WASHINGTON (Reuters) – The attorney general filed a lawsuit on Facebook on Wednesday with a local court, saying the company failed to protect user data and "offered nearly half of all the residents' data to be manipulated for political purposes during the 2016 election."
Which violated the Consumer Protection Act, according to a statement from Attorney General Karl A. Racine.
"Facebook has failed to protect the privacy of its users and to deceive them about who can access their data and how it was used," he said in the statement. "Facebook puts users at risk of tampering by allowing companies like Cambridge Analytics and other third-party applications to collect personal data without the permission of users." The lawsuit today aims to make Facebook fulfill its promise to protect the privacy of its users.
Facebook said in a statement on Wednesday it was reviewing the lawsuit.
"We are reviewing the complaint and look forward to continuing our discussions with public lawyers in the capital and elsewhere," a Facebook spokesman said.
Among the ways Facebook allegedly violates the law:
- tricked: The company allegedly misled users by telling them it would protect their privacy and asking third-party application developers to do the same. In fact, the complaint alleges that Facebook allowed University of Cambridge researcher Aleksandr Kogan and his company Global Science Research to collect data from users who did not use their applications and then sold them to Cambridge Analytica, a controversial political firm.
- Neglecting: The company did not properly monitor or audit third-party applications, the prosecutor said, and failed to verify whether the Kogan application adheres to Facebook policies on user data.
- confusion: Facebook's privacy and application settings were "confusing and ambiguous", making it difficult for consumers to configure, according to the suit. "Instead of allowing users to control access to their third-party application information directly from the main privacy settings page, Facebook has asked users to move to a different part of its third-party privacy settings platform," according to AG. "This has made it difficult for customers to realize that applications can collect their data."
- delay: Facebook took more than two years to inform users about the activities of Cambridge Analytica. "The company conducted a quick investigation and confirmed that the data had been incorrectly harvested from users and then sold to Cambridge Analytica," according to the Attorney General's Office. "However, Facebook did not tell users affected by the breach until 2018."
- Indifference: Facebook did not pretend that Cambridge Analytica had deleted the user data it had collected, while the political company retained the data that had been blocked from its systems.