A federal judge on Friday rejected Facebook’s argument that it cannot be sued for letting third parties, such as Cambridge Analytica, access users’ private data because no “real world” harm has resulted from the conduct.

“The injury is the disclosure of private information,” U.S. District Judge Vince Chhabria declared during a marathon four-and-a-half-hour motion-to-dismiss hearing Friday.