D.C. Attorney General Files Privacy Suit Against Facebook

D.C. Attorney General Files Suit Against Facebook Over Privacy

Suit alleges company failed to protect users in the Cambridge Analytica scandal

Facebook CEO Mark Zuckerberg in May 2018. The social-media company was hit with a lawsuit Wednesday alleging that its lax oversight and misleading privacy settings allowed user data to be harvested and sold to Cambridge Analytica. Photo: Marcio Jose Sanchez/Associated Press
36 Comments
By

WASHINGTON—The District of Columbia attorney general filed suit against Facebook FB -7.25% on Wednesday, alleging the company “failed to protect the privacy of its users” in the Cambridge Analytica scandal.

Attorney General Karl Racine said in a statement that the company also deceived users “about who had access to their data and how it was used.”

Shares of Facebook were down about 6% Wednesday on the news of the suit.

Mr. Racine’s suit—the first significant action by an attorney general against the social-media giant in the scandal—alleges that Facebook’s lax oversight and misleading privacy settings allowed a researcher to use the platform to harvest millions of users’ personal information without their permission and then sell it to Cambridge Analytica, a political consulting firm.

Cambridge Analytica then used the data to help presidential campaigns target voters based on their personal traits, according to Mr. Racine’s suit.

Cambridge Analytica worked for Republican presidential candidates including President Trump during the 2016 campaign. It was founded on the premise of using cutting-edge social science to better target voters in political campaigns.

Representatives of the Trump campaign have said Cambridge Analytica overpromised its ability to use “psychographic” data to identify and persuade voters. The company announced earlier this year it was shutting down in the wake of the scandal.

Facebook's current data crisis involving Cambridge Analytica has angered users and prompted government investigations. To understand what's happening now, you have to look back at Facebook's old policies from 2007 to 2014. WSJ's Shelby Holliday explains. Illustration: Laura Kammerman (Originally published March 23, 2018)

A Facebook spokeswoman said, “We’re reviewing the complaint and look forward to continuing our discussions with attorneys general in D.C. and elsewhere.”

No other state attorneys general have joined in the suit, and there is no formal multistate investigation, D.C. officials said.

The D.C. attorney general’s suit seeks monetary and injunctive relief, including relief for harmed consumers, damages, and penalties. It estimates that more than 340,000 D.C. users were affected. It wasn’t immediately clear how much Facebook might eventually have to pay, although officials said the company was liable for up to $5,000 per violation.

The Federal Trade Commission also is probing Facebook over the incident as well as other suspected privacy issues. One question for the FTC is whether Facebook violated terms of an earlier consent decree in the Cambridge Analytica matter. Under the decree, approved in 2012, Facebook agreed to get user consent for collecting personal data and sharing it with others.

If the FTC finds that Facebook violated the decree, the firm could face millions of dollars in fines as well as harm to its reputation with users.

Write to John D. McKinnon at john.mckinnon@wsj.com and Sarah E. Needleman at sarah.needleman@wsj.com