Pay the price —

Mark Zuckerberg must pay for Cambridge Analytica data scandal, DC lawsuit says

Zuckerberg and Facebook sold "as much access to users as possible," AG says.

Facebook CEO Mark Zuckerberg speaking to members of Congress via video conference.
Enlarge / Facebook CEO Mark Zuckerberg testifies via video conference during a House antitrust subcommittee hearing on online platforms and market power on July 29, 2020.
Getty Images

Mark Zuckerberg was sued Monday by District of Columbia Attorney General Karl Racine, who says the Facebook founder should be held financially responsible for the Cambridge Analytica data scandal. The lawsuit was filed in DC Superior Court and demands that Zuckerberg pay civil penalties and restitution or damages.

"We're suing Mark Zuckerberg for his role in Facebook's misleading privacy practices and failure to protect millions of users' data," Racine wrote on Twitter. "Our investigation shows extensive evidence that Zuckerberg was personally involved in failures that led to the Cambridge Analytica incident. This lawsuit is not only warranted, but necessary. Misleading consumers, exposing their data, and violating the law come with consequences, not only for companies that breach that trust, but also corporate executives."

Racine's lawsuit says that "Facebook's 2010 decision to open up the Facebook Platform to third parties" was "the brainchild of Zuckerberg." This change let developers "access the massive trove of user data that Facebook had collected through the 'side door' of applications," the lawsuit said, continuing:

Zuckerberg had always been aware that the success of Facebook hinged on convincing users that their data was private enough, while selling as much access to those users as possible without driving them away. And Zuckerberg was fully aware that users would be concerned by this newly vulnerable position. So Zuckerberg engaged in a decade-long campaign designed to convince users that Facebook cared about and tried to protect users and their data. Behind closed doors however, Zuckerberg insisted that Facebook's policies be "as simple as we can get away with." Given that Facebook's platform was designed to allow abuse, Zuckerberg's company largely operated without proper safeguards in place to protect users: policy enforcement was lax, review of app violations was inconsistent or subjective, and the policies themselves were unclear and confusing.

Ultimately, the political consulting firm "Cambridge Analytica used the Facebook Platform—in a way that Facebook and Zuckerberg encouraged—to influence and manipulate the outcome of a United States presidential election," Racine's complaint said. Cambridge Analytica knew it could access user data "using Facebook's existing developer tools, an open secret that was well known to Facebook's business partners using the platform" and that "it could leverage Facebook's lax policy enforcement to continue manipulating the Facebook data it had amassed without fear Facebook would do anything about its operations. All the while, Facebook and Zuckerberg were trying to convince users in their user-facing statements that their data was safe," Racine alleged.

Zuckerberg “involved in nearly every major decision”

Zuckerberg "is personally involved in nearly every major decision the company makes" and was responsible for "Facebook's inconsistent actions regarding privacy, including deceptive trade practices, misrepresentations, and ambiguities that violate the CPPA [DC's Consumer Protection Procedures Act]," the AG alleged. The alleged violations include false representations to users about privacy on Facebook, the failure to inform users that personal information could be shared with third-party applications without their knowledge or affirmative consent, and "Facebook's failure to tell consumers for over two years that their personal information was improperly harvested and sold" to Cambridge Analytica.

The scandal came to light in March 2018, when, according to the complaint, "whistleblower Christopher Wylie publicly revealed that... Cambridge Analytica—a London-based electioneering firm—exfiltrated the personal data of more than 70 million Facebook users in the United States, including more than 340,000 District residents, in order to influence the results of the 2016 United States presidential election." Furthermore, "this data trove included Facebook users' ages, interests, pages they've liked, groups they belong to, physical locations, political affiliation, religious affiliation, relationships, and photos, as well as their full names, phone numbers, and email addresses."

Facebook knew in December 2015 that researcher and app developer Aleksandr Kogan "had sold Facebook consumer data to Cambridge Analytica," a violation of Facebook's platform policy, the complaint said. (Kogan and former Cambridge Analytica CEO Alexander Nix agreed to a settlement with the Federal Trade Commission in 2019.)

As noted in Racine's complaint, Cambridge Analytica used the data to target political ads and "received millions of dollars from the Ted Cruz presidential nomination campaign and later the Donald Trump presidential campaigns to provide digital advertising services during the 2016 Election."

Channel Ars Technica