What The Jury Decided
A Santa Fe jury ruled on September 25, 2026 that Meta violated New Mexico's Unfair Practices Act, finding 31 of the 34 statements Facebook made about user data, hate speech policy and its Cambridge Analytica response to be unfair or deceptive trade practices. The case, heard in the 1st Judicial District Court before Judge Francis Mathew, focused on public statements Meta made between 2016 and 2020, including comments attributed to Mark Zuckerberg and company blog posts that told users their data would not be shared with outside developers.
New Mexico's attorney general argued the false statements reached more than 2 million residents, though only about 350,000 had their Facebook profile data directly exposed to Cambridge Analytica-linked apps. Court filings cited in reporting put the reach of each individual deceptive statement at roughly 1.4 million New Mexico users in 2020 alone, a number that becomes central once the case moves from guilt to punishment.
The State That Said No
Meta's Cambridge Analytica exposure was supposed to be settled already. In 2024, the company agreed to pay roughly 459 million dollars to 47 states over the scandal, in which the political consultancy harvested data from as many as 87 million Facebook users without consent. New Mexico was not one of the 47.
The state's attorney general chose to litigate instead, arguing that a check, however large, was not the same as an admission that Meta had lied to its own users. This is New Mexico's second trial win against Meta in 2026, after a separate March verdict over teen safety practices in the same Santa Fe courthouse. The state has now built two full trial records against the company in a single year, something no settlement produces.
Why A Verdict Outweighs A Settlement
A settlement is a negotiated number attached to a company's standard denial of wrongdoing. A verdict is different: twelve jurors examined 34 specific public statements and decided, one by one, that 31 of them were deceptive, and that some were willfully so. That finding exists now as a fact on the court record, not as a number both sides agreed to stop arguing about.
That distinction matters past New Mexico's border. A jury finding of willful deception is the kind of fact that other state attorneys general, private plaintiffs and foreign regulators can point to when building their own cases, in a way a settlement's boilerplate denial never allows. Meta bought quiet in 47 states. In the 48th, it now has a public trial record it did not choose.
The Penalty Math Nobody Has Settled Yet
New Mexico law caps civil penalties for willful violations of the Unfair Practices Act at 5,000 dollars per violation, under Section 57-12-11 of the state statutes, a figure state lawmakers have separately proposed raising to 25,000 dollars. Judge Mathew must now decide what counts as one violation: each of the 31 deceptive statements, or each time one of those statements reached a New Mexico user.
| Path Meta faced | Coverage | Amount | Fault admitted |
|---|---|---|---|
| 47-state settlement (2024) | 47 states | About 459 million dollars | No, standard denial clause |
| New Mexico solo trial (2026) | 1 state, about 2 million residents | Not yet set, up to 5,000 dollars per willful violation under NM Stat 57-12-11 | Yes, 31 of 34 statements found deceptive |
The two readings are not close. Counted by statement, the maximum penalty sits in the hundreds of thousands of dollars, a rounding error against Meta's 2026 revenue. Counted by user exposure, at roughly 1.4 million reached per statement, the statutory math points somewhere far larger, though no court has yet ruled that a single consumer's exposure to a false statement counts as its own violation.
The Lesson For Anyone Operating In The EU Too
European readers tend to assume US privacy exposure works like GDPR: a fine capped at a percentage of global annual revenue, set by a single regulator applying one formula. New Mexico's case shows that assumption is wrong for a meaningful share of US consumer-protection law, which instead caps penalties per individual violation, with no ceiling tied to company size at all.
For a company operating on both sides of the Atlantic, that is not a detail, it is a different risk shape entirely. A GDPR fine is predictable once you know your revenue. A per-violation US state penalty is not predictable until a court decides what a violation actually counts as, which is precisely the question New Mexico's penalty phase now has to answer first.
Read next: OpenAI's Filter Cannot Make Your Chats Anonymous | France Just Priced Missing MFA at EUR 500,000
