AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
New Mexico’s Cambridge Analytica Case
Coverage from Courthouse News Service, The Record, and others
New Mexico’s case against Meta centers on Facebook data collected through a personality-quiz application and transferred to Cambridge Analytica.
State allegations connected information from roughly 87 million profiles to targeted political advertising during the 2016 U.S. presidential election, and estimated that about 350,000 New Mexico residents were affected. The dispute examines what Meta disclosed to users, how it protected their information, and what safeguards followed; the state’s legal action has included liability findings, penalties, and a $25 billion judgment. It brings questions of consumer privacy and corporate responsibility into focus.
If you read one thing
It gives a clear account of the jury’s privacy-deception findings and the unresolved consequences of the verdict.
Best explainer
It explains the scale of the potential penalties and the dispute over how violations should be counted.
The evidence
It adds distinct context on why New Mexico is pursuing the case alone and the state’s estimate of affected residents.
Jury liability for privacy deception
A New Mexico jury found Facebook liable for misleading users about privacy practices, including its handling of third-party apps and promises to investigate and notify affected users. The liability finding is established, although reporting differs on the number and scope of violations.
Exceptional penalties remain contested
The verdict exposes Meta to potentially enormous civil penalties, but the judge must still determine the final amount. New Mexico has sought $35–$40 billion, while Meta argues the figure is unconstitutional and the state has proposed a reduction to address due-process concerns.
New Mexico is the remaining state case
A multistate settlement released Meta from future Cambridge Analytica-related liability, leaving New Mexico as the state continuing to pursue this case. The jury verdict has resolved liability, while the penalty decision remains pending.
nearly 44 million violations
New Mexico Unfair Practices Act violations found by the jury
“A New Mexico jury on Friday found Facebook violated the law nearly 44 million times by lying to consumers about its data privacy practices.”
$5,000 civil penalties per violation
Maximum penalty under New Mexico's Unfair Practices Act
“The amount of damages the Meta-owned tech giant will ultimately pay will be determined by a judge in the coming weeks, but the verdict could cost Meta billions because each violation of New Mexico's Unfair Practices Act carries up to $5,000 in civil penalties.”
about 350,000 New Mexico residents
residents estimated to have been exposed
“The state estimates that about 350,000 New Mexico residents were exposed in the Cambridge Analytica breach.”
more than two million New Mexicans
population potentially covered by the state’s violation theory
“McGinn argued that the harm extended to all New Mexicans, numbering more than two million, and that each affected person could potentially represent a violation.”
roughly 87 million profiles
Facebook profiles harvested by the personality quiz
“In court documents, New Mexico alleges that Facebook failed to alert or protect users from a personality quiz that harvested data from roughly 87 million Facebook profiles and sold it to Cambridge Analytica.”
No new-member articles were supplied, so there is no evidence of a material change since the prior state.
Previously
A New Mexico jury found Meta liable for misleading Facebook users about privacy and data practices, in a case stemming from information collected through a third-party personality quiz and shared with Cambridge Analytica. The state says the episode involved data from as many as 87 million profiles and seeks substantial civil penalties and changes to Facebook’s practices. The judge has yet to set the final penalty, and Meta disputes the amount sought.
Meta now says it investigated suspicious applications and strengthened safeguards after the data exposure, adding a company-reported response to the case.