A New Mexico jury has found Facebook liable for deceiving users about privacy protections on the social media platform. The verdict came after a two-week trial in Santa Fe, where jurors heard accusations that Facebook misled users about a data breach tied to a third-party personality quiz. The judge will now decide how much Facebook pays, with attorneys asking for the maximum $5,000 penalty per violation.
The case centers on a quiz that harvested data from roughly 87 million profiles and sold it to Cambridge Analytica, a political consulting firm. The data was used to generate targeted ads for clients including the 2016 campaign for President Trump. Jurors found Facebook liable for over 2 million violations.
The Quiz at the Center
The breach began with a personality quiz that users took on Facebook. The trial focused on whether Facebook told users the truth about what was happening. Jurors found that the company did not. The quiz was a tool that users could take, and it was through that quiz that Facebook’s data was harvested and sold to Cambridge Analytica.
Facebook’s Response
A Meta spokesperson told CBS News that the company disagreed with the jury’s decision and would continue to defend “against efforts to distort our records.” The company also noted that free speech issues “featured very prominently” in the case.
But the verdict stands. Facebook was found liable for deceiving users, and the judge will now set the penalty. The state’s attorneys asked for the maximum $5,000 per violation, which could mean a massive payment if the full count holds.
The Settlement Loophole
The New Mexico case is unusual because the state refused to sign the multistate settlement that Meta agreed to in August. That settlement covered child safety issues, and Meta agreed to pay up to $18 billion to settle the case. But the settlement included a clause that released Meta from future liability related to the Cambridge Analytica privacy breach.
Florida was the only other state that did not sign the settlement. New Mexico is the only state to pursue a case. The settlement effectively closed the door on future lawsuits for the states that signed, but New Mexico’s refusal to sign kept that door open for it. It was this refusal that let the state pursue its own case.
The Two-State Standoff
New Mexico is not the first state to take on Meta. Earlier this year, the state won judgments totaling $942 million from Meta in a two-phase trial about the company’s safety protections for minors. The court also ordered Meta to implement new safeguards, including age-verification technology and time limits on its platforms.
The pattern is clear. Meta settles with states that agree to the terms, and it fights the ones that do not. New Mexico chose to fight, and the jury sided with the state.
The state’s attorney general, Raúl Torrez, has made clear his position. “For years, Facebook operated as if the rules that apply to everyone else didn’t apply to them,” he said. “Today, a jury of New Mexicans said otherwise.”
“For years, Facebook operated as if the rules that apply to everyone else didn’t apply to them. Today, a jury of New Mexicans said otherwise.”
The Outcome So Far
The verdict is a historic one, not just for New Mexico, but for every state fighting to hold Big Tech accountable. Jurors also found Facebook misled the public about investigations into data brokers following the Cambridge Analytica scandal.
Lawyers for Facebook claimed the state’s evidence was outdated and that despite having five years to gather material, New Mexico failed to find more than one other instance of a data breach. The defense did not win the day.
The case will now move to the penalty phase. The judge will determine how much Facebook pays, and the state’s attorneys are asking for the maximum $5,000 per violation.
What Meta Said
The Meta spokesperson’s statement was careful. The company disagreed with the verdict but did not dispute the basic finding that it had deceived users. Instead, it framed the case as one about free speech, saying that free speech issues “featured very prominently” in the trial.
The company’s position is that it has a First Amendment right to manage its platforms as it chooses. “We have a First Amendment right to manage those platforms in a way we believe best serves the interests of our community,” Meta said. “This means prioritizing free speech, protecting our users’ information and giving them control over their data.”
The case is still unresolved at the penalty stage. The judge will determine the amount Facebook pays, and the state’s request for the maximum $5,000 per violation means the total could be large.
For a company with Meta’s resources, the warning is clear. New Mexico has shown that it will not settle, and it has the resources to fight. The settlement that Meta agreed to in August released it from future liability related to the Cambridge Analytica privacy breach. New Mexico refused to sign that settlement.
The verdict is a message to any company that thinks it can operate above the law. For a company with Meta’s resources, that is a warning — not a punishment. The settlement that Meta agreed to in August released it from future liability, but New Mexico refused to sign.
The case will now move to the penalty phase. The judge will determine how much Facebook pays, and the state’s attorneys are asking for the maximum $5,000 per violation. For a company with Meta’s resources, that is a warning — not a punishment.
For New Mexico, the verdict is a victory. A jury of New Mexicans said otherwise.
Where the paper stands
The paper backs the jury’s finding that Facebook misled users and is against letting big companies hide their failures, including data breaches tied to third-party apps. The verdict stands, and the judge will now set the penalty.
The paper’s position is simple: when big companies ask to be regulated, the question is who those rules lock out. Licensing regimes and compliance costs only giants can afford are a moat, not a safeguard. Narrow rules against direct harm, such as forcing companies to disclose safety failures they hid, are the right approach. Broad rules that hand the market to the incumbents are the wrong approach.
The Cambridge Analytica breach showed Facebook’s willingness to deceive users about what happened to their data. The maximum penalty of $5,000 per violation, which could apply to over 2 million violations, would send a clear signal that data breaches tied to third-party apps have consequences. The settlement that Meta agreed to in August released it from future liability, but New Mexico refused to sign — and that refusal kept the door open to this case.
Source material: “Jury finds Facebook liable for deceiving users in Cambridge Analytica case,” CBS News.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.