Washington DC's top prosecutor is suing Facebook in the first significant US move to punish the firm for its role in the Cambridge Analytica scandal.
District of Columbia Attorney General Karl Racine filed the lawsuit, the Washington Post said.
It accused Facebook of allowing the wholesale scraping of personal data on tens of millions of users.
The action adds to a number of regulatory investigations, following a year of privacy and security missteps.
A Facebook spokesperson said: "We're reviewing the complaint and look forward to continuing our discussions with attorneys general in DC and elsewhere."
As well as this lawsuit, Facebook is being probed by the Securities and Exchange Commission, the Federal Trade Commission and the Department of Justice.
In the UK, the company was fined £500,000 ($NZ930,000) over the Cambridge Analytica scandal, the maximum fine the British data regulator can impose.
Bigger trouble may arise from the Irish data protection regulator, which is investigating Facebook for multiple admissions of security flaws, in what is being seen as the first major test of Europe's new privacy rules.
According to the Post, the DC attorney general's action could be amended to include more recent data security admissions, including more revelations published on Wednesday by The New York Times.