Karl Racine, the attorney general of the District of Columbia, has filed a lawsuit against Facebook, after this years earlier revelation that the social network had allowed Cambridge Analytica to access user information without their knowledge. Although the breach took place in the beginning of 2014 and affected more than 87m Facebook users, the scandal did not surface until March of 2018.

Cambridge Analytica, a British political consulting firm that uses data analysis during the electoral process, collected names, likes, and other personal data from Facebook users. While Facebook has previously been under scrutiny for privacy regulations, the first official legal action came from the D.C. attorney general and not the Federal Trade Commission (FTC). Members of Congress, privacy advocates, and everyday internet users have been increasingly more adamant about legal action being taken against not only Facebook, but other tech giants in Silicon Valley.

While privacy advocates have stated their appreciation for Racine’s actions, they have also expressed worry that official legal action had to come from local D.C. government officials, and not the FTC. Because of the FTC’s reluctance to investigate and discipline Facebook, privacy advocates think other companies in Silicon Valley will be under less pressure to follow privacy regulations and assume there will be little to no consequences.

While the lawsuit is being filed solely by Racine, there have been government officials from around the US that have agreed with the attorney general’s actions, with Racine saying he has “had discussions with a number of other states that are similarly interested in protecting the data and personal information of their consumers.” Officially, there is no plan for the states to band together, but Racine’s aids have said they may add charges to the lawsuit as more details about the privacy breach become public.

Publications such as The Washington Post and The New York Times have reported other privacy missteps, including Facebook allowing 6.8m user photos to be accessed by third-party groups without user permission. This week, it was made public that Facebook has extensive data-sharing arrangements with companies such as Amazon and Spotify.

Racine, who is basing the lawsuit off of the state’s consumer protection law, believes Facebook has been knowingly misleading users when it comes to their privacy settings, and should have alerted the affected Facebook members when Cambridge Analytica gained access to personal information.

“Facebook’s lax oversight of its privacy protocols and confusing privacy settings put the personal information of millions of Americans at risk,” Racine said.

If allegations against Facebook’s privacy settings are proven, the company may have to pay a fine that is based on the total number of violations and users affected, which could accumulate into the billions. The FTC has continued to stay mostly quiet about the investigation, with members only stating that it would be inappropriate to comment on the status of the case.