Facebook users suing over the social network’s worst-ever privacy scandal gained leverage to pry into its internal records to back up their claims that it failed to safeguard their personal data, exposing the company to potentially billions of dollars in damages.

A federal judge in San Francisco rejected Facebook’s request to throw out a lawsuit claiming the company deceived users into allowing their data to be harvested. The information was sold to a UK political consulting firm that mined it to help Donald Trump win the 2016 US presidential election.

According to Facebook, “if people use social media to communicate sensitive information with a limited number of friends, they have no right to complain of a privacy violation if the social media company turns around and shares that information with a virtually unlimited audience”, US district judge Vince Chhabria wrote in Monday’s ruling. “Facebook’s argument could not be more wrong.”

“When you share sensitive information with a limited audience, especially when you’ve made clear that you intend your audience to be limited, you retain privacy rights and can sue someone for violating them,“ Chhabria wrote.

In allowing the suit over Cambridge Analytica to move forward, Chhabria opened the door for the users to get a glimpse of Facebook’s internal operations in their quest for make the company pay damages and rewrite policies for handling personal information.

District of Columbia attorney-general Karl Racine, who filed a similar suit against Facebook, won permission on 31 May to proceed with his case. The company agreed in July to pay US$5-billion to resolve a US Federal Trade Commission investigation of privacy violations stemming from the scandal.

Storm of controversy

Facebook has faced a storm of controversy since the revelation early last year that Trump’s campaign benefited from the work of an app developer who started out by collecting personal information from 300 000 users, and later, from those users’ friends. Unbeknownst to users, the developer shared the data trove with Cambridge Analytica, which used it to target voters in 2016 with hyper-specific appeals through “psychographic” modelling.

While Cambridge Analytica’s research drew on as many as 87 million Facebook users, the ensuing lawsuits were filed on behalf of everyone in the US who uses the social network.

The lawsuit targets Facebook’s relationships with “business partners”, a broad category that includes device manufacturers such as Samsung Electronics, website Yahoo, as well as Amazon.com, Microsoft and Sony.

Facebook allegedly gave those partners access to its users’ information and that of their friends. Those companies in turn shared data with Facebook. Chhabria ruled users have adequately alleged they didn’t consent to such sharing.

Facebook contends it disclosed its practices in user agreements. It has also argued that anyone sharing their information on a social network shouldn’t count on holding onto their privacy.

“You have to closely guard something in order to have a reasonable expectation of privacy,” the company’s lawyer, Orin Snyder, told Chhabria at a 29 May hearing. “There is no expectation of privacy when you go on a social media platform,” the purpose of which is to share things with big groups of people, he said.

“You can’t cry foul, that there’s gambling going on in this establishment, when you’ve been warned,” Snyder told the judge.

The Cambridge Analytica scandal demonstrated in a “dramatic way” that Facebook doesn’t have control in cases where an app developer breaks a data-sharing agreement with the company, the attorney said.

Lesley Weaver and Derek Loeser, lawyers representing the users, said in an e-mailed statement that they “look forward to the discovery process that will prove our clients’ claims”.