A United States federal judge ordered Facebook Inc to face most of a nationwide lawsuit seeking damages for letting third parties such as Cambridge Analytica access users’ private data, calling the social media company’s views on privacy “so wrong”.

While dismissing some claims, US District Judge Vince Chhabria in San Francisco said on Monday users could try to hold Facebook liable under various federal and state laws for letting app developers and business partners harvest their personal data without their consent on a “widespread” basis.

He rejected Facebook’s arguments that users suffered no “tangible” harm and had “no right to complain of a privacy violation if the social media company turns around and shares that information with a virtually unlimited audience.”

“Facebook’s motion to dismiss is littered with assumptions about the degree to which social media users can reasonably expect their personal information and communications to remain private,” Chhabria wrote. “Facebook’s view is so wrong.”

“When you share sensitive information with a limited audience, especially when you’ve made clear that you intend your audience to be limited, you retain privacy rights and can sue someone for violating them,” he added.

A Facebook spokeswoman said the company considered protecting people’s information and privacy “extremely important”, but believed its practices were consistent with its disclosures and “do not support any legal claims.”

The company’s lawyer, however, has argued that anyone sharing their information on a social network should not count on holding on to their privacy.

“You have to closely guard something in order to have a reasonable expectation of privacy,” Facebook’s, Orin Snyder, told Chhabria at a May 29 hearing. “There is no expectation of privacy when you go on a social media platform,” the purpose of which is to share things with big groups of people, he said.

Users’ right to privacy

Lesley Weaver and Derek Loeser, two lawyers representing the users, said in a joint statement that they were pleased with the decision, and “especially gratified that the court is respecting Facebook users’ right to privacy.”

In allowing the suit over Cambridge Analytica to move forward, Chhabria opened the door for the users to get a glimpse of Facebook’s internal operations in their quest to make the company pay damages and rewrite policies for handling personal information.

Facebook has faced a storm of controversy since early last year over data privacy issues.

This included a 2015 breach which allowed Cambridge Analytica, a British political consulting firm, to access the personal data of an estimated 87 million Facebook users.

In their 414-page complaint, users said Facebook misled them into thinking they could keep control over personal data, when in fact it let thousands of “preferred” outsiders such as Airbnb, Lyft and Netflix gain access.

While Cambridge Analytica’s research drew on as many as 87 million Facebook users, the ensuing lawsuits were filed on behalf of everyone in the US who uses the social network.

The lawsuit targets Facebook’s relationships with “business partners”, a broad category that includes device manufacturers such as Samsung Electronics Co, website Yahoo!, as well as Amazon.com Inc, Microsoft Corp and Sony Corp.

Chhabria faulted Facebook for treating privacy as an “all-or-nothing” proposition, where users would forfeit their privacy by sharing data even in a “limited” fashion.

He said Facebook had taken different positions elsewhere, including in a California case where it likened information kept on social media accounts to information stored on smartphones, where privacy concerns might be greater.

That position is “closer to the truth than the company’s assertions in this case,” Chhabria wrote. “Sharing information with your social media friends does not categorically eliminate your privacy interest in that information.”

The litigation covers Facebook users in the US and the United Kingdom whose information had been shared with third parties without their consent since 2007.

Several US state attorneys general have decided to investigate Facebook under an antitrust inquiry.