Security1 publisher2 min readPublished
New Mexico jury finds Facebook deceived users about data privacy nearly 44 million times
New Mexico jurors found Facebook broke the state's Unfair Practices Act nearly 44 million times, at up to $5,000 per violation. A judge sets the penalty in the coming weeks from findings that Facebook's public statements about data sharing misled its users.
The Watch · Security desk
What happened
- Jurors found Facebook misled users by telling them they controlled how their information was shared and that it did not buy or sell their private data, particularly with advertisers.
- The jury found Facebook did not keep post-Cambridge Analytica promises to investigate data-heavy apps, run forensic audits, cut off developers who misused data and alert affected users.
- New Mexico already won a $942 million civil penalty from Meta in March, in a kids' online safety case brought under the state's consumer-protection laws.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- cost Meta's bill passes $1 billion at any per-violation penalty above about $23, a small fraction of the $5,000 the statute allows.
- exposure Post-incident pledges such as forensic audits and user notification now carry consumer-protection exposure in New Mexico when a company does not follow through on them.
- decision Besides a per-violation figure, the judge must rule on New Mexico's request to put Meta's future data handling under court-ordered changes.
- precedent Torrez is offering the verdict to every state, and a per-violation count that held up before a jury gives other attorneys general a model for privacy claims.
Nearly 44 million violations at up to $5,000 each put the statutory ceiling just under $220 billion [3][1]. The judge does not have to go near it [3]. At $50 a violation, one percent of the maximum, the total still comes to about $2.2 billion [2]. The Record's report does not explain how jurors arrived at the count [1].
Meta has paid large sums in this area before [9]. It settled a separate kids' online safety case with California in August for $17 billion plus a commitment to reforms [11]. The Record puts Meta's penalties across privacy cases in the tens of billions of dollars, and says this verdict could add substantially to that total [9][4].
The Cambridge Analytica findings are the part closest to incident response. Facebook made its app-investigation promises in the aftermath of that scandal [8]. The case ran under New Mexico's Unfair Practices Act [3], so a post-incident pledge was judged the way any consumer claim is judged: against what the company actually did. The jury found Facebook did not carry out the steps it promised [8].
The content-moderation findings matter less for data handling. According to the attorney general's press release, jurors found Facebook "willfully" deceived consumers about enforcing its community standards, including the claim that it offered "no special protections for particular groups and no exceptions to its policies for politicians or newsworthiness" [7]. Other statements found false included that Facebook deleted "harmful" misinformation and did not profit from misinformation or hate [16].
"For years, Facebook operated as if the rules that apply to everyone else didn't apply to them," Torrez said in a statement [12]. He called the result "a historic verdict, not just for New Mexico, but for every state fighting to hold Big Tech accountable" [13].
So far this is one jury in one state, and no penalty has been set [1][2]. A Meta spokesperson did not immediately respond to The Record's request for comment [15].
What to watch
- The judge's per-violation penalty, due in the coming weeks, which decides whether the bill lands near $1 billion or far above it.
- Whether the judge grants New Mexico's request for court-ordered changes to Meta's data privacy practices.
- Meta's response to the verdict, including any challenge; the company had not commented when The Record published.