The U.S. capital city sued Facebook in December, accusing it of misleading users because it had known about the breach for two years before disclosing it and had allowed third-party app makers to access user information without their consent.
Judge Fern Flanagan Saddler signed the order denying Facebook's motion to dismiss, or alternatively, stay proceedings, the court said in a brief statement on its website.
It was the second legal blow for the world's largest social network on Friday, after a judge in Delaware ordered it to turn over to shareholders emails and other records on its handling of data privacy, also linked to the Cambridge Analytica scandal.
Facebook did not immediately respond to a Reuters request for comment on the decision.
Cambridge Analytica, hired by U.S. President Donald Trump's 2016 election campaign, used a personality quiz distributed on Facebook to gather profile information in order to predict and influence voter behavior.
It shut down after the breach was disclosed. Several U.S. and European regulatory probes into Facebook ensued, including investigations by multiple state attorneys general.
The Washington, D.C. court could award unspecified damages and impose a civil penalty of up to $5,000 per violation of the district's consumer protection law, or potentially close to $1.7 billion, if penalized for each consumer affected.The lawsuit alleges the firm's quiz software had data on 340,000 D.C. residents, even though just 852 users had directly engaged with it.