Facebook Inc. faces growing pressure over its privacy protections as the District of Columbia sued Wednesday over its handling of user data, exemplified by the privacy breach in which personal information of millions of Americans was transferred to Cambridge Analytica, a political consulting firm hired by President Donald Trump’s 2016 campaign.

The suit alleges Facebook violated the district’s Consumer Protection and Procedures Act as a result of lax oversight of the company’s third-party applications. It came just hours after an explosive New York Times report that the social media giant had allowed, even after the Cambridge Analytica scandal, more than 150 companies to access more users’ personal data than it had disclosed, prompting renewed calls for Congress to act.

“It is beyond obvious at this point that social media platforms are simply not up to the task of voluntarily ensuring the privacy and security of their users,” Senator Mark Warner, a Democrat from Virginia, tweeted on Wednesday. “Congress must step in.”

Facebook has been battered all year by questions about its privacy protections, and its shares took another hit Wednesday, falling as much as 7.3 percent and trading at $136.43 at 2 p.m. in New York. Revelations about its response to manipulation of the social network before and after the 2016 U.S. presidential election, and shifting accounts about breaches of users’ privacy, have battered the company’s reputation and fueled frustration in Washington. Lawmakers have been threatening for some time to impose new regulations to rein in Facebook, and the New York Times only seemed to further the case.

“We’re reviewing the complaint and look forward to continuing our discussions with attorneys general in DC and elsewhere,” Facebook said. Separately, in response to the New York Times report, the Menlo Park, California-based company said: “none of these partnerships or features gave companies access to information without people’s permission.”

‘Users at Risk’

Washington Attorney General Karl Racine, who filed the lawsuit, said in a statement that “Facebook put users at risk of manipulation by allowing companies like Cambridge Analytica and other third-party applications to collect personal data without users’ permission.”

Racine’s suit seeks a court order barring Facebook from violating the law, as well as payment of unspecified restitution and damages. While other states have investigations underway into Facebook’s role in the Cambridge Analytica scandal, none have released findings yet, and Racine said on a press call after filing the suit that there are no plans for a multi-state investigation into the company’s privacy practices.

Warner, the top Democrat on the Senate Intelligence Committee that heard testimony from Facebook Chief Operating Officer Sheryl Sandberg in September, has previously put forth several potential measures for regulating tech companies. He said the Times’s report “is yet another data point demonstrating that Facebook offers users far too little in the way of transparency about how their data is being used, and by whom.”

Senator Ron Wyden, an Oregon Democrat who has proposed legislation that would jail chief executives if they lie about privacy, slammed the company’s “chutzpah” on Wednesday and suggested recent revelations cast doubt on Facebook executives’ public statements.

“When companies repeatedly lie to Congress and the American people about what they do with our messages, location, likes and everything else, Congress has a duty to do something about it,” Wyden said in a statement. “Clearly these people need some skin in the game before they will take Americans’ privacy seriously.”

‘Clock is Ticking’

Similarly, Trump’s re-election campaign manager Brad Parscale tweeted “the clock is ticking on Zuck or Sandberg,” referring to Chief Executive Officer Mark Zuckerberg. Parscale has been critical of social media platforms over unsubstantiated allegations they systematically silence conservatives and called the revelations about access to private messages “the final nail in the coffin.”

The Cambridge Analytica scandal hinges on a third-party company, Global Science Research, which used a personality-quiz app to obtain information from Facebook on up to 85 million Americans. Facebook in August said it had investigated thousands of apps and suspended 400 of them since the scandal erupted earlier this year.

Racine’s suit, providing a Washington-specific angle on the scandal, cites Facebook’s involvement with Cambridge University researcher Aleksandr Kogan, a GSR co-director whose application was installed by 852 Facebook users in the city. The app then collected personal information of 340,000 residents who were their friends on the social platform, according to the suit. The data was then sold to Cambridge Analytica, the suit says.

“This sequence of events was replete with failures in oversight and enforcement,” the complaint says. “After discovering the improper sale of consumer data by Kogan to Cambridge Analytica, Facebook failed to take reasonable steps to protect its consumers’ privacy by ensuring that the data was accounted for and deleted.”

Racine alleges Facebook violated the District’s consumer protection law by misleading users about the security of their data, failing to properly monitor how third-party apps use data, making it difficult for users to control data settings for apps and failing to disclose the Cambridge Analytica breach to consumers for more than two years.

Cambridge Analytica whistleblower Christopher Wylie testified to Congress that Steve Bannon, Trump’s former adviser, was behind much of the company’s early focus on promoting public discontent to influence U.S. elections. He claimed the company was set up to be essentially a “full-service propaganda machine,” according to a partial transcript of a closed-door interview released by House Democrats in April. Cambridge Analytica shuttered after the scandal.