Jury: Facebook's privacy promises broke consumer law 43.9 million times

A jury in Santa Fe decided on 25 September that Facebook's public statements about privacy were not marketing puffery but wilful deception under New Mexico's Unfair Practices Act. The verdict form records 43,899,720 violations. At the statutory maximum of 5,000 dollars each, the theoretical exposure is about 219.5 billion dollars.

Nobody expects that number to be the cheque. What matters is the finding underneath it: promises a platform makes about how it handles your data are consumer representations, and a jury can decide they were lies.

Where 43.9 million comes from

This is the part most coverage skips, and it is the part that makes the headline number legible. The count is not 43.9 million people who were individually wronged. It is roughly the number of deceptive statements multiplied by the number of Facebook users in New Mexico at the relevant time, a figure reported at about 2.1 million, or 1.36 million on the 2020 basis.

One false public statement reaching every user in a state of just over two million people therefore produces millions of violations on its own. Cambridge Analytica related findings alone account for more than 18.1 million of the total. Multiply by a statutory 5,000 dollars and you arrive at a figure larger than Meta's annual revenue, which is why the arithmetic is better read as a bargaining position than as a bill.

The statement the case was built on

The state's argument rested on the gap between what Facebook told the public and what it did with third-party access to data, and one line from 2010 kept surfacing.

Mark Zuckerberg, 2010, as cited in coverage of the trial

"We do not and never will sell any of your information to anyone."

1. The claim is narrowly true and was never the state's target: the case was about access granted to third parties, not about sales.
2. That narrowness is what a consumer protection statute is designed to catch, because the standard is whether an ordinary reader was misled, not whether the sentence survives a lawyer's parsing.
3. The jury's rejection of three other statements shows it was not simply accepting everything the state offered.

What the judge does next, and why the March case matters

Judge Francis Mathew, not the jury, sets the penalty per violation and decides what Meta must change in how it operates in the state. The hearing is on 1 October and the attorney general, Raúl Torrez, has said his team will seek the maximum.

The reason that is not automatically rhetoric is what happened in March. In a separate New Mexico case about child safety, a jury found 75,000 violations, the statutory maximum of 5,000 dollars was applied to each, and the result was 375 million dollars in penalties plus a 567 million dollar abatement order. The same court has already shown it will go to the top of the range. At 43.9 million violations it cannot do that and still arrive at a judgment anyone could pay, so the question is what fraction it picks and what the injunction requires. Appeals would then run for two to three years.

Why this travels beyond New Mexico

Privacy policies are usually enforced, if at all, by data protection regulators under data protection law. This verdict used a different lever: ordinary consumer protection law, the same body of rules that governs whether a washing machine does what the box says. Under that framing, a privacy claim in a blog post or a press release is a product representation, and a state attorney general does not need a privacy statute to act on it.

That is a broadly available tool. Most jurisdictions have an unfair or deceptive practices law, most of them long predate the internet, and most carry per-violation penalties written when a violation meant one misdescribed appliance rather than one sentence reaching two million people at once. Texas took a related route when it sued Meta over its claims about end-to-end encryption in WhatsApp, and the multi-state child safety litigation we covered when the damages estimates ran into the trillions is the same idea at scale.

The contrast with this week's other case is instructive. TikTok settled with Alabama four days before a jury was due to hear it, paying at least 100 million dollars and agreeing to rebuild its teen experience. Meta went to the jury and lost. Both outcomes end with a company's product decisions being set by a state, one by negotiation and one by verdict.