Jury finds Meta liable for misleading New Mexico users over privacy

A New Mexico jury in Santa Fe found Facebook liable on Friday for deceiving users about privacy protections, in a case stemming from the Cambridge Analytica scandal. Judge Francis Mathew will now determine how much the company pays, with attorneys for the state asking for the maximum $5,000 penalty per violation.

What the jury found

The two-week trial centered on accusations that Facebook deceived users about a data breach caused by a third-party personality quiz that harvested data from roughly 87 million profiles and sold it to Cambridge Analytica to generate targeted ads. The now-defunct firm's clients included the 2016 campaign for Donald Trump.

Jurors sided with prosecutors, finding that Facebook's failure to protect users' data affected New Mexico's entire population of more than two million people; the company was held liable for more than two million violations. Jurors also found that Facebook misled the public about investigations into data brokers after the scandal broke.

The 2021 lawsuit

New Mexico's attorney general filed the case in 2021, three years after news reports revealed that personal data from as many as 87 million Facebook users had been harvested through a third-party app and used to profile voters, Reuters reported. The state accused the company of making statements that misled New Mexicans about how their personal information would be shared with third parties and how it handled hate speech and misinformation. The case focused on specific statements, including comments by Meta CEO Mark Zuckerberg and company blog posts that, the state said, made people believe they controlled the information they shared. In reality, the state argued, Meta sold data to third-party apps and made policy exceptions for certain users.

Meta's defense and what comes next

Attorneys for Meta argued in closing statements that the state's evidence was outdated and that, after five years of gathering material, New Mexico found only one other data breach. The company says the statements at issue were cherry-picked snippets that ignored context in which it acknowledged its privacy record was not perfect, and denies selling users' information.

It is the second time in six months that a Santa Fe jury has weighed a New Mexico case against Meta. In August, the company agreed to pay up to $18 billion to settle a multistate child-safety lawsuit; the 130-page settlement released Meta from future liability tied to the Cambridge Analytica breach, leaving New Mexico the only state to pursue a case. Florida was the only other state that refused to sign, saying the deal was too lenient. Earlier this year, New Mexico won judgments totaling $942 million from Meta in a two-phase trial over safety protections for minors, and the court ordered safeguards including age-verification technology and time limits.