What a provocative AI advertisement reveals about data privacy, behavioral influence, and the lessons we apparently haven’t learned.

By: Jennifer Gilligan, IntegraMSP President

I came across an interesting advertisement on LinkedIn this week about AI and data privacy. It was provocative, certainly. The imagery of personal information being auctioned off was designed to get attention, and it worked. But what caught my attention wasn’t the idea of personal data being sold. It was the much subtler implication of what happens after that data changes hands.

And that got me thinking about Cambridge Analytica. Remember that scandal?

In 2018, Cambridge Analytica became synonymous with the harvesting of Facebook user information and the use of psychological profiling to target political messaging. But the story didn’t end there. In February 2025, ProPublica published an extraordinary investigation detailing how the firearms industry had shared sensitive customer information with political operatives, including Cambridge Analytica, to influence elections.

The information went well beyond names, addresses, and purchasing histories. It included personal interests, financial circumstances, religious affiliations, and intimate details about consumers’ lives. That information was combined with commercially available data to build psychological profiles. Those profiles were then used to determine which messages would be most persuasive to particular groups of voters.

Think about that for a moment. Information collected through ordinary commercial transactions was repurposed to influence political behavior. The people providing that information weren’t necessarily aware of how it would eventually be used.

And that is the part of this story we should be paying attention to as AI becomes embedded in everyday life.

Same business model. Different technology.

We have been collecting, aggregating, analyzing, buying, and selling personal information for decades. Data brokers existed long before generative AI. Behavioral advertising existed long before ChatGPT. Political microtargeting didn’t suddenly appear because someone developed a large language model. What’s changing is the sophistication and accessibility of the technology.

Consider how much information people now voluntarily share with AI platforms. Business strategies. Financial information. Personal challenges. Customer data. Internal documents. Questions they might never type into a traditional search engine. Sometimes that information is protected by strong privacy controls and contractual restrictions. Sometimes it isn’t. And not every AI provider uses customer information for advertising, model training, or resale. Those distinctions matter.

But so does the larger question: What happens when increasingly detailed information about human behavior becomes available for purposes beyond those originally intended?

AI can make it easier to analyze enormous amounts of information, identify patterns, generate personalized messaging, and automate interactions at a scale that would have been difficult or prohibitively expensive just a decade ago. The underlying concept isn’t new. The ability to execute it at scale is changing dramatically.

Privacy is only part of the conversation.

We tend to frame data privacy around unauthorized access, security breaches, and identity theft. Those are legitimate concerns. But Cambridge Analytica demonstrated another dimension of the problem. Information doesn’t have to be stolen to be used in ways that people never anticipated.

It can be collected for one purpose, transferred or combined with other information, and subsequently used to influence decisions. And those decisions aren’t limited to elections.

Consider the potential implications for consumer purchasing, financial decisions, employment, public opinion, and even the information people encounter when researching important issues.

There is an important distinction between understanding an audience and exploiting what you know about that audience.

Personalization can be useful. Targeted communication can be entirely legitimate.

But when an organization uses intimate behavioral information to identify vulnerabilities and shape decisions without meaningful transparency, we’re having a very different conversation.

One that raises questions about consent, autonomy, and accountability.

AI governance is about more than protecting company information.

I spend a great deal of time talking about AI adoption and governance. Much of that conversation understandably centers on protecting confidential information, controlling access, establishing acceptable-use policies, and evaluating vendors. All important.

But I think we need to broaden our thinking.

Organizations should understand not only what information their AI tools collect, but also how that information is retained, processed, shared, and potentially used downstream.

Who owns it? Who can access it? Can it be used to train models? Is it shared with third parties? What happens when a contract ends?

And perhaps most importantly, does the person providing that information understand what they have actually agreed to?

Because consent buried in pages of legal language isn’t necessarily the same thing as informed understanding. The responsibility also extends beyond AI providers. Businesses collecting customer and employee information have an obligation to consider how their own technology decisions affect the people whose data they hold.

We have seen this before.

When I first saw the advertisement - I was - hmm - clever. And then I was - wait - I've seen this before - this is just a new flavor.

It presented a disturbing vision of personal information becoming a commodity. But that isn’t some distant, hypothetical future. We already know that personal data can be collected, combined, sold, analyzed, and used to influence behavior. ProPublica’s reporting provides a particularly compelling example of how that process has operated in practice.

AI doesn’t invent the problem.

It introduces new capabilities, new sources of information, and potentially far greater scale. And while we should absolutely be excited about what AI makes possible, we should be equally interested in who controls the information powering those possibilities.

Because the real issue isn’t simply whether our data is being collected or sold.

It’s whether we retain any meaningful control over what that information is ultimately used to accomplish.

The technology is new. The business model isn’t. And we would be wise to remember what happened the last time we underestimated the difference.

Referenced reading

LinkedIn advertisement that prompted this article
https://www.linkedin.com/posts/acostaloren%C3%A0_ai-dataprivacy-futureofwork-activity-7467945264138604544-fEBi

ProPublica: Gun Lobbyists and Cambridge Analytica Weaponized Gun Owners’ Private Details for Political Gain — February 5, 2025
https://www.propublica.org/article/guns-lobbying-cambridge-analytica-nssf-privacy-elections

ProPublica: How Cambridge Analytica Used Intimate Data to Exploit Gun Owners’ Private Lives — February 27, 2025
https://projects.propublica.org/gun-owners-cambridge-analytica-data-psychological-profiles-privacy/

Federal Trade Commission: Cambridge Analytica case
https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3107-cambridge-analytica-llc-matter