District of Columbia Attorney General Karl Racine filed the lawsuit on Wednesday, said the Washington Post.

It accused Facebook of allowing the wholesale scraping of personal data on tens of millions of users.

The action adds to a number of regulatory investigations, following a year of privacy and security missteps.

A Facebook spokesperson told the BBC: "We're reviewing the complaint and look forward to continuing our discussions with attorneys general in DC and elsewhere."

• Facebook's data-sharing deals exposed

As well as this lawsuit, Facebook is being probed by the Securities and Exchange Commission, the Federal Trade Commission and the Department of Justice.

In the UK, the company was fined £500,000 over the Cambridge Analytica scandal, the maximum fine the British data regulator could impose.

Bigger trouble may arise from the Irish data protection regulator, which is investigating Facebook for multiple admissions of security flaws, in what is being seen as the first major test of Europe’s new privacy rules as dictated by the General Data Protection Regulation.

According to the Post, the DC attorney general’s action could be amended to include more recent data security admissions, including more revelations published on Wednesday by the New York Times.