A jury in Santa Fe found Facebook liable on Friday for deceiving New Mexico residents about how their data was protected — the last major case still standing from the Cambridge Analytica scandal.
The two-week trial centred on a third-party personality quiz that harvested data from roughly 87 million profiles and passed it to the political consultancy Cambridge Analytica, whose clients included Donald Trump's 2016 campaign. Jurors sided with the state, finding that Facebook's failure to protect user data affected New Mexico's entire population of more than two million people. According to Reuters, the jury found more than 43 million violations under the state's unfair business practices law, which allows civil penalties of up to $5,000 per violation — a theoretical ceiling of roughly $219 billion. Judge Francis Mathew will set the actual figure, and Meta is expected to appeal.
The company's exposure here is unusually large because of what it settled elsewhere. In August, Meta agreed to pay up to $18 billion to resolve a multistate child-safety suit, and buried in the 130-page agreement was a release from future liability over the Cambridge Analytica breach. New Mexico never signed that deal; neither did Florida, which called it too soft — leaving New Mexico the only state still litigating the breach. Its lawyers argued the evidence was outdated; the jury disagreed.
This is not New Mexico's first win against Meta. In a separate two-phase trial over safety protections for minors, the state won judgments totalling $942 million plus court-ordered safeguards, including age-verification technology and time limits on Meta's platforms.
The verdict is likely to become a template for state-level privacy enforcement. It also shows how much of the cost of the Cambridge Analytica affair was moved off the table by national settlements — and how much remains in the hands of states that refused to sign.
