It’s been quite a month for Facebook, Cambridge Anayltica, and a previously unknown Cambridge researcher named Aleksandre Kogan, writes Kirsty Cameron, digital planning director, Starcom, exclusively for ExchangeWire.

The facts, as most people know them by now, are that some 270,000 people opted in to answer some questions through an app called MyDigitalLife, which gave the researcher some pretty rich data sets. What a lot of people didn’t know, was that at that time, it was standard practice for apps such as these to be able to pull the Facebook data of the friends of those 270,000 people too, and this this led to some 50 million profiles being passed over to Cambridge Anayltica and, supposedly, helped Trump win the election though some nifty micro-targeting. People’s horror at this revelation has taken many turns, with hashtags (on Facebook no less), of #deletefacebook, as well as longwinded Twitter threads revealing exactly how Facebook and Google are using your data, and how much they do indeed know about you. The reason this has grasped the public consciousness so acutely, of course, is twofold. Firstly, this is Facebook and, secondly, this concerns politics and the idea that our minds can be swayed from tailored messages on the platform we use the most has an element of George Orwell’s 1984 to it. On top of this, as with any story surrounding Facebook, or indeed Youtube, traditional publications have jumped on it to ‘expose’ Facebook and give it a dressing down, as it continues to take more ad revenue and has little to say in the way of apology, apart from a limp "this should not have happened".

As a couple of the more measured responses to the scandal have pointed out, using data to inform your targeting is far from new. From a marketing perspective, this is of course done all the time. Email addresses you have given to the likes of Airbnb are used to create custom audiences on Facebook. Shopper data you give over to your supermarket can be used to match who you are on social media. What you like and what you post, where you live, are all used for better targeted ads. Clicking 'I agree' is second nature when viewing the Ts and Cs and, of course, as The Guardian pointed out: "An individual who depends on Google, Facebook, or Twitter is not in a position to negotiate her own separate agreement. Why spend time on a contract you can neither change nor refuse?" The problem lies at the heart of the business model. To use the hackneyed phrase, "if the service is free, you’re the product", that’s the reality. Mark Zuckerberg himself admits, "the ad-based model isn’t going to go away", at least in social media. The subject is particularly pertinent to Facebook, which doesn't have anything directly tangible to give its customers, unlike other giants, such as Apple and Amazon, who would survive if all ads disappeared tomorrow.

What does this mean for advertisers?

The controversy couldn’t come at a more timely moment. The GDPR is coming into effect in May and will change everything in a real way. The right to be forgotten, opting in, instead of out, will have a genuine impact on advertisers. How brands and agencies negotiate this change remains to be seen, and what it will do for the brands that hold so much of our data, anonymised or not. A lot of people are talking about a value exchange, and I think they're right. Data strategy is important for media agencies and advertisers – of course it is. And it's not confined to Facebook by any stretch. Clever uses of data in OOH, (Spotify's Valentine's campaign comes to mind), show that it can improve communications when used responsibly and ethically. I do not mind if Netflix uses my data, or someone else's, to recommend shows it thinks I will enjoy.

Apps asking your opinion and giving much richer data sets is no longer allowed and hasn’t been for a few years. But Facebook still has hugely useful data points that may no longer be permissible, outside of what you offer up, such as age, occupation, location, etc. With the arrival of the GDPR, third-party partners will now be removed as a targeting option. That may not be a good thing for the ad world or the premium publishers. As Benedict Evans recently surmised: "The more that Apple stops people knowing about you and that Facebook stops anyone except Facebook knowing what it knows about you, the more that Facebook (and Google) ads are worth and the less any other ads are worth. Which is good for privacy, but maybe not great for ad-funded content." With 80% of ad revenue already going to Google and Facebook in Europe (up to 84% globally, excluding China), these tighter strictures might lead to even tighter walled gardens and an increase on the duopoly. Relatively harmless (if annoying) cookie-based targeting is being effectively outlawed, which is what most publishers rely on, whilst the tech giants with the richer datasets can gain further competitive advantage. Advertisers have no choice to but to be more reliant on the duopoly. In essence, it is a game theory problem. But ePrivacy has still not been enshrined in law. It's not too late for regulators to focus on reigning in the duopoly rather than just sinking smaller publishers through demanding cookie consent. It has left the rest of the internet scrambling around for the 20%; and if quality content is going to continue to exist, this new legislation might mean more publishers will have to turn to a subscription-based model.

What is clear, is that no one is going to stop using Facebook: users and advertisers will both continue to flock there. There will continue to be bad ads on Facebook (not useful, or spam-like), but Facebook has scale and a lot of validated data that was willingly handed over. Unlike the brand-safety question on YouTube, which got brands legitimately nervous, this hasn’t. After all, as one ad exec put it, "this is a Facebook problem, not a brand problem". Only seven brands ceased to advertise on Facebook after this scandal broke. The Cambridge Analytica saga may have highlighted how unscrupulous Facebook is, and yet it looks like legislators (and advertisers, as a consequence) are only looking to strengthen their position rather than penalise them.