Facebook Inc. (FB:UW) users suing over the social network’s worst-ever privacy scandal won leverage to pry into its internal records to back up their claims that the company failed to safeguard their personal data.

A federal judge in San Francisco rejected Facebook’s bid to throw out a lawsuit claiming the company deceived users into allowing their data to be harvested and sold to a U.K. political consulting firm that then mined the information to help Donald Trump win the 2016 U.S. presidential election.

In allowing the suit over Cambridge Analytica to move forward, U.S. District Judge Vince Chhabria didn’t address the merits of users’ claims. But he opened the door for them to get a glimpse of Facebook’s internal operations in their quest for make the company pay damages and rewrite policies for handling personal information.

District of Columbia Attorney General Karl Racine, who filed a similar suit against Facebook, won permission May 31 to proceed with his case. The company agreed in July to pay US$5 billion to resolve a U.S. Federal Trade Commission investigation of privacy violations stemming from the scandal.

The case is In Re Facebook Consumer Privacy User Profile Litigation, 18-MD-02843, U.S. District Court, Northern District of California (San Francisco).