Suits Target Mark Zuckerberg Over Cambridge Analytica: Why It Matters

This week, the DC Attorney General sued Zuckerberg. Facebook and its founder face lawsuits over Cambridge Analytica across the country, writes Zamaan Qureshi.

Nearly three years ago, Facebook (now Meta) agreed to a $5 billion dollar settlement with the Federal Trade Commission (FTC), following an “exhaustive investigation” into Facebook’s mishandling of user information as it related to Cambridge Analytica. Facebook, which made $69.6 billion in profit in 2019, paid the fine, and began a three-year effort to cover up its executives’ and senior management’s tracks.

Three years later, Facebook’s bad acts may finally be catching up to it. This week the Attorney General of Washington DC, Karl Racine, announced his office is suing Facebook founder, CEO and Chairman Mark Zuckerberg. The complaint filed Monday in the DC Superior Court alleges that Zuckerberg was personally involved in decisions that permitted Cambridge Analytica to collect the information of over 87 million users' data to benefit the 2016 presidential campaign of Donald Trump. “The evidence shows Mr. Zuckerberg was personally involved in Facebook’s failure to protect the privacy and data of its users leading directly to the Cambridge Analytica incident,” Racine said in a statement.

The suit follows an adjacent one in the DC Superior Court filed by the same office alleging privacy violations by Facebook as a whole during the scandal. Racine attempted to personally add Zuckerberg to the suit early this year but a judge ruled against it.

The decision to sue Zuckerberg himself appeared to come after years of investigative work undertaken by Racine’s office. In his statement, Racine said that the District pored through “hundreds of thousands of pages of documents” stemming from its adjacent suit and “conducted a wide range of depositions with Facebook’s directors, former employees, and whistleblowers, and examined hours of Mr. Zuckerberg’s public statements, including sworn testimony before the US Senate and other law enforcement agencies.”

Here’s what the lawsuit means - and why it matters for Facebook and its users.

There has been much debate about the now-defunct British consultancy firm, Cambridge Analytica. Four years on from when The Guardian and The New York Times first published stories breaking the scandal, the topic has become polarized. Those that seek to downplay the incident make Cambridge Analytica out to be something of a relatively small firm that sold marketing snake oil and had little influence.

Those more concerned about the firm’s activities point to issues such as the Channel 4 News revelations that Cambridge Analytica embedded its consultants directly in the Trump campaign to engage in “voter deterrence”—to use highly targeted social media ads to persuade Black voters not to vote in an election that was decided by extremely thin margins in key states, the firm’s role in the Brexit referendum, and its connections to other intrigues, such as the investigation into Russian interference in elections.

Regardless of these questions, the fact remains that the relationship between Facebook and Cambridge Analytica was a major privacy violation—one that is still unresolved.

Since the scandal, a number of lawsuits have sprung up in an effort to hold Facebook to account.

Delaware

In Delaware, a lawsuit led by the California State Teachers’ Retirement System representing a raft of retirement and pension funds in the Delaware Chancery Court has been described by Jason Kint, CEO of Digital Content Next and a close follower of these suits, as the “mother of all lawsuits” filed against Facebook.

!!! Friday Night Surprise. Plaintiffs just filed their response to Facebook in my favorite case - what I call the mother of all lawsuits - in Delaware where it's incorporated. It's a tight but absolutely delicious 120 pages so I'll break down the allegations here for you. /1 pic.twitter.com/dghSKEqPOO

— Jason Kint (@jason_kint) April 9, 2022

The lawsuit comes as a result of a prior court order to allow shareholder plaintiffs to “inspect Facebook's books.” The complaint alleges that Zuckerberg, Facebook COO Sheryl Sandberg, and Konstantinos Papamiltiadis, the then-VP of Platform Partnerships at the company, violated their fiduciary duty to Facebook’s shareholders. Discovery has churned out stunning revelations about Facebook's actions, from the “illicit practice” of allowing “whitelisted” companies access to Facebook user data to allegations the company chose to pay a more substantial penalty to the FTC in 2019 to avoid scrutiny of its senior executives.

The plaintiffs were granted privileged access to Facebook’s internal documents and learned that Zuckerberg was named on the original FTC suit in 2019 but later removed from the final settlement agreement.

Why? That gets into the third allegation of insider trading. The plaintiffs allege that board members possessed non-public information that allowed them to make insider decisions that board members claim did not amount to SEC violations of direct automated insider trading. But plaintiffs got a hold of the numbers.

Zuckerberg sold 85 million shares of Facebook stock, amounting to $9.6 billion during that time—approximately 20% of his Facebook holdings. Sandberg sold 18 million shares and Marc Andreessen and Peter Thiel, other Facebook board members, sold 63% and 98% of their Facebook holdings respectively during the time period.

That is why the timeline of Zuckerberg’s knowledge of what was happening and when around the Cambridge Analytica scandal has become the source of much inquiry in other lawsuits.

California

In the Northern District of California, a class action lawsuit is aiming to answer just that question. Plaintiffs are represented by lawyers from Keller Rohrback LLP and Bleichmar Fonti & Auld LLP and allege that Zuckerberg and senior executives knew about the Cambridge Analytica scandal much earlier than they told their shareholders or investigators and Congress.

In 2019, Rep. Alexandria Ocasio-Cortez (D-NY) pressed Zuckerberg over the timeline and his knowledge of Cambridge Analytica when he appeared before the House Financial Services Committee. The flustered CEO flubbed his response only to conclude that he did not know. Indeed, Zuckerberg and other Facebook senior executives may have misled Congress and the UK Parliament during the investigations into Cambridge Analytica. Zuckerberg and Facebook have failed to give a straight answer on when the CEO became personally aware, even though an earlier Guardian story by reporter Harry Davies brought Cambridge Analytica’s harvesting of Facebook user data to light as far back as December 2015.

Plaintiffs in this case then won discovery and found that in “in January 2017” Zuckerberg had “emailed his management team to ask for an explanation of what Cambridge [Analytica] had done,” dispelling the implication that Facebook has told lawmakers: that Zuckerberg was aware of Cambridge Analytica’s data deletion in 2018.

Plaintiffs also found looking through Sheryl Sandberg’s custodial files that the documents “demonstrated Cambridge Analytica was just the tip of the iceberg” questioning just how many “Cambridge Analyticas” there were.

Washington DC

Finally, back in DC, Attorney General Racine’s first suit came against Facebook in December of 2018. The case has been rocky but important details have been obtained via discovery, including that Cambridge Analytica was not the only app in violation of Facebook’s terms. Others included apps called “Nation Builder” (a campaign platform used by the Trump campaign in 2016) and “Strategic Media 21.” The Attorney General is also seeking discovery of hits in Facebook documents related to the keyword queries “Music Walrus” and “Sex Compass.”

Connecting the dots to the Senate Intelligence Committee’s investigation reveals that a whistleblower told the Committee that she believed Cambridge Analytica may have obtained data from other Facebook third-party apps, not only the “thisisyourdigitallife” app designed by Aleksandr Kogan and Joseph Chancellor.

Overall, Racine’s office says that Facebook misled users about their ability to secure their own data, failing to disclose the breach, and ensure data was properly deleted, among other allegations.

That brings us back to this week: yet another filing, with extensive evidence, in a case that could finally bring some justice in the Cambridge Analytica matter.

Accountability takes all shapes and forms. But Facebook isn’t going anywhere. So just days after Facebook’s annual shareholder meeting, where Zuckerberg exercised his power to reject shareholder proposals for reform, these lawsuits and the discovery they churn up may be the best tool to achieve some measure of accountability.

Watch this space.