Connecticut’s attorney general is laying the groundwork to sue Meta Platforms over the Cambridge Analytica privacy leak seven years ago, with the state issuing a request for proposals for law firms to represent Connecticut, and potentially other states, on privacy litigation against the tech giant for as long as six years.
Meta Platforms could face litigation filed by Connecticut and potentially other states over the Cambridge Analytica privacy leak seven years ago, with the state seeking to hire a law firm for up to six years of litigation work against the tech giant.The firm selected by Connecticut would work under the supervision of state Attorney General William Tong “with respect to potential litigation against Meta, Cambridge Analytica and others involved in the suspected improper harvesting of personal online information,” according to a request for proposals obtained by MLex (see here). Connecticut has not yet hired a firm for that job, a spokeswoman for Tong said Tuesday.
While the RFP applies only for services to Connecticut, there is a possibility other states could join the litigation. “This RFP is for representation of Connecticut, but there could be involvement with multistate partners in the future,” Connecticut said in response to questions posted by interested firms.
Connecticut asked law firms to submit bids by early October for a minimum of three years of work “representing, assisting, advising and providing counsel of the State of Connecticut in potential litigation concerning suspected violations of law, including but not limited to violation of the State Unfair Trade Practices Acts, by Meta, Cambridge Analytica and others involved in the potential improper harvesting of personal online information,” according to the RFP document.
The state is looking for a law firm that could pursue litigation against Meta using “creative alternative fee proposals,” such as sharing in “a percentage of any direct financial recovery to the State of Connecticut by settlement and a greater percentage of any direct financial recovery after trial.”
Whether state attorneys general would take collective legal action against Meta over the Cambridge Analytica case has long been in question, with Illinois quietly dropping its claims against Meta this year in a court in Chicago (see here). Meta agreed to a record $5 billion settlement with the US Federal Trade Commission following the Cambridge Analytica revelations in 2019 (see here), and a record $725 million settlement for private class-action litigation over the Cambridge Analytica leak received final appeal court approval this year (see here).
The District of Columbia has active litigation against Meta over the Cambridge Analytica leak (see here), as does the Office of the Privacy Commissioner of Canada where the litigation has reached Canada’s Supreme Court (see here), but no group of US states has yet sued Meta over what is arguably one of the most serious privacy breaches in Meta’s history.
Connecticut’s RFP may indicate that the small New England state is prepared to assume the leadership mantle of a multistate probe. Tong’s office did not respond to additional questions about the Meta RFP other than to confirm that the state has not yet hired a law firm.
“The intention of this Request for Proposals (RFP) is to seek substantial legal services to support and add depth to the OAG pursuant to alternative fee arrangements, in recognition of the opportunity to provide meaningful assistance in litigation of great local and national importance regarding the welfare of our citizens,” the state said in the document.
The state is asking for a wide spectrum of legal services consistent with protracted litigation against a large tech company, including helping Connecticut write pleadings and legal briefs on discovery and dispositive motions, assisting the attorney general in settlement negotiations, and providing "necessary expert, technical, paralegal and clerical, document retrieval and analysis and other litigation support."
Texas recently used a similar system of relying on outside counsel in privacy litigation against Meta and Google, cases that resulted in a total of about $2.8 billion in settlements. Google recently finalized its $1.38 billion settlement of two separate privacy cases with Texas Attorney General Ken Paxton (see here).
The Cambridge Analytica scandal erupted in 2018 when the company then known as Facebook acknowledged that a rogue app developer who built a personality quiz app downloaded by fewer than 300,000 people had obtained the personal data of about 87 million Facebook users. The developer, Alexandr Kogan, conveyed that Facebook user data to political data-mining company Cambridge Analytica for use in the 2016 US presidential election won by Donald Trump.
State attorneys general in California, Massachusetts, Illinois and other states since 2018 have been probing Facebook’s data sharing policies with app developers, which prior to 2015 allowed apps on its platform to access not only the personal data of people downloading the app, but also their Facebook friends. Initially, a group of 37 states wrote to Facebook saying the Cambridge Analytica “revelations raise many serious questions concerning Facebook’s policies and practices (see here).
Meta noted in its latest quarterly securities filing last week that the “state attorneys general inquiries and litigation and certain government inquiries in other jurisdictions remain ongoing” on the Cambridge Analytica matter. The company did not immediately respond to a request for comment Tuesday about the Connecticut RFP.
Connecticut has a long history of putting an emphasis on privacy enforcement, with the state establishing a dedicated privacy and data security unit within the office of the state attorney general a decade ago (see here).
States often form multistate groups to take on large companies on privacy or antitrust litigation, and Tong, who is due to become president of the National Association of Attorneys General (NAAG) in 2026, is in a strong position to work with other states. It was unclear Tuesday, however, how many other states might join Connecticut if it elects to sue Meta.
California has been investigating Meta over its practices of sharing user data with apps and other third parties since June 2018 after news broke about the Cambridge Analytica leak (see here).
Then-California Attorney General Xavier Becerra took Meta to court in 2019 for failing to comply with two civil investigative subpoenas requesting documents and email correspondence form top executives. Becerra dropped a petition to enforce the subpoenas in 2020 (see here), saying Facebook had finally complied. But the probe continued, with Becerra sending Facebook a third investigative subpoena (see here) and continuing to interview company officials.
Just last month, a spokesperson for the California AG’s office told MLex in a statement that its case was ongoing (see here), and that a settlement with Illinois had no bearing on its own investigation.
California and several other states did not immediately respond to questions from MLex Tuesday about their potential involvement in any privacy litigation against Meta brought by Connecticut. A spokesperson for California Attorney General Rob Bonta declined to discuss the state's plans.
"We are unable to preview any potential legal action our office may engage in," the spokesperson said.
Please email editors@mlex.com to contact the editorial staff regarding this story, or to submit the names of lawyers and advisers.