A New Mexico jury has found Meta violated the state’s Unfair Practices Act and misled residents about privacy and the company’s handling of misinformation. The decision comes from a state lawsuit filed in 2021, rooted in the long-running fallout from the Cambridge Analytica scandal involving Facebook user data and political advertising during the 2016 election.
The immediate practical point is simple: Meta has lost the jury phase of this case, but the final financial consequence is not yet known. A judge still must decide how much Meta will be fined. That distinction matters. A jury finding establishes that the state prevailed on the claims at issue; the later ruling will determine the monetary remedy.
What the New Mexico case was about
New Mexico’s lawsuit alleged that Meta misrepresented the access it permitted third-party applications to have to user data. It also challenged privacy settings the state described as unclear or vague. In addition, the case included allegations that Meta falsely represented its hate-speech policies as being applied equally to everyone.
Those are related but distinct issues. Third-party apps are services built by outside developers that can interact with a platform under rules set by that platform. If users are told an app has limited access, but the practical access is broader or the explanation is misleading, the issue is not merely technical. It goes to whether people could make informed choices about their personal information.
Privacy settings are the controls people use to decide, at least in theory, who can see information and how a service may use it. A setting can exist without being meaningfully understandable. The dispute in New Mexico concerned the clarity of those controls and Meta’s representations about them, not simply whether a menu of account options was available.
The misinformation and hate-speech claims raise a separate question of policy enforcement. Platforms commonly publish rules describing prohibited behavior and how moderation is meant to work. A claim that a company represented those rules as evenly enforced, when they were not, concerns the gap between public assurances and operational reality. The jury’s verdict means New Mexico succeeded in persuading jurors that Meta’s conduct ran afoul of the state’s consumer-protection law.
The Cambridge Analytica connection
The case traces back to Cambridge Analytica, which obtained and used information from roughly 50 million Facebook users, largely without their consent. That information was used to target political advertising in the 2016 election.
The scandal became a durable reference point for the risks created when a social platform permits outside services to access user information at scale. The key issue is not only the collection of a single user’s data. Depending on how a system is built, data shared through an app can potentially affect people who did not expect that app to be involved in their online lives at all.
That is why the New Mexico verdict is about more than an old controversy receiving another mention. The state’s claims linked the historical data-practices episode to specific representations made to residents: what outside apps could do, how clearly privacy choices were explained, and how platform rules on harmful speech were characterized.
Meta rebranded from Facebook to Meta in 2021, but a corporate rebrand does not end unresolved legal matters attached to prior conduct. The company has already entered multiple settlements connected to Cambridge Analytica in the United States, United Kingdom and Australia. New Mexico’s case shows that settlement activity elsewhere did not dispose of every claim or every jurisdiction’s concerns.
What Meta conceded—and what it disputed
During the trial, Meta’s lawyers acknowledged that the company had made past mistakes in its treatment of privacy and misinformation. But the company denied selling user data and denied benefiting from hate speech.
Those positions are important to keep separate. An admission that mistakes occurred is not the same as accepting every allegation advanced by a state. Likewise, the jury’s finding does not mean every claim sometimes associated with the broader Cambridge Analytica controversy has been proven in this particular case. The result reported here is that jurors found Meta violated New Mexico’s Unfair Practices Act and misled residents regarding privacy and misinformation.
That careful framing matters in technology litigation, where public discussion can collapse several questions into one. Data access, data sales, advertising targeting, content moderation, privacy notices and corporate benefit can overlap, but they are not interchangeable terms. The trial addressed a defined set of claims under a defined state law.
How an Unfair Practices Act case works in plain language
Consumer-protection laws such as an Unfair Practices Act generally concern deceptive or unfair conduct in commerce. In plain language, the legal focus is often whether a business gave consumers a misleading impression about something material to their decision-making.
For a social platform, that can include statements about how personal information is shared, the controls a person has over that information, or the way rules are administered. The difficult part for ordinary users is that these subjects are often conveyed through policy pages, prompts, account settings and developer permissions rather than a straightforward product label. A person may have to interpret technical language before recognizing the consequences of a choice.
The New Mexico case also illustrates why states can pursue their own actions even when a company has reached broader settlements. A multistate agreement may resolve claims for participating states, while other states may decline to join a particular portion of the resolution. New Mexico and Florida declined to participate in the part of a later settlement that resolved existing Cambridge Analytica lawsuits, leaving room for this New Mexico trial to proceed.
The settlement backdrop and what remains unresolved
Meta recently reached a settlement with 47 U.S. states over child-safety concerns totaling $18 billion. That agreement included a $459 million payment intended specifically to resolve existing Cambridge Analytica lawsuits. New Mexico and Florida did not participate in that portion of the settlement.
The figures should not be treated as New Mexico’s penalty. They describe a separate, broader settlement arrangement and its Cambridge Analytica component. In the New Mexico case, the fine has not yet been set. Until the judge rules, it is not possible to responsibly state what Meta will owe the state as a result of the jury verdict.
There is also no reported company response here beyond the positions described from the trial. Meta had been asked for comment on the case and verdict, but no further response is established in the available information. Any later statement, appeal decision or penalty order could materially affect the next stage of the story.
Why clarity is the central consumer issue
For users, the most useful lesson is not that every privacy setting can eliminate risk. It cannot. Rather, people should be able to understand what a platform says its settings and permissions do before they rely on them. When a service describes access for outside apps, a meaningful explanation should help users distinguish between a narrow permission and a broader data pathway.
The same principle applies to moderation promises. Saying that a platform has a policy is different from explaining how that policy is enforced. Saying a policy is applied equally is a stronger representation still, because it communicates consistency. The New Mexico verdict puts legal weight behind the proposition that representations about both privacy and misinformation practices can be tested under consumer-protection law.
That does not turn each user into a lawyer or a security specialist. It does, however, reinforce the value of reading permission prompts carefully, periodically reviewing connected apps and treating vague privacy language as a reason to look for clearer information before sharing more data. The responsibility for truthful, comprehensible representations remains with the company; individual caution is a practical safeguard, not a substitute for it.
What to watch next
The next concrete development is the judge’s decision on the fine. That ruling will supply the missing answer to the question most readers will have after the verdict: what financial consequence will follow?
Beyond the dollar figure, the case is another reminder that the Cambridge Analytica episode remains legally consequential years after the underlying conduct. Meta has resolved multiple matters in several countries, yet New Mexico’s jury verdict demonstrates that prior settlements and a changed corporate name did not erase state-level scrutiny.
It also arrives in a broader environment where platform claims are increasingly examined not only as technical descriptions but as consumer-facing promises. Readers following technology policy developments can find related platform and device coverage in our report on code pointing to possible next entry-level iPad specifications. In Meta’s New Mexico case, though, the key question is less about what new technology may do than whether users were accurately told what an existing platform was doing with their information and policies.
