• by Wendy Davis , Yesterday

Handing a defeat to Meta Platforms, a District of Columbia appeals court on Thursday restored the district's lawsuit stemming from well-publicized allegations that Facebook allowed the defunct political consultancy Cambridge Analytica to obtain data about tens of millions of users.

The move came in a dispute dating to 2018, when former District of Columbia Attorney General Karl Racine sued the social platform for allegedly running afoul of the district's Consumer Protection Procedures Act, which prohibits companies from duping consumers about privacy.

Racine sued soon after reports emerged that Cambridge Analytica purchased the personal data of millions Facebook users from Alexsandr Kogan, a professor who collected the information in 2014 via his personality quiz app "thisisyourdigitallife." That app was downloaded by 270,000 Facebook users, but Kogan was able to gather information about millions of those users' friends.

In April 2015, Facebook stopped allowing developers to access data about users' friends. But in 2014, when Kogan's app scraped the data, Facebook's allowed developers to glean information about users' friends, subject to their privacy settings.

Among other allegations, Racine's office said Meta unintentionally misled users about whether their data could be accessed by outside developers -- in part because Facebook's statements regarding privacy created "a high potential for consumer confusion."

His complaint noted that Facebook "publicly represented that consumers controlled how their data is shared," but also allowed outside developers like Kagan to access consumers' data even when they hadn't downloaded Kagan's app.

Meta countered that its disclosures to consumers were accurate, noting that its privacy policy in 2014 specifically informed users that anything they shared on Facebook could be re-shared by their friends.

District of Columbia Superior Court Judge Maurice Ross dismissed the complaint in 2023, ruling that the attorney general failed to prove the charges against Meta by "clear and convincing" evidence.

"Facebook clearly and repeatedly made disclosures to users about its policies such that the reasonable user could not have been misled as a matter of law," Ross wrote in an order granting summary judgment to Meta.

The district then appealed to the District of Columbia Court of Appeals, which reversed Ross's ruling. The appellate judges said Ross should not have required proof by "clear and convincing" evidence, but should instead have decided whether the attorney general proved the claims by a "preponderance" of the evidence.

In theory, it's easier to prove charges by a "preponderance" of evidence than by "clear and convincing" evidence.

The appellate court returned the case to Ross for further proceedings.

Meta separately faced a class-action lawsuit by consumers over Cambridge Analytica, and an enforcement action by the Federal Trade Commission, which claimed Meta violated a prior consent decree by sharing users' data.

Meta settled the FTC charges in 2020 by paying $5 billion.

The company also agreed to a $725 million settlement of the class-action by users. Before settling, Meta unsuccessfully argued that the consumers' lawsuit should be dismissed on the grounds that users have no privacy claim on information they share with social media contacts.

U.S. District Court Judge Vince Chhabria Chhabria rejected that argument in 2019.

“Facebook’s argument could not be more wrong,” he wrote. "Sharing information with your social media friends does not categorically eliminate your privacy interest in that information."