New Mexico jury finds Meta liable over Cambridge Analytica deception
A jury in New Mexico has found Meta liable for deceiving users about privacy protections in connection with the Cambridge Analytica scandal, a ruling that could expose the company to civil penalties of up to $219 billion. The verdict, delivered on September 25, 2026, marks the first time a jury has held the social media giant accountable for misrepresentations tied to the 2018 data breach that harvested profiles from approximately 87 million users.
New Mexico Attorney General Raúl Torrez announced the state would seek the maximum penalty of $5,000 per violation after the jury found Meta liable for over 2 million violations of the state's consumer protection law. Judge Francis Mathew will determine the final penalty amount.
What the jury found
The case centred on statements Meta made about how it handled third-party access to user data. The jury concluded the company deceived customers about a data breach where a third-party personality quiz harvested and sold profile information to Cambridge Analytica, a political consulting firm.
Specifically, the jury found that a 2010 statement by CEO Mark Zuckerberg — "You have control over how your information is shared. We do not share your personal information with people or services you don't want" — constituted a false or deceptive representation. The panel also found Meta misled the public about its investigations into third-party data harvesting and made false statements related to auditing apps and notifying affected users.
Why Malta residents should care
For people in Malta who use Facebook or Instagram, the verdict highlights a discrepancy between what platforms promise about data control and what they deliver. The data at issue — names, locations, likes, and friend networks — is the same information Maltese users share daily. The case underscores that privacy policies and public assurances from tech companies may not match actual practice.
Meta has stated it disagrees with the verdict and intends to appeal, citing First Amendment rights and arguing its safeguards have improved. The company maintains its platforms now restrict the data third-party apps can access.
How this case proceeded alone
New Mexico pursued its lawsuit after most US states settled similar claims. In August 2026, Meta reached an $18 billion multi-state settlement primarily addressing child safety issues, which included a provision releasing the company from future liability related to Cambridge Analytica for participating states. New Mexico and Florida declined to join.
Separately, in March 2026, Meta paid $50 million to settle claims in California over the same privacy breach.
Changes Meta has made — and new challenges
Since the Cambridge Analytica scandal, Meta has restricted third-party app access to sensitive data such as religious views, relationship status, and political affiliations. It also disabled the ability to search for users by email or phone number.
However, the company's data practices face fresh scrutiny in 2026. A new AI privacy policy integrates user conversations with Meta AI into advertising models. European regulators have raised concerns about age assurance systems and features like infinite scroll. In September 2026, a Portuguese digital rights group initiated collective proceedings challenging these design features.
What happens next
Judge Francis Mathew will determine the civil penalty Meta must pay New Mexico. Any award is likely to face lengthy appeals. The verdict nevertheless signals that tech companies face increasing financial and legal risks when their privacy promises fall short of reality — a development that could shape how digital platforms treat user data in Malta and beyond.
