Facebook Shares Drop as Data Privacy Fallout Spreads

Facebook shares sank on Wednesday as concerns about its ability to safeguard user data sparked a government lawsuit, criticism in the US Congress and a New York Times report on how it had shared data with other companies.

The stock of the world's largest social media company fell 7.25 percent, its biggest intraday drop since July, taking losses for the year to about 24 percent. Investors are concerned about snowballing legal and regulatory efforts over data use polices that have upset many customers and could carry significant penalties and costs.

In particular, the Silicon Valley firm has drawn global scrutiny since disclosing earlier this year that a third-party personality quiz distributed on Facebook gathered profile information on 87 million users worldwide and sold the data to British political consulting firm Cambridge Analytica.

Washington, DC, Attorney General Karl Racine said the US capital city was suing Facebook, accusing it of misleading users because it had known about the incident for two years before disclosing it.

It further alleges Facebook misled users by allowing several app makers it called partners "to override Facebook consumers' privacy settings and access their information without their knowledge or consent."

Facebook said in a statement, "We're reviewing the complaint and look forward to continuing our discussions with attorneys general in DC and elsewhere."

The New York Times reported new details on Tuesday about the user data that remained available to such partners years after they had shut down features that required them. Facebook acknowledged the lapse in a blog post but said it had not found evidence of wrongdoing by those partners.

In response, both Democrat and Republican lawmakers criticised the company and queried whether Chief Executive Officer Mark Zuckerberg had lied to Congress in hearings earlier this year.

The incoming chair of the House Judiciary Committee's antitrust subcommittee, Representative David Cicilline, tweeted: "Zuckerberg told Congress that Facebook users had 'complete control' over their data. Sure looks like he lied."

Incoming Republican senator Josh Hawley made similar comments about Zuckerberg's testimony.

The stock slide was the worst since the owner of Facebook, WhatsApp, and Instagram warned in July that profit margins would erode in coming years because of consumer and government pressure to better guard data and suppress objectionable content.

"Facebook could have prevented third parties from misusing its consumers' data had it implemented and maintained reasonable oversight of third-party applications," according to the lawsuit filed in the Superior Court of Washington, DC, on Wednesday.

The court could award unspecified damages and impose a civil penalty of up to $5,000 per violation of the district's consumer protection law, or potentially close to $1.7 billion, if penalised for each consumer affected. The lawsuit alleges the quiz software had data on 340,000 DC residents, though just 852 users had directly engaged with it.

'Confusing settings'
Facebook offered separate privacy settings around 2013 to control what friends on the network could see and what data could be accessed by apps, enabling the quiz and other services to collect details about users' Facebook friends without many of them realising it, according to the lawsuit.

Racine told reporters that Facebook had tried to settle the case before he filed suit, as is common during investigations of large companies, but that a lawsuit was necessary "to expedite change" at the Silicon Valley company.

Britain's data protection authority in July fined Facebook GBP 500,000 ($631,000) for breaches of data in the Cambridge Analytica incident.

Since then, Facebook has disclosed a pair of security breaches involving profile data and posts of up to 29 million users and 6.8 million users, respectively.

At least six US states have ongoing investigations into Facebook, according to state officials.

In March, a bipartisan coalition of 37 state attorneys wrote to the company, demanding to know more about the Cambridge Analytica data and its possible links to US President Donald Trump's election campaign.

At the same time, the Federal Trade Commission took the unusual step of announcing an investigation into whether Facebook had violated a 2011 consent decree, exposing the company to a multi-billion dollar fine.

State attorneys general have found some success taking on technology companies over data privacy. Uber Technologies in September agreed to pay $148 million as part of a data breach settlement with 50 US states and Washington, DC.

Agnieszka McPeak, a professor at Duquesne University School of Law, said states will likely make claims similar to those of DC, pressuring Facebook into a settlement that involves both a monetary fine and modified business practices.

"If a company faces 51 separate actions around the country for deceptive practices, that can have a real impact," McPeak said.

© Thomson Reuters 2018