Facebook Inc. (FB.O) was sued by the District of Columbia over a privacy breach in which personal information of millions of Americans was transferred by an app developer to Cambridge Analytica, a political consulting firm that worked for President Donald Trump’s 2016 campaign.

The suit, filed Wednesday by the district’s attorney general, Karl Racine, alleges Facebook violated the Consumer Protection and Procedures Act as a result of lax oversight of the company’s third-party applications.

Facebook shares fell Wednesday following a New York Times report that -- separate from the Cambridge Analytica scandal -- the social media giant had allowed more than 150 companies to access more users’ personal data than it had disclosed. Shares extended their decline with news of the suit, falling as much as 6.8 per cent and trading at US$133.95 at 1:03 p.m. in New York.

Racine’s suit seeks a court order barring Facebook from violating the law, as well as payment of unspecified restitution and damages.

Facebook didn’t immediately respond to requests for comment on the lawsuit.

WEIGH IN

Have you closed any of your social media accounts because of privacy concerns?

Results

Total Results: 0

The Cambridge Analytica scandal hinges on a third-party company, Global Science Research, which used a personality-quiz app to obtain information from Menlo Park, California-based Facebook on up to 85 million Americans. Facebook in August said it had investigated thousands of apps and suspended 400 of them since the scandal erupted earlier this year.

Racine’s suit, providing a Washington-specific angle on the scandal, cites Facebook’s involvement with Cambridge University researcher Aleksandr Kogan, a GSR co-director whose application was installed by 852 Facebook users in the city. The app then collected personal information of 340,000 residents who were their friends on the social platform, according to the suit. The data was then sold to Cambridge Analytica, the suit says.

"This sequence of events was replete with failures in oversight and enforcement," the complaint says. "After discovering the improper sale of consumer data by Kogan to Cambridge Analytica, Facebook failed to take reasonable steps to protect its consumers’ privacy by ensuring that the data was accounted for and deleted."

Revelations about Facebook’s response to manipulation of the social network before and after the 2016 U.S. presidential election, and shifting accounts about breaches of users’ privacy, have battered the company’s reputation and fueled frustration on Capitol Hill. Lawmakers have been threatening for some time to impose new regulations to rein in Facebook, and the news report only seemed to further the case.

“It is beyond obvious at this point that social media platforms are simply not up to the task of voluntarily ensuring the privacy and security of their users,” Senator Mark Warner, a Democrat from Virginia, tweeted on Wednesday. “Congress must step in.”

Warner, the top Democrat on the Senate Intelligence Committee that heard testimony from Facebook Chief Operating Officer Sheryl Sandberg in September, has previously put forth several potential measures for regulating tech companies. He said the Times’s report “is yet another data point demonstrating that Facebook offers users far too little in the way of transparency about how their data is being used, and by whom.”

Senator Ron Wyden, an Oregon Democrat who has proposed legislation that would jail chief executives if they lie about privacy, slammed the company’s "chutzpah" on Wednesday and suggested recent revelations cast doubt on Facebook executives’ public statements.

“When companies repeatedly lie to Congress and the American people about what they do with our messages, location, likes and everything else, Congress has a duty to do something about it," Wyden said in a statement. "Clearly these people need some skin in the game before they will take Americans’ privacy seriously.”