Facebook Privacy Lawsuit Ends With New Mexico Verdict

A major Facebook privacy lawsuit in New Mexico has ended with a jury finding Facebook liable for misleading users about the privacy protections available on its social media platform.

The verdict, delivered Friday in Santa Fe, marks another significant legal setback for Meta Platforms, Facebook’s parent company, and brings a case that dates back to the Cambridge Analytica scandal closer to a final financial penalty.

The New Mexico jury found more than 43 million violations of the state’s consumer protection law. The amount Meta will ultimately have to pay has not yet been determined. Attorneys representing New Mexico are asking the judge to impose the maximum civil penalty of $5,000 for each violation.

The case has attracted attention because it focuses on one of the most consequential privacy controversies in Facebook’s history. It also comes at a time when Meta is facing legal challenges over several aspects of its social media business.

For New Mexico officials, the verdict represents a conclusion to a legal campaign that began years after the Cambridge Analytica scandal first became public.

What the Facebook Privacy Lawsuit Was About

The Facebook privacy lawsuit centered on claims that the company failed to adequately protect users from third-party applications that could access personal information.

At the center of the case was a personality quiz application that collected information from Facebook users and, through the platform’s data-sharing system, obtained information connected to millions of additional profiles.

The data was ultimately provided to Cambridge Analytica, a political consulting firm that used Facebook information to help develop targeted advertising.

The scandal became public in 2018 and triggered international scrutiny of Facebook’s privacy practices.

Investigators and journalists reported that data associated with approximately 87 million Facebook profiles had been harvested through the third-party application. Cambridge Analytica later became closely associated with political advertising during the 2016 U.S. presidential election.

New Mexico’s case was filed in 2021. The state argued that Facebook did more than simply experience a security or privacy failure. Prosecutors alleged that the company made statements that gave users a misleading impression about how their personal information was protected and how third-party developers could access it.

Jury Finds More Than 43 Million Violations

The central finding from the New Mexico jury was that Facebook violated the state’s consumer protection law more than 43 million times.

The number is particularly important because New Mexico’s Unfair Practices Act allows civil penalties for individual violations.

The jury determined the number of violations, while the judge will determine the amount of money Facebook must pay.

State attorneys are seeking the maximum penalty of $5,000 per violation. The final amount could therefore be extremely large, although the verdict itself does not mean that the maximum penalty will automatically be imposed for every violation. The judge must still determine the appropriate penalty.

The state also sought injunctive relief intended to prevent similar practices in the future.

That means the case is not simply about financial damages. New Mexico has also argued that Facebook should face restrictions or requirements designed to prevent another large-scale privacy failure.

Cambridge Analytica Remains at the Center

The case reaches back to one of the most controversial episodes in the history of social media.

Cambridge Analytica obtained Facebook user data through a third-party personality quiz. The information was later used for political consulting and targeted advertising.

New Mexico prosecutors argued that Facebook’s privacy policies and public statements did not adequately reflect the risks associated with third-party applications.

The state also accused Facebook of misleading the public about its investigations into developers that had obtained user information.

According to the case presented by New Mexico, Facebook identified numerous applications that raised concerns but did not take steps that prosecutors believed were sufficient to protect affected users or force the deletion of data.

Those allegations became a major part of the state’s argument that the company had misrepresented the level of control users had over their personal information.

Meta Disagrees With the Verdict

Meta has rejected the state’s characterization of its conduct.

The company argued during the trial that Facebook had taken substantial steps to investigate suspicious third-party applications after the Cambridge Analytica scandal became known.

Meta’s attorneys also argued that the evidence presented by New Mexico was outdated because Facebook had significantly strengthened its privacy and security controls since the events at the center of the lawsuit.

The company has maintained that Facebook users have control over certain information shared with advertisers and that the platform has introduced additional safeguards over time.

A Meta spokesperson said the company disagreed with the verdict and would continue defending itself against what it described as efforts to distort its record.

