## Facts

- The District of Columbia, through the Office of the Attorney General, sued Facebook, Inc. under the District of Columbia Consumer Protection Procedures Act (CPPA), alleging Facebook failed to protect consumers’ personal data.
- The District alleged Facebook collected and maintained significant amounts of users’ personal information and data about users’ online behavior, and permitted third-party developers and other partners to access that information through Facebook-connected tools and applications.
- The District alleged that Facebook users reasonably expected Facebook to take steps to safeguard their data, but Facebook did not do so.
- The District’s complaint centered on the 2013–2015 incident involving Cambridge University researcher Aleksandr Kogan, who used a third-party application to harvest Facebook user data.
- The District alleged the application harvested personal data from a large pool of users and that Kogan then sold or transferred the harvested data to Cambridge Analytica, a political consulting firm.
- The District alleged that, although the Kogan application was installed by about 852 Facebook users in the District of Columbia, it also collected data from those users’ Facebook “friends,” resulting in collection of information for more than 340,000 District residents who did not install the application.
- The District alleged Facebook failed to inform the public adequately about how information was used and shared, failed to protect consumer data, and failed to enforce its own consumer-protection policies relating to third-party access.
- The District alleged Facebook violated the CPPA by publicly promising that it would protect the privacy of consumers’ personal information, require applications and third-party developers to respect that privacy, and control application use of data through contractual mechanisms, while allegedly allowing broad third-party access without effective oversight.
- Facebook moved to dismiss for failure to state a claim and also argued the Superior Court lacked specific personal jurisdiction in the District of Columbia; in the alternative, Facebook asked the court to stay the case.
- Facebook pointed to its consumer-facing terms, including statements that Facebook was not responsible for third-party actions, that it required applications to respect user privacy, and that a user’s agreement with a third-party application controlled how that application could use, store, and transfer content and information.

## Issues

1. Whether the District’s complaint stated a plausible CPPA claim based on alleged misrepresentations or omissions about privacy protections, third-party access, and enforcement of Facebook’s policies.
2. Whether the Superior Court of the District of Columbia could exercise specific personal jurisdiction over Facebook for CPPA claims arising from alleged data-harvesting and resulting effects on District residents.
3. Whether the court should stay the case in light of other proceedings or investigations concerning Facebook’s data practices.

## Decision

- The court denied Facebook’s motion to dismiss.
- The court concluded the District’s allegations were sufficient at the pleading stage to proceed on its CPPA theory that Facebook misrepresented or failed to disclose material facts concerning data privacy and third-party access.
- The court held it could exercise specific personal jurisdiction over Facebook for claims tied to alleged impacts on District residents arising from Facebook’s operation of its platform and related data practices.
- The court denied Facebook’s alternative request to stay the proceedings.

## Legal Principles

- On a motion to dismiss for failure to state a claim, the court treats well-pleaded factual allegations as true and draws reasonable inferences in the plaintiff’s favor.
- Under the CPPA, a defendant may violate the statute by misrepresenting or failing to state a material fact where the representation or omission has a tendency to mislead a consumer.
- Disclosures or disclaimers in user-facing terms and policies do not automatically defeat a CPPA deception theory at the pleading stage where the complaint plausibly alleges that, taken as a whole, the communications could mislead reasonable consumers.
- Specific personal jurisdiction may be exercised where the defendant has purposeful contacts with the forum and the asserted claims arise out of or relate to those contacts and alleged in-forum effects.
- A stay of proceedings is discretionary; a court may deny a stay where the local enforcement action can proceed independently and the moving party does not show a sufficient basis for delay.

## Conclusion

In District of Columbia v. Facebook, Inc., Case No. 2018 CA 8715 B (2019), the D.C. Superior Court denied Facebook’s motion to dismiss (and alternative request to stay) the District’s CPPA action based on allegations that Facebook misled consumers about data privacy and third-party access and failed to enforce its own protections, including in connection with the Cambridge Analytica data-harvesting episode affecting hundreds of thousands of District residents.
