New Mexico’s fight with Meta has reached a staggering scale, with the state’s penalty request potentially climbing as high as $219 billion. At the center of the case is a jury finding that Facebook misled users about privacy protections, third-party data access, misinformation policies, and a breach tied to Cambridge Analytica.
The verdict turns a familiar privacy scandal into a major test of how consumer protection laws apply to a social media platform with millions of users. New Mexico says Meta violated the state’s Unfair Practices Act, and jurors found more than 2 million violations of consumer protection laws.
A Privacy Case With Millions of Alleged Violations
The jury found Facebook liable for deceiving users about privacy protections on the platform. It also found that Meta misrepresented what third-party apps could do with Facebook data, maintained privacy settings that were unclear or vague, and falsely said it applied hate speech policies equally to everyone.
Those findings cover a wide range of conduct, not just one data incident. New Mexico argued that Meta’s statements reached Facebook users across the state, and jurors found 43 million violations based on the number of Facebook users in New Mexico who were the audience for the misleading statements.
The state’s case also points to the scale of Facebook’s reach. The company’s failure to protect user data impacted New Mexico’s entire population of more than 2 million people, according to the findings presented in the case.
Jurors found that 26 of 29 statements made by Meta were misleading. That result gives the penalty phase a huge number of alleged violations to consider, with the state positioned to seek as much as $219 billion.
Attorney Randi McGinn captured the state’s argument in a direct appeal to the court: “This court should speak to Meta in the only language it understands, which is money, and the value of its stock price.”
Cambridge Analytica Returns to the Center
The jury’s decision also revisits the Cambridge Analytica scandal, which involved data harvested from Facebook and used to target political advertising during the 2016 election. Cambridge Analytica, a British political data firm, used information connected to Facebook for political campaigns, including the 2016 campaign for Donald Trump.
A third-party personality quiz harvested data from roughly 87 million profiles and sold it to Cambridge Analytica. Another finding in the case said information from over 50 million Facebook profiles was harvested without consent for political ad campaigns.
New Mexico’s jury found Facebook liable for deceiving users about the data breach connected to that personality quiz. The state and Facebook therefore faced the same central question from two directions: what users were told about their data, and what happened after third-party applications gained access to it.
Meta filed a lawsuit against New Mexico in 2021, and the company has challenged the state’s case throughout the dispute. During the trial, Facebook lawyers claimed the state’s evidence was outdated and that New Mexico failed to find more than one other instance of a data breach.
Meta Seeks a Much Lower Penalty
Meta is asking the court to cap penalties at $3.45 billion. The company argues that New Mexico was unable to prove that any of its residents had actually been misled, even though the jury found millions of violations tied to the platform’s statements and privacy practices.
The penalty fight includes a $40 billion figure, while the state could ask for as much as $219 billion. Those numbers show why the final decision could reshape the financial consequences of privacy violations under New Mexico law.
Meta has also defended its broader approach to running Facebook. In a statement dated September 26, 2026, a Meta spokesperson said, “We disagree with the verdict and will continue to defend ourselves against efforts to distort our record. Meta’s platforms are forums for free expression. We have a First Amendment right to manage those platforms in a way we believe best serves the interests of our community. This means prioritizing free speech, protecting our users’ information and giving them control over their data.”
The dispute comes after Meta settled with 47 US states over child safety concerns in an $18 billion settlement. That agreement included a $459 million payment to resolve existing Cambridge Analytica lawsuits, and Meta agreed in August 2026 to pay up to $18 billion to settle the multistate lawsuit.
New Mexico and Florida declined to participate in the settlement related to Cambridge Analytica lawsuits. New Mexico’s separate case now leaves the company facing a verdict built around privacy promises, third-party access, political advertising, and the reach of misleading statements.
The court’s next decision will determine whether the jury’s findings translate into a penalty closer to Meta’s proposed cap, the $40 billion figure, or the state’s possible $219 billion request. Whatever number emerges, the case keeps one question in view: how much should a platform pay when privacy assurances fail across an entire population?
Based on
