I've never understood why Meta is being pursued over this and not Cambridge Analytica. I thought CA were the ones misusing the app system.
Facebook claims they were deceived by Cambridge Analytica, but the lawsuit asks the question of whether or not Facebook acted with the kind of safeguards that a reasonable organization would have used.
For example, if my safety deposit box gets stolen by a thief at a bank, but the bank used a cheap Master padlock on the door, the bank could be held liable for negligence since no ordinary bank by a reasonable person’s judgment would use such a bad lock to secure a vault.
Yes, it was the thief’s fault, but the bank having unreasonably below-standard security was a proximal cause to the theft.
Someone slips on spilled soda at a gas station and Coca-Cola gets the lawsuit.
In your example, Coca-Cola could be legitimately liable if we found out that Coca-Cola used packaging that was known to be insufficient compared to the rest of the industry. They didn’t directly cause the problem but their packaging was a proximate cause.
In this Facebook case, it’s well established that Facebook isn’t the one that committed the infractions that Cambridge Analytica committed, but the issue at hand is that they didn’t act in the way that an ordinary organization would have in this context.
I.e., a reasonable and ordinary company would have had more safeguards in place that would prevented the issue from happening. An ordinary and reasonable company wouldn’t allow any company to slurp up user data without going through a strong vetting process.
Let's not forget Facebook didn't do anything wrong - the only data that CA received was data that was marked as public by the profiles.
In my opinion there are two entities at fault here - the users, who gave CA permission to siphon off their friends' info, and CA, for scraping and storing data they had no reason to have.