SANTA FE, N.M. — In a historic legal defeat for Big Tech, a New Mexico state court jury has found Facebook—now operating under the corporate parent Meta—liable for systematically deceiving millions of users regarding its privacy protections and data-handling practices.
The verdict, handed down on Friday, September 25, following a rigorous two-week trial in Santa Fe, centers on an astronomical 43 million violations of New Mexico’s Unfair Practices Act. Jurors concluded that the social media giant repeatedly misled the public, obfuscated the true nature of its data-sharing protocols, and failed to adequately safeguard user information against third-party exploitation.
While the jury largely sided with the state regarding deceptive privacy statements, it delivered a nuanced verdict by rejecting claims that Facebook intentionally fabricated statements concerning the removal of specific categories of harmful content, such as pandemic-related misinformation. Even so, the sheer volume of violations found under state consumer protection statutes sets a dramatic legal precedent, positioning New Mexico as a lone wolf among state prosecutors willing to take Meta to trial over the historic Cambridge Analytica data breach.
Main Facts of the Case
The focal point of the Santa Fe trial was the fallout from the notorious "This Is Your Digital Life" personality quiz, a third-party application deployed on Facebook that harvested the personal data of approximately 87 million profiles. This data was subsequently funneled to Cambridge Analytica, a now-defunct political consulting firm that utilized the psychological profiles to target voters during the 2016 U.S. presidential campaign, which ultimately elected Donald Trump.
During the proceedings, New Mexico prosecutors systematically dismantled Meta’s narrative, walking the jury through 34 distinct public statements and policy documents issued by the company regarding data security. Jurors determined that in nearly every instance, these statements were deceptive, effectively misleading New Mexico’s entire population of over two million residents.
- The Violations: The jury tallied more than 43 million individual statutory violations, scaling with the number of affected users and deceptive statements made over several years.
- The Scope: The trial exposed systemic vulnerabilities in how social media platforms interact with third-party developers, revealing that user data could be easily scraped and commercialized without explicit, informed consent.
- The Defense Strategy: Meta’s legal team argued that the state’s evidence relied on outdated infrastructure, emphasizing that the company had completely overhauled its privacy frameworks, data governance policies, and third-party app access protocols in the years since the lawsuit was initially filed in 2021.
Chronology of the Controversy and Legal Battles
To understand the weight of the New Mexico verdict, one must trace the timeline of regulatory reckoning that began nearly a decade ago.
2014–2018: The Cambridge Analytica Breach
The seeds of the litigation were planted years prior, when third-party researcher Aleksandr Kogan harvested data from millions of Facebook users via a harmless-looking personality app. Although Facebook discovered the breach in 2015, it failed to notify affected users or adequately police the third-party developers, choosing instead to request that the data be deleted. When the story broke publicly in 2018 via internal whistleblower leaks and investigative journalism, it sparked global outrage, leading to parliamentary inquiries in the United Kingdom and congressional hearings in the United States.
2018–2021: Public Backlash and Regulatory Scrutiny
In the wake of the scandal, the #DeleteFacebook movement gained unprecedented traction, with nearly one in ten Americans purging their accounts. Regulatory bodies across the globe began drafting tighter privacy guardrails, culminating in landmark laws like the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
2021: New Mexico Files Suit
Frustrated by what it viewed as a sluggish federal response and corporate deflection, the New Mexico Department of Justice filed a comprehensive consumer protection lawsuit against Facebook in 2021. The state alleged not only privacy violations but also that the platform actively profited from the proliferation of harmful, violent, or inaccurate content.
August 2023–Present: The Multistate Settlement and Solo Pursuit
Earlier this year, Meta orchestrated a massive legal maneuver by agreeing to pay up to $18 billion (later reported around $16.7 billion) to settle a sprawling multistate lawsuit largely centered on child safety and minor protection. Unbeknownst to the general public until court documents were scrutinized, a clause buried deep within the 130-page settlement agreement sought to release Meta from any future liability stemming from the Cambridge Analytica breach.
