District of Columbia v. Facebook, Inc.

The District of Columbia (plaintiff) filed a complaint against Facebook, Inc. (defendant) for failing to protect consumers’ personal data in violation of the District of Columbia Consumer Protection Procedures Act. A defendant violated the act by misrepresenting or failing to state a material fact that had a tendency to mislead a consumer. Specifically, the district alleged that Facebook allowed a university researcher to use an application to harvest personal data, which data he then sold to another third party, Cambridge Analytica, a political consulting firm. The data came from thousands of users. The district alleged that Facebook failed to inform the public regarding information use, failed to protect consumer data, and failed to enforce their consumer-protection policies. In its complaint, the district stated that Facebook violated the act by falsely promising consumers that it would protect the privacy of consumers’ personal information, would require applications and third-party developers to respect the privacy of consumers’ personal information, and would control how those applications used the data through contracts between consumers and third-party applications. In its defense, Facebook pointed to a Statement of Rights and Responsibilities that stated, “Facebook is not responsible for the actions . . . of third parties” and “[Facebook] require[s] applications to respect [users’] privacy, and [users’] agreement with the [third party] application will control how the [third party] application can use, store, and transfer that content and information.” Finally, Facebook also included a statement that it may share some data with partner companies to improve its service. Facebook moved to dismiss for failure to state a claim.