A New Mexico jury has found Facebook liable for deceiving users about privacy protections connected to the Cambridge Analytica scandal, handing the state a verdict that could expose the company to substantial penalties.
The decision followed a two-week trial in Santa Fe. Jurors agreed with state prosecutors that Facebook failed to protect user information and misled the public about its response to investigations of data brokers. They found the company liable for more than two million violations, a figure tied to New Mexico's population.
The judge, rather than the jury, will decide the amount Facebook must pay. Lawyers for New Mexico have asked for the statutory maximum of $5,000 for each violation. The requested figure is not yet an award, and the eventual judgment will depend on the court's assessment.
The case grew out of the harvesting of information from roughly 87 million Facebook profiles through a third-party personality quiz. That information was sold to Cambridge Analytica, a political consulting business that used profile data to help generate targeted advertising. The firm's clients included Donald Trump's 2016 presidential campaign. Cambridge Analytica has since shut down.
New Mexico Attorney General Raúl Torrez called the verdict a warning that technology companies operating in the state can be held responsible for statements about how they handle personal data. The state's case argued that the conduct affected New Mexicans broadly, rather than only users who could point to a separate individual breach.
Facebook disputed that position at trial. Its lawyers said the evidence was outdated and argued that the state had identified only one other breach despite years of investigation. After the verdict, a Meta spokesperson said the company disagreed with the outcome and would continue defending its record. The company also argued that its management of the platform implicated First Amendment interests while saying that it prioritizes free expression, information protection and user control.
The verdict makes New Mexico an unusual holdout in litigation over the Cambridge Analytica episode. A multistate settlement reached in August included a release from future liability related to the privacy breach. New Mexico did not join that resolution, leaving it as the only state to continue pursuing this case; Florida also declined the settlement but said its objection was that the terms were not sufficiently strong.
The finding adds to recent legal pressure on Meta in New Mexico. The state has also secured judgments totaling $942 million in litigation over protections for minors, along with an order for measures including age verification and platform time limits. Those separate proceedings concern different conduct, but together they show state authorities increasingly using consumer-protection law to test the promises large platforms make to their users.
For the Cambridge Analytica case, the next decisive step is the judge's penalty ruling. Until that occurs, the jury's finding establishes liability, but not the final financial consequence.
