For years, privacy advocates and scholars were waiting for some sort of “privacy Chernobyl.” After more than a decade of trying to focus attention on the growing threat of massive corporate surveillance, we began to wonder if it would take a massive meltdown of personal data ending up in the wrong hands for legislators, regulators, and the general public to take notice and take action.

We also knew that behemoths like Amazon, Google, and Facebook, and up-and-coming troublemakers like Uber were gathering up as much personal data as they could and deploying it in invisible ways.

We knew as early as 2011 that Facebook was allowing application developers access to personal and behavioral data for millions of Facebook users. Facebook wanted developers to build features like games that would make Facebook more attractive and important to daily life. So if you played Mafia Wars or Words with Friends through Facebook, you probably revealed personal information about all of your friends to Zygna or NewToy, the companies that built those games. This was not a mistake. This was by design.

We knew that in 2012 the re-election campaign of Barack Obama had built a voter contact system using Facebook and had acquired personal data on millions of American voters. When we tried to raise the alarm that no head of state should have so much personal data on so many of his citizens – many of whom opposed his candidacy – we were ignored because the dominant story at the moment was how digitally savvy the Obama campaign was. No one seemed concerned that the United States might some day have a president who was unconcerned with niceties like the rule of law or civil liberties.

With so much personal data floating out among political campaigns, consultants, and hundreds of unaccountable private companies, how could someone not be abusing Facebook users? How could Facebook refuse to concede the dangers it had encouraged?

For years privacy concerns lacked victims, villains, characters, stories, and a grand narrative. The problems with surveillance were as diffuse as any environmental problem. Without acute and visible harm, it was difficult to rally public concern.

The “privacy Chernobyl” started its meltdown at first slowly, then spectacularly. This time there were villains worthy of a James Bond thriller.

London-based consulting firm Cambridge Analytica was funded by a reclusive American right-wing hedge-fund billionaire named Robert Mercer. Its Vice President was extreme nationalist Steve Bannon, who later quit the board to run Donald Trump’s campaign for US president. An Eton-educated faux-Machiavelli named Alexander Nix was the chief executive officer. Nix resigned in 2018 after Channel 4 News revealed him boasting of setting up “honey traps” and bribery stings to influence global elections. A fictional drama could not have been cast any better.

In December 2016 a Swiss news site called Das Magazine published a long account of how Cambridge Analytica had worked with researchers at the University of Cambridge to gather personal information on millions of Facebook users and deploy it to position political advertisements on Facebook. Facebook users had been persuaded to take a seemingly harmless personality quiz.

Few took note of the Das Magazine story until the US-based news site Motherboard translated it into English six weeks later, in January 2017. At that point, other journalists and activists began trying to flesh out the story. Interest built, but was limited to the set of people who worked at the intersection of data analytics and politics.

More than a year later the reactor core melted down. In March 2018 the Observer and The New York Times simultaneously published articles on which they had been collaborating. These investigations were more complete and revealing than the relatively speculative work that Das Magazine had published.

Most crucially, the two newspapers revealed that Cambridge Analytica had acquired data on more than 50 million – ultimately revealed to be more than 87 million – Facebook users. Kogan had pledged to Facebook that he was collecting the data for academic research. But Facebook had no oversight system and foolishly trusted developers to keep user data safe and use it only for declared purposes.

The Observer revealed that Facebook learned it had allowed Cambridge Analytica to acquire the data as early as 2015 but had done nothing to alert users or regulators. Facebook had covered up a major scandal.

The fact that Cambridge Analytica had worked for the Donald Trump for President campaign in 2016 left the mistaken impression that the firm knew what it was doing and had influenced the vote.

The reaction was swift and spectacular. Regulators and legislators on two continents began investigations of both Facebook and Cambridge Analytica. Hillary Clinton attributed her 2016 loss in part to the roles that Facebook and Cambridge Analytica had played.

While privacy advocates welcomed the newfound attention to the issues of corporate surveillance, ad targeting, and the abuse of personal data for political ends, the spectacle of Cambridge Analytica obscured the full scope of the problem.

The fact is that Cambridge Analytica sold snake oil to gullible political campaigns around the world. Nix boasted of the power of “psychometric profiling” of voters using a complex set of personality descriptors. Nix somehow convinced campaigns that this ability to stereotype voters could help them precisely construct of messages and target ads. There is no reason to believe any of this.

Personality testing is generally unreliable and the results are difficult to replicate. There is no evidence that “personality” accurately predicts political persuasion better than more obvious traits like gender, education levels, social class, or the big one -- declared party affiliation. Campaign officials working for Senator Ted Cruz, the US presidential candidate who employed Cambridge Analytica before the Trump campaign did, complained that the firm did nothing to help the losing campaign.

The fact is that if you want to target political advertisements precisely to move voters who have expressed interest in particular issues or share certain interests, there is an ideal tool to use that does not rely on pseudoscience. It’s called Facebook.

Buying an inexpensive ad on Facebook involves a simple process of choosing the location, gender, occupation, education level, hobbies, or professional affiliation of Facebook users. You don’t need Cambridge Analytica when you have Facebook. Both the “Leave” campaign and the Trump campaign purchased many ads on Facebook.

Facebook might not be run by Bond villains. But it’s run by people who have little knowledge of or concern for democracy or the dignity of the company’s 2.3 billion users.

The privacy meltdown story should be about how one wealthy and powerful company gave our data without our permission to hundreds of companies with no transparency, oversight, or even concern about abuse. Fortunately, the story does not end with Cambridge Analytica. The United States government revealed on Wednesday that it had opened a criminal investigation into Facebook over just these practices.

• Siva Vaidhyanathan is a Guardian US columnist and a professor of Media Studies at the University of Virginia. He is the author of Antisocial Media: How Facebook Disconnects Us and Undermines Democracy (Oxford University Press, 2018)