• by Wendy Davis  @wendyndavis, March 21, 2018

Facebook and President Trump's campaign consultancy, Cambridge Analytica, were hit with a class-action complaint this week for allegedly violating users' privacy.

The lawsuit, by Maryland resident Lauren Price, is the latest fallout from explosive reports that Cambridge Analytica harvested the data of about 50 million Facebook users without their knowledge or explicit consent. Facebook is also facing questions from lawmakers and a probe by the Federal Trade Commission.

"The incident has violated the privacy of millions of people in every state," Price alleges in a complaint filed Tuesday in U.S. District Court for the Northern District of California. "The privacy and personal, sensitive information of 50 million people is now at high risk for identity theft and compromise, and will continue to be at risk."

Price alleges that the companies violated California consumer protection laws, and were negligent.

Cambridge Analytica obtained information about 50 million Facebook users from researcher Aleksandr Kogan, who gleaned the data in 2014 through the personalty-quiz app "thisisyourdigitallife," according to reports. Only 270,000 Facebook users downloaded Kogan's app, but he was able to gather data about many of those users' contacts.

Facebook said last Friday that it knew about the data transfers in 2015. The company didn't suspend Cambridge Analytica from the platform until last week.

In 2014, when Kogan's app began gathering data, Facebook allowed developers to glean data about downloaders' friends, subject to their privacy settings. A Facebook spokesperson said Tuesday that the company "respected the privacy settings that people had in place."

Cambridge Analytica, which did work for Trump's campaign, denies using "personality profiles" in the presidential election. But the UK's Channel 4 reported this week that CEO Alexander Nix -- now suspended from the company -- boasted of Cambridge Analytica's work for Trump. "We did all the research, all the data, all the analytics, all the targeting, we ran all the digital campaign, the television campaign and our data informed all the strategy," Nix told a Channel 4 undercover reporter.

Price alleges in her class-action complaint that Cambridge Analytica was effectively "mounting a campaign of psychological warfare on millions of hapless victims, without their knowledge or consent."

Facebook failed to "take appropriate measures" to protect users' information, Price alleges. She adds that her data -- and that of other Facebook users -- is now "in the hands of those who will use it for their own advantage, or is being sold for value."

Internet law expert Venkat Balasubramani says the lawsuit raises an issue that's central to other cases stemming from data breaches -- whether the "failure to safeguard somebody's information is actionable, particularly when that information hasn't been used to cause financial harm to that individual."

"I expect the plaintiffs will have a creative argument here," he says, adding that they may attempt to argue that alleged voter manipulation is the type of harm that should be recognized by the courts.

Facebook doesn't consider the incident a data "breach," but the company's characterization may not be that significant to the courts.

Balasubramani adds that Facebook has a variety of arguments on its side, including that it told users that their data can be accessed by third parties, and that users didn't suffer any economic injury.

While Price's lawsuit is the first to result from the debacle, it likely won't be the last. Lawyer Jay Edelson, who has brought numerous privacy lawsuits against tech companies, says his firm will also get involved in the litigation.

"We are currently speaking to a number of different stakeholders and expect to begin filing suit in the near term," he writes in an email to MediaPost.