This may not be the best of times for Facebook and Cambridge Analytica, as Cook County, Illinois, has filed a suit against both companies for allegedly violating an Illinois fraud law after reports that the political consulting firm used ill-gotten Facebook data in an effort to influence voter behavior.
The suit filed last Friday, in Cook County Circuit Court, alleged that Cambridge Analytica, deceived the millions of Illinois Facebook users whose information it collected, arguing that Facebook failed to protect its users’ privacy and misrepresented how their data would be used.
According to the suit, “Facebook sought to keep developers building on its platform and provide companies with all the tools they need to influence and manipulate user behavior.
“That’s because Facebook is not a social media company; it is the largest data mining operation in existence.”
Facebook said it could not comment immediately on the lawsuit, and Cambridge Analytica did not respond to requests for comment, reports Chicago Tribune.
The lawsuit joins others brought against the social media giant and Cambridge Analytica in response to a report from The New York Times and The Observer of London earlier this month.
The newspapers reported that Cambridge Analytica, whose U.K.-based parent SCL Group was also named in Cook County’s suit, gained access to private information of more than 50 million Facebook users, including their profiles, locations and what they like.
The firm claimed its tools could analyze voters’ personalities and influence their behavior with targeted messages.
At least five lawsuits have been filed in federal court in Northern California over the alleged misuse of user data.
Those include a suit from a Facebook shareholder who is seeking class-action status, claiming he and other company shareholders have suffered losses and damages since the Cambridge Analytica news was first reported, and another from a woman seeking class-action status over Facebook and Cambridge Analytica’s alleged improper data collection.
Since the report about Cambridge Analytica was published, a public conversation about deleting Facebook profiles has sprung up, and the privacy of people’s online information has come into question. Some experts say that deleting a Facebook profile can’t protect the more than a decade’s worth of data that users have already poured into the platform.
The Federal Trade Commission on Monday confirmed that it has opened an investigation into Facebook’s data practices, and 37 state attorneys general, including Illinois’ Lisa Madigan, sent a letter to Facebook CEO Mark Zuckerberg demanding answers about the company’s practices and privacy protections. Meanwhile, U.K. investigators reportedly raided Cambridge Analytica’s offices in London late last week.
Zuckerberg said in a post last week that the company took steps several years ago to make sure users’ data aren’t accessed this way again. He also promised that the company would do more to protect its users’ data. “We have a responsibility to protect your data, and if we can’t then we don’t deserve to serve you,” he wrote.
Cambridge Analytica improperly acquired the information, Facebook has said, but it didn’t steal the data. Users allowed the maker of a personality quiz app to take the data. About 270,000 people took the quiz several years ago, and the app-maker was able to scrape data from their Facebook friends. He then provided the data to Cambridge Analytica.
Still, Facebook told its users that their personal data would be protected, according to the Cook County lawsuit. It engaged in unfair and deceptive conduct when it allowed a third party to collect its users’ data, the suit alleges.
The lawsuit, filed by Cook County State’s Attorney Kimberly Foxx on behalf of Illinois residents, brings one count each against Facebook and Cambridge Analytica for allegedly violating the Illinois Consumer Fraud and Deceptive Business Practices Act.
The suit asks that both companies be fined $50,000 for each Illinois user whose data was accessed and that Cambridge Analytica be fined an additional $10,000 for each day a violation affecting an Illinois resident age 65 or older has existed.
The companies “must be held accountable for their actions,” Foxx said in a statement.
“Cambridge Analytica deliberately misled Facebook users so it could build psychological profiles of the user and their friends, and Facebook did not stop it,” she said. “This blatant deception violated Illinois law and more importantly violated the privacy of Illinois residents.”
Cook County is being represented by Chicago law firm Edelson, which has brought privacy suits against Facebook and other tech companies, including Google and Netflix.
Cambridge Analytica has previously denied any wrongdoing and suspended its CEO, Alexander Nix.
The app developer, Cambridge University researcher Aleksandr Kogan, who is not named in the Cook County suit, told the BBC last week that he didn’t know the data would be used for Trump’s election campaign and that Cambridge Analytica is using him as a scapegoat.
Internet security advocates have argued that there aren’t enough laws to protect consumer privacy. Companies often lean on terms of service that consumers sign before using an app or service, but few actually read that fine print. Even if they do, some experts say it is nearly impossible for users to know the extent to which their data could be used.
That’s increasingly a problem in a world where technology companies are building their businesses on data collection, and it’s illustrated in this case, said Alvaro Bedoya, who runs the Center on Privacy and Technology at Georgetown University Law Center.
The basis of the lawsuit is that what happened with Cambridge Analytica on Facebook wasn’t an accident: It was Facebook’s business model, Bedoya said.
“This thing didn’t just happen to a couple users in California or New York, this happened to millions of people,” he said. “Frankly, it’s the tip of the iceberg.”
