A New Mexico jury has found Facebook liable for deceiving users about privacy protections related to the Cambridge Analytica data breach, a verdict that could carry extraordinary financial consequences. Jurors determined the company's failures impacted the state's entire population of more than 2 million people, with attorneys requesting the statutory maximum penalty of $5,000 per violation. If the judge applies that ceiling, the math is stark: over $10 billion. The two-week trial in Santa Fe focused on a now-familiar scandal — a third-party personality quiz that harvested data from roughly 87 million Facebook profiles and sold it to Cambridge Analytica, the political consulting firm whose clients included Donald Trump's 2016 campaign. But the legal significance here is procedural, not historical. Every other state except Florida signed an August settlement in which Meta agreed to pay up to $18 billion over child safety issues. Buried in that 130-page agreement was a release from future Cambridge Analytica liability. New Mexico refused to sign. It is now the only state pursuing the data breach in court. The jury also found Facebook misled the public about its post-scandal investigations into data brokers, compounding the violation count past 2 million. New Mexico Attorney General Raúl Torrez framed the verdict as a precedent: "For years, Facebook operated as if the rules that apply to everyone else didn't apply to them. Today, a jury of New Mexicans said otherwise." Meta's defense rested on two claims: that the state's evidence was outdated, and that the company has a First Amendment right to manage its platforms as it sees fit. A Meta spokesperson said the company disagreed with the verdict and would continue to defend "against efforts to distort our records," adding that free speech issues "featured very prominently" in the case. The constitutional argument — that platform management is protected speech — signals the likely appellate strategy. This verdict lands in context. New Mexico has already won $942 million from Meta in a two-phase trial over child safety protections, with the court ordering new safeguards including age-verification technology and time limits. The state has become the most aggressive single-state enforcer against Meta in the country, pursuing cases other states traded away for settlement dollars. The structural question is whether this model — one state refusing a global settlement and winning at trial — changes the calculus for future multistate negotiations. Meta's August settlement effectively purchased immunity from 48 states on Cambridge Analytica. New Mexico's refusal to sell that immunity, and its courtroom success, exposes the tension between collective settlement efficiency and individual enforcement power. If the penalty phase produces a number anywhere near the statutory maximum, it will look like the states that settled left billions on the table. The penalty phase will determine whether this verdict is a symbolic rebuke or a financial earthquake. At $5,000 per violation across 2 million-plus violations, the theoretical ceiling exceeds $10 billion. The actual number will depend on the judge's interpretation of what constitutes a distinct violation and whether the maximum penalty applies uniformly. Either way, Meta now faces the cost of a liability it thought it had already buried.
