New Mexico jury finds Facebook liable for over 43 million violations of consumer protection law—and Meta could owe over $200 billion in penalties

Facebook could owe over $200 billion in penalties, which would be a significant financial penalty for the company.

A New Mexico jury has found Meta Platforms, the parent company of Facebook, liable for over 43 million violations of the state's consumer protection law. The verdict stems from accusations that Facebook deceived users about privacy protections, particularly concerning a data breach from a third-party personality quiz that compromised approximately 87 million user profiles. This data was allegedly sold to a political consulting firm for targeted advertising. The jury found that Facebook made deceptive statements about safeguarding user data and misled the public about investigations into data-harvesting third-party apps. Attorneys for New Mexico are seeking the maximum penalty of $5,000 per violation, which could result in a penalty exceeding $200 billion. Meta has stated it disagrees with the verdict and plans to continue its defense, arguing the state's evidence was outdated. The judge will determine the final penalties at a later hearing.

This verdict represents a significant legal challenge for Meta, potentially setting a precedent for how state consumer protection laws can be applied to large technology platforms. While Meta disputes the evidence, the jury's decision underscores a growing public and legal scrutiny over data privacy practices and user deception. The substantial potential penalty, though subject to judicial review, highlights the escalating financial risks associated with privacy violations, even as Meta claims its policies have evolved since the lawsuit was filed. The state is also seeking an injunction, which could impose operational changes on Meta's practices in New Mexico.

The case is notable because New Mexico pursued this litigation independently after Meta settled a broader multistate lawsuit concerning child safety and the Cambridge Analytica breach. This decision by New Mexico to go it alone and the resulting verdict could embolden other states to pursue similar actions, especially those that did not join the earlier settlement. It also raises questions about the adequacy of existing industry-wide settlements in addressing all potential liabilities, particularly concerning past data breaches and deceptive practices, and suggests that individual states may still find value in seeking larger damages through their own legal avenues.