DC attorney general sues Facebook over Cambridge Analytica

The attorney general for Washington, D.C., filed a lawsuit against Facebook on Wednesday over its handling of the Cambridge Analytica scandal in what is the first government enforcement action the company has faced in the U.S. over its handling of user data in the incident revealed earlier this year.
The lawsuit accuses Facebook of failing to protect user data from mishandling by third parties and alleges that the company's privacy policies violated D.C. consumer protection laws.

“Facebook failed to protect the privacy of its users and deceived them about who had access to their data and how it was used,” Attorney General Karl Racine (D) said in a statement. “Facebook put users at risk of manipulation by allowing companies like Cambridge Analytica and other third-party applications to collect personal data without users’ permission.

"Today’s lawsuit is about making Facebook live up to its promise to protect its users’ privacy,” he added.

The lawsuit, filed in D.C. Superior Court, is seeking civil penalties, restitution for Facebook users in the district and an order for Facebook to change its privacy policies.
“We’re reviewing the complaint and look forward to continuing our discussions with attorneys general in DC and elsewhere,” a Facebook spokesperson said in a statement.
The news comes amid another brutal week for the embattled social network. On Tuesday night, The New York Times reported that Facebook had extensive data-sharing contracts with multiple large tech companies beyond what had been disclosed to its users.
The news called into question whether Facebook was in violation of a 2012 consent agreement with the Federal Trade Commission (FTC) that requires it to be up front with users about how their data is being handled.
The FTC announced earlier this year that it would be investigating whether Facebook had violated the order in its handling of the Cambridge Analytica scandal.
Cambridge Analytica, a right-wing political consulting firm that has done work for several GOP lawmakers, obtained data on millions of unwitting Facebook users from a researcher who collected the information through a third-party app on the platform.
That incident set off a firestorm among lawmakers and regulators around the world. Earlier this year, the United Kingdom hit Facebook with a fine of more than $500,000 over the scandal, and the FTC, which has stayed quiet about its probe, could theoretically fine Facebook trillions of dollars if it finds consent agreement violations.
In his lawsuit on Wednesday, Racine cited Facebook's lack of disclosure to its users about the incident and argued that its privacy policies have deceived consumers into believing it was making sure that third parties were handling their data appropriately.

"Facebook could have prevented third parties from misusing its consumers’ data had it implemented and maintained reasonable oversight of third-party applications consistent with its representation in its public statements, terms of service, and policies," the lawsuit reads. "The District brings this case to ensure that Facebook is held accountable for its failure to protect the privacy of its consumers’ personal data."
—Updated at 2:55 p.m.