New Mexico jury finds Meta liable for 43 million violations in Cambridge Analytica case

In 2018, news reports revealed that Cambridge Analytica, a now defunct British political consulting firm, had harvested personal data from as many as 87 million Facebook users through a third party personality quiz. The firm's clients included Donald Trump's 2016 presidential campaign, and the data was used for political profiling and targeted advertising. The scandal triggered global scrutiny of Facebook's data practices and led to multiple investigations and lawsuits, including one filed by New Mexico Attorney General Raúl Torrez in 2021, three years after the revelations.

That lawsuit alleged that Facebook, now known as Meta Platforms, misled users about how their personal information could be shared with third parties and the extent of users' control over their data. The state also claimed that the company made deceptive statements about its handling of hate speech, misinformation, and exceptions to its platform rules. The case finally went to trial in Santa Fe, New Mexico, for roughly two weeks in September 2026. The jury of 12 heard testimony and arguments about the company's public communications and its internal practices.

On Friday, September 25, 2026, the jury found Facebook liable for deceiving users about privacy protections. The jury found more than 43 million violations of the state's Unfair Practices Act, according to the New Mexico Department of Justice. The verdict sets up a remedies phase before Judge Francis Mathew of New Mexico's First Judicial District, who will determine civil penalties that can reach up to $5,000 per violation. A hearing is scheduled for October 1, 2026. The state is seeking the maximum penalty for each violation, and the theoretical maximum could exceed $219 billion.

The outcome is the latest legal setback for Meta, which has faced mounting scrutiny over its data handling and content moderation practices. The state's Department of Justice said the verdict marks a significant victory for New Mexico consumers and holds one of the world's largest technology companies accountable for its conduct. Meta has said it disagrees with the verdict and will continue to defend itself against efforts to distort its record.

Key Facts

MLex reported on September 25 that a jury of 12 found that Facebook made deceptive or unfair statements in 31 of the 34 statements about its handling of users' personal data, including over its policies leading up to the Cambridge Analytica privacy scandal in 2018. The verdict dates to September 25, 2026. Reuters reported on September 26 that jurors found 26 of 29 statements identified by the state were misleading, including comments about user data, hate speech and misinformation. They rejected claims that Meta misled consumers about removing harmful content and fact checking.

The jury found more than 43 million violations, based on the number of people affected. The Epoch Times reported on September 27 that the jury found over 43.8 million violations of New Mexico's Unfair Practices Act through false or misleading statements to consumers. The Associated Press reported on September 26 that the jury found Facebook liable for deceiving users about privacy protections, affecting New Mexico's entire population of more than two million people. Attorneys for the state are asking for the maximum $5,000 penalty per violation.

New Mexico Attorney General Raúl Torrez said at a press conference that the case revealed in stark detail the way in which this company plays fast and loose with the rules. He said his office will push for the maximum penalty and will also seek court ordered changes such as corrections and an audit of how Meta manages user data. All money awarded will go into a fund for the state's education system, Torrez said. The state is also seeking an injunction.

Meta spokesperson Alex Burgos said, 'We disagree with the verdict and will continue to defend ourselves against efforts to distort our record.' A Meta spokesperson also said that Meta's platforms are forums for free expression, and that this means prioritizing free speech, protecting users' information and giving them control over their data. Meta had argued during trial that the statements were cherry picked snippets ignoring context, and denied selling users' information.

The verdict is Meta's second major courtroom loss in New Mexico this year. In a separate youth safety case, a jury imposed $375 million in March 2026, and a judge later added $567 million for teen mental health, bringing total exposure to $942 million. The current case is separate from that youth safety matter, but it adds to the company's legal troubles in the state. The lawsuit was filed in 2021, and the trial lasted roughly two weeks.

Analysis

The size of the potential penalty is staggering, but the practical outcome is likely to be far more complicated. The theoretical maximum of over $219 billion assumes the judge awards the maximum $5,000 for each of the more than 43.8 million violations. That would exceed Meta's annual revenue and would almost certainly be challenged on appeal. The judge could instead impose a lower amount per violation or a lump sum, and the state's request for an injunction and other remedies could be just as significant as the financial penalty.

What this really means is that state level consumer protection laws have become a powerful tool for holding large technology companies accountable, even when federal regulation stalls. New Mexico's Unfair Practices Act allows for civil penalties on a per violation basis, and the jury's finding that more than 43 million violations occurred means the state has enormous leverage. The case also shows that juries are willing to accept the argument that misleading statements about data privacy can affect an entire state's population, not just individual users.

The verdict also highlights the long shadow of the Cambridge Analytica scandal. Although the scandal broke in 2018, the legal consequences are still unfolding years later. The fact that the jury found 26 of 29 challenged statements misleading, or 31 of 34 according to another tally, suggests that jurors were persuaded that Facebook's public communications did not match its actual practices. Meta's defense that the statements were taken out of context did not prevail.

The bigger picture here is that Meta faces a growing accumulation of legal risks in the United States. The New Mexico case is just one of several state level actions. The previous $942 million in penalties from the youth safety case already showed that New Mexico courts are willing to impose substantial financial consequences. If the judge in this case awards even a fraction of the theoretical maximum, it could encourage other states to pursue similar claims. Meta has said it will continue to defend itself, and the appeal process could take years, with interest accruing on any judgment.

Why It Matters

This case matters because it tests whether state consumer protection laws can effectively penalize a global technology platform for statements made years ago. The verdict found that Facebook misled New Mexico residents about data privacy and misinformation, and the remedies phase will determine how much the company pays and what changes it must make. The state is seeking an injunction that could require Meta to correct its statements and undergo an audit of its data management practices. Those non financial remedies could have a lasting impact on how Meta operates.

The decision also matters for other technology companies. If New Mexico succeeds in securing a large penalty, it could inspire other states to bring similar cases under their own consumer protection statutes. The Cambridge Analytica scandal affected users across the United States and around the world, and many states have already taken action against Meta. A significant penalty in New Mexico would add to the financial and reputational pressure on the company.

For New Mexico residents, the money awarded will go into a fund for the state's education system, according to Attorney General Torrez. That means the case is not just about punishing Meta but also about providing resources for public schools. The state's population of more than two million people was found to be affected by the misleading statements, so the outcome has a direct connection to residents. The judge's decision on penalties will determine how much funding the state receives.

Next Up

The immediate next step is the remedies hearing on October 1, 2026, before Judge Francis Mathew. At that hearing, the judge will determine civil penalties under New Mexico's Unfair Practices Act, with the state seeking the maximum $5,000 per willful violation. The judge will also consider the state's request for an injunction, which could include corrections and an audit of Meta's user data management. Meta is expected to appeal any penalty, and interest would accrue on the judgment during the appeal process.

Beyond New Mexico, the verdict is likely to be cited by other states and regulators as they consider their own actions against Meta. The company continues to face scrutiny over its data practices and content moderation, and the outcome of this case could influence the broader regulatory environment. For now, all eyes are on the October 1 hearing, where the theoretical maximum of over $219 billion could begin to take a more concrete form.