At this point it is just an investigation. Nobody has been charged with anything. They have to find a law Facebook has broken first, and presumably establish enough evidence that they expect to succeed at a trial.
Negligence specifically does not, it only requires the existence of a duty of care (except not in specialized cases, that of reasonable care, which doesn't mean you are aware of risk, but that a reasonable person in your place would be.) Recklessness requires conscious awareness and disregard of risk, but not awareness of wrongness.
Harms from recklessness are mistakes, while recklessness itself is not, but negligence is quite normally a mistake.
But of course there's always the Computer Fraud and Abuse Act which is so broad that it could potentially apply to just about anything anyone has ever done via an internet connection.