Facebook was sued by the District of Columbia on Wednesday for allowing data-mining firm Cambridge Analytica to improperly access data from as many as 87 million users.
The lawsuit filed by D.C. Attorney General Karl Racine alleges that Facebook misled users about the security of their data and failed to properly monitor third-party apps.
In 2013, a researcher launched a Facebook app that claimed to generate a personality profile. It turns out, the app also hoovered up the personal information of users' Facebook friends and that information was eventually sold to Cambridge Analytica, a consulting firm that did work for several Republican candidates.
The fallout from Cambridge Analytica, which is still ongoing, led to congressional hearings in the United States and inquiries in the United Kingdom. Facebook also did change what type of data it allows outside developers access, although critics have charged that it did not move fast enough.
"Facebook failed to protect the privacy of its users and deceived them about who had access to their data and how it was used," Rancine said in a statement. "Facebook put users at risk of manipulation by allowing companies like Cambridge Analytica and other third-party applications to collect personal data without users’ permission. Today’s lawsuit is about making Facebook live up to its promise to protect its users’ privacy."
The lawsuit alleges that Facebook told users that it would protect their personal information, but allowed the app developer to collect and sell the data of users who hadn't downloaded or used the app. It also alleges that Facebook was aware in 2014 that the developer wanted to download the information about users' friends but "failed to monitor or audit the app."
The information of more than 340,000 District of Columbia residents was exposed but only 860 downloaded the quiz, Racine noted.
Facebook has reportedly already produced "reams of documents" in response to the attorney general's investigation, officials said. A copy of the full complaint against Facebook can be viewed here.
After the suit was filed Wednesday, Facebook said in a statement: "We're reviewing the complaint and look forward to continuing our discussions with attorneys general in DC and elsewhere."
The D.C. attorney general is seeking an injunction to ensure Facebook puts in place protocols and safeguards to monitor users’ data and to make it easier for users to control their privacy settings. In addition, it seeks restitution for consumers, penalties and costs.
It was revealed this week that Facebook's privacy controls had broken down yet again. In that case, a software flaw affected nearly 7 million users, leading to their photos being exposed to a much wider audience than they had intended. In addition, a New York Times report claims that Facebook allowed other companies to access users' private messages and personal data.
The Associated Press contributed to this report.