Meta Found Liable for Misleading New Mexico Residents on Data Handling
A state jury ruled the social platform violated consumer protection law over Cambridge Analytica-era claims, opening the door to penalties years after the scandal
The Verdict and Its Roots
A jury in New Mexico has determined that Meta breached the state's Unfair Practices Act by misrepresenting how it managed user privacy and handled misinformation on its platform. The finding, delivered on 25 September 2026, stems from a 2021 lawsuit that the state attorney general filed in the aftermath of the Cambridge Analytica affair, when data from approximately 50 million Facebook users was harvested and deployed to target political advertisements during the 2016 US presidential election.
The case centred on allegations that Meta obscured what third-party applications could do with user data, maintained privacy controls that were deliberately vague, and falsely claimed it enforced hate speech policies uniformly. During proceedings, Meta's legal team conceded the company had mishandled aspects of privacy and misinformation in earlier years, but rejected claims that it sold user data or profited from hate speech on the platform.
Penalties Still to Be Determined
A judge has not yet announced the financial penalty Meta will face. The Unfair Practices Act allows for civil fines, and the scale of the award will hinge on how the court interprets the scope and duration of the violations. Given that New Mexico pursued this case independently rather than joining a multistate settlement, the state retains latitude to seek damages tailored to its resident population and the specific harms alleged.
Meta has not issued a public statement on the jury's decision. The outcome adds another line item to the company's ledger of legal settlements and judgments tied to Cambridge Analytica, a scandal that has continued to generate litigation nearly a decade after the 2016 election cycle.
A Pattern of Settlements Across Jurisdictions
Cambridge Analytica remains one of the most visible episodes in Meta's regulatory history. The firm, which dissolved in 2018, extracted user profile data through a personality quiz app and used it for political micro-targeting without explicit consent from most affected users. Meta's oversight failures allowed the breach to persist undetected for years.
Since the scandal broke, Meta has entered into settlement agreements in the United States, the United Kingdom, and Australia. In early 2026, the company reached an $18 billion settlement with 47 US states over child safety concerns. Embedded within that broader agreement was a $459 million component specifically intended to resolve lingering Cambridge Analytica claims in participating states.
New Mexico and Florida opted out of the Cambridge Analytica portion of that settlement, preserving their right to litigate independently. Florida has not yet brought its case to trial. New Mexico's decision to proceed allowed a jury to weigh the evidence and deliver a liability finding, rather than accepting a negotiated sum.
Why New Mexico Chose to Litigate
State attorneys general face a recurring strategic choice: join a multistate settlement for guaranteed but often modest per-capita recovery, or pursue standalone litigation that carries higher risk but also the possibility of a larger award and a more detailed public record. New Mexico's opt-out reflects a calculation that the facts warranted a trial and that a jury verdict would carry weight beyond the immediate financial outcome.
The state's original complaint, filed in 2021, argued that Meta's conduct violated consumer protection statutes designed to prevent deceptive trade practices. By framing the case around state law rather than federal data protection rules, New Mexico avoided some of the jurisdictional complexity that has slowed other privacy cases and kept the focus on whether Meta's public statements matched its actual practices.
The Broader Context for Platform Accountability
This verdict arrives as regulators and legislatures across multiple jurisdictions intensify scrutiny of how social platforms collect, share, and monetise user data. The European Union's General Data Protection Regulation and Digital Services Act have set a high bar for transparency and user control. In Asia, jurisdictions including South Korea, India, and Singapore have introduced or strengthened data protection frameworks that impose significant fines for breaches and misrepresentation.
In the United States, the absence of a comprehensive federal privacy law has left enforcement fragmented across state attorneys general and the Federal Trade Commission. That patchwork creates uneven compliance burdens for platforms but also allows individual states to test novel legal theories. New Mexico's successful use of its consumer protection statute may encourage other states to revisit dormant or settled claims, particularly if the eventual penalty is substantial.
What Comes Next for Meta
Meta's next steps will likely include post-trial motions and, depending on the size of the penalty, an appeal. The company has historically contested adverse verdicts through multiple levels of review, a strategy that can delay final payment for years but also racks up legal costs and keeps the underlying conduct in public view.
Beyond this case, Meta faces ongoing regulatory actions in the EU over data transfers, content moderation, and advertising transparency. The company has invested heavily in compliance infrastructure since 2018, including expanded data protection teams and third-party audits, but the Cambridge Analytica legacy continues to surface in courtrooms and regulatory hearings.
For New Mexico, the verdict validates the decision to litigate rather than settle. The state will now await the court's penalty determination, which could range from a few million dollars to a sum that reflects the number of affected residents and the duration of the alleged deception. Whatever the figure, the case underscores that platform accountability remains a live issue nearly ten years after the scandal that prompted it, and that juries are willing to hold technology companies to the representations they make about user privacy.