The disagreement between the two sides is important because the trial examined events that occurred years ago. Meta’s defense focused in part on changes the company says it has made since the Cambridge Analytica scandal.

New Mexico, meanwhile, argued that later improvements do not eliminate responsibility for earlier conduct.

New Mexico Took a Different Path

The outcome also reflects New Mexico’s decision to continue pursuing its privacy claims after other states reached a broader settlement with Meta.

In August, Meta agreed to pay up to $18 billion over the next decade as part of a multistate settlement involving allegations concerning child safety and social media use.

The settlement also included provisions affecting potential future liability related to the Cambridge Analytica privacy breach.

New Mexico did not join that settlement and continued with its own litigation over Facebook’s handling of user information.

As a result, New Mexico became the state that continued pursuing a courtroom verdict over the privacy controversy while the broader multistate case moved toward settlement.

That decision ultimately brought the Cambridge Analytica dispute back into a courtroom nearly a decade after the scandal first emerged.

Why the Facebook Privacy Lawsuit Matters

The consequences of the case extend beyond Facebook.

The verdict illustrates how state consumer protection laws can be used to challenge the way major technology companies communicate with consumers about privacy.

Rather than focusing only on whether personal data was exposed, the New Mexico case examined whether Facebook’s public statements accurately described the protections users could expect.

That distinction could be important for other technology companies.

Social media platforms, advertising networks and app developers routinely collect and exchange large amounts of personal information. Their privacy policies can involve complicated rules covering advertising, third-party applications, data sharing and user controls.

The New Mexico verdict shows that statements about those systems can become part of a legal dispute when regulators or prosecutors argue that consumers were given a misleading impression.

The Case Comes After Another Major Meta Ruling

The privacy verdict is not Meta’s only major legal battle in New Mexico this year.

Earlier in 2026, the state secured a separate judgment involving the company’s treatment of young users.

A New Mexico court ordered Meta to pay $567 million into a fund addressing youth mental health concerns. Combined with an earlier $375 million jury penalty, the company’s total financial exposure from that case reached $942 million. The court also ordered changes to Facebook and Instagram, including stronger age verification and additional protections for minors.

That earlier case was separate from the Facebook privacy lawsuit involving Cambridge Analytica.

However, the two cases demonstrate the breadth of New Mexico’s legal actions against Meta.

One case focused primarily on allegations involving young users and platform safety. The latest case focuses on privacy, data collection and statements made to users.

What Happens Next for Meta?

The latest jury decision does not immediately settle every remaining question.

The judge must determine the financial penalty associated with the violations identified by the jury. The state has requested the maximum available penalty, but the final amount will depend on the court’s decision.

Meta could also continue challenging the outcome through the legal system.

The company has consistently disputed allegations that its past practices should be characterized in the manner presented by New Mexico prosecutors.

For users, the case is another reminder of how much personal information can flow through modern social media platforms and third-party applications.

The Cambridge Analytica controversy began with a personality quiz and ultimately became a worldwide debate over digital privacy, political advertising and the responsibilities of technology companies.

A New Chapter in the Privacy Debate

The New Mexico verdict gives that debate another major development.

The jury’s finding that Facebook committed more than 43 million violations under state consumer protection law represents a substantial legal consequence for the company. However, the final financial penalty remains to be decided.

The case also demonstrates that privacy disputes can remain active for years after the original data practices have changed.

For Meta, the immediate focus will be on the financial and legal consequences of the verdict and any further proceedings that follow.

For regulators and consumers, the case provides another example of the growing effort to hold technology companies accountable for how they collect, protect and describe the use of personal information.

Nearly a decade after Cambridge Analytica became a symbol of the risks surrounding social media data, the Facebook privacy lawsuit in New Mexico has produced another significant ruling.

The final penalty could determine how costly that ruling becomes for Meta. More broadly, the case may continue to influence how companies explain privacy protections and third-party data access to users in the years ahead.