A Santa Fe jury on Friday, September 25, 2026, decided that Facebook willfully broke New Mexico's Unfair Practices Act through 26 public statements by Mark Zuckerberg, Sheryl Sandberg and other company voices on data sales, hate speech, misinformation and the aftermath of Cambridge Analytica. Jurors recorded 43,899,720 violations, leaving a district judge to set a penalty that state law caps at $5,000 for each one.

In Short

A jury in Santa Fe decided on September 25, 2026 that Facebook broke New Mexico's consumer protection law with 26 public statements about privacy, hate speech, misinformation and its handling of the Cambridge Analytica scandal. It matters because every counted violation can carry up to $5,000 in penalties, and one claim at the centre of the case - that Facebook does not sell your data - is the same line the company has used for years to describe how its advertising works. A judge, not the jury, now decides how much Meta pays and whether it must change how it operates in the state, and Meta has said it disagrees with the verdict.

A verdict built one statement at a time

The document the jury returned is a 37-page special verdict form from the First Judicial District Court for the County of Santa Fe. The plaintiff is the State of New Mexico, acting through Attorney General Raúl Torrez; the defendant is Meta Platforms, Inc., formerly Facebook, Inc.; the case number is D-101-CV-2021-00132. The form does not pose a single question about liability. It quotes 29 statements instead, each tagged with a speaker, a date and a plaintiff's exhibit number, and asks three things about every one of them.

The first question is whether the state proved that Facebook engaged in an unfair or deceptive trade practice with respect to the statement. The second is whether it did so willfully. The third, reached only when both earlier answers are yes, asks jurors to "please write the number of violations, if any." A sixth part, headed "Practices," then asks whether Facebook committed an unconscionable trade practice in each subject area, and whether that too was willful. The form closes with a line in capitals: "AT LEAST 10 OF US AGREE AS TO EACH QUESTION ABOVE." It is dated the 25th day of September 2026. The foreperson's name is blacked out in the copy the New Mexico Department of Justice published.

The 29 statements fall into five groups. Part I covers users' control of their data, in questions 1 to 6. Part II deals with misinformation across questions 7 to 10, and Part III with hate speech across questions 11 to 16. Part IV takes on the application of Facebook's Community Standards in three questions, while Part V, the longest, addresses the investigation of app developers that the company promised after Cambridge Analytica, in questions 20 to 29.

Who said what? Zuckerberg is the speaker in 14 of the 29 questions and Sandberg, the former chief operating officer, in six. Nick Clegg, then the company's global affairs chief, appears twice. A single sentence by Anna Stepanov is quoted in two separate questions, Ime Archibong accounts for one statement, and four are attributed to Facebook as a company. The oldest dates from May 24, 2010. The newest, from August 16, 2022, was one of those the jury rejected.

Jurors answered yes on liability and on willfulness for 26 of the 29 questions, and yes to all ten questions in Part VI. Counted by question, the state prevailed on 31 of 34. Randi McGinn, an attorney for the state, told reporters after the verdict that some counts had been combined and that the jury sided with the state on 26 of 29 statements, according to Source NM.

Two numbers behind 43,899,720

How does a jury arrive at a number like that? The form asks how many violations occurred, but not how to count them. Jurors wrote only two figures anywhere on it: 2,100,000 against 11 statements and 1,386,648 against the other 15. Eleven times 2,100,000 is 23,100,000. Fifteen times 1,386,648 is 20,799,720. Together they make 43,899,720.

Both figures track estimates the state placed before the jury. According to the Associated Press, McGinn asked jurors during closing arguments on September 23 to consider that Facebook had deceived all New Mexicans with its statements on privacy and violent content, and prosecutors estimated the state had more than 1.3 million Facebook users at the time of the breach. In its report on the verdict, the Associated Press described the data statements as affecting the state's entire population of more than two million people.

A pattern in the form shows how jurors distributed the two numbers, even though no written reasoning accompanies the answers. Every statement delivered through an outside news organisation carries 2,100,000: the Washington Post in 2010, PBS, Bloomberg Television, CNN, CNBC, CBS, the New York Times, WIRED and two answers from an interview with Kara Swisher. Every statement delivered through Facebook's own channels carries 1,386,648. Those channels include posts on Facebook, items in the company Newsroom, two quarterly earnings calls and the 2014 F8 developer conference. The split is consistent with a view that a mass-media interview reached the whole state while a company post or call reached its users, though the form itself states no method.

The weight falls unevenly across speakers. Zuckerberg's 14 statements account for 24,406,536 violations, or 55.6% of the total. Sandberg's six add 11,173,296. The four corporate statements contribute 5,546,592, and Clegg and Archibong 1,386,648 each. One day stands out: five statements made on March 21, 2018, in a Newsroom post, a Facebook post and interviews with CNN, the New York Times and WIRED, carry 9,073,296 violations between them.

