The news
A New Mexico jury on Friday, September 25, 2026, found that Facebook, owned by Meta Platforms (META), committed nearly 44 million violations of the state's Unfair Practices Act by deceiving users about privacy. The Meta privacy verdict carries civil penalties of up to $5,000 per violation.
KVIA reported the exact count as 43,899,725; The Record described it as nearly 44 million and the Associated Press (AP) as more than 43 million. The state filed the lawsuit in 2021, and Attorney General Raúl Torrez's office tried it before a jury over two weeks in Santa Fe, according to AP. State attorneys asked for the maximum $5,000 per violation, and AP reported that the company could owe more than $200 billion at that rate, with interest accruing if it appeals.
A judge, not the jury, will set the final amount. AP reported that penalties will be decided at a hearing on October 1, while The Record said the figure would be determined in the coming weeks. New Mexico is also asking the court to order changes to Facebook's data privacy practices, The Record reported.
According to The Record, jurors found that Facebook misrepresented how much control users had over how their data was shared and falsely said it did not buy or sell user information to advertisers. The jury also found that Facebook misled the public about how it would police third-party apps after the Cambridge Analytica scandal, including promises to conduct audits, stop working with developers that abused data and notify affected users.
At the center of the case was a third-party personality quiz. According to AP, it collected data from about 87 million Facebook profiles, and that data was sold to Cambridge Analytica, a political consultancy, for use in targeted advertising. The verdict on content claims was mixed across reports: The Record said jurors found some statements on hate speech and misinformation willfully deceptive, while AP said jurors found the state had not proved false claims about removing harmful content, including COVID-19 misinformation.
Meta spokesperson Alex Burgos said, "We disagree with the verdict and will continue to defend ourselves against efforts to distort our record," as reported by AP. Torrez called the result historic for every state trying to hold large technology companies accountable, according to The Record, and told reporters that any money awarded will go into a fund for New Mexico's education system, AP reported.
The numbers
- Violations found by the jury (per KVIA)
- 43,899,725
- Maximum civil penalty per violation
- $5,000
- Potential exposure at the maximum rate (AP estimate)
- More than $200 billion
- Profiles harvested by the quiz app (per AP)
- Roughly 87 million
- Penalty hearing date (per AP)
- October 1, 2026
Why CEOs should care
For general counsel and marketing chiefs, the verdict shows that public privacy statements work like product claims. The jury weighed what Facebook told users about data control, data sales to advertisers and app audits, and found those statements deceptive under a general consumer-protection law. Inventory every privacy promise in help pages, policies, executive testimony and marketing copy, and check each one against what engineering and vendor teams actually do.
For CFOs and boards, the exposure scales with the number of violations, not with proven financial harm. New Mexico has just over two million residents, according to AP, yet the violation count ran far higher, and each one carries a penalty of up to $5,000. The reports did not explain how violations were counted, so boards should ask counsel how a regulator could count violations against their own products in each state, and whether reserves and insurance reflect that math.
For CISOs and privacy leaders, promises made after an incident become evidence later. The jury found Facebook misled users about audits, developer cutoffs and user notices it said it would carry out after Cambridge Analytica. If your company has publicly committed to vendor audits or breach notifications, keep dated records showing those steps happened, and have legal review incident communications before they go out.
The bigger picture
New Mexico has beaten Meta in court before. AP reported that the state had already won judgments totaling $942 million against the company in an earlier two-phase trial over safety protections for minors. Separately, Meta agreed in August 2026 to settle a multistate child-safety lawsuit that New Mexico chose not to join; AP put that deal at up to $18 billion, while The Record reported $17 billion. Together, the cases show state attorneys general using consumer-protection statutes to challenge how platforms describe their data and safety practices, with penalties counted per violation.
What’s next
The judge will now decide the penalty per violation and whether to order changes to Facebook's privacy practices, with AP reporting a hearing set for October 1. Meta has said it disagrees with the verdict; watch whether it appeals, how the court treats the split findings on content claims, and whether other states cite the result in their own cases.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