Only two states—New Mexico and Florida—refused to sign off on the collective agreement, arguing that the terms were far too lenient on Big Tech. While Florida remained an outlier on procedural grounds, New Mexico took its case all the way to a jury verdict, rendering it the only state to independently try and defeat Meta over Cambridge Analytica in a court of law. Furthermore, New Mexico successfully secured $942 million in judgments earlier this year in a separate two-phase trial regarding minor safety protections on Meta’s platforms.
Supporting Data and Evidence Presented at Trial
The trial featured extensive documentation, expert testimonies, and depositions that shed light on the inner workings of Silicon Valley’s moderation and privacy architectures.
- The 34 Statements: State attorneys analyzed 34 public declarations made by Facebook executives—including CEO Mark Zuckerberg—regarding user privacy and safety. The jury found 33 of these statements to be misleading or outright false.
- Internal Decision-Making Structures: Jurors were shown depositions and heard testimonies from former insiders. Notably, former Facebook content moderator Ryan Hartwig revealed in an interview that global policy decisions affecting billions of users were frequently made by an insular team of roughly six people, raising serious questions about corporate accountability and centralized censorship power.
- Widespread Security Gaps: Beyond Cambridge Analytica, plaintiffs reminded the court of subsequent massive data exposures, including an incident where the personal records—including phone numbers, full names, and email addresses—of more than 500 million users were compromised and leaked online.
- Meta’s Content Metrics: Countering the state’s allegations that it monetized harm, Meta’s defense team maintained that the platform successfully intercepts and removes 99% of content that violates its community standards before users ever encounter it.
Official Responses and Stakeholder Perspectives
The legal showdown has drawn sharp reactions from state prosecutors, tech defense attorneys, and digital rights advocates alike.
- The New Mexico Department of Justice: In an official statement, the state DOJ hailed the verdict as a monumental triumph for everyday consumers. The agency emphasized that the decision sends an unmistakable message that even the wealthiest and most influential technology conglomerates on Earth are subject to state consumer protection laws and must answer for deceptive business practices.
- Meta’s Official Stance: Alex Burgos, a spokesperson for Meta, pushed back vehemently against the jury’s findings. In an emailed statement, Burgos remarked: "We disagree with the verdict and will continue to defend ourselves against efforts to distort our record." Meta’s legal team repeatedly asserted during the trial that its platforms serve as vital public forums for free expression, arguing that the company possesses a First Amendment right to manage and curate its digital spaces. Burgos further stressed that Meta remains deeply committed to safeguarding user information, providing individuals with granular control over their data, and protecting free speech globally.
Implications for the Tech Industry and Future Litigation
With the jury having established liability across more than 43 million violations, the legal battle now transitions into its next critical phase.
- Upcoming Penalties and Injunctions: A Santa Fe district court judge will preside over a yet-to-be-scheduled penalty hearing. Because the state found violations numbering in the tens of millions, statutory fines could scale to staggering heights, though legal experts note that courts often apply caps or judicial discretion to prevent excessive penalties. Additionally, New Mexico is aggressively pursuing a permanent injunction to bar Meta from deploying similar deceptive data practices within the state in the future.
- A New Legal Blueprint for States: For years, major tech corporations have relied on massive nationwide multidistrict litigation (MDL) settlements to wipe clean their slates, often avoiding the grueling optics of a jury trial. New Mexico’s refusal to fold into the multistate settlement—and its subsequent victory—demonstrates that aggressive state-level litigation remains a viable and potent weapon against corporate malfeasance.
- Data Privacy Legislation: The verdict arrives at a time of mounting bipartisan frustration over digital privacy rights in the United States. As federal lawmakers continue to stall on enacting comprehensive federal data privacy legislation, state attorneys general are stepping into the vacuum. The New Mexico verdict may embolden other states to reject pre-packaged national settlements, opting instead to take tech giants to court to extract harsher financial penalties and stricter operational mandates.
As the judge prepares to weigh financial penalties and injunction requests in the coming weeks, legal scholars and technology analysts will be watching Santa Fe closely. The fallout from this trial may fundamentally alter how social media platforms collect, monetize, and protect user data for the next decade.
