The Washington PostDemocracy Dies in Darkness

Facebook CEO Mark Zuckerberg added to D.C. privacy lawsuit

The District of Columbia suit stems from the Cambridge Analytica scandal

Facebook CEO Mark Zuckerberg has been added to a consumer protection lawsuit filed by the District of Columbia. (Matt McClain/The Washington Post)
4 min

The attorney general for the District of Columbia has added Facebook chief Mark Zuckerberg to a lawsuit stemming from the Cambridge Analytica scandal, one of the first times the tech founder has personally been targeted by regulators.

In 2018, Attorney General Karl A. Racine (D) sued the social media giant on accusations of unfair and deceptive trade practices under the District’s Consumer Protection Procedures Act, alleging Facebook had misled users — including about half of District residents — about the security of their data. Under the CPPA, individuals are liable for the actions of a company if they were aware of them at the time.

But after reviewing hundreds of thousands of pages of internal documents and interviewing former employees and others, it became evident that Zuckerberg “knowingly and actively” participated in each decision leading up to Cambridge Analytica’s collection of user data and misrepresented how secure that data was, Racine said Wednesday in a statement.

How the Facebook whistleblower learned to use data as a weapon from years in tech

If Zuckerberg and Facebook are found to have broken the law, they could be on the hook for millions of dollars in restitution and civil penalties.

Zuckerberg was aware that Facebook’s success hinged on assuring users their data was protected, while selling access to that data without driving people away, Racine’s complaint states. The decision to open Facebook to third parties was Zuckerberg’s “brainchild.”

“The evidence further demonstrates that Mr. Zuckerberg also participated in misleading the public and government officials about Facebook’s role,” Racine said. “Under these circumstances, Mr. Zuckerberg should be held liable for his involvement in the decisions that enabled the exposure of millions of users’ data.”

Though much of the evidence in the complaint is redacted because of a privacy order, what remains speaks to the tight grip Zuckerberg has on operations. The CEO owns more than half of Facebook’s voting shares, giving him immense sway over the company’s activity.

Analysis: Lawmakers’ latest idea to fix Facebook: Regulate the algorithm

In the wake of the scandal, Zuckerberg sought to take responsibility for the company’s missteps, including its entanglement with Cambridge Analytica.

“I started Facebook, I run it and I’m responsible for what happens here,” he told lawmakers.

Historically, though, company lawyers have fought hard to shield Zuckerberg from legal and regulatory fallout, The Washington Post has reported. When the Federal Trade Commission cobbled together its initial Facebook settlement over privacy failings roughly a decade ago, the agency weighed whether to charge the young CEO personally.

In the end, however, the FTC dropped mention of him from a version of the order shared around April 2011, according to email records obtained from the agency under open-records laws.

How to change your privacy settings on Facebook

Facebook fought Racine’s lawsuit when it was filed in 2018, asking the judge to dismiss it. On Wednesday, a Facebook spokesman called the allegations “as meritless today as they were more than three years ago, when the District filed its complaint,” in an emailed statement to The Post.

“We will continue to defend ourselves vigorously and focus on the facts.”

Cambridge Analytica, a political consultancy that had worked for the Trump campaign, was suspended from Facebook for improperly accessing the personal information of 87 million users. The company later declared bankruptcy and ceased operations in the United States and Britain.

“Zuckerberg was personally aware of the risks that sharing consumer data with apps posed,” the complaint reads, “but actively disregarded those risks because sharing data was otherwise beneficial and lucrative to Facebook’s business model and platform growth.”

Meet the doctors' group spreading covid conspiracy theories in plain sight on Facebook

In 2019, the FTC reached a $5 billion settlement with Facebook over its failure to protect users in a case that began with the Cambridge Analytica scandal but later broadened to include other privacy and security abuses at the company.

The move to hold Zuckerberg accountable for the company’s privacy failures comes as Facebook and its effects on democracy, polarization, security, public health and other critical matters come under growing scrutiny.

On Tuesday, the Verge reported that Facebook is poised to ditch its name and unveil a new one that reflects the company’s ambitions to build a “metaverse,” a term Zuckerberg has been bandying about that signals the company’s quest for further dominance in daily life and technology.

The metaverse is “going to be a big focus, and I think that this is just going to be a big part of the next chapter for the way that the Internet evolves after the mobile Internet,” Zuckerberg told the Verge over the summer. “And I think it’s going to be the next big chapter for our company too, really doubling down in this area.”

Read the series: Facebook under fire

The Facebook Papers are a set of internal documents that were provided to Congress in redacted form by Frances Haugen’s legal counsel. The redacted versions were reviewed by a consortium of news organizations, including The Washington Post.

The trove of documents show how Facebook CEO Mark Zuckerberg has, at times, contradicted, downplayed or failed to disclose company findings on the impact of its products and platforms.

The documents also provided new details of the social media platform’s role in fomenting the storming of the U.S. Capitol. An investigation by ProPublica and The Washington Post found that Facebook groups swelled with at least 650,000 posts attacking the legitimacy of Joe Biden’s victory between Election Day and Jan. 6.

Facebook engineers gave extra value to emoji reactions, including ‘angry,’ pushing more emotional and provocative content into users’ news feeds.

Read more from The Post’s investigation:

Key takeaways from the Facebook Papers

Frances Haugen took thousands of Facebook documents. This is how she did it.

How Facebook neglected the rest of the world, fueling hate speech and violence in India

How Facebook shapes your feed