A jury in Santa Fe handed Meta Platforms its second major courtroom defeat in New Mexico this year. On Friday, September 25, 2026, jurors in the state’s First Judicial District Court found that Facebook deceived users about the privacy protections on its platform, violating New Mexico’s Unfair Practices Act, according to CBS News. The verdict caps a two-week trial rooted in the Cambridge Analytica scandal and leaves Meta facing a penalty phase that could run into the billions.
The case, tried before Judge Francis Mathew, is now the third distinct courtroom loss for Meta in New Mexico within seven months. Combined with penalties from an earlier child-safety case, the state’s legal campaign against the company has already produced more than $942 million in court-ordered payments, and the new privacy verdict could add far more once damages are set, per reporting from the Albuquerque Journal.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What the New Mexico Jury Actually Decided
Jurors were asked to decide whether Facebook violated New Mexico’s consumer-protection law by misrepresenting how it handled user data, and if so, how many times it happened. According to CBS News, the panel answered both questions against Meta: the company deceived users about the privacy protections available on Facebook, failed to adequately protect personal data connected to the Cambridge Analytica scandal, and misled the public about its own investigation into third-party data brokers after that scandal broke.
The Albuquerque Journal’s account of the verdict adds that jurors also found Facebook failed to tell users their personal information had been accessed by a third-party application developer, one of five practices the state’s attorneys argued amounted to unconscionable trade practices under New Mexico law. Crucially, the jury did not set a dollar amount. That task now falls to Judge Mathew, who must determine both the number of violations that will count toward a penalty and the dollar figure applied to each one.
Inside the Two-Week Santa Fe Trial
The trial opened in early September with New Mexico attorney Randi McGinn delivering the state’s opening argument, according to the Albuquerque Journal, which reported that a video of Meta CEO Mark Zuckerberg was displayed to jurors as she spoke. Testimony ran for roughly two weeks before closing arguments took place on Wednesday, September 23, 2026, with state attorneys urging jurors to find Facebook liable for thousands of violations of state law, the Associated Press reported.
The case traces back to a lawsuit New Mexico’s attorney general’s office filed in 2021, focused specifically on how Facebook handled user information before and after the Cambridge Analytica breach became public. That makes this a distinctly different legal track from the child-safety litigation the state pursued separately, even though both cases share a defendant and a courthouse.
The Cambridge Analytica Connection, Eight Years Later
Cambridge Analytica, the now-defunct political consulting firm, harvested data from as many as 87 million Facebook users without their consent starting around 2014, a figure Reuters reported was reintroduced at trial in September 2026, using a personality-quiz app that also pulled information from users’ friends networks. The scandal broke publicly in 2018 and triggered a wave of state and federal scrutiny, most of which has long since settled or faded. New Mexico’s case is the rare exception that made it all the way to a jury verdict eight years later.
That persistence became especially notable this month. According to the Associated Press, an August 2026 multistate settlement over child-safety claims, in which Meta agreed to pay up to $17 billion, included language releasing the company from future liability tied to the Cambridge Analytica privacy breach in the states that signed on. New Mexico did not take that deal on the privacy claim, making it the only state still pursuing a Cambridge Analytica-based case in front of a jury. It is a pattern that echoes how regulators in the EU fined Google over location-data privacy failures even after other jurisdictions had moved on from similar complaints.
43 Million Violations: How That Number Adds Up
The most eye-catching figure to come out of Friday’s verdict is the jury’s finding of exactly 43,899,725 violations of New Mexico’s consumer-protection statute, according to the Associated Press, a precise tally tied to the scale of Facebook’s user base and data-sharing practices within the state that was first reported more broadly as “more than 43 million” by News4Jax. Reuters additionally reported that jurors found 26 of the 29 Meta statements at issue in the trial to be misleading, and the outlet also reported that the jury found Meta’s conduct affected New Mexico’s entire population of more than 2 million residents.
