By ByteBot
A New Mexico jury on September 25, 2026 handed Meta its first jury verdict on the Cambridge Analytica breach — finding 43,899,720 violations of the state’s consumer protection law. At the $5,000-per-violation maximum, the theoretical exposure is roughly $219.5 billion. Every other U.S. state settled in August and quietly signed away their Cambridge Analytica claims as part of Meta’s $18 billion child-safety deal. New Mexico’s attorney general, Raúl Torrez, refused that deal and took Facebook to trial. Yesterday, that bet paid off.
43.9 Million Violations, $219 Billion on the Table
The jury evaluated 29 specific public statements Facebook made between 2010 and 2022 and found 26 of them willfully deceptive. Violations fell into five categories: data control claims (“Facebook doesn’t sell user data”), misinformation promises, hate speech statements, content moderation claims, and — critically for developers — app developer audit promises. Mark Zuckerberg personally made 14 of those 29 statements, accounting for 55.6% of all violations. Sheryl Sandberg appeared in six.
The $219.5 billion figure is a theoretical ceiling, not a realistic outcome. Judge Francis Mathew will determine actual damages, and appeals will almost certainly follow — a process that could take 2-3 years, with post-judgment interest accruing the entire time. AG Torrez has publicly instructed his team to seek the maximum and expects a penalty ruling within weeks. Whatever the final number, the jury’s willingness to count nearly 44 million violations across 26 statements is the signal: platform-level deception about data practices is now jury-eligible.
The Settlement That Buried Cambridge Analytica Claims — and the State That Refused
In August 2026, Meta settled a multistate child safety lawsuit for roughly $18 billion. Forty-seven states signed. Buried in the 130-page agreement was a full release of all Cambridge Analytica liability — meaning those states gave up any claims related to the 87 million profile breach as part of the deal. New Mexico wasn’t in that group. AG Torrez filed his case independently in 2021 and continued to trial after other states took the settlement.
The contrast in implied value is striking. The multistate settlement worked out to fractions of a cent per affected user on the Cambridge Analytica side. New Mexico’s jury, by contrast, found 43.9 million violations at up to $5,000 each. Whether the judge applies anything close to that maximum or not, the gap shows exactly how much Cambridge Analytica liability states may have surrendered in exchange for child safety payments.
The Developer Audit Promises That Didn’t Hold Up in Court
Ten of the 29 deceptive statements the jury evaluated were specifically about Facebook’s post-2018 promises to its developer ecosystem. After Cambridge Analytica became public, Facebook pledged to investigate every app with large data access, conduct forensic audits, ban developers who misused data, and proactively notify affected users. The jury found all ten of those statements to be willfully deceptive — meaning Facebook made promises about developer oversight that it did not keep.
That matters beyond the lawsuit. Developers who built on Facebook’s platform in 2018-2022 were working under assurances that the platform was auditing third-party apps and enforcing its data policies. A jury has now ruled those assurances were false. The legal standing of what platforms tell developers about data policy enforcement is no longer theoretical — it is established in court.
Related: Spymarks, Not Watermarks: The Hidden Trackers in Your AI Outputs
The API Design That Made 87 Million Reachable From 300,000
Cambridge Analytica was enabled by a specific Facebook API design decision. The Open Graph platform let any app authorized by one user collect data from all of that user’s friends — without those friends consenting. A personality quiz downloaded by 300,000 people reached 87 million profiles through that cascade. Facebook removed friend permissions after 2018. Current Graph API endpoints require App Review and business verification, and the metadata introspection shortcut developers relied on was removed entirely in May 2026.
The API is locked down now, but the architecture decision that enabled Cambridge Analytica predates the enforcement changes by five years. That gap — between the breach, the public promises to fix it, and what actually happened — is exactly what the New Mexico trial examined. Moreover, this verdict is the first time a U.S. jury has had to decide what was actually true in that gap.
Key Takeaways
- A New Mexico jury found 43.9 million violations against Meta on September 25, 2026 — the first jury ruling on the Cambridge Analytica breach — with a theoretical $219.5 billion maximum exposure.
- 47 other states settled in August 2026 and released Cambridge Analytica claims as part of Meta’s $18 billion child safety deal. New Mexico refused and went to trial.
- 10 of the 29 deceptive statements the jury evaluated were specifically about Facebook’s promises to audit third-party developers post-2018. A jury has now ruled those promises were false.
- The Open Graph API’s friend-permission cascade — 300,000 downloads reaching 87 million profiles — has been disabled since 2018; current Graph API requires App Review and business verification.
- Penalty ruling is expected within weeks; Meta will appeal. Developers building on Meta platforms should track both the damages outcome and the age-verification rollout from the August settlement.
