Security2 publishers2 min readPublished
New Mexico jury holds Facebook liable for misleading users over Cambridge Analytica
New Mexico jurors held Facebook liable for misleading users on privacy after the Cambridge Analytica harvest, finding more than two million violations. A Santa Fe judge now sets penalties of up to $5,000 per violation, and the state wants the maximum on each.
The Watch · Security desk
What happened
- A third-party personality quiz app harvested data from about 87 million profiles, later sold to Cambridge Analytica, a now-defunct consultancy whose clients included the 2016 Trump campaign.
- Jurors found violations on most of the 34 statements on the verdict sheet, with between 1.3 million and 2.1 million violations for each, Bloomberg Law reports.
- The jury also found Facebook deceived the public about its inquiries into data brokers after the Cambridge Analytica fallout, according to The Independent.
- Meta's $18 billion youth-safety settlement in August released it from future Cambridge Analytica claims, which left New Mexico as the only state still suing over them.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure On this verdict's logic, a platform that lets third-party apps reach user data can be held to its own privacy statements, with penalties that scale with every affected user in a state.
- contradiction The Independent and Bloomberg Law count violations differently, so at $5,000 each the ceiling is either about $10 billion or at least $117 billion.
- precedent One state stayed out of a multistate release and took the released claims to a jury alone. It won, and other states can point to that at the next global settlement.
The data left Facebook through a third-party app. New Mexico's case went after Facebook's own conduct: what it told users about their privacy protections, and how it safeguarded their information [1][5]. Jurors found that the neglect reached the state's entire population of more than two million residents [5].
At $5,000 a violation, the two published counts produce very different ceilings. The Independent's total of more than two million violations puts the ceiling at $10 billion or more [1]. Bloomberg Law counts by statement, at 1.3 million to 2.1 million violations each [13]. One statement alone at the cap comes to $6.5 billion to $10.5 billion [2]. Most of 34 is at least 18 statements. Stacked in full, that is at least 23.4 million violations and a ceiling of at least $117 billion [3]. Judge Francis Mathew of the First Judicial Circuit in Santa Fe sets the penalty, and with it the counting method [12].
In closing, Facebook's lawyers argued that New Mexico relied on stale evidence. They also said five years of investigation turned up only one additional breach [7]. The defense measured the case in breaches, while the verdict sheet was built on statements [13]. Jurors sided with the state after a two-week trial [3].
This verdict comes after another New Mexico win against Meta: $942 million in judgments from a two-part trial over minor safety controls, plus orders for age-checking tools and time caps [11]. Florida also refused to sign the August settlement, saying it was not strict enough on Meta [10].
The exposure for platforms that let outside developers pull user data is in the company's own statements, here about its privacy protections and about its inquiries into data brokers after the scandal [1][6]. The published reports do not quote the 34 statements, so it is not yet public which specific promises the jury found misleading [13].
What to watch
- Judge Francis Mathew's penalty ruling, and whether he counts violations per resident or per statement.
- Any Meta post-trial motion or appeal challenging the per-resident violation count.
- Release of the 34 verdict-sheet statements, showing which privacy claims jurors found misleading.