Facebook Liable in Cambridge Analytica Deception Case
A New Mexico jury on Friday found Facebook liable for deceiving users about privacy protections on its platform, marking the social media giant’s latest and potentially most expensive legal setback tied to the Cambridge Analytica scandal. The verdict, delivered after a two-week trial in Santa Fe, found more than 43 million violations of the state’s consumer protection law. If the presiding judge awards the maximum statutory penalty of $5,000 per violation, Meta Platforms Inc. could owe over $200 billion—a figure CBS News reported comes with interest accruing if the company appeals.
It is now up to First Judicial District Judge Francis Mathew to determine the actual penalty, which he will weigh at a hearing scheduled for October 1. New Mexico Attorney General Raúl Torrez said he has instructed his trial team to “try to secure the maximum penalty allowed”—and that all money awarded will go into a fund for the state’s education system.
A Verdict Years in the Making
The case traces back to 2018, when reports revealed that a third-party personality quiz had harvested data from roughly 87 million Facebook profiles without proper consent and sold it to Cambridge Analytica, a political consulting firm whose clients included the 2016 campaign for Donald Trump. The revelation triggered congressional hearings, the #DeleteFacebook movement, and a wave of global scrutiny over how tech companies handle user data.
New Mexico’s lawsuit, filed by Torrez in 2021, accused the company of misleading users about those protections. By the time the jury returned its verdict on Friday, it had found that Facebook’s deceptive statements affected the state’s entire population of more than two million people. Jurors also concluded that the company misled the public about investigations into third-party app developers that harvest user data following the scandal.
The scope of the finding is unusual. According to Law.com, the jury found Meta violated the law as to 26 of the 29 alleged misstatements made by CEO Mark Zuckerberg, former CFO Sheryl Sandberg, and other executives before and after the Cambridge Analytica affair. The outlet described it as “a seminal moment.”
Meta Vows to Fight
Meta disputed the verdict and signaled it would continue defending itself. “We disagree with the verdict and will continue to defend ourselves against efforts to distort our record,” spokesperson Alex Burgos said in an email statement reported by Fortune.
Burgos also framed the matter as a free speech question. “Meta’s platforms are forums for free expression,” he said. “We have a First Amendment right to manage those platforms in a way we believe best serves the interests of our community.”
During closing arguments, lawyers for Facebook argued the state’s evidence was outdated and that despite having five years to gather material, New Mexico found only one other instance of a data breach, The New York Post reported. The jury reviewed 34 statements the company made about data protections and content policies, finding deception in almost every case.
In one of the few wins for the defense, jurors found the state did not prove that Facebook made false claims about removing harmful content, including misinformation about the COVID-19 pandemic.
The Penalty Puzzle
Whether the verdict translates into a meaningful financial hit remains an open question. “It’s unlikely that this is going to be the case that effectively penalizes the company in a meaningful way,” Peter Ormerod, an associate professor of law at Villanova University, told Fortune, noting Meta’s high margins. “There’s been a lot of criticism that none of these amounts of money are enough to discipline the company.”
New Mexico has nonetheless compiled a notable record against Meta in 2026. Earlier this year, the state won judgments totaling $942 million from the company in a two-phase trial over its protections for minors, and the court ordered new safeguards including age-verification technology and time limits on its platforms.
The Cambridge Analytica verdict is also distinctive because New Mexico is the only state still pursuing its own case on the matter. In August, Meta agreed to pay up to $18 billion to settle a multistate lawsuit involving child safety issues. Buried in the 130-page settlement was an agreement to release Meta from future liability related to the Cambridge Analytica privacy breach. Florida was the only other state that declined to sign, saying the settlement was not tough enough on Meta.
A Blueprint for the States
The case reflects a broader trend: with no comprehensive federal privacy law in place, state attorneys general have become the frontline regulators of Big Tech. Torrez framed the verdict in exactly those terms. “For years, Facebook operated as if the rules that apply to everyone else didn’t apply to them. Today, a jury of New Mexicans said otherwise,” he said. “This is a historic verdict, not just for New Mexico, but for every state fighting to hold Big Tech accountable.”
The New Mexico Department of Justice echoed that message, saying the verdict “marks a significant victory for New Mexico consumers” and holds one of the world’s largest technology companies accountable.
There are signs the strategy could spread. Florida’s refusal to join the multistate settlement left the door open for future litigation, and other states watching New Mexico’s twin 2026 wins may see a viable path to pursue their own claims.
What to Watch
All eyes now turn to Judge Mathew’s October 1 hearing, where the court will weigh competing arguments about what penalties are fair—and how much of the theoretical $200 billion exposure becomes real. The state is also seeking an injunction to stop the practices it challenged at trial.
Meta is expected to appeal any substantial penalty, a process that could stretch for years and accrue interest along the way. For now, the verdict stands as the clearest legal rebuke yet of the company’s handling of the data scandal that reshaped the global debate over privacy—and as a signal to other states that the fight is far from over.