Ideas Analysis
Same Scandal, Different Price
Cambridge Analytica cost 5 billion dollars in the US and 50 million in Australia. In Latin America it cost nothing. Bolivia still has no data protection law, and Europe already bans what just happened here.
By Violeta Ayala — Tecnóloga Creativa
The price
Cambridge Analytica harvested data from tens of millions of Facebook users to profile voters. The scandal broke in 2018 and it was the same scandal everywhere.
What changed was the price each country charged.
FTC penalty, 2019
settlement with users, 2023
payment program, 2024
ICO fine, 2019
No payment program.
Meta admitted no liability in any of the settlements.
The Australian case holds the number that explains everything. Only 53 people in Australia installed the app that collected the data.
311,127 were affected. The app took the data of the friends of whoever installed it.
Australia's privacy regulator sued Meta in March 2020. The case closed in December 2024 with a settlement, after a court-ordered mediation.
Seven years of investigation and litigation. Meta withdrew from the case without admitting any breach of the law.
The laws that came after
The British fine was 500,000 pounds because that was the maximum the law allowed at the time of the conduct. One month after the scandal broke, in May 2018, Europe's General Data Protection Regulation took effect.
Under that rule, the same conduct would have cost a percentage of global revenue.
Australia opened a review of its 1988 Privacy Act and is still adjusting it. Chile passed Law 21.719, in force from December 1, 2026, creating a Data Protection Agency for the first time.
Brazil already had its general data protection law and a national authority.
What Europe bans today
On October 10, 2025, the European regulation on transparency and targeting of political advertising took effect. It requires labeling every political ad and disclosing who paid for it, what it cost, which election it concerns, and what targeting mechanisms were used.
It requires explicit consent to use data for political purposes and bans profiling based on sensitive data such as ethnic origin or political opinions.
And one rule is worth reading slowly from Bolivia: it bans foreign entities from providing political advertising services in the three months before an election.
Meta and Google chose to stop selling political advertising in the European Union rather than comply. They called the rule unworkable.
A demanding regulation changed the behavior of two of the largest companies in the world. That is the point of comparison.
Bolivia
Bolivia has no personal data protection law. It is one of the few countries in Latin America still without one.
What exists is the constitutional recognition of privacy and informational self-determination in articles 21 and 130, the privacy protection remedy, and some sectoral rules in telecommunications.
There are at least two drafts written and public. One from the electronic government agency, another driven by the InternetBolivia.org Foundation together with civil society organizations.
Neither has become law.
There is also no electoral rule requiring campaigns to declare the origin of the data they use, their algorithmic targeting, or their use of artificial intelligence. The electoral authority has no unit able to audit any of it.
And there is no register of foreign political consultants. The United States requires anyone acting for a foreign interest to register. Bolivia asks for nothing.
Put it side by side. Europe bans foreign entities from providing political advertising services three months before a vote. In Bolivia, a foreign consultant holding the regional license to an artificial intelligence platform joined the campaign between the first round and the runoff.
That campaign's strategist says he was not paid, and that what he brought was daily data on Bolivians.
The three asymmetries
First. Capability arrives before regulation. The tools land fully built. The oversight has to be invented afterwards, if anyone remembers.
Second. The economics invert accountability. A tool sold at commercial rates in the United States can be deployed at near zero cost in a smaller market.
No price means no contract, no contract means no record, and no record means nothing to audit. Free is not generosity. Free is what makes influence untraceable.
Third. Testing happens where scrutiny is thinnest. Brazil 2022, Argentina 2023, Honduras 2025, Bolivia 2025.
Techniques are refined where nobody audits, then exported upward.
None of this requires a conspiracy. It requires only that capability outpace accountability.
That is the default condition across most of the world.
What can be done
The data protection law is already written. Twice. It needs to be debated and passed, with an autonomous authority able to enforce it, as Chile has just done.
The electoral rule is cheaper still. Require every campaign to declare what data it used, where it came from, who paid for it, and on what criteria it targeted.
It is a box on a form that already exists. Europe has required it since October 2025.
And a register of foreign political consultants, obliged to declare who hires them and who pays them, even when they charge nothing.
Especially when they charge nothing.
Australia took seven years to close its case and secured a payment program for 311,000 people. Without a law, that account cannot even be opened here.
The question worth asking in every election from now on is short: what data, sourced how, and paid for by whom.
Sources
- Office of the Australian Information Commissioner. Enforceable undertaking accepted from Meta Platforms, December 2024, and statements on the 50 million Australian dollar payment program. Figures on affected users and app installations taken from the civil penalty proceedings.
- United States Federal Trade Commission. 2019 order concerning Facebook.
- Meta class action settlement with US users, 725 million dollars, 2023.
- United Kingdom Information Commissioner's Office. 500,000 pound fine, paid without admission of liability, 2019.
- European Union Regulation on the transparency and targeting of political advertising, in force since October 10, 2025.
- Statements by Meta and Google on withdrawing political advertising in the European Union, July and October 2025.
- Chile's Law 21.719, in force from December 1, 2026, creating the Personal Data Protection Agency.
- Political Constitution of the State of Bolivia, articles 21 and 130.
- Draft Personal Data Protection Law from Bolivia's electronic government agency.
- Draft Personal Data Protection Law promoted by the InternetBolivia.org Foundation.
- Catalina Paz. Talk at the Global Youth Leadership Forum, published by Trendsetter Bolivia and reproduced by eju.tv on December 11, 2025.
Fine and settlement figures come from official documents issued by each authority. The absence of a law in Bolivia is verified against regional comparative guides and against the draft bills themselves, which exist precisely because the law does not. The reading of the asymmetries is interpretive.