By subject, Part V dominates with 18,146,592 violations, 41.3% of the total. Part I follows at 10,459,944, then Part III at 7,646,592, Part IV at 4,159,944 and Part II at 3,486,648. At the statutory maximum, the app developer category alone would come to $90.7 billion.

A five-violation discrepancy

The official tally does not quite match the handwriting. In its release on September 25, the New Mexico Department of Justice put the total at 43,899,725 violations - five more than the sum of the entries on the form - and later in the same release referred to more than 43.8 million. The local outlet nm.news reported 43,899,720, which agrees with the form. The gap has no practical effect on the ceiling. At $5,000 per violation, the form's total yields $219,498,600,000, and the department's figure yields $219,498,625,000. Both round to the $219.5 billion that nm.news cited as Meta's maximum exposure.

What Facebook told users about their data

Part I rests on six statements, and all six were found willfully deceptive. The oldest, from Zuckerberg's May 24, 2010 piece in the Washington Post, reads: "You have control over how your information is shared. We do not share your personal information with people or services you don't want. We do not give advertisers access to your personal information. We do not and never will sell any of your information to anyone." Jurors assigned it 2,100,000 violations.

Eight years later, in a Newsroom Q&A on April 4, 2018, Zuckerberg set the company apart from data brokers: "There are other internet companies or data brokers or folks that might try to track and sell data, but we don't buy and sell." A day later, on PBS, Sandberg said: "We do not sell data or give your personal data to advertisers, period." Zuckerberg repeated the formula to Swisher on July 18, 2018 - "So we don't sell data, we don't give the data to anyone else" - and Sandberg returned to it twice in January 2019. Her Facebook post of January 24 stated: "We don't sell people's data and we don't share personal information with advertisers without permission."

The sixth statement, made by Sandberg on the fourth-quarter 2018 earnings call on January 30, 2019, is the closest the form comes to a description of the advertising product itself: "We don't sell your data and we don't tell advertisers who you are. What we do is allow advertisers to reach people interested in their products." The jury found it willfully deceptive and counted 1,386,648 violations. The first question in Part VI then extended the finding, recording that the state had proven a willful unconscionable trade practice concerning users' control of their data. According to nm.news, an unconscionable practice under the statute is one that takes advantage of consumers' lack of knowledge to a grossly unfair degree.

Which clause did jurors consider false? The form does not say. The two sides framed the question differently. According to the Associated Press account of closing arguments, Meta's attorneys told jurors the platform does not sell user information, while McGinn argued that a majority of Facebook's revenue comes from advertising and that the company therefore had an incentive to supply targeted advertising opportunities. McGinn also told jurors that users had become the company's product, according to the same report.

Hate, misinformation and the July 2020 statements

Two statements dated July 1, 2020 bear directly on the advertising market. One, from a Facebook announcement titled "Sharing Our Actions on Stopping Hate," reads: "Facebook does not benefit from hate, and we have no incentive other than to remove it when we find it." The other, a Newsroom post by Clegg titled "Facebook Does Not Benefit from Hate," states: "I want to be unambiguous: Facebook does not profit from hate." It adds: "When we find hateful posts on Facebook and Instagram, we take a zero tolerance approach and remove them."

Both appeared on the first day of the Stop Hate for Profit boycott. According to an NPR report published the same day, more than 400 companies, from Coca-Cola and Adidas to Ford and Lego, had pledged to halt advertising on Facebook in July 2020 over its handling of hate speech. The jury found both statements willfully deceptive and counted 1,386,648 violations apiece, 2,773,296 in total.

Four weeks later, on the company's second-quarter 2020 earnings call on July 30, Zuckerberg said: "We do not profit from misinformation or hate, and we do not want this content on our platforms." That statement was found willfully deceptive as well. So was his August 18, 2021 interview on CBS This Morning, in which he explained: "So the 18 million number that I shared is the number of pieces of content that we've seen on the platform that we take down." The CBS interview is the most recent statement the jury found against Facebook, and it carries 2,100,000 violations.

The rest of Part III stretches back to 2017. On August 16 that year, after Charlottesville, Zuckerberg posted: "There is no place for hate in our community. That's why we've always taken down any post that promotes or celebrates hate crimes or acts of terrorism." He told Swisher in July 2018: "We're not gonna let people plan violence or attack each other or do bad things." And a December 1, 2020 Newsroom item on an Oversight Board case involving Uyghur Muslims stated: "We do not allow hate speech on Facebook because it creates an environment of intimidation and exclusion, and in some cases, may promote real-world violence." All three were found willfully deceptive. Part VI recorded willful unconscionable practices on both misinformation and hate speech.

