Facebook liable for 43 million data privacy

A New Mexico jury found Facebook violated state consumer protection law over 43 million times by deceiving users about data sharing with third-party apps like the Cambridge Analytica-linked personality quiz. The verdict, delivered on September 25, 2026, in Santa Fe, concluded a two-week trial centered on accusations that Facebook misled the public about its investigations into third-party app developers following the scandal.

The jury determined Facebook did not honor promises to investigate apps that accessed significant amounts of user data after Cambridge Analytica. The personality quiz app scraped data from roughly 87 million user profiles, which was later sold to the political consulting firm Cambridge Analytica, whose clients included the 2016 campaign for Donald Trump. Jurors found Facebook misled consumers by telling them they controlled how their information was shared.

The company did not conduct forensic audits of third-party apps, did not stop working with developers who misused data, and did not alert people whose information may have been impacted. During closing arguments, lawyers for Facebook claimed the state’s evidence was outdated and that despite having five years to gather material, New Mexico found only one other instance of a data breach. Jurors found the deceptive statements affected New Mexico’s entire population of more than two million people.

Legal basis and potential penalties

Each violation of New Mexico’s Unfair Practices Act carries up to $5,000 in civil penalties. Attorneys representing the state are asking for the maximum $5,000 penalty per violation. The jury did not set a monetary amount; Judge Francis Mathew must determine the number of violations and the per-violation penalty during a hearing on October 1.

If the state successfully persuades the judge to award the maximum civil penalties for every violation, the company could owe over $200 billion.

Broader context of Meta’s legal exposure

The verdict adds to Meta’s growing financial penalties from state-led cases. In March, a New Mexico court ordered Meta to pay $942 million in civil penalties for breaking consumer protection laws related to kids’ online safety. In August, Meta agreed to pay up to $18 billion to settle a multistate lawsuit involving child safety issues.

Buried in that 130-page settlement was an agreement to release Meta from future liability related to the Cambridge Analytica privacy breach, making New Mexico the only state to decide to pursue a case on its own. Florida was the only other state that did not sign the settlement, saying it was not tough enough on Meta, leaving the door open for future litigation. The court in the child safety case also ordered Meta to implement new safeguards, including age-verification technology and time limits on its platforms.

Statements and next steps

New Mexico Attorney General Raúl Torrez issued a press release calling the verdict historic. "For years, Facebook operated as if the rules that apply to everyone else didn’t apply to them," Torrez said. He also stated, "This is a historic verdict, not just for New Mexico, but for every state fighting to hold Big Tech accountable."

New Mexico is pressing the judge to order Facebook to make sweeping changes to its data privacy practices and is seeking an injunction to stop similar practices in the future. Torrez told reporters that all money awarded will go into a fund for the state’s education system.

Alex Burgos, a spokesperson for Meta, said in an email, ‘We disagree with the verdict and will continue to defend ourselves against efforts to distort our record.’ In a statement after the verdict, Burgos added that Meta’s platforms are forums for free expression and that the company has a First Amendment right to manage those platforms.

Jurors found the state didn’t prove that Facebook made false claims about removing harmful content, including misinformation about the COVID-19 pandemic. The state had claimed the company favored certain accounts and allowed for violent or inaccurate content to proliferate. Facebook denied the claims, arguing the company has adapted its policies since the state’s lawsuit was filed in 2021, removes 99% of content that violates standards, and has robust systems to determine whether content should be taken down.

Peter Ormerod, an associate professor of law at Villanova University, said it’s unlikely this case will effectively penalize the company in a meaningful way, noting Meta has very high margins and previously skirted regulatory actions. Judge Francis Mathew will determine the number of violations and per-violation penalty in a hearing scheduled for October 1.