Cook County didn't cite an overall claim for damages, but noted that each violation of the Illinois fraud act could carry a penalty of up to $50,000, plus as much as $10,000 more if a given victim is 65 or older. We wouldn't expect the state to seek the maximum penalty per person when there are reportedly "millions" of affected residents, but it could be a costly lawsuit if successful.

We've asked Facebook if it can comment. When Mark Zuckerberg and Sheryl Sandberg have acknowledged problems with handling Cambridge Analytica's behavior, however, the social network may be more focused on limiting damages than avoiding them entirely. And it won't be surprising if other states join in -- over 50 million people were affected by the data collection, and that's bound to include victims in other parts of the US.