The District of Columbia’s attorney general sued Facebook Wednesday in response to the Cambridge Analytica scandal.
Filed by Karl Racine, the lawsuit, first reported in the Washington Post, “marks the first major effort” by U.S. regulators to penalize Facebook for its involvement with the data firm.
Cambridge Analytica, which was given access to information on as many as 87 million Facebook users without their permission, aided then-candidate Donald Trump’s presidential campaign in spreading political ads on the social network.
The lawsuit, confirmed in a press release, argues Facebook failed to protect the data of 340,000 D.C. residents who were swept up in the privacy scandal.
“Facebook’s lax oversight and misleading privacy settings allowed, among other things, a third-party application to use the platform to harvest the personal information of millions of users without their permission and then sell it to a political consulting firm,” the press release states.
Given that each individual violation could result in a maximum penalty of $5,000, CNBC reports, Facebook could face a fine as large as $1.7 billion.
“Today’s lawsuit is about making Facebook live up to its promise to protect its users’ privacy,” Racine said.
A spokesperson for Facebook said in response that the social media company was in the process of looking over the lawsuit.
“We’re reviewing the complaint and look forward to continuing our discussions with attorneys general in DC and elsewhere,” the spokesperson said.
News of the lawsuit comes only hours after the New York Times revealed that Facebook shared far more private data with third parties than previously realized.
Facebook, according to internal documents seen by the Times, even gave companies such as Spotify and Netflix the ability to “read, write and delete users’ private messages.”
The social media company has already been under investigation by the Security and Exchange Commission, the Federal Trade Commission, and the Justice Department for the Cambridge Analytica incident.
The scandal also led Facebook to pay a $640,000 fine earlier this year issued by Britain’s Information Commissioner’s Office.