(Reuters) — A federal judge on Monday ordered Facebook to face most of a nationwide lawsuit seeking damages for letting third parties such as Cambridge Analytica access users’ private data, calling the social media company’s views on privacy “so wrong.”

While dismissing some claims, U.S. District Judge Vince Chhabria in San Francisco said users could try to hold Facebook liable under various federal and state laws for letting app developers and business partners harvest their personal data without their consent on a “widespread” basis.

He rejected Facebook’s arguments that users suffered no “tangible” harm and had no legitimate privacy interest in information they shared with friends on social media.

“Facebook’s motion to dismiss is littered with assumptions about the degree to which social media users can reasonably expect their personal information and communications to remain private,” Chhabria wrote. “Facebook’s view is so wrong.”

A Facebook spokeswoman said the company considered protecting people’s information and privacy “extremely important,” but believed its practices were consistent with its disclosures and “do not support any legal claims.”

Lesley Weaver and Derek Loeser, two of the plaintiffs’ lawyers, said in a joint statement that they were pleased with the decision, and “especially gratified that the court is respecting Facebook users’ right to privacy.”

The litigation followed a series of data privacy issues involving Menlo Park, California-based Facebook.

These included the 2015 breach that allowed Cambridge Analytica, a British political consulting firm, to access data for an estimated 87 million Facebook users. That breach was not revealed until March 2018.

In their 414-page complaint, users said Facebook misled them into thinking they could keep control over personal data, when in fact it let thousands of “preferred” outsiders such as Airbnb, Lyft and Netflix gain access.

Chhabria faulted Facebook for treating privacy as an “all-or-nothing” proposition, where users would forfeit their privacy by sharing data even in a “limited” fashion.

He said Facebook had taken different positions elsewhere, including in a California case where it likened information kept on social media accounts to information stored on smartphones, where privacy concerns might be greater.

That position is “closer to the truth than the company’s assertions in this case,” Chhabria wrote. “Sharing information with your social media friends does not categorically eliminate your privacy interest in that information.”

The litigation covers Facebook users in the United States and United Kingdom whose information was shared with third parties without their consent since 2007.

The case is In re Facebook Inc Consumer Privacy User Profile Litigation, U.S. District Court, Northern District of California, No. 18-md-02843.

(Reporting by Jonathan Stempel in New York; Additional Reporting by Aishwarya Nair; Editing by Dan Grebler)