New Mexico Jury Holds Facebook Liable for Privacy Breach Deceptions
A New Mexico jury found Facebook liable for deceptive privacy practices in September 2026.
Why it matters: This ruling heightens legal risks for tech companies on user data privacy. Legal teams must strengthen compliance and transparency to mitigate penalties under data protection laws.
- New Mexico jury ruled Facebook liable on September 25, 2026, over deceptive privacy practices.
- Case involves data harvesting from 87 million profiles via an app tied to Cambridge Analytica.
- Approximately 350,000 New Mexico residents were impacted, subjecting Facebook to penalties up to $5,000 per violation.
- Meta CEO Mark Zuckerberg gave a video deposition; Facebook argued it enhanced safeguards post-breach.
On September 25, 2026, a New Mexico jury held Facebook liable for deceptive privacy practices related to the misuse of user data. The case centers on Facebook’s failure to prevent a third-party personality quiz app from harvesting data from about 87 million profiles, which was shared with Cambridge Analytica, a political consulting firm.
Unlike many states that settled such cases, New Mexico pursued a trial. Under the state's Unfair Practices Act, Facebook faces penalties up to $5,000 for each privacy violation. Approximately 350,000 New Mexico residents were affected, out of roughly 1.3 million users in the state at that time.
Facebook defended itself by highlighting post-breach actions, including identifying suspicious apps and updating privacy measures over five years. Meta CEO Mark Zuckerberg provided video deposition testimony, addressing questions about security enhancements and content moderation.
New Mexico Attorney General Raúl Torrez accused Meta executives of knowingly harming children and misleading the public. Earlier in 2026, Meta paid $375 million in civil penalties for related violations involving child safety and consumer deception.
This ruling reflects increased state-level enforcement against tech privacy lapses. Legal professionals and compliance officers should recognize this trend and prioritize stringent data protection policies and transparent user disclosures to manage liability risks.
By the numbers:
- 87 million profiles — data harvested by app linked to Cambridge Analytica
- 350,000 residents — New Mexico users affected by the breach
- $5,000 per violation — maximum penalty under New Mexico's Unfair Practices Act
Yes, but: While the ruling marks a firm stance on privacy accountability, Facebook’s defense emphasized ongoing improvements, and it is unclear how penalties will be assessed in practice.
What's next: Legal teams should monitor how enforcement of state data privacy laws evolves and adapt compliance strategies accordingly. Upcoming reviews of similar cases in other states may increase pressure on tech firms.