"Facebook failed to protect the privacy of its users and deceived them about who had access to their data and how it was used," Attorney General Karl Racine said in a statement. "Facebook put users at risk of manipulation by allowing companies like Cambridge Analytica and other third-party applications to collect personal data without users' permission. Today's lawsuit is about making Facebook live up to its promise to protect its users' privacy."

Facebook's connection to Cambridge Analytica and the information that the political consultancy firm obtained on millions of Facebook users came to light in March, and since then, a number of investigations have been launched into the incident and the social network's data privacy practices. The FBI, DOJ, SEC and FTC have initiated probes in the US and Facebook was hit with a number of lawsuits, from states and users both in the US and abroad, as the scandal developed. Earlier this year, the UK's Information Commissioner's Office issued Facebook a £500,000 ($645,000) fine over the debacle.

Racine's office determined that Facebook had violated Washington, DC's Consumer Protection Procedures Act by misleading users about data security, not properly monitoring third-party data use and failing to disclose the Cambridge Analytica breach in a timely manner. The office wants Facebook to introduce additional protocols and safeguards regarding user data and is seeking restitution for consumers as well as penalties.