Facebook Just Got Hit With a Massive Lawsuit. It Could Cost the Company Billions.

Tom Williams/CQ Roll Call/Newscom/ZUMA

DC Attorney General Karl Racine on Wednesday filed a lawsuit against Facebook, accusing the social-media giant of “unfair and deceptive” practices that violated consumer privacy and led to the Cambridge Analytica scandal. The first lawsuit of its kind in the United States, the move could result in billions of dollars’ worth of fines for the company and pave the way for states around the country to file similar complaints.

“Facebook failed to protect the privacy of its users and deceived them about who had access to their data and how it was used,” Racine said in a statement. “Today’s lawsuit is about making Facebook live up to its promise to protect its users’ privacy.”

In March, it was revealed that Facebook had allowed third-party access to an app, enabling political consulting firm Cambridge Analytica to harvest the data of nearly 90 million Facebook users. Cambridge Analytica then used that data while working for the 2016 presidential campaigns of Ted Cruz and Donald Trump.

The lawsuit also comes on the heels of a New York Times report published Tuesday night that revealed that those same data practices allowed at least 150 other companies to access consumer data, including Facebook users’ private messages. The sharing of data with third parties continued well past a 2011 agreement with the Federal Trade Commission that required Facebook to disclose its data practices more transparently and improve its privacy practices. Racine says his office will be updating its suit to include the new allegations.

The lawsuit could take years to wind its way through the courts, but if it’s successful, Facebook could be on the hook for serious civil penalties under DC’s Consumer Protection Procedures Act, a blanket law that allows for damages for a number of trade violations, including data security breaches. Under the law, a company can be fined up to $5,000 per violation. According to the DC attorney general’s estimates, as many as 340,000 District residents were affected by the Cambridge Analytica incident.

If the lawsuit is expanded to include more recently revealed violations, which gave parties ranging from Netflix to Russian search engine Yandex access to consumer data, fines could possibly reach into the billions of dollars and could top the nearly $1.7 billion fine Facebook is currently facing in the European Union, where consumer data protections are much more stringent. On Tuesday, Facebook settled for $450,000 a lawsuit brought by Washington state alleging the company had violated political advertising laws.

Federal lawmakers are also calling for reform, arguing that a series of new consumer privacy proposals slated to be introduced in Congress next year might imbue the FTC with the necessary powers to invoke meaningful penalties against the tech giant.

“When companies repeatedly lie to Congress and the American people about what they do with our messages, location, likes and everything else, Congress has a duty to do something about it,” Sen. Ron Wyden (D-Ore.) wrote in a statement, touting his own legislation that would include prison time for CEOs who violate consumer privacy laws.