DC attorney general sues Mark Zuckerberg over Cambridge Analytica scandal

District of Columbia Attorney General Karl Racine has sued Meta CEO Mark Zuckerberg over the Facebook Cambridge Analytica scandal. The suit alleges that Zuckerberg was “directly responsible” for creating the lax privacy rules that allowed the consulting firm to harvest user data without consent, then failing to promptly inform users and ensure the data was deleted. It follows a failed attempt to name Zuckerberg in a similar suit against Facebook itself.

Racine’s fundamental accusations haven’t changed since the earlier filing last year. The suit covers an incident in which University of Cambridge professor Aleksandr Kogan collected personal information from around 270,000 Facebook users plus data from friends who hadn’t consented to the collection. Kogan passed the information to Cambridge Analytica’s parent company, which worked on former President Donald Trump’s campaign, in 2015. The details only became known when the incident leaked in 2018, and Zuckerberg publicly accepted responsibility.

Racine alleges that Zuckerberg violated the Consumer Protection Procedures Act by misleading Facebook users about the privacy of their data and failing to disclose a violation of it. “Zuckerberg is not just a figurehead at Facebook; he is personally involved in nearly every major decision the company makes, and his level of influence is no secret,” the complaint says. “Within Facebook, Zuckerberg directly oversaw the product development and engineering work that was exposing consumer data to abuse.”

Racine initially sued Meta (then known as Facebook) in 2018, and that case remains ongoing. But a judge said in March that he’d waited too long to add Zuckerberg as a party to that suit — something Racine argued would send a message to other corporate executives. Racine’s office told The Washington Post that the new suit is based on documents that were obtained during the Facebook litigation, bolstering the case against Zuckerberg.

“This unprecedented security breach exposed tens of millions of Americans’ personal information, and Mr. Zuckerberg’s policies enabled a multi-year effort to mislead users about the extent of Facebook’s wrongful conduct,” Racine said in a statement reported by the Post. “This lawsuit is not only warranted, but necessary, and sends a message that corporate leaders, including CEOs, will be held accountable for their actions.”