Cambridge Analytica comes back to haunt Facebook as jury finds it liable for 'privacy deception'

A New Mexico jury Friday found Facebook liable for deceiving users about privacy protections, handing the state a major victory in its long-running case stemming from the Cambridge Analytica data scandal. After a two-week trial in Santa Fe, jurors concluded that Facebook failed to adequately protect user information and misled the public about its response to data brokers, finding the company liable for more than two million violations.

The amount Facebook parent Meta will have to pay will now be determined by the judge. Lawyers representing New Mexico have asked for the maximum penalty of $5,000 for each violation, meaning the theoretical financial exposure could run into billions of dollars depending on how the court calculates and applies the penalties.

Cambridge Analytica at heart of case

The trial centred on Facebook’s handling of the Cambridge Analytica scandal, in which information from tens of millions of Facebook profiles was harvested through a third-party personality quiz. Data from roughly 87 million profiles was ultimately obtained and used by Cambridge Analytica, a now-defunct political consulting company that worked for clients including Donald Trump’s 2016 presidential campaign.

New Mexico prosecutors argued that Facebook had represented its platform as providing users with meaningful privacy protections while allowing third-party developers to obtain extensive information. The state maintained that Facebook’s conduct violated consumer-protection laws and affected New Mexico residents broadly, rather than being confined to users whose information was directly obtained through the personality quiz.

Jurors accepted the state’s case that Facebook’s failure to protect user information affected New Mexico’s population of more than two million people. They also concluded that the company misled the public about investigations it conducted into data brokers after the Cambridge Analytica scandal became public.

The findings resulted in Facebook being held liable for more than two million violations. The jury decided liability, while the court will separately determine the financial consequences.

Facebook challenged state’s case

Facebook’s lawyers disputed New Mexico’s allegations during the trial, arguing that much of the evidence relied upon by prosecutors was outdated. In closing arguments, the company’s attorneys said the state had spent five years gathering evidence but had identified only one additional instance of a data breach.

The defence sought to challenge the state’s attempt to treat Facebook’s conduct as affecting New Mexico’s entire population. The jury ultimately rejected the company’s arguments on the central liability questions placed before it.

The verdict makes New Mexico an outlier among US states in continuing to pursue Facebook over Cambridge Analytica. A broader multistate settlement involving Meta contained provisions releasing the company from future liability connected with the privacy scandal, leaving New Mexico as the only state still pursuing such a case.

Florida was the only other state that did not join that settlement, arguing that its terms were not sufficiently stringent. It has not, however, pursued the same Cambridge Analytica case as New Mexico.

Meta faces mounting legal costs

The privacy verdict adds to a series of costly legal setbacks for Meta in New Mexico. Earlier this year, the state secured judgments totalling $942 million following a two-phase trial focused on protections for children and teenagers using the company’s platforms.

The court also ordered Meta to introduce additional safeguards, including age-verification technology and limits on the amount of time minors can spend on its platforms. Those proceedings were separate from the Cambridge Analytica privacy case decided Friday.

Meta had also agreed in August to pay up to $18 billion to settle a multistate lawsuit concerning child-safety issues. Included in the lengthy settlement was an agreement releasing Meta from future liability related to the Cambridge Analytica privacy breach, a provision New Mexico did not accept.

Penalty now rests with judge

The next major question is how the judge will translate the jury’s finding of more than two million violations into a monetary penalty. New Mexico has sought the statutory maximum of $5,000 for each violation, but the final award will depend on the court’s determination.

The verdict comes years after the Cambridge Analytica scandal first forced Facebook’s data practices into global scrutiny and prompted investigations into how information collected through third-party applications could be used for political targeting. Although Cambridge Analytica subsequently shut down, litigation and regulatory action over Facebook’s handling of user information have continued.

For New Mexico, Friday’s verdict establishes Facebook’s liability under the state’s case. The potentially far larger battle now shifts to the penalty phase, where the judge will decide how much the findings against the social media company will ultimately cost.