Cross-check and the politicians exception

Part IV tested promises of even-handed enforcement. A July 17, 2018 Newsroom post titled "Working to Keep Facebook Safe" answered a British Channel 4 Dispatches programme about the company's moderation. "We want to make clear that we remove content from Facebook, no matter who posts it, when it violates our standards," it stated. "There are no special protections for any group," it continued, before describing the cross-check system as a process that "simply means that some content from certain Pages or Profiles is given a second layer of review to make sure we've applied our policies correctly."

Two Zuckerberg posts from June 2020 complete the group. On June 5, responding to criticism that the company had not labelled the President's posts the week before, he wrote that content actually inciting violence would be removed, adding: "There is no exception to this policy for politicians or newsworthiness." On June 26, he wrote that content from a politician or government official that may lead to violence or deprive people of their right to vote would be taken down, and that the policies set out that day carried no exceptions for politicians.

Each of the three was found willfully deceptive, at 1,386,648 violations apiece, for a category total of 4,159,944. In Part VI, the jury also found a willful unconscionable trade practice regarding what the form calls "preferential treatment."

The promises after Cambridge Analytica

Part V begins before the scandal. At the F8 developer conference on April 30, 2014, Zuckerberg described a change to app permissions: "So now we're going to change this and we're going to make it so that now everyone has to choose to share their own data with an app themselves." Jurors found that statement willfully deceptive too.

The rest of the category comes from the weeks after the scandal broke in March 2018. On March 21, a Newsroom post titled "Cracking Down on Platform Abuse" promised a tool to show people whether their data had been accessed through the "thisisyourdigitallife" app, and added: "Moving forward, if we remove an app for misusing data, we will tell everyone who used it." Zuckerberg's Facebook post the same day was more specific: "We will ban any developer from our platform that does not agree to a thorough audit." To CNN, he said: "We should not have trusted the certification that they gave us, and we're not going to make that mistake again." To the New York Times, he pledged to "be conservative" in notifying users, and to "try to tell anyone whose data may have been affected, even if we don't know for certain that they were." In a WIRED interview, also on March 21, he committed to a full investigation of every app with access to large amounts of data before the platform was locked down in 2014, forensic audits of suspicious apps, and removal of developers who refused.

Sandberg's contributions followed. "This was a huge breach of trust," she told CNBC on March 22, 2018. "Cambridge Analytica never should have had this data." On April 5, she told PBS: "So in the Cambridge Analytica case, the friends of friends' sharing that enabled that, we shut that down in 2015." She made a similar point to Bloomberg Television the same day. On May 14, 2018, Archibong wrote in a Newsroom update on the app investigation: "Where we find evidence that these or other apps did misuse data, we will ban them and notify people via this website."

All ten were found willfully deceptive. Six carry 2,100,000 violations and four carry 1,386,648, for a total of 18,146,592. Part VI added a finding of willful unconscionable practice on the app developer investigation. More than 350,000 New Mexicans may have been caught up in the data harvest, according to Torrez, and his office plans to work with the court to notify them, nm.news reported. The 2021 complaint put the national figure at about 70 million US users, according to the Albuquerque Journal. The personality quiz at the centre of the scandal harvested data from roughly 87 million profiles worldwide, according to the Associated Press.

Meta contested this category at length. According to the Albuquerque Journal's account of opening statements, Meta attorney Dane Butswinkas told jurors that the investigation ultimately cost $130 million and involved more than 700 investigators, that the company suspended 125,000 apps and banned 120 developers who accounted for about 80,000 apps, and that it sued five developers.

Three statements the state could not prove

Jurors answered no on three questions. Two of them concern the same sentence. Stepanov's statement in the company's Widely Viewed Content Report for the third quarter of 2021, dated November 9, 2021, reads: "We remove content from Facebook when it poses a real risk of harm, like graphic violence, hate speech or fake COVID cures." It appears as Question 9 under misinformation and again as Question 16 under hate speech, and was rejected both times.

The third rejected statement is Clegg's, from an August 16, 2022 Newsroom post on planning for the US midterms: "We have 10 fact-checking partners in the US to address viral misinformation, including five who cover content in Spanish." The same passage described warning labels and an additional $5 million for fact-checking and media literacy. The programme it described did not last. Meta set out plans on January 7, 2025 to end its US fact-checking programme in favour of a Community Notes model, and the programme ended in the United States on April 7, 2025.

One published account of the verdict diverges from the form on this point. Source NM reported that jurors rejected the claim about removing posts that promote hate crimes or terrorism after Charlottesville. The form marks Question 11, which quotes that post, yes on both liability and willfulness and assigns it 1,386,648 violations. The rejected hate speech question is Question 16, the repeated Stepanov sentence.

