It has been almost ten years since Cambridge Analytica became the dark myth at the centre of Trump, Brexit and political microtargeting.

But the lesson most people took from that scandal is still the wrong one.

Yes, the data breach was real. Yes, the company was unethical. And yes, Cambridge Analytica helped clients win campaigns that changed the world.

But the idea that it had built some secret psychological mind-control machine was always much shakier.

That story was useful to them.

“Stolen data” sounded impressive. “Psychographic profiling” sounded like science fiction. And to exactly the kind of clients Cambridge Analytica wanted to impress, it made the company look more powerful, more dangerous and more valuable than it probably was.

Even the excellent reporting on Cambridge Analytica by Carole Cadwalladr in The Guardian never fully closed the gap between the stolen data and the electoral impact Cambridge Analytica claimed it could create.

The reporting exposed a real scandal. But the public story that formed around it often gave the company’s own marketing more credit than it deserved.

The reality was less mystical, much more important and it still matters today.

The targeting was not magic

The targeting Cambridge Analytica actually used was often pretty clunky.

In a podcast interview, Matthew Oczkowski, Cambridge Analytica’s former Head of Product, described a much more familiar campaign logic: using available signals and proxies to identify likely audiences, test messages and improve performance over time.

One example he gives is 4x4 ownership as a rough proxy for Republican values.

Smart, yes. Useful, yes. Groundbreaking mind-control, no.

That distinction matters because it changes what we should learn from the scandal.

The real story is not that Cambridge Analytica hypnotised voters with stolen data. The real story is that they understood something many public-interest organisations still struggle to accept: campaign impact comes from research, testing, measurement and iteration.

What Cambridge Analytica actually did

What Cambridge Analytica actually did was data-driven strategy.

They researched audiences to understand what resonated. They turned those insights into creative executions. They measured engagement. Then they iterated relentlessly to improve.

Not once.

Not for one audience.

But again and again, across every segment where there was potential for cost-effective gain.

That is not magic.

It is marketing discipline.

And this is still badly understood, especially on the pro-democratic side.

Too often, data is treated as either suspicious or magical. Either it is seen as unethical manipulation, or it is treated as a black box that only hostile actors know how to use.

Both views are wrong.

The real leverage is not in stolen data.

It is in learning faster than your opponents.

• Which messages earn attention?

• Which frames resonate outside the base?

• Which creative versions travel?

• Which audiences are actually reachable?

• Which assumptions collapse the moment they meet the real world?

These are measurable questions.

And if the strategic thinking is sharp enough, if the organisation is honest enough to learn from the results and if the team is adaptable enough to keep improving, the advantage compounds.

The wrong lesson

The lesson from Cambridge Analytica was not that democracy was defeated by a magic database.

It was that disciplined research, audience insight, creative testing and iteration can beat people who are still trying to win attention with one polished message and a good conscience.

That should have been the real warning.

Instead, too many constructive actors learned a different lesson: that data-driven campaigning is inherently dirty, that targeting is manipulation and that ethical organisations should keep their distance from the tools of modern influence.

That mistake has been costly.

Because hostile actors did not stop using these tools. Populists did not stop testing messages. Disinformation networks did not stop learning from engagement. Political operators did not stop finding out which frames travel and which audiences can be moved.

They kept learning.

Much of the public-interest sector kept publishing.

That is the gap.

Detection is not response

This matters today because the disinformation field still spends too much energy on detection alone.

Detection is necessary. We need to know which narratives are spreading, who is amplifying them and where they are travelling.

But knowing which narratives are spreading is not the same as knowing what response actually reduces their traction, changes audience receptivity or builds resilience in the real world.

A dashboard does not change minds.

A fact-check does not automatically reach the people most vulnerable to the falsehood.

A threat report does not tell us which counter-message will work, with whom and why.

That is the next frontier.

Over the past years, Europe has built significant capabilities in monitoring, fact-checking and threat analysis. The next step is to develop real societal response capacity: one that can measure impact on citizens, test which interventions actually work and strengthen democratic resilience across Member States.

That is also where our work in the frame of the EU Narrative Observatory is heading.

The question is no longer only: what harmful narratives are spreading?

The harder question is: what actually works against them?

That answer will not come from guesswork. It will come from audience research, message testing, targeting logic, creative iteration and impact measurement.

In other words, from learning faster.

That was the useful lesson hidden inside the Cambridge Analytica scandal.

And it is still the lesson too many people refuse to learn.