New Mexico jury finds Facebook liable over privacy claims

A New Mexico jury has found Facebook liable for misleading users about the privacy of their personal information, creating the possibility of a penalty worth more than $200 billion if the state’s request is granted in full.

The verdict, reached after a two-week trial in Santa Fe, identified more than 43 million violations of New Mexico’s consumer protection law. The state’s attorneys are asking the judge to impose the maximum civil penalty of $5,000 for each violation. The final amount will be decided at a hearing scheduled for October 1.

SecurityWeek, which reported the verdict, said the case focused on Facebook’s handling of data obtained through a third-party personality quiz. Information from about 87 million profiles was collected and sold to Cambridge Analytica, a political consulting company whose clients included Donald Trump’s 2016 campaign.

The jury concluded that Facebook made misleading representations about how it protected user data. It also found that the company gave the public an inaccurate account of investigations into outside application developers accused of collecting information from users.

A case rooted in the Cambridge Analytica scandal

The New Mexico lawsuit followed the wider controversy over Cambridge Analytica, which brought Facebook’s data practices under intense scrutiny. Prosecutors argued that the company deceived users about the security of their information and about its response to third-party applications that obtained data.

Jurors found that the alleged conduct affected the state’s entire population of more than two million people. New Mexico’s Department of Justice described the outcome as an important victory for consumers and said it held one of the world’s largest technology companies responsible for its actions.

Facebook, which is owned by Meta, rejected the verdict. Meta spokesperson Alex Burgos argued that the state had presented evidence that was no longer current and said the company would continue to challenge what it considered a distorted account of its record.

During closing arguments, Facebook’s lawyers said New Mexico had five years to assemble its case but had identified only one additional data breach. The company also maintained that its policies and practices had changed since the lawsuit was filed in 2021.

The jury did not accept every claim made by the state. It found prosecutors had failed to establish that Facebook falsely represented its efforts to remove harmful material, including misinformation connected to the COVID-19 pandemic.

Possible penalty remains uncertain

The scale of the verdict does not necessarily indicate what Meta will ultimately have to pay. Multiplying the maximum $5,000 penalty by the number of violations would produce a sum exceeding $200 billion, with interest potentially accumulating if the company appeals. The judge must weigh competing arguments over what punishment would be appropriate.

Peter Ormerod, an associate professor of law at Villanova University, told SecurityWeek that Meta’s large profit margins and history of facing regulatory action could limit the practical effect of the judgment. He praised New Mexico’s persistent prosecution but questioned whether the result would be large enough to change the company’s conduct.

Attorney General Raúl Torrez said any money awarded would be directed to the state’s education system. New Mexico is also seeking an injunction that would prevent Facebook from repeating similar practices.

Meta has defended its authority to set rules for its platforms, saying they are forums for free expression. The company said its approach includes protecting user information, giving people control over their data and managing content according to what it believes serves its community. In testimony played during the trial, chief executive Mark Zuckerberg said Facebook had substantial systems for deciding whether material should be removed.

Part of a broader legal fight

The privacy verdict adds to a series of legal setbacks for Meta. New Mexico previously obtained judgments totaling $942 million in a separate, two-stage case concerning protections for minors on the company’s services. That case resulted in orders requiring safeguards including age-verification technology and limits on time spent on the platforms.

In August, Meta agreed to pay as much as $18 billion to resolve a multistate lawsuit involving child safety. The settlement also released the company from future liability connected with the Cambridge Analytica breach. New Mexico pursued its own action instead of joining that agreement, while Florida also declined to sign, arguing that the settlement did not go far enough.

That decision left New Mexico as the only state to take the Cambridge Analytica privacy dispute to trial. The next major step is the October penalty hearing, where the judge will determine whether the jury’s finding leads to a substantial financial sanction, a smaller award or additional legal proceedings.