Your Privacy Settings Did Nothing. A Jury Just Proved It.

On September 25, 2026, a jury in Santa Fe found that Meta misled New Mexico residents about their privacy nearly 44 million times. The finding that matters most is not the number. It is the mechanism the trial laid bare: even when users carefully adjusted every privacy toggle Facebook offered, the company allowed third party apps to pull data through their friends. You could lock your own door perfectly, and it made no difference, because the people who knew you had left theirs open. If that sounds familiar, it should. It is exactly how data broker and people search sites expose you today, through relatives and household members you never asked to be tied to.

What did the jury actually find?

After a two week trial, the jury found that Facebook violated New Mexico's Unfair Practices Act 43,899,725 times by misleading residents about how their personal data was protected and shared. On 31 of the 34 questions on the verdict form, jurors answered that Facebook willfully deceived its customers. Each violation carries a penalty of up to 5,000 dollars, and a judge will decide the final amount in the coming weeks. Meta disagrees with the verdict and has said it will continue defending its record, including through appeal, so the penalty phase is far from settled.

The case grew out of the Cambridge Analytica scandal, in which data from roughly 87 million Facebook profiles was harvested and used for voter profiling. New Mexico was the only state that kept its claims out of Meta's multistate settlement and took them in front of a jury. We covered the verdict itself when it landed, in our report on the jury finding that Facebook deceived users about privacy. This article is about the part of the trial that applies to you right now, whether or not you have ever had a Facebook account.

How did your friends leak your data when your own settings were locked?

Here is the mechanism at the center of the scandal. For years, when a Facebook user installed a third party app, that app could request access not only to the installer's data but to data belonging to the installer's entire friends list. Your friend took a personality quiz, and the quiz walked away with information about you. That is how a single app used by a few hundred thousand people ended up touching tens of millions of profiles. Your own privacy settings governed what strangers could see on your profile. They did not govern what an app could extract through someone who knew you.

The state's argument, which the jury accepted, was that Meta told users they controlled how their information was shared while permitting something very different behind the interface. The settings page was real. The control it promised was not. Privacy researchers have a name for this: the illusion of user control. You are given switches to flip, the switches do something, and the something is much smaller than you were led to believe.

Why is this exactly what data brokers do to you today?

Open your listing on any people search site and look at what sits next to your name: possible relatives, associated persons, household members, previous co-residents. You never gave any of that to the broker. Neither, in most cases, did your relatives. The broker assembled it from property records, utility connections, shared addresses, and purchased marketing files, then stitched your family together into one browsable map. We explain the stitching in detail in why people search sites list your relatives.

The structural problem is identical to the one the jury just ruled on. You can be careful. You can stay off social media, use an alias for deliveries, and give out a secondary phone number. Your mother's listing still names you as her son or daughter and links to your city. Your brother's old lease still ties your name to an address. A stalker, a scammer, or an angry stranger does not need to find your door. They need to find anyone who knows you, and the brokers have conveniently indexed everyone who knows you. Your caution does not bind your family, just as your Facebook settings never bound your friends. If you want to see where brokers get all this raw material, read how data brokers get your information.

What can you actually do about exposure you did not cause?

Start with the free steps, because there are real ones.

• Audit your own app permissions. On Facebook, review Settings, then Apps and Websites, and remove anything you do not actively use. Do the same on Google and Apple accounts. This closes the doors you personally control, for free.
• Search your family, not just yourself. Look up your parents, siblings, and adult children on two or three people search sites. Their listings are the side doors into your life, and most people never check them.
• File opt outs where exposure is worst. Every major people search site has an opt out process, and they cost nothing but time. The catch is that one removal does not touch the relative listings that point back at you, and suppressed records frequently resurface when the broker ingests its next data refresh.

That resurfacing problem is where honest numbers matter. Consumer Reports testing found that opt outs filed by hand or through automated tools cleared only about 27 percent of a person's exposed listings, while services where actual humans track each removal and file again when records return reached around 70 percent. The gap is not magic. It is persistence. Brokers rebuild profiles on a cycle, so removal has to be a cycle too.

What does this verdict change for everyone outside New Mexico?

Legally, the verdict binds one company in one state, and the penalty is not yet set. Practically, it hands every other state attorney general a template that has now survived a jury: a state consumer protection law, not a federal privacy statute, produced a finding of nearly 44 million violations. The United States still has no comprehensive federal privacy law, so state level cases like this one are currently the sharpest enforcement tool that exists. Expect more of them.

For you as an individual, the lesson is blunter. A settings page is a promise, and this jury concluded the promise was broken at enormous scale. Treat every privacy toggle, on every platform, as a request rather than a guarantee, and assume the data that describes you travels through people you know as often as it travels through you. Protection that only covers your own choices covers less than half the problem.

Frequently asked questions

Did the jury decide how much Meta has to pay?

No. The jury decided liability: 43,899,725 violations of New Mexico's Unfair Practices Act. A judge will set the penalty, which can run up to 5,000 dollars per violation, and Meta has said it disagrees with the verdict and will keep defending itself, so appeals are likely before any amount is final.

Can I find out if my data was caught up in Cambridge Analytica?

Facebook notified affected users in 2018 through a notice at the top of the news feed and a tool in its help center. Years later, the practical answer is to assume broad exposure: roughly 87 million profiles were harvested, mostly belonging to people who never installed the app, only to people whose friends did.

If I delete Facebook, does my family exposure on broker sites go away?

No. People search sites build relative listings mainly from offline records: property files, shared addresses, phone accounts, and marketing databases. Deleting a social account removes one source among many and does nothing to listings already published. Those have to be removed from each broker directly.

Can Privoria remove my information from Meta or Facebook?

No, and no outside service can. What Meta holds internally is reachable only through Meta's own tools and the courts. What we remove is your public exposure on people search and data broker sites, including the listings that connect you to your relatives, and we keep removing them when they come back.