NewsPublished 28 Sep 2026

New Mexico Jury Finds Facebook Liable for Deceiving Users About Privacy Protections

Source SecurityWeek

Description

A New Mexico jury found Facebook liable for deceiving users about privacy protections related to a data breach involving a third-party app that harvested data from approximately 87 million profiles. The jury determined Facebook violated state consumer protection laws over 43 million times. The case focused on Facebook's misleading statements about protecting user data and investigations into third-party developers after the Cambridge Analytica scandal. The jury did not find Facebook liable for false claims about removing harmful content. The judge will decide penalties, which could be substantial, but the overall impact on Facebook's finances remains uncertain.

Impact

The verdict establishes legal liability for Facebook regarding deceptive privacy practices affecting millions of users in New Mexico. The company faces potentially significant civil penalties, which could exceed $200 billion if maximum fines per violation are applied. However, the financial impact is uncertain given Facebook's profitability and previous regulatory outcomes. The ruling may influence future regulatory and legal actions but does not confirm any technical vulnerability or active exploitation. It highlights risks related to third-party data harvesting and transparency in privacy protections.

Defensive guidance

This is a legal judgment rather than a technical vulnerability; no technical patch or remediation applies. Organizations should monitor legal developments and ensure compliance with consumer protection laws regarding user data privacy. Facebook and similar platforms may need to enhance transparency and controls around third-party data access to avoid similar legal liabilities. The judge's forthcoming penalty decision and any injunctions will clarify further legal requirements.

Summary

The New Mexico jury concluded that Facebook (Meta) deceived users regarding privacy protections following a data breach caused by a third-party personality quiz app that collected data from about 87 million profiles and sold it to Cambridge Analytica. The jury found over 43 million violations of state consumer protection law, holding Facebook accountable for misleading statements about data protection and investigations into third-party app developers. Facebook disputed the verdict, claiming evidence was outdated and denying false claims about content removal. The case is distinct from a multistate settlement and focuses solely on New Mexico's claims. The judge will determine the financial penalties and possible injunctions to prevent future deceptive practices.

References

securityweek.com/new-mexico-jury-finds-facebook-liable-for-deceiving-users-about-privacy-protections/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Sep 2026, 10:47 UTC

References

Community reviews