A jury finally said it out loud
Eight years after the Cambridge Analytica story broke, a New Mexico state court jury has found Facebook liable for deceiving users about privacy protections on the platform. The verdict came down on September 25 in Santa Fe, after a two-week trial in the First Judicial District Court. This is a state attorney general enforcement action under the New Mexico Unfair Practices Act, not a private class action, and it is the second Santa Fe jury verdict against Meta in six months.
What makes this verdict different from every settlement before it is that a jury actually ruled on the deception itself. The FTC imposed a record $5 billion penalty in 2019, and the federal class action over the same scandal settled for $725 million in 2023, but no jury had ever found Facebook liable for the Cambridge Analytica conduct. Now one has.
What the jury found
Jurors sided with the state on 31 of 34 counts on the verdict form, which the state counts as 26 of 29 misleading statements. They found the company liable for more than 43 million violations of the Unfair Practices Act, and found that Facebook’s failure to protect user data affected New Mexico’s entire population of more than 2 million people.
The deceptive statements fell into five categories: users’ ability to control their data, efforts to combat hate speech, efforts to combat misinformation, uniform application of community standards, and the company’s commitment to conduct a thorough investigation after the Cambridge Analytica scandal became public. Much of the evidence came from statements the company itself made: Mark Zuckerberg’s public comments, Sheryl Sandberg’s interviews, corporate blog posts. The state argued those were factual promises, and the jury agreed they were false.
The underlying scandal is familiar: a third-party personality quiz harvested data from roughly 87 million profiles and passed it to Cambridge Analytica, whose clients included the 2016 Trump campaign.
The penalty math is the wild card
Judge Francis Mathew will decide penalties in a later phase. New Mexico’s Unfair Practices Act allows up to $5,000 per violation, and Attorney General Raul Torrez has been happy to multiply: more than 43 million violations at the maximum comes to a theoretical ceiling north of $219 billion. Nobody expects that number, and it is worth treating as negotiation posture rather than forecast. The state will also ask for corrective statements about the past misstatements and an independent audit of how Meta manages user data, and any penalty funds would flow into a special fund supporting New Mexico schools.
Meta disputes the verdict and says it will keep defending itself, with a spokesperson pointing to First Amendment rights to manage its own platform. An appeal is close to certain, and the penalty number will not be final until that plays out.
Why New Mexico was still suing at all
The interesting strategic detail is that this case exists only because New Mexico refused to settle. In August 2026, Meta agreed to pay up to $18 billion to settle a multistate child safety lawsuit, and that deal released Meta from future Cambridge Analytica-related liability for the 47 states that signed. Meta separately paid $459 million to a group of states that had sued over Cambridge Analytica privacy claims. New Mexico, then led by Hector Balderas, had filed its own case back in 2021 and never joined either deal, with Florida the only other holdout on the child safety side.
The lesson for state enforcers is obvious in hindsight: one holdout state just produced the first jury finding of deception tied to Cambridge Analytica. Mega-settlements buy peace from signatories, but they do not extinguish an attorney general who kept their own case alive for five years.
What platform builders should take from it
For anyone building a platform that touches user data, the sharpest point is narrow: the case was won on public statements. Blog posts, help center copy, executive interviews. Courts can count each statement as a violation, one by one, when the statement turns out to be false. “You control your data” is not marketing puffery if the data flows prove otherwise, it is a countable claim.
That argues for an audit of your own published privacy promises, especially anything absolute. It also argues for documenting how third-party app access is actually enforced, because gaps between policy and enforcement are exactly what becomes evidence when a regulator or state attorney general comes knocking.
What happens next
The penalty hearing before Judge Mathew has no scheduled date yet. Meta will appeal, probably on both the liability findings and whatever penalty lands. Watch the dollar figure when it comes: it will set the reference point for every state attorney general wondering whether their own consumer protection statute can do what federal privacy law has failed to do. The penalty phase, not the verdict, is where this case becomes a precedent that matters.