Facebook, Zuckerberg sued by DC attorney general over Cambridge Analytica scandal

Washington D.C. Attorney General Karl Racine filed a lawsuit against Facebook and its founder Mark Zuckerberg on Monday for a variety of data privacy law violations related to the actions of Cambridge Analytica during the 2016 U.S. presidential election and other third-party companies that used data from the social media site. 

The lawsuit accuses Facebook and Zuckerberg of violating the district’s Consumer Protection Procedures Act (CPPA) in several ways, including through the sale of user data to third parties and for allegedly misleading users about how their data will be used. 

“This lawsuit is not only warranted, but necessary. Misleading consumers, exposing their data, and violating the law come with consequences, not only for companies that breach that trust, but also corporate executives,” Racine said in a statement.

NEW: We're suing Mark Zuckerberg for his role in Facebook’s misleading privacy practices and failure to protect millions of users’ data.

Our investigation shows extensive evidence that Zuckerberg was personally involved in failures that led to the Cambridge Analytica incident.

— Archive: AG Karl A. Racine (@AGKarlRacine) May 23, 2022

Facebook and parent company Meta did not respond to requests for comment.

The 37-page filing asserts that Facebook and Zuckerberg knowingly gave third-party companies like Cambridge Analytica access to the information of millions, including 340,000 Washington D.C. residents.

Cambridge Analytica was hired by the campaign of former US President Donald Trump to help with targeted advertising. Aleksandr Kogan, a researcher affiliated with Cambridge University, was given access to the information of more than 87 million people through a third-party Facebook application purporting to be a personality study in 2013. 

Kogan eventually sold the data he obtained to Cambridge Analytica for $800,000.

The lawsuit says Facebook violated sections of the CPPA through “unfair and deceptive trade practices” by claiming to protect the privacy of consumers’ personal information and failing to do so. 

The company also allegedly failed to disclose to users that their personal information would be shared without their knowledge or consent and harvested by third-party applications. 

Facebook failed to explain to its users how they can control who gains access to their their data and change privacy sections, violating the CPPA. 

The district is seeking restitution and civil penalties if the company is convicted.  

This is the second lawsuit Racine has filed against Facebook and Zuckerberg. He previously went after the social media giant in 2018. 

Racine noted that since that case was filed, he has "fought tooth and nail against the company's characteristic efforts to resist producing documents and otherwise thwart our suit."

“We continue to persist and have followed the evidence right to Mr. Zuckerberg. The evidence shows Mr. Zuckerberg was personally involved in Facebook’s failure to protect the privacy and data of its users leading directly to the Cambridge Analytica incident," Racine said.

"This unprecedented security breach exposed tens of millions of Americans’ personal information, and Mr. Zuckerberg’s policies enabled a multi-year effort to mislead users about the extent of Facebook's wrongful conduct. This lawsuit is not only warranted, but necessary, and sends a message that corporate leaders, including CEOs, will be held accountable for their actions.”