The attorney general for the District of Columbia today sued Facebook for failing to protect its users’ data and for allowing an app developer to harvest the personal information of millions of users without their permission and sell it to a political consulting firm, Cambridge Analytica.
The lawsuit filed by Karl Racine is the first major effort by U.S. regulators to penalize the social media giant for its entanglements with the now-defunct firm. The suit charges Facebook with various violations of the district’s consumer protections laws, including misleading users about the security of their data, failing to adequately monitor third-party apps’ use of this data and keeping silent about the breach for two years.
“Facebook failed to protect the privacy of its users and deceived them about who had access to their data and how it was used,” Racine said in a statement. “Facebook put users at risk of manipulation by allowing companies like Cambridge Analytica and other third-party applications to collect personal data without users’ permission.
“Today’s lawsuit,” Racine said, “is about making Facebook live up to its promise to protect its users’ privacy.”
Facebook said in a statement Wednesday to The Washington Post that it is “reviewing the complaint and look forward to continuing our discussions with attorneys general in DC and elsewhere.”
The lawsuit (read it here) reprises the now-familiar events that led up to the privacy breach. Facebook permitted a Cambridge University researcher named Aleksandr Kogan to use a quiz app to harvest the personal data of some 70 million Facebook users in the U.S., and sell this information to the consulting firm, which used the information to target voters and influence elections.
“Facebook failed to take the basic step of reviewing the terms of service of Kogan’s application, which would have alerted the company to the fact that Kogan planned to improperly sell consumer data,” the suit alleges. “Furthermore, after discovering the improper sale of consumer data by Kogan to Cambridge Analytica, Facebook failed to take reasonable steps to protect consumers’ privacy by ensuring that the data was accounted for and deleted.”
The suit represents another blow for the embattled social media company which has been the subject of numerous damaging disclosures.