SAN FRANCISCO — The attorney general of the District of Columbia, Karl Racine, sued Facebook on Wednesday for allowing the political consulting firm Cambridge Analytica to harvest the private data of tens of millions of the social network’s users.
It was a first step by a state attorney general to punish Facebook for privacy violations. “Facebook failed to protect the privacy of its users and deceived them about who had access to their data and how it was used,” Mr. Racine said in a statement.
In a statement, Facebook said, “We’re reviewing the complaint and look forward to continuing our discussions with attorneys general in D.C. and elsewhere.”
The New York Times and other news organizations reported in March that Cambridge Analytica, which was based in London, had improperly obtained the data of as many as 87 million Facebook users. Cambridge Analytica, which had ties to President Trump’s campaign, used the information to build psychographic profiles of American voters.
The reports prompted concerns among lawmakers and regulators in Europe and the United States about whether Facebook had a proper handle on the data of its more than 2.2 billion users worldwide. The Justice Department and the F.B.I. began investigating Cambridge Analytica, which is now defunct. In July, Facebook said it faced an expansion of federal investigations into its sharing of user data with Cambridge Analytica.
In the United Kingdom, regulators and lawmakers have moved quickly to penalize Facebook. In July, the Silicon Valley company was hit with the maximum possible fine of 500,000 pounds, or about $660,000, for the improper harvesting of its users’ data.
At the time, the Information Commissioner’s Office in Britain said it had determined that “Facebook contravened the law by failing to safeguard people’s information. It also found that the company failed to be transparent about how people’s data was harvested by others.”