Facebook has made more than its share of questionable privacy decisions in its 18-year history, ranging from telling users about their friends' online purchases to changing people's default settings.
But one of the company's biggest mistakes may have been to allow developers to obtain information about people who hadn't interacted with them. That decision ultimately allowed the defunct political consultancy Cambridge Analytica to obtain 87 million unsuspecting Facebook users' personal information.
Cambridge Analytica reportedly obtained the data from Alexsandr Kogan, a professor who collected the information in 2014 via his personality quiz app "thisisyourdigitallife." That app was downloaded by 270,000 Facebook users, but Kogan was able to gather information about millions of those users' friends.
In April of 2015, Facebook stopped allowing developers to access data about users' friends.
But in 2014, when Kogan's app scraped the data, Facebook allowed developers to glean information about users' friends, subject to their privacy settings.
While that policy fueled an ongoing public relations crisis, whether it violated any laws is far from clear.
Consider that Facebook explicitly told users in 2014 that their data could be shared with developers.
“Just like when you share information by email or elsewhere on the web, information you share on Facebook can be re-shared,” Facebook said in its former data use policy.
Facebook's terms of service also prohibited developers like Kogan from distributing the data -- but whether those terms obligated Facebook to police outside developers is unsettled.
Despite the muddy legal issues, the Washington, D.C. Attorney General Karl Racine announced to great fanfare this week that he will attempt to hold Zuckerberg personally liable for Cambridge Analytica's data harvesting.
Racine originally sued Facebook in 2018, alleging that the company violated a local consumer protection law by failing to police developers like Kogan.
The new complaint seeks to hold Zuckerberg personally responsible, on the theory that he allowed and encouraged developers to gather too much information.
“Zuckerberg was personally aware of the risks that sharing consumer data with apps posed, but actively disregarded those risks because sharing data was otherwise beneficial and lucrative to Facebook's business model and platform growth,” Racine alleges.
Many of Racine's other allegations against Zuckerberg are blacked out, making it difficult to assess his case.
But it's not immediately clear why the decision to open the platform to developers -- a decision disclosed to users -- would have violated the city's consumer protection law.
The amended complaint also explicitly alleges that Cambridge Analytica influenced the 2016 presidential election.
The presidential campaign of Senator Ted Cruz (R-Texas) used Cambridge Analytica to send microtargeted ads to voters, and former President Donald Trump's campaign may have also done so.
While Cambridge Analytica denied using specific Facebook data on Trump's behalf, the company's former CEO, Alexander Nix, boasted to an undercover reporter that the company's extensive ad targeting helped Trump win the presidency.
Nix's boasts aside, whether Cambridge Analytica's data harvesting efforts actually made a difference in the election is up for debate.
NBC News reported three years ago that political consultants don't think Cambridge Analytica swung the election, adding that Republican and Democratic consultants said there was “scant evidence” the company was even effective.
For its part, a Facebook spokesperson says the new allegations “are as meritless today as they were more than three years ago.”
The spokesperson adds: “We will continue to defend ourselves vigorously and focus on the facts.”