Missouri Attorney General Josh Hawley, a Republican, added to the pressure on Facebook this week by issuing a wide-ranging civil investigation demand.
The Missouri official said he has reason to believe Facebook violated state law by engaging in conduct involving "deception," "fraud," or "unfair practices." Materials handed over in response to the probe could be disclosed to other state or federal law enforcement agencies, according to the document.
Hawley is asking Facebook - going back to Jan. 1, 2012 - to disclose every time it's shared user information with a political campaign or political action committee, how much those campaigns paid Facebook for such data, and whether users were notified. That includes groups working with the campaigns of President Donald Trump and former President Barack Obama.
Government probes, such as Missouri's effort, could provide ammunition for already filed lawsuits or new ones from users and investors seeking damages for privacy violations or losses in the company's share price related to the Cambridge Analytica disclosure, lawyers who specialize in technology cases said.
"Facebook's having to fight on multiple fronts, with potentially conflicting strategies and obligations, is what will make this 'litigation swarm' problematic," said Marc Melzer, a New York-based attorney. The company will likely "want to move slowly and withhold as much as they can without antagonizing regulators or the courts that are presiding over the suits."
Users and investors have filed at least 18 lawsuits since last month's revelations about Cambridge Analytica. Beyond privacy violations, they are accusing Facebook of user agreement breaches, negligence, consumer fraud, unfair competition, securities fraud and racketeering.
Zuckerberg, Chief Operating Officer Sheryl Sandberg, and board members including Marc Andreessen and Peter Thiel face additional claims from shareholders for allegedly failing to uphold their fiduciary duties and wasting corporate assets.
Damages could be substantial for shareholders, with one group of investors estimating that at least $50 billion in the company's market capitalization has been wiped out as a result of the disclosure, which affected 50 million users.
Investors need only show that Facebook failed to disclose problems that caused the losses to succeed in court. Monetary damages resulting from breaches of user privacy are more difficult to estimate, and could be harder to prove, according to class action lawyers who aren't involved in the cases.
Given its massive cash reserves, legal payouts probably won't pose a major threat for the company. Facebook has typically settled lawsuits and regulatory actions over privacy in the past fairly swiftly, and for modest sums. The company will probably seek to do the same here, if it can, lawyers said.
"The main issue for them is going to be the media and how bad they look," said Miami-based attorney Erica Rutner. "Perhaps they enter into a quick settlement because they don't want to bad press associated with it."