Meta's position

Meta rejects the verdict. In a statement provided to Source NM, a company spokesperson said Meta disagreed with the verdict and would continue to defend itself against efforts to distort its record, describing its platforms as forums for free expression and asserting a First Amendment right to manage them. The company, according to the same statement, prioritises free speech, protecting users' information and giving them control over their data. The Associated Press identified the spokesperson as Alex Burgos.

The defence at trial took several lines. According to abq.news, the court's jury instructions recorded Meta's position that its statements were not false or tied to the sale of goods or services, and that federal law and free speech protections shielded it. Butswinkas told jurors in closing that they had been presented with no information about any New Mexican reacting to any of the statements, according to a Nexstar Media report. The Associated Press reported that Facebook's lawyers called the state's evidence outdated, noted that the state had found only one other instance of a data breach despite five years to gather material, and argued that the company had adapted its policies since 2021 and removes 99% of content that violates its standards.

What happens next

The jury's work is done; the penalty is not. Under the Unfair Practices Act, courts may impose a civil penalty of up to $5,000 for each willful violation, according to the New Mexico Department of Justice, and the amount is left entirely to the judge's discretion. First Judicial District Judge Francis Mathew will schedule further proceedings before ruling on penalties and on injunctive relief, which the state is also seeking. Torrez said he instructed his trial team to seek the maximum, according to nm.news, and expects a ruling within weeks. He also said an appeal could take two to three years, with post-judgment interest accruing throughout.

The range between floor and ceiling is wide. At $5,000 per violation, the total would be $219.5 billion. At $100, it would be about $4.39 billion; at $10, about $439 million. State law routes such civil penalties into a fund supporting New Mexico schools, Torrez said, according to nm.news. The verdict pays nothing to individual users, although residents can still pursue their own claims, the outlet reported.

The allocation of roles differs from the state's first trial against Meta this year. In that case, a jury found 75,000 violations and assigned each one the $5,000 statutory maximum, producing $375 million. In this case, the jury counted and the judge will price. The violation count here is 585 times larger than in March. Meta has not paid the earlier judgments, according to the Santa Fe New Mexican, and has instead posted a $1.8 billion bond while asking the court to reconsider its findings or grant a new trial.

A third Santa Fe trial in 2026

The Cambridge Analytica case was filed two years before New Mexico's child safety lawsuit against Meta, yet its verdict arrived six months later than the child safety jury's. Former Attorney General Hector Balderas filed it in 2021, choosing to sue on his own rather than join the multistate litigation that followed the 2018 revelations, according to Source NM. Torrez's separate 2023 child safety lawsuit produced a jury trial from February 2 to March 24, 2026 and a bench trial from May 4 to May 22, ending on August 6 with a $567 million abatement order on top of the $375 million civil penalty.

Jury selection in this case began on September 8, 2026, with opening statements on September 9, according to the New Mexico Department of Justice. The state presented video depositions of Zuckerberg and Sandberg, according to Source NM, and the department's pre-trial witness list also named Calum Matheson and Sam Woolley, whom it described as corporate propaganda experts. The trial had been scheduled to run through October 2, according to the Albuquerque Journal. It closed a week early, after two weeks of evidence, with closing arguments on Wednesday, September 23 and the verdict on Friday.

New Mexico also stayed out of the settlement that closed most of the parallel litigation. The multistate consent judgment entered in Oakland in August 2026 included a Cambridge Settlement Amount of $459,293,017.80, allocated across 48 states. That deal releases Meta from all claims related to Cambridge Analytica, including future ones, according to the Albuquerque Journal. According to the Associated Press, New Mexico is the only state to have taken the data breach claims to trial.

Why the verdict matters to advertisers

The first category of statements concerns the language platforms use to describe targeted advertising. The distinction Zuckerberg and Sandberg drew - Facebook does not sell data, it lets advertisers reach people - is the line that separates a platform holding its own user data from a broker selling information about people it has no direct relationship with. A New Mexico jury has now found that, as delivered to New Mexico consumers, the statements built on that distinction were willfully deceptive. What the verdict does not do is settle, as a matter of law, whether audience targeting amounts to selling data. It is one jury's finding under one state's statute, about specific statements, and it remains open to post-trial motions and appeal.

The channels matter as well. Four of the proven statements came from earnings calls or from company posts published on the first day of an advertiser boycott, the same routes through which platforms typically communicate content policy and data commitments to brands and agencies. The jury treated each of them as a trade practice directed at New Mexico consumers and assigned each 1,386,648 violations.

The costs are accumulating on Meta's income statement. The company recorded a $2.4 billion charge tied to legal proceedings in the second quarter of 2026, a quarter in which advertising revenue rose 27% to $59.36 billion, and it has disclosed an expected $10 billion legal expense accrual for the third quarter linked to the multistate teen settlement. The $219.5 billion ceiling in New Mexico is about 1.12 times the $196.2 billion in full-year 2025 advertising revenue that Meta reported in January 