Washington DC’s attorney general has sued Mark Zuckerberg, seeking to hold the Facebook co-founder personally responsible for his alleged role in allowing the political consultancy Cambridge Analytica to harvest the personal data of millions of Americans during the 2016 election cycle.

The suit, filed in the capital by the District of Columbia attorney general, Karl Racine, alleges that Zuckerberg directly participated in policies that allowed Cambridge Analytica to gather the personal data of US voters without their knowledge in an attempt to help Donald Trump’s election campaign.

“This unprecedented security breach exposed tens of millions of Americans’ personal information, and Mr Zuckerberg’s policies enabled a multi-year effort to mislead users about the extent of Facebook’s wrongful conduct,” Racine said in a news release.

“This lawsuit is not only warranted, but necessary, and sends a message that corporate leaders, including chief executives, will be held accountable for their actions.”

Meta declined to comment.

Racine has previously sued Facebook’s parent company, Meta, under the District of Columbia’s Consumer Protection Procedures Act. The act makes individuals responsible for violations if they knew about them at the time.

The suit against Zuckerberg is based on hundreds of thousands of documents, including depositions from employees and whistleblowers, that have been collected as part of its ongoing litigation against Meta.

“Since filing our landmark lawsuit against Facebook, my office has fought tooth and nail against the company’s characteristic efforts to resist producing documents and otherwise thwart our suit. We continue to persist and have followed the evidence right to Mr Zuckerberg,” said Racine.

Racine charges that the Cambridge Analytica scandal was a result of Zuckerberg’s desire to open up Facebook to third-party developers.

The suit alleges Zuckerberg was aware of the risks of data leaks associated with the strategy. In one email discussing state leakage Zuckerberg noted “there is clear risk on the advertiser side,” according to the lawsuit.

The suit points out that since 2012, Zuckerberg has served as chairman of Facebook’s board and controls approximately 60% of the voting shares.

“At all times relevant to the lawsuit, evidence showed Mr Zuckerberg was responsible for and had the clear ability to control Facebook’s day-to-day operations,” Racine’s office said in a statement.

As the Guardian revealed in 2018, Cambridge Analytica, which was hired by Trump’s 2016 election campaign team, gained access to the private data of 50 million Facebook users. The company claimed the information could be used to identify different types of voters and influence their behavior.

In 2019 Facebook was fined a record $5bn by the Federal Trade Commission (FTC) for violating consumers’ privacy. Critics of the fine said it did too little to change the company’s behavior and charged that litigation should have been brought against Zuckerberg.

Carl Tobias, Williams chair in law at the University of Richmond, said it can be “difficult” to sue corporate officers in their personal capacity, and Racine had failed in an attempt earlier this year to sue Zuckerberg when the suit was filed too late. “This filing seems to be creative, but it may not be more successful than previous attempts to sue CEOs and corporate officers in a personal capacity,” said Tobias.

Meta declined to comment.