New Mexico Jury Finds Facebook Liable for Misleading Users Over Data Breach

A New Mexico jury concluded Friday that Facebook deceived users about the privacy safeguards on its platform, finding the company liable for more than two million violations. The verdict stems from a two-week trial in Santa Fe that examined Facebook’s handling of a data breach involving a third-party personality quiz that harvested information from roughly 87 million profiles and supplied it to political consulting firm Cambridge Analytica.

Jurors determined that the breach affected the state’s entire population of over two million residents, and they also held Facebook accountable for misleading the public about subsequent investigations into data brokers. State attorneys are seeking the maximum statutory penalty of $5,000 per violation, though the final amount will be set by the presiding judge.

During closing arguments, Facebook’s lawyers argued that the evidence presented was outdated and that New Mexico had uncovered only a single other breach despite a five-year investigative window. A Meta spokesperson told CBS News that the company disagrees with the verdict and will continue to defend itself, emphasizing its First Amendment rights and a commitment to free speech, user information protection, and data control.

The case follows Meta’s August settlement of a multistate lawsuit over child-safety concerns, which included a provision releasing the company from future liability for the Cambridge Analytica breach. New Mexico remains the only state to pursue a separate lawsuit on that issue, while Florida declined to join the settlement, citing insufficient rigor. Earlier this year, New Mexico secured judgments totaling $942 million from Meta in a separate trial concerning safeguards for minors, leading to court-ordered implementation of age-verification tools and usage limits.