New Mexico Jury Finds Facebook Liable for Deceptive Privacy Practices in Landmark Cambridge Analytica Verdict
In a significant legal development for the technology sector, a New Mexico jury delivered a verdict on Friday, September 25, finding Facebook—now operating under the corporate umbrella of Meta Platforms—liable for systematically deceiving users regarding privacy protections on its platform. The jury concluded that the social media giant committed more than 43 million violations of the state’s consumer protection statutes. The case, which concluded after a rigorous two-week trial in Santa Fe, represents a rare instance in which a state has successfully pursued litigation against the tech behemoth regarding the long-standing fallout of the Cambridge Analytica scandal.
The trial proceedings focused heavily on the company’s management of user data, specifically concerning the third-party personality quiz "This Is Your Digital Life." This application acted as a conduit for the unauthorized harvesting of data from approximately 87 million user profiles. The harvested information was subsequently sold to Cambridge Analytica, a now-defunct political consulting firm that utilized the data to build psychological profiles of voters, which were then leveraged by clients, including the 2016 campaign of Donald Trump.
A Chronology of the Cambridge Analytica Scandal and Legal Fallout
The origins of this litigation trace back to the explosive revelations of 2018, when whistleblowers exposed how Facebook’s platform architecture allowed third-party developers to access not only the data of users who took quizzes but also the data of their unsuspecting friends.
Following the global outcry, the social media landscape shifted permanently. The subsequent years saw a wave of regulatory investigations across the United Kingdom, the European Union, and the United States. While most states eventually opted into a massive, multi-state settlement agreement—a deal that included a release of liability for Meta concerning the Cambridge Analytica breach—New Mexico took the rare path of proceeding to trial.
In August of this year, Meta reached a multi-state settlement figure estimated at roughly $16.7 billion to resolve various child safety and privacy concerns. However, New Mexico’s refusal to sign the waiver regarding the Cambridge Analytica breach kept the company’s past practices under judicial scrutiny. This verdict arrives on the heels of another significant legal defeat for Meta in New Mexico, where the state secured judgments totaling $942 million earlier this year, stemming from a two-phase trial regarding the company’s failure to implement adequate safety protections for minors.
Trial Dynamics: Evidence and Testimony
During the Santa Fe trial, the jury reviewed 34 specific statements issued by Facebook regarding its data protection protocols and content management policies. The jury found that in almost every instance, these statements misled the public. The state’s legal team, led by attorney Randi McGinn, successfully argued that Facebook’s business model was inherently at odds with its public-facing commitments to user privacy.
A pivotal moment in the trial involved the playback of a deposition from Meta CEO Mark Zuckerberg. When questioned about the robustness of the company’s internal content moderation and data oversight systems, Zuckerberg maintained that the firm had established rigorous protocols to identify and remove policy-violating content. Conversely, the state presented evidence from a former Facebook insider, corroborated by interviews with former content moderator Ryan Hartwig, suggesting that the most critical policy decisions were being funneled through an incredibly small team of roughly six individuals, raising questions about the efficacy of global moderation strategies.
Facebook’s defense counsel contended that the state’s evidence was fundamentally outdated. They argued that the company had undergone a massive transformation in its corporate governance and data privacy policies since the lawsuit was originally filed in 2021. Furthermore, Meta spokespeople emphasized that the company now claims to remove 99% of content that violates its community standards. Meta spokesperson Alex Burgos stated, "We disagree with the verdict and will continue to defend ourselves against efforts to distort our record." The company further maintains that its platforms function as forums for free expression, asserting a First Amendment right to curate and manage content as it sees fit.
Economic and Regulatory Implications
The scope of this verdict is expansive. By finding that the deceptive statements affected the entire population of New Mexico—exceeding two million residents—the jury established a scale of liability that could result in substantial financial penalties. While the judge has yet to set a date for the penalty phase of the trial, the potential for a massive fine looms large. The state of New Mexico is also seeking a permanent injunction that would legally compel Meta to alter its current data practices and potentially submit to independent monitoring.
This ruling arrives at a time when the broader tech industry is under increasing pressure from state attorneys general. Beyond the Cambridge Analytica breach, the company has faced significant criticism regarding a separate privacy incident involving the exposure of personal data—including phone numbers, full names, and email addresses—belonging to over 500 million users. The cumulative effect of these revelations has triggered a persistent public backlash, famously exemplified by the #DeleteFacebook movement, which saw nearly one in ten Americans abandon the platform at the height of the controversy.
Analyzing the Impact on Future Tech Litigation
Legal experts suggest that the New Mexico verdict serves as a watershed moment for state-level consumer protection. For years, major technology companies have relied on federal preemption and large-scale, nationwide settlements to insulate themselves from aggressive local litigation. By successfully litigating the Cambridge Analytica case independently, New Mexico has provided a roadmap for other states to hold multinational tech corporations accountable for localized harms.
The fact that the jury rejected the state’s claims regarding the removal of COVID-19 misinformation indicates that the verdict was not a blanket indictment of all company policies, but rather a surgical critique of specific privacy and data management claims. This nuance may make the verdict harder to overturn on appeal, as it demonstrates that the jury carefully weighed the evidence regarding specific, identifiable harms.
As the legal proceedings shift toward the penalty phase, the outcome will likely be viewed as a litmus test for the future of Big Tech accountability. If the state secures a significant financial judgment and an effective injunction, it may embolden other jurisdictions to bypass national settlement agreements in favor of state-specific litigation, fundamentally altering the risk profile for companies like Meta.
Furthermore, the verdict reinforces the growing public demand for transparency in algorithmic management. The trial highlighted the tension between the "move fast and break things" philosophy that defined the early era of social media and the current regulatory reality, where data privacy is treated as a fundamental consumer right.
Ultimately, the New Mexico jury’s decision serves as a stark reminder that even the world’s largest technology companies are not immune to the scrutiny of state courts. Whether this victory results in a systemic shift in how Meta handles user data remains to be seen, but the precedent set in Santa Fe will undoubtedly influence the landscape of digital privacy law for years to come. The state’s Department of Justice continues to frame this as a victory for the average consumer, promising to ensure that the penalties imposed serve as both a punishment for past transgressions and a deterrent against future deceptive practices. As regulators, lawmakers, and corporate legal departments digest the implications of this ruling, the pressure on social media platforms to prioritize user privacy over data monetization has never been greater.
