Meta faces huge penalty after jury finds Facebook misled users over privacy

New Delhi: A jury in the US state of New Mexico has found Facebook liable for misleading consumers about their personal information and the enforcement of its content policies, delivering another legal setback to its parent company, Meta. The verdict, returned on Friday, established more than 43.8 million violations of state consumer protection law, although a judge will determine the financial penalty in subsequent proceedings.

The state’s attorney general, Raul Torrez, said his office would seek the maximum penalty available, potentially approaching $219 billion, according to Bloomberg Law. That figure represents potential exposure under the law – it is not a fine already imposed on the company.

The two-week trial in Santa Fe examined Facebook’s public assurances about privacy and content moderation against the backdrop of the Cambridge Analytica scandal. The controversy, which became public in 2018, involved the acquisition of information from as many as 87 million Facebook profiles by a political consultancy whose clients included Donald Trump’s 2016 presidential campaign.

According to the New Mexico’s justice department, jurors found deceptive assurances about users’ control over information-sharing and Facebook’s handling of personal data. They also found misleading statements about the consistent enforcement of community standards, including whether politicians and other groups received exceptions or special treatment.

The findings extended to Facebook’s promised response after Cambridge Analytica, including investigations of applications with extensive access to user information. Those assurances covered audits, action against developers who misused data and notifications to people whose information might have been affected.

Meta disputed the outcome, saying it would continue defending itself against “efforts to distort our record”. The company also invoked its constitutional right to manage its platforms and said its approach prioritized free expression, the protection of personal information and users’ control over their data.

During the trial, Meta’s lawyers argued that the state had selected fragments of company statements while disregarding qualifications and acknowledgements that its systems were imperfect, Reuters reported. Meta also denied selling users’ information, while jurors rejected some allegations concerning statements about harmful-content removal and fact-checking practices.

The millions of violations do not represent millions of separate data breaches: Bloomberg Law reported that counts attached to individual statements reflected either Facebook’s New Mexico user population or the state’s total population. The judge, Francis Mathew, will decide the civil penalties, with state law allowing up to $5,000 for each violation.

The Cambridge Analytica episode exposed how information collected through an apparently limited interaction could spread far beyond the people directly participating in it. In its 2019 enforcement action, the US Federal Trade Commission (FTC) said an application developed by Aleksandr Kogan collected information from people answering personality questions and from their Facebook friends.

The regulator alleged that the application misleadingly assured participants it would not collect identifiable information, even though it gathered identifiers linking individuals to their Facebook profiles. The resulting information was used to generate personality scores, which were matched with US voter records for voter profiling and targeted advertising.

That mechanism explains the scandal’s significance beyond a conventional privacy dispute: personal information gathered through a social platform became material for political targeting. It also exposed the limitations of consent when one person’s use of an application enabled access to information about others in their network.

Facebook previously agreed to a $5 billion settlement with the FTC, announced on July 24, 2019, resolving allegations that it violated an earlier privacy order. The regulator alleged that Facebook’s disclosures and settings undermined users’ privacy choices and that its supervision of outside application developers was inadequate.

The settlement also imposed structural safeguards, including an independent privacy committee, designated compliance officers and stronger external assessments of the company’s privacy programme. These requirements sought to make privacy decisions subject to continuing oversight, alongside the financial penalty. The next stage of the New Mexico proceedings will determine both the cost of the latest verdict and any additional obligations imposed on Meta. Torrez said the state would seek changes that could include corrections to earlier statements and an audit of how the company manages user information.