Facebook

Part one

Engineering outrage

In January 2012, Facebook secretly manipulated the News Feeds of 689,003 users to test whether emotions could be transferred through algorithmic curation. They could: users shown less positive content posted more negatively, and vice versa. No informed consent was obtained. When the study was published in PNAS in 2014, COO Sheryl Sandberg called it "poorly communicated," and the UK's Information Commissioner's Office opened an investigation.^[1]

The company then built that capability into the product. When emoji reactions launched in 2017, the ranking algorithm weighted the "angry" reaction five times more than a like — systematically boosting inflammatory content. Internal data scientists warned leadership this was amplifying the most inflammatory material on the platform; change was slow, because reducing inflammatory content also reduced engagement.^[2]

In January 2018, a feed change meant to prioritize "meaningful social interactions" backfired: divisive posts drew the most comments and reshares, so the change boosted outrage. European political parties told Facebook the algorithm was forcing them into more negative, extreme messaging simply to maintain reach.^[2] A 2021 internal presentation put it plainly: "Our algorithms exploit the human brain's attraction to divisiveness."^[3] The full mechanics are on The Machine.

Part two

The whistleblowers

In 2021, product manager Frances Haugen copied tens of thousands of internal documents and took them to regulators and the press. They showed a company that repeatedly measured its own harms — and repeatedly chose engagement.

• September 13, 2021
  The Wall Street Journal publishes "The Facebook Files"

  Internal research shows the algorithm systematically amplified divisive content because it maximized engagement.^[2]

• October 3, 2021
  Haugen reveals her identity on 60 Minutes

  The anonymous source behind the Files goes public on CBS.^[4]

• October 5, 2021
  Haugen testifies before the U.S. Senate

  She tells senators what the company's own research showed — and that leadership knew.^[4]

• October 25, 2021
  "The Facebook Papers" published by 17+ news organizations

  A consortium of outlets publishes coordinated reporting on the full document set.^[3]

Among the revelations: a 2019 internal test account was recommended increasingly extreme political content — conspiracy theories and QAnon groups — within days. The "break the glass" safety measures deployed around the 2020 election worked, but were rolled back within weeks because they reduced engagement — before the January 6 Capitol insurrection. Facebook dissolved its Civic Integrity team in December 2020, after the election.^[3]

Haugen was not alone. In 2020, data scientist Sophie Zhang published a 7,800-word internal memo documenting how Facebook was used for coordinated political manipulation in Honduras, Azerbaijan, India, and other countries — and how slowly the company responded.^[5]

Part three

Your data was never safe

On July 24, 2019, the FTC imposed a $5 billion penalty — the largest ever against a tech company — for violating a 2012 consent decree that required explicit user consent for data sharing, and placed Facebook under 20-year oversight. Dissenting commissioners argued Zuckerberg should have been held personally liable.^[7] The settlement also noted that phone numbers users had supplied for two-factor authentication were used to target them with ads.^[7]

The breaches kept coming anyway. A September 2018 vulnerability in the "View As" feature exposed some 50 million accounts (later revised to 30 million); for 14 million of them, attackers could see gender, relationship status, religion, hometown, birthdate, education, work, recent locations, and recent searches. Ireland's Data Protection Commission later fined Meta €265 million.^[8] In April 2021, personal data of 533 million users from 106 countries appeared on a hacking forum; Facebook said it had been scraped through a vulnerability patched in 2019 — and declined to notify the people affected.^[8]

The surveillance also extends beyond the platform, and beyond its members. Facebook's Pixel, Like buttons, and Login are embedded on millions of third-party websites, tracking browsing even when you are not on Facebook — and, as a researcher demonstrated in 2011, even after you log out. Through uploaded contact lists, tracking pixels, and (until 2021) facial recognition, the company builds shadow profiles of people who never created an account; a Belgian court ordered it to stop tracking non-users on pain of €250,000 per day.^[9] In January 2023, Ireland's regulator fined Meta €390 million for forcing users to accept personalized ads as a condition of using Facebook and Instagram.^[8]

And what Facebook gathered, it quietly shared. A December 2018 New York Times investigation found data-sharing partnerships with more than 150 companies: Microsoft's Bing could see the names of virtually all users' friends without consent, Netflix and Spotify could read users' private messages, Amazon could obtain names and contact information through users' friends, and at least 60 device manufacturers had their own agreements.^[10]

Part four

Real-world damage

Myanmar was not an isolated case. In the Philippines, Duterte-aligned troll networks used Facebook to support an extrajudicial drug war, as Nobel laureate Maria Ressa has documented. In India, a 2019 internal test account filled with inflammatory Hindu nationalist content and calls for violence against Muslims within weeks. In Ethiopia, the platform spread hate speech during the Tigray conflict; the family of Professor Abrham Meareg, killed after inciting posts circulated about him, sued Meta.^[3]

The machine does the same thing to information. During the pandemic, health misinformation on Facebook was viewed an estimated 3.8 billion times in one year, and up to 65 percent of anti-vaccine misinformation traced back to just twelve individuals — while Facebook's own recommendation algorithms directed users toward anti-vaccine content.^[12] In the final three months of the 2016 campaign, the top 20 fake news stories on Facebook generated more engagement (8.7 million) than the top 20 stories from major legitimate outlets (7.3 million) — a suggestion Zuckerberg initially dismissed as "a pretty crazy idea."^[13] Russia's Internet Research Agency reached an estimated 126 million Americans through roughly 470 fake accounts and pages, even staging dueling real-world protests in Houston; the Senate Intelligence Committee called Facebook the "foremost" platform exploited, and Facebook did not publicly acknowledge the operation until September 2017.^[13]

The response, in January 2025, was to retreat: Meta ended its third-party fact-checking program in the US, replacing it with an unproven "Community Notes" system, and loosened its hate-speech policies.^[14]

Part five

The fine print

Regulators on both sides of the Atlantic have now put numbers on the conduct above. Cumulative fines and settlements exceed $9 billion.^[15]