State attorneys asked the court to apply the statutory maximum of $5,000 per violation, a request that, multiplied against the jury’s 43,899,725-violation finding, produces a theoretical figure of roughly $219 billion, according to Bloomberg Law. That ceiling number is not an actual award, and by October 2026 Reuters reported the state had narrowed its actual request to a range of $35 billion to $40 billion once the penalty phase got underway, a far smaller but still unprecedented figure. Judge Mathew retains wide discretion to reduce the countable violations, apply a lower per-violation figure, or otherwise scale the eventual penalty down from either number.
| Detail | What Was Found | Source |
|---|---|---|
| Verdict date | Friday, September 25, 2026 | CBS News |
| Court | First Judicial District Court, Santa Fe, Judge Francis Mathew | Albuquerque Journal |
| Law violated | New Mexico Unfair Practices Act | CBS News |
| Violations found | More than 43 million | News4Jax |
| State’s requested penalty | $5,000 per violation (statutory maximum) | CBS News |
| Theoretical maximum exposure | More than $215 billion (not an actual award) | News4Jax |
| Trial length | Approximately two weeks | CBS News |
| Case filed | 2021, by New Mexico’s attorney general’s office | Investing.com |
What Happens Next: The Penalty Phase
With liability established, the case now moves into a penalty phase in front of Judge Mathew alone, without a jury. According to Courthouse News, Judge Mathew moved quickly, holding a penalty hearing just one week after the verdict, in early October 2026, where he will need to determine how many of the 43,899,725 violations actually count toward a monetary penalty and what dollar figure to apply per violation, a process that could still take additional weeks or months given the scale of the numbers involved. Meta also retains the standard path of post-trial motions and an eventual appeal to New Mexico’s appellate courts, though none of the outlets covering the verdict reported that the company had filed anything of that kind as of publication.
Meta has not issued a public statement responding specifically to Friday’s verdict that has been quoted in the reporting reviewed for this article, and this piece will not attribute words to the company or its spokespeople that were not actually published. What is clear from the case’s trajectory so far is that Meta contested the allegations throughout the two-week trial rather than settling, a strategy that did not change the outcome.
How This Differs From New Mexico’s Child-Safety Case
It’s worth being precise about which New Mexico case is which, because the state has now run two separate legal tracks against Meta that produced two separate jury and court findings in 2026. The privacy case decided Friday stems from the 2021 lawsuit over Cambridge Analytica and data-sharing practices. It is legally distinct from the child-safety lawsuit that Attorney General Raúl Torrez filed against Meta and CEO Mark Zuckerberg in 2023, which alleged the company concealed what it knew about child sexual exploitation on its platforms and caused harm to children’s mental health.
That child-safety case already produced two rounds of penalties this year. In March 2026, a jury ordered $375 million in civil penalties against Meta. Then, on August 6, 2026, following a separate three-week bench trial, Judge Bryan Biedscheid ordered an additional $567 million, of which roughly $420 million was earmarked for treatment services for affected children, according to PBS NewsHour. In his ruling, Judge Biedscheid called Meta’s platforms a “public nuisance” and found they were a “significant contributing cause” of a mental-health crisis among the state’s teenagers, a characterization reported by the Washington Post.
| Case | Type | Penalty / Status | Date |
|---|---|---|---|
| Child-safety civil penalty (jury phase) | Jury verdict | $375 million | March 2026 |
| Child-safety remediation order (bench trial) | Judge Bryan Biedscheid ruling | $567 million (~$420M for treatment services) | August 6, 2026 |
| Cambridge Analytica privacy case | Jury verdict on liability only | Penalty pending; state sought up to $215B theoretical max | September 25, 2026 |
| Combined child-safety total | Court-ordered | $942 million | As of September 2026 |
Why New Mexico Stands Alone on This Claim
Most states that once investigated Facebook’s role in the Cambridge Analytica scandal resolved those claims years ago through settlements or simply let them lapse. New Mexico’s decision to keep pursuing the privacy claim through trial, even after opting out of the release language embedded in August’s multistate child-safety settlement, sets it apart from the rest of the country’s attorneys general. It also means the legal exposure Meta now faces in Santa Fe is not shared by any other state government, at least not through active litigation.
That kind of solo enforcement path is unusual but not unprecedented in tech privacy law. State and national regulators elsewhere have also broken away from the pack to pursue their own privacy actions rather than folding into broader settlements, similar in spirit to how individual jurisdictions have pressed forward with breach-related enforcement even after a company reaches a multistate deal, as seen when Wisconsin joined a separate $2.3 million settlement over the Labcorp data breach rather than relying solely on a national resolution.
Meta’s Mounting Legal Bill and Market Reaction
None of the reporting reviewed identifies a confirmed, directly attributable stock move tied specifically to Friday’s privacy verdict. Meta shares have been volatile this month for reasons that go well beyond New Mexico, including investor enthusiasm around the company’s Muse AI platform weighed against ongoing legal, security, and spending risks. Shares were trading in the $750 range in the days around the verdict, though outlets covering the stock’s movement attributed swings to profit-taking after a broader AI-driven rally rather than to the courtroom news specifically.
For comparison, when Judge Biedscheid handed down the $567 million child-safety order in August, Meta shares dipped less than 0.5% in after-hours trading to roughly $589.44, according to the Associated Press. That muted reaction suggests investors have, so far, treated New Mexico’s litigation as a manageable cost of doing business rather than an existential threat, even as the total court-ordered and pending exposure climbs into the billions. It’s a different kind of market shrug than the one seen when Meta’s VR stock dipped amid competition from Apple’s Vision Pro, where product rivalry rather than legal risk drove the move.
Historical Context: From a 2018 Scandal to a 2026 Verdict
It’s easy to forget how long ago Cambridge Analytica actually was. The scandal broke in March 2018, led to a $5 billion settlement between Facebook and the U.S. Federal Trade Commission the following year, and prompted a temporary stock selloff and a congressional hearing where Zuckerberg testified before lawmakers. Most of the legal fallout from that era was resolved within a few years. New Mexico’s case is the exception that shows how a state-level consumer-protection claim, built on the same underlying facts, can outlast the federal settlement and keep grinding through the courts nearly a decade later.
That long tail matters for how the industry thinks about legal risk. A settlement with federal regulators or even most state attorneys general does not necessarily close the door everywhere. New Mexico’s persistence is a reminder that data-handling decisions made in 2014 can still generate courtroom liability in 2026, a timeline few compliance teams plan for when they estimate legal exposure.
How This Compares to Other Big Tech Privacy Enforcement
New Mexico’s verdict lands in a year that has already seen aggressive privacy enforcement against large platforms on both sides of the Atlantic. Regulators in the EU fined Google €403 million over location-data privacy violations, a case that, like New Mexico’s, hinged on whether a platform adequately disclosed how it collected and used personal information. The dollar figures and legal frameworks differ substantially, EU fines are typically capped as a percentage of global revenue while New Mexico’s per-violation statutory penalty scales with user counts, but both cases reflect a broader pattern of regulators treating vague or misleading privacy disclosures as an enforceable wrong rather than a matter of user education.
The scale of New Mexico’s theoretical exposure, more than $215 billion if the statutory maximum were applied to all 43 million violations, dwarfs any single privacy fine levied against a technology company to date. Whatever amount Judge Mathew ultimately sets, even a small fraction of that ceiling would represent one of the largest state-level consumer-protection penalties in U.S. history, well beyond the $942 million Meta has already been ordered to pay across its two child-safety rulings this year.
What This Verdict Signals for Data Trust in 2026
The verdict arrives during a year already crowded with headlines about compromised personal data, from breaches affecting tens of millions of users at smaller platforms to government agencies losing control of staff records. Findings like Friday’s tend to reinforce a broader erosion of public confidence in how platforms handle personal information, a trend visible in incidents ranging from the Gyazo breach that exposed 23.6 million users to the Welsh police cyberattack that compromised staff data earlier this year. It sits alongside a string of 2026 data-handling failures that have kept privacy litigation and breach disclosures in the news cycle almost continuously.
For Meta specifically, the timing compounds an already difficult year on the trust front. The company has spent 2026 simultaneously promoting new AI products while defending against courtroom findings that its past privacy practices misled the very users it now wants to adopt those products, a tension that is unlikely to disappear once Judge Mathew issues a penalty figure.
Predictions: Where the Case Goes From Here
- Judge Mathew’s penalty ruling is unlikely to approach the theoretical $215 billion ceiling. Expect a figure that reduces both the countable violations and the per-violation dollar amount substantially, following the pattern of most large statutory-penalty cases.
- Meta will very likely pursue post-trial motions and, if the penalty is significant, an appeal to New Mexico’s appellate courts, a process that could stretch the case well into 2027 or beyond before any payment is finalized.
- Other state attorneys general are unlikely to reopen their own Cambridge Analytica claims given the age of the underlying conduct and the fact that most already settled, leaving New Mexico’s outcome as a singular data point rather than the start of a new multistate wave.
- Expect continued scrutiny of the gap between the $18 billion multistate child-safety settlement and New Mexico’s decision to opt out of the associated privacy release, with plaintiffs’ attorneys elsewhere pointing to it as a model for holding out on similar releases in future settlements.
- Meta’s near-term stock reaction to any penalty ruling will likely stay muted relative to the headline number, consistent with how markets treated the March and August child-safety rulings, unless the final figure meaningfully exceeds analyst expectations.
The Bigger Picture for State-Level Privacy Enforcement
New Mexico’s willingness to run a Cambridge Analytica case all the way to a jury verdict, eight years after the underlying conduct and years after most other states moved on, is itself a data point worth watching. It suggests that state consumer-protection statutes with per-violation penalty structures, rather than capped percentage-of-revenue fines, can produce far larger theoretical exposure for companies with hundreds of millions of users. Whether that becomes a template other state attorneys general revisit, or remains a one-off shaped by New Mexico’s particular litigation history, will likely become clearer once Judge Mathew’s penalty ruling lands.
In the meantime, the verdict adds one more entry to a growing ledger of 2026 courtroom and regulatory setbacks for Meta, joining the child-safety penalties, the EU’s separate action against Google over location data, and a broader wave of breach and enforcement news, including claims that the ShinyHunters group breached the FBI and holds terabytes of stolen data, that has made data privacy one of the most consequential legal battlegrounds in tech this year.
Frequently Asked Questions
What did the New Mexico jury actually find on September 25, 2026?
The jury found that Facebook violated New Mexico’s Unfair Practices Act by deceiving users about privacy protections, failing to protect data connected to the Cambridge Analytica scandal, and misleading the public about its investigation into third-party data brokers, according to CBS News.
How much money will Meta have to pay?
No final amount has been set. The jury found liability and more than 43 million violations, but Judge Francis Mathew must still determine the penalty amount. New Mexico’s attorneys requested the statutory maximum of $5,000 per violation, which would theoretically exceed $215 billion, though that figure is not an actual award.
Is this the same case as New Mexico’s child-safety lawsuit against Meta?
No. This privacy verdict stems from a 2021 lawsuit over Cambridge Analytica and data practices. The separate child-safety case, filed in 2023 by Attorney General Raúl Torrez, already produced a $375 million jury penalty in March 2026 and a $567 million court order in August 2026.
Why is New Mexico the only state still pursuing this claim?
According to the Associated Press, an August 2026 multistate settlement over child-safety claims included a release from future liability tied to the Cambridge Analytica privacy breach. New Mexico did not accept that release for its privacy claim, allowing it to proceed to trial while other states’ claims were resolved.
Has Meta responded to the verdict?
No verified, directly attributable statement from Meta responding specifically to the September 25 verdict appeared in the reporting reviewed for this article. Meta contested the allegations throughout the two-week trial.
Did Meta’s stock price react to the verdict?
No confirmed, directly attributable stock move tied specifically to the privacy verdict has been reported. Shares moved amid broader trading activity tied to AI-related news that week, and market commentary attributed volatility to profit-taking rather than the litigation itself.
What happens next in the case?
The case moves into a penalty phase before Judge Mathew, who will determine the number of violations that count toward a penalty and the dollar amount per violation. Meta retains the option to file post-trial motions and appeal any resulting judgment.
How does this compare to other big tech privacy fines in 2026?
It follows a year that also saw the EU fine Google €403 million over location-data privacy violations. New Mexico’s case uses a different legal framework, a per-violation statutory penalty rather than a revenue-based fine, which is why its theoretical maximum exposure is far larger than typical privacy fines against major platforms.
