A Jury Just Found Facebook Deceived Users About Privacy

On Friday 25 September 2026, a jury in Santa Fe found that Facebook deceived users about the privacy protections on its platform, in violation of New Mexico's Unfair Practices Act. The jury found more than 43 million violations. The state is asking for the maximum penalty of 5,000 dollars per violation, and a judge will decide the figure at a hearing on 1 October. Meta says it disagrees with the verdict and will keep defending itself. The number that matters most, though, is not 43 million or the potential penalty. It is this: roughly 270,000 people took a quiz, and about 87 million people had their data harvested. That ratio is the whole lesson.

What did the jury actually decide?

The two-week trial in New Mexico's First Judicial District Court, before Judge Francis Mathew, centred on the Cambridge Analytica affair. Jurors reviewed 34 statements the company had made and concluded it made deceptive statements about protecting user data, affecting the state's entire population of more than two million people. They also found that Facebook failed to tell users their personal information had been accessed by a third-party app developer, and that it misled the public about its own investigation into developers harvesting user data after the scandal broke.

No dollar amount has been set. The jury determined liability and the number of violations, and Judge Mathew must now decide how many violations count toward a penalty and what figure applies to each. New Mexico's attorney general has said any money awarded will go into a fund for the state's education system, and the state is also seeking an injunction against similar practices in future.

What was Cambridge Analytica again?

A political consulting firm that obtained personal data harvested from Facebook users and used it for targeted political advertising, notably around the 2016 US election. The data came through a personality quiz app called thisisyourdigitallife. Roughly 270,000 people installed it. Because of how Facebook's platform worked at the time, the app reached approximately 87 million users worldwide, since installing it also exposed data about the installer's friends.

Facebook knew Cambridge Analytica had purchased the harvested data in December 2015 and did not disclose it publicly until April 2018, after a whistleblower came forward.

The number that should stay with you

270,000 to 87 million. For every person who actually made a choice, roughly 320 people who made no choice at all had their data swept up. If you were among those 87 million, you did not install anything, did not click anything, and did not agree to anything. A friend took a quiz.

This is the part that gets lost in coverage focused on penalties and corporate accountability. The case is not really a story about one app or one firm. It is the clearest demonstration available that consent-based privacy does not protect you, because the most consequential disclosures about you are frequently made by other people.

Where else does that pattern show up?

Almost everywhere, once you start looking. A relative uploads their contacts and your phone number enters a system you never touched. Someone takes a DNA test and information about their biological family, including you, becomes analysable. A friend tags you in a photo at a location. A former housemate's address history creates a record linking the two of you.

People-search profiles are built on exactly this principle. They publish a list of your relatives and associates, assembled from shared address records rather than anything you disclosed, which is covered in why people-search sites list your relatives. Your profile exposes your family, and their profiles expose you. Nobody consented to any of it.

What should you actually do?

Tightening your own settings is worth doing and is not sufficient, which is the honest conclusion from this case. A few things that help:

• Audit third-party apps connected to your accounts and remove anything you no longer use. Each connection is a data pathway you have forgotten about.
• Turn off the settings that let others find you by phone number or email address.
• Skip the quizzes. Personality tests and games that require account access are, structurally, the same mechanism as the one in this case.
• Download your data from the platforms you use, which shows what has accumulated.
• Reduce your public listings, since those are built from other people's records as much as your own.

That last one is the only lever that reaches the part you did not choose. It also has to be maintained, because listings rebuild from fresh public records. Consumer Reports found that opt-outs done by hand or by automation cleared roughly 27 percent of exposed listings, while removals handled by real people who monitor and refile reached about 70 percent.

Frequently asked questions

Do I get money from this verdict?

No. This was an action brought by the state of New Mexico under its consumer protection law, not a class action paying individuals, and the attorney general has said any award goes into a state education fund. It is separate from earlier consumer settlements involving the same scandal.

How much will Meta actually pay?

Unknown as of writing. The jury found liability and the number of violations, and the judge decides the penalty at a hearing on 1 October. The state is seeking the statutory maximum per violation, and Meta has said it disagrees with the verdict, so appeals are possible.

Was my data part of the Cambridge Analytica harvest?

Facebook notified affected users back in 2018, so check any notification history on your account. Given the scale, roughly 87 million profiles worldwide, plenty of people were included through a friend rather than through anything they did themselves.

Does deleting Facebook fix this?

It stops new collection from that platform but does not recall data already shared, and it does nothing about the separate public record layer that publishes your address and relatives. Deleting an account is a reasonable choice, just not a complete one.