The office of the Washington, DC attorney general announced today that it is filing a lawsuit against Facebook over the Cambridge Analytica scandal.

The scandal erupted this year after it was revealed that Facebook had leaked the data of tens of millions of users by sharing the information with an academic, which was in turn obtained by the data firm. While Facebook CEO Mark Zuckerberg was hauled before Congress to testify after the revelation, and Cambridge Analytica has since folded, the lawsuit is the first major government action taken in the United States against Facebook over the incident.

Alleges lax privacy standards at Facebook

The lawsuit alleges that lax privacy standards around third-party apps and partner companies allowed an incident like the data leak to happen, and claims the company misrepresented third-party developers’ ability to obtain data.

Facebook, according to the suit, violated the Consumer Protection Procedures Act through its actions. The attorney general’s office is seeking civil penalties in the case of an amount to be proven if the case goes to trial.

“Facebook failed to protect the privacy of its users and deceived them about who had access to their data and how it was used,” Attorney General Karl Racine said in a statement. “Facebook put users at risk of manipulation by allowing companies like Cambridge Analytica and other third-party applications to collect personal data without users’ permission. Today’s lawsuit is about making Facebook live up to its promise to protect its users’ privacy.”

Since the Cambridge Analytica scandal first unfolded, Facebook has faced increasing scrutiny over its handling of data. In just recent days, the company has been criticized over its partnerships with other businesses and major leaks of user data.

Facebook did not immediately respond to a request for comment.