A judge ruled Facebook founder Mark Zuckerberg and former directors of the social-media company must face claims they turned a blind eye to rampant privacy violations, including allowing a firm hired by Donald Trump’s 2016 presidential campaign to collect data on millions of users.
Delaware Chancery Court Judge Travis Laster concluded Wednesday that alleged conflicts-of-interest meant Facebook’s board couldn’t be trusted to properly investigate claims the company repeatedly violated promises to protect users’ personal information.
Facebook directors either “affirmatively went along with” improper behavior or ignored it, the judge said in an oral ruling. “There were a string of red flags that were readily apparent” and weren’t acted upon, Laster said.
The privacy suits by investors were tied to a record $5 billion fine officials of Facebook — now a unit of Meta Platforms Inc. — paid the US government to resolve a privacy probe tied to a 2018 revelation about its business with Cambridge Analytica, a consulting firm hired by Trump.
The government investigation stemmed from evidence Cambridge improperly obtained data on tens of millions of Facebook users from a researcher who collected personal data through a third-party quiz app. The app not only collected its users’ data, but also information on their friends, affecting millions of consumers.
Accounts Harvested
An internal review by Facebook later determined at least 50 million user accounts were improperly harvested by Cambridge, according to investors’ court filings.
In December, Meta agreed to pay $725 million to settle investor claims in California tied to the Cambridge scandal.
Dave Arnold, a Facebook spokesman, declined to comment on Laster’s ruling.
The Cambridge scandal dealt a blow to Facebook’s reputation at a time when the company was already under fire for allowing Russian agents to exploit its platform to try to influence the 2016 election. But Facebook investors contend the privacy violations stretched back four years before the Cambridge news became public.
They noted the US Federal Trade Commission found alleged violations going back to 2012 — the same year that Facebook finalized an earlier agreement over privacy lapses. Four months after that accord, the FTC said, Facebook removed a disclosure that information users shared with friends could get sucked up by apps those friends used — while allowing the practice to continue.
Making Billions
Facebook shareholders alleged in their suits company directors acquiesced to the violations to help the company make billions in advertising and data sales instead of insuring the firm protected users.
“This complete and utter failure of leadership and governance left Facebook subject to public scrutiny, billions of dollars in lost market value, millions of dollars in foreseeable fines and costs, and inquiries by governments worldwide,” investors said in court filings.
In his ruling, Laster noted investors allege Facebook officials agreed to pay more in the FTC settlement to protect Zuckerberg from facing personal liability in the cases. Some company shareholders allege the social-media giant may have paid as much as $2 billion extra to protect the founder. The judge said if that allegation is true, it would support “a claim for waste” of corporate assets.
Laster also noted that Facebook directors, including venture-capital titans Mark Andreessen and Peter Thiel, were warned by the company’s internal security experts that users’ personal data was being handled improperly. Instead of acting to ensure controls were tightened, they stood by as the head of computer security was removed.