• by Wendy Davis  @wendyndavis, June 2, 2023

Meta Platforms has defeated a long-running consumer-protection lawsuit brought by a Washington, D.C. attorney over allegations that the company wrongly allowed the defunct political consultancy Cambridge Analytica to harvest users' data.

In a ruling issued Thursday, District of Columbia Superior Court Judge Maurice Ross said Meta's policies with regard to data sharing did not mislead users.

“Facebook clearly and repeatedly made disclosures to users about its policies such that the reasonable user could not have been misled as a matter of law,” Ross wrote in an 18-page order granting Meta summary judgment.

The ruling comes in a lawsuit dating to 2018, when former District of Columbia Attorney General Karl Racine alleged that Meta (then named Facebook) violated a local consumer protection law by failing to notify users that their data could be shared without their knowledge or “affirmative consent.”

The suit stemmed from the highly publicized report that Cambridge Analytica purchased personal data of up to 87 million Facebook users from Alexsandr Kogan, a professor who collected the information in 2014 via his personality quiz app "thisisyourdigitallife." That app was downloaded by 270,000 Facebook users, but Kogan was able to gather information about millions of those users' friends.

In April of 2015, Facebook stopped allowing developers to access data about users' friends.

But in 2014, when Kogan's app scraped the data, Facebook allowed developers to glean information about users' friends, subject to the friends' privacy settings. Facebook's terms of service prohibited developers like Kogan from sharing that information.

Racine's complaint included allegations that Meta didn't adequately inform users their data could be shared, failed to enforce its terms of service, and waited too long to notify consumers about the data harvesting.

Ross rejected all of those claims. “The most straightforward disclosure of friend-sharing could be found in the Data Use Policy (effective from December 11, 2012 until January 30, 2015),” Ross wrote.

That policy contained the following language: “Just like when you share information by email or elsewhere on the web, information you share on Facebook can be re-shared. This means that if you share something on Facebook, anyone who can see it can share it with others, including the games, applications, and websites they use.”

Ross also found Facebook's response to the data harvesting didn't violate its terms of service.

“Facebook took swift action in response to Cambridge Analytica,” he wrote, adding that the company directed Kogan to delete the data.

“In 2018, Facebook banned Cambridge Analytica, began an investigation, and informed users of potential disclosure. There is no promise within Facebook’s policies that dictates how Facebook should have responded differently in these situations,” he wrote. “While the District may disagree with Facebook’s approach to the situation, there is no legal basis that required Facebook to act differently.”

The District of Columbia attorney general was not the only one to sue Meta over the data sharing. The Federal Trade Commission also alleged in an enforcement action that the company wrongly allowed Cambridge Analytica and other outside developers access to users' data. Meta settled that matter for $5 billion, and agreeing to new privacy oversight.

Facebook users also brought a class-action lawsuit against the company. Meta recently agreed to settle that matter for $725 million.