A New Mexico jury has found Meta Platforms Inc. liable for deceiving users about privacy protections on Facebook, following a two-week trial in Santa Fe. The verdict centers on claims that the company misled users regarding a 2016 data breach involving an external personality quiz app that harvested data from roughly 87 million profiles and sold it to Cambridge Analytica, a now-defunct political consulting firm.
The jury determined that Facebook’s failure to protect user data impacted New Mexico’s entire population of over two million people, and also found the company liable for misleading the public about investigations into data brokers following the scandal. The judge will now decide the financial penalty, with state attorneys requesting the maximum fine of $5,000 per violation, totaling over two million violations.
Meta disputes the ruling, arguing in closing arguments that the state’s evidence was outdated and that New Mexico failed to uncover more than one other instance of a data breach despite five years to gather material. A Meta spokesperson stated the company disagrees with the jury’s verdict and will continue defending against what it calls efforts to “distort our records.” The spokesperson also emphasized the company’s First Amendment right to manage its platform as it sees fit, including prioritizing free speech and user control over information.
Background and Legal Context
The trial focused on Facebook’s handling of the Cambridge Analytica scandal, in which a third-party app collected user data under false pretenses and shared it with the political firm. The data was later used to create targeted political advertisements, including for the 2016 Donald Trump campaign. New Mexico is the only state to pursue legal action against Meta over this breach, as most others settled in a multistate lawsuit in August, agreeing to pay up to $18 billion related to child safety issues. Florida also opted out of the settlement, citing concerns it was not stringent enough.
In addition to this case, New Mexico has secured $942 million in judgments against Meta this year in a separate trial concerning safety protections for minors. The court ordered Meta to implement new safeguards, including age-verification technology and time limits on certain features for underage users.
Company Response and Ongoing Litigation
Meta maintains that it has taken steps to enhance user privacy since the Cambridge Analytica incident, though the company has faced repeated legal challenges over its data practices. The company’s legal team argued during the trial that the state’s case relied on outdated information and failed to demonstrate widespread harm beyond the initial breach. The spokesperson reiterated that Meta believes it acted in accordance with its policies and legal obligations at the time.
The outcome of this case could set a precedent for how courts interpret corporate accountability in data privacy cases, particularly regarding misrepresentation of privacy protections and the scope of harm to users. The judge’s decision on penalties is expected in the coming weeks.