New Mexico Jury Finds Meta Liable for Privacy Violations in Cambridge Analytica Case

A state judge in Santa Fe will soon decide whether to impose one of the largest corporate privacy fines in history, following a jury verdict that found Meta Platforms liable for deceiving New Mexico residents. On Friday, jurors concluded that Facebook violated the state's Unfair Practices Act exactly 43.9 million times by misleading users about how their personal data was protected. The state is seeking the maximum statutory penalty of $5,000 per violation, exposing the technology giant to theoretical damages exceeding $219 billion—a mathematical maximum that judges rarely impose in practice, but one that establishes immense negotiating leverage.[1][3]

The two-week trial centered on the mechanics of a 2014 third-party personality quiz that harvested information from roughly 87 million Facebook profiles. That data was subsequently acquired by Cambridge Analytica, a political consulting firm that utilized the information to generate targeted advertisements during the 2016 United States presidential campaign.[2][4]

State prosecutors successfully argued that Facebook's public assurances of security were essentially marketing language, designed to maintain user trust while the platform's architecture inherently prioritized the collection and monetization of personal data. The jury determined that the company's failure to safeguard this information impacted New Mexico's entire population of more than 2 million residents.[2][5]

Jurors were asked to evaluate 34 specific corporate statements regarding privacy controls and data sharing. Beyond the initial data harvesting, the jury also found Meta liable for over 2 million additional violations for misleading the general public about its subsequent investigations into third-party data brokers following the initial 2018 scandal.[3][5]

The verdict represents a unique legal strategy by New Mexico Attorney General Raúl Torrez. In August 2026, Meta negotiated an $18 billion multistate settlement primarily focused on child safety issues. However, that 130-page agreement included a provision releasing the company from future liability related to the Cambridge Analytica breach.[4][5]

New Mexico opted out of that settlement, choosing to pursue the privacy claims independently. "For years, Facebook operated as if the rules that apply to everyone else didn't apply to them," Torrez said following the verdict. "Today, a jury of New Mexicans said otherwise."[2][4]

During closing arguments, Meta's defense attempted to frame the Cambridge Analytica incident as an isolated, decade-old anomaly rather than a structural feature of its business model. The company maintained that despite having five years to gather material, prosecutors failed to identify more than one instance of a data breach affecting state residents.[2][5]

Meta also argued that because Facebook operates as a free service, it falls outside specific provisions of New Mexico's consumer protection laws. Following the verdict, a company spokesperson stated that Meta disagreed with the outcome and would continue to defend against efforts to "distort our records," noting that First Amendment free speech issues featured prominently in their defense.[2][4]

The jury did not side with the state on every count. They declined to find Meta liable for making false statements regarding its efforts to remove misinformation and hate speech from the platform, drawing a strict legal distinction between data privacy failures and content moderation practices.[1][5]

The financial stakes now shift to the presiding judge, who will schedule a subsequent hearing to determine the final monetary damages and consider the state's request for injunctions to halt future deceptive practices. While the $219 billion maximum penalty is unlikely to be levied in full, the verdict establishes a clear precedent for states willing to litigate historical privacy claims outside of consolidated national settlements.[3][5]