The question
What should have been independently verified when personal data moved from a platform, through a third party, into profiling, targeting and downstream decision systems?
CASE 010 · INDEPENDENT PUBLIC-SOURCE CASE STUDY
WHEN DATA OUTLIVES THE ORIGINAL PERMISSION
What should have been independently verified when personal data moved from a platform, through a third party, into profiling, targeting and downstream decision systems?
Case type: Independent public-source demonstrationClient status: Not a client engagementPrimary capability: Data Provenance & Third-Party Use VerificationSite review: 18 August 2026
Public document status
Web case study currently available. No full Aperture public PDF is published for this demonstration.
The case page remains a public illustration of the evidence problem. If a full Aperture PDF is later approved for publication, the direct document link will be added here.
Decision structure
What this case is designed to test
The uncertainty
Direct-user data, connected-user data, onward transfer, derived profiles, deletion claims and downstream purpose required separate verification.
What had to be examined
Data provenance, authority at each material stage, onward transfer, purpose drift, derivative use, third-party controls and whether asserted deletion was actually verified.
Decision relevance
Whether possession of data established continuing authority to retain, transform, transfer or use it downstream.
Principal public finding
Authority to collect data at one point cannot safely be treated as authority for every later transfer, transformation, retention and use.
Reliance classification: DATA RELIANCE REQUIRES PROVENANCE, PURPOSE, TRANSFER AND DISPOSITION VERIFICATION AT EACH MATERIAL STAGE
This is a retrospective public-source case study. It asks what should have been independently verified before or during reliance. It does not claim Aperture would certainly have exposed the historical failure, and later evidence is not treated as though it was available at the earlier decision point.
Key verification themes
- Direct-user versus connected-user data
- Collection versus onward transfer
- Purpose drift and derivative profiles
- Deletion asserted versus deletion verified
- End-to-end provenance and third-party governance
Status discipline
Legal and factual status are kept separate.
The FTC formally found Cambridge Analytica engaged in deceptive practices. Facebook’s $5 billion FTC settlement was broader than Cambridge Analytica alone, while the separate $100 million SEC settlement was resolved without Facebook admitting or denying the allegations. This case does not claim Cambridge Analytica changed the result of a specific election.
Allegations, admissions, regulatory findings, settlements and adjudicated outcomes are not treated as interchangeable evidence categories.
Public proof, protected process
Enough to assess the work. Not enough to reproduce the system.
This public case explains the decision problem, the material evidence issue, the principal finding, important limitations and the reliance implication. Aperture's detailed non-public methodology, workflows and controls remain proprietary and are not published here.