others,” she says.

Justice Nicholas Kasirer backed this up, citing the Federal Court of Appeal, which in 2024 overturned a Federal Court of Canada ruling that sided with Facebook. The appeal court reasoned friends of direct app users would have “at best, a vague and rosy picture of how third-party apps may use their data.”

Facebook also maintained the information shared — including birth dates, locations and liked activities — isn’t sensitive data, like medical or other highly private information.

“Facebook is a social network. People choose to come to Facebook because they want to share information. No one is coming to Facebook with things they wish to keep secret from the world … The reason we are given the likes is because one wants the world to know,” Feder said.

But Justice Mahmud Jamal countered by explaining that as Canadians live more of their lives online, their digital trail of activities offers insight into their personal lives and political views.

“If you ask Canadians, when you participate on Facebook, do you know that your data trail is being used to target political messages to you, to sell you things? Some may say ‘I don’t care,’ but others may say, ‘actually, I didn’t know that,’” he said.

Feder also argued that any issues with a third-party app’s privacy policies are the responsibility of the app developer — not Facebook. In this case, he pointed to Aleksandr Kogan, the creator of the “This Is Your Digital Life" app at the center of the case.

Colleen Bauman, representing the Privacy Commissioner, pushed back, arguing Facebook failed to act on clear warning signs. In particular, the company knew that the app was requesting access to user data beyond what the app needed, which Facebook’s own policies prohibited.

“Facebook acknowledged that this was a red flag, yet they failed to take any steps. They continued to disclose data for the next year,” she said.

Feder countered that Facebook had put safeguards in place and improved its platform to protect user data. Facebook’s filings detail how the company implemented the Privacy Commissioner’s recommendations from a 2008 investigation.

This included the Granular Data Permissions system, implemented in 2010. Under this system, when a user installed an app, they were informed about the types of information the app wanted to access, given a link to the app’s privacy policy, and able to grant or deny each requested permission. However, these safeguards were put in place before the creation of the app.

The debate also drew interventions from civil liberties groups.

Cynthia Khoo, attorney for the British Columbia Civil Liberties Association, which participated as an intervener, stressed the complex modern reality of social media platforms as part of a vast third-party ecosystem, where companies collect and monetize personal data.

She cited examples such as social media posts being used by surveillance firms to monitor protestors or activity data feeding algorithmic models that discriminate in housing and employment.

Social media is comparable to an iceberg, Khoo said. The tip is the basic information we share: the likes, posts, and texts. The rest is the information inferred from it: behavior patterns, political views, and more, that is sold to third parties.

“Users need to be informed about the entire iceberg, not just the part above the water. They should be informed of the potential consequences,” she said.

The justices did not indicate when or how they would rule.