Key takeaways
- Unintentional material misrepresentations are now within the reach of DC’s consumer protection law.
- Senior corporate officers who play a central role in challenged business practices and personally direct consumer-facing communications to District residents may face individual jurisdiction in the District.
- Public statements accepting personal responsibility for a company’s conduct may later be used to support personal liability.
On May 12, 2026, the Superior Court of the District of Columbia denied Mark Zuckerberg’s motion to dismiss the District’s personal-liability claims under the District of Columbia Consumer Protection Procedures Act (CPPA), D.C. Code §§ 28-3901, et seq. Judge Darlene M. Soltys rejected each of the four grounds Zuckerberg raised, clearing the way for the District to pursue discovery and, potentially, trial against the Facebook founder in his personal capacity. Coupled with a 2025 District of Columbia Court of Appeals decision that broadened the reach of the CPPA, the ruling underscores the growing personal exposure that senior corporate officers may face for consumer-facing representations directed at District residents.
Background
In March 2018, public reporting revealed that a third-party application available on the Facebook platform—developed in 2013 by researcher Aleksandr Kogan—had collected personal information from an estimated 87 million Facebook users. Because of Facebook’s poor privacy protections, the application was able to access not only the data of users who installed it, but also data belonging to those users’ Facebook friends, regardless of whether those individuals had used the application or adjusted their privacy settings. The information was subsequently used by Cambridge Analytica for voter profiling and targeted political advertising in connection with the 2016 U.S. presidential election. More than 340,000 District residents were allegedly affected.
Two proceedings, two defendants
The Office of the Attorney General for the District of Columbia first sued Facebook in December 2018. In May 2022, the Attorney General filed a separate complaint against Zuckerberg individually, alleging violations of the CPPA. After stays and appeals, both cases are proceeding in parallel.
The District’s allegations against Zuckerberg
The complaint centers on the 2010 decision to open the Facebook platform to third-party developers. The District alleges a “decade-long campaign designed to convince users that Facebook cared about and tried to protect users and their data,” and quotes Zuckerberg’s instruction that the company’s policies be “as simple as we can get away with.” The complaint characterizes enforcement as “lax,” application-violation review as “inconsistent or subjective,” and the governing policies as “unclear and confusing” until 2018.
DC alleges that Zuckerberg is personally liable because he “(i) was aware or should have been aware of Facebook’s data-sharing policy terms; (ii) possessed and/or exercised the authority to control the policies and practices… ; (iii) was responsible for creating and implementing the deceptive policies… ; (iv) participated in the deceptive trade practices… ; (v) directed, managed, or supervised… employees… who participated… ; and (vi) knew or should have known of the deceptive trade practices… and had the power to stop them, but did not.”
The Court of Appeals decision expanding CPPA liability
The individual action against Zuckerberg was stayed pending review by the District of Columbia Court of Appeals (DCCA) of the Attorney General’s appeal in the Facebook case. Judge Ross had granted summary judgment to Facebook, concluding that the company had not intentionally misled consumers, excluding the District’s privacy expert, and finding that the District could not satisfy the “clear and convincing” evidentiary standard.
The DCCA reversed. In a decision with significant implications for CPPA enforcement, the court held that unintentional misrepresentations of material fact are actionable under the statute. The court further held that, while intentional misrepresentations must be proven by clear and convincing evidence, unintentional misrepresentations need only be established by a preponderance of the evidence. In practical terms, a negligent misrepresentation may now support a CPPA claim—a meaningful expansion of potential liability for businesses operating in the District.
The court’s ruling on the motion to dismiss
Zuckerberg moved to dismiss on four grounds: (1) lack of personal jurisdiction; (2) impermissible claim-splitting; (3) collateral estoppel; and (4) failure to state a claim. The court rejected each.
Personal jurisdiction. Zuckerberg, a California resident, argued that the District’s courts lacked jurisdiction over him personally. The court disagreed. Under the District’s long-arm statute, D.C. Code § 13-423(a), a court may exercise jurisdiction over a person who causes tortious injury in the District by an act or omission outside the District if that person regularly does or solicits business, or derives substantial revenue from services rendered, in the District. The court noted that Zuckerberg is not merely an employee; he controls approximately 60% of the company’s voting shares and has directed its operations since its founding.
The court also pointed to Zuckerberg’s 2010 op-ed in The Washington Post, in which he told users directly—including District residents—that “you have control over how your information is shared” and that “we do not share your personal information with people or services you don’t want.” Relying on Shoppers Food Warehouse v. Moreno, the court reasoned that a defendant who deliberately directs communications to District residents through a District publication may be subject to suit in the District. Internal 2012 communications in which Zuckerberg acknowledged that the company “leak[ed] info to developers” further supported the conclusion that his contacts with the forum were sufficient.
Claim-splitting. The court rejected this argument, explaining that the rule against claim-splitting applies to successive suits against the same defendant on the same claim. Zuckerberg and Facebook are distinct defendants. The court’s previous ruling denying the District’s request to add Zuckerberg to the Facebook case was only procedural.
Collateral estoppel. Zuckerberg contended that Judge Ross’s denial of the motion to add him to the Facebook case, and a later denial of a motion to add him as a document custodian, amounted to a merits determination that he did not meaningfully participate in the alleged CPPA violations. Judge Soltys disagreed. She noted that Facebook’s own attorneys rejected the notion that Zuckerberg would be held liable if Facebook was found guilty. Absent a final judgment on the merits that pertains to both defendants, collateral estoppel did not apply.
Failure to state a claim. The court found the District’s allegations sufficient because Zuckerberg served as the company’s “prime decisionmaker,” made personal public assurances regarding data privacy while pursuing an open-platform strategy that made user data available to third parties, and allegedly was aware of the associated risks but proceeded nonetheless. The court concluded that these allegations, together with Zuckerberg’s congressional testimony that “I started Facebook, I run it, and I’m responsible for what happens here,” were sufficient to survive dismissal under Rule 12(b)(6).
Potential damages
The CPPA authorizes recovery of the greater of $1,500 per violation or treble damages, together with attorneys’ fees. The District alleges that more than 340,000 District residents were affected. At $1,500 per affected resident, statutory damages alone could exceed $510 million. The Attorney General may also advance an alternative damages theory.
What comes next
Having filed its individual complaint in 2022 and awaited resolution of the Facebook appeal, the District is now positioned to pursue discovery against Zuckerberg with a substantial evidentiary record gleaned from public disclosures—internal communications, the 2010 op-ed, and congressional testimony—already reflected in its allegations. The central question going forward will be whether the District can establish that Zuckerberg personally made or directed misrepresentations to District consumers, and not merely that Facebook did.
The “meaningful participation” standard is likely to be the focus of any subsequent summary judgment briefing–and appeal.
Porter Wright attorneys continue to monitor these proceedings. Businesses and executives with questions about CPPA exposure or consumer-protection compliance should consult experienced counsel. Please contact Adrian Snead or any member of Porter Wright’s Litigation Department or Government & Regulatory Affairs Practice Group if you have any questions.
District of Columbia v. Zuckerberg, No. 2022-CA-002273-B (D.C. Super. Ct. May 12, 2026); see also District of Columbia v. Facebook, Inc., 340 A.3d 1 (D.C. 2025); District of Columbia v. Facebook, Inc., No. 2018 CA 008715 B (D.C. Super. Ct.).
