Karl Racine, the attorney-general for the District of Columbia, sued the company on Wednesday over an alleged breach of the district’s consumer protection law. The lawsuit seeks restitution or damages for some 340,000 DC residents who are said to have been affected by the breach, along with unspecified civil penalties.
“We’re reviewing the complaint and look forward to continuing our discussions with attorneys-general in DC and elsewhere,” Facebook said in a statement.
The action comes almost a year after the Cambridge Analytica scandal triggered a political crisis for the social networking company. A £500,000 fine imposed in the UK — the maximum allowed under the law in place at the time — is the only penalty for Facebook over the incident so far, though the failure has been under investigation in multiple jurisdictions in the US.
The number of its residents the District of Columbia says were affected by the data leak
Wednesday’s lawsuit, filed in a Washington court, takes aim at Facebook over its alleged failure to live up to its promises to protect user privacy, and for not alerting them earlier to the Cambridge Analytica leak.
The case stems from how the personal data of about 70m Facebook users was obtained by the political research firm in 2014. Some 290,000 people signed up for an app on the social network that involved taking a personality quiz.
Without their knowledge, the app’s developer sold their data — along with information about their Facebook friends — to Cambridge Analytica, according to the lawsuit. In DC, 852 people used the app, leading to the leak of data about 340,000 residents, the lawsuit said.
The DC case also takes aim at Facebook over partnership agreements that led it to release information, some of it private, to other companies, without express consent. The company has argued that the agreements were valid and only covered arrangements where partners integrated their own hardware and services with the social network, enabling Facebook’s services and content to be accessed in more places.
State consumer laws such as DC’s Consumer Protection Procedures Act usually give local law enforcers broad powers in cases where merchants or others are accused of misleading customers. Mr Racine’s civil lawsuit includes one count of violating the act, listing a range of alleged breaches. These include failing to warn users that their data could be shared with a third party such as Cambridge Analytica; not making clear how users could control their own data to prevent it from being leaked; and not warning them that it had given other companies rights to override their privacy settings.
Get alerts on Facebook Inc when a new story is published