The District of Columbia filed suit Wednesday against Facebook for allowing data-mining firm Cambridge Analytica to inappropriately access the data of as many as 87 million users.

“Facebook failed to protect the privacy of its users and deceived them about who had access to their data and how it was used,” Attorney General Karl Racine said, adding that the company, “put users at risk of manipulation by allowing companies like Cambridge Analytica and other third-party applications to collect personal data without users’ permission.”

Lawmakers held congressional hearings and the Federal Trade Commission launched an investigation after Facebook CEO Mark Zuckerberg said Cambridge Analytica got data gathered from a personality quiz app created in 2013 by Cambridge University researcher Aleksandr Kogan. The app, which was installed by about 300,000 people, asked users to share their data as well as the data of their friends, Zuckerberg said.

The lawsuit alleges that Facebook told users that it would protect their personal information, but allowed the app developer to collect and sell the data of users who hadn’t downloaded or used the app.

The company ultimately determined that as many as 87 million Facebook users were affected.

Company officials discovered Cambridge Analytica had inappropriately obtained user data in 2015, according to the lawsuit, however, they failed to inform the public until this year. Even after that, Facebook officials accepted the consultancy firm’s assurances that the data had been deleted and failed to properly ensure the information had been erased, the lawsuit said.

“Today’s lawsuit is about making Facebook live up to its promise to protect its users’ privacy,” Racine said.

What You Need to Know: Cambridge Analytica

The Associated Press contributed to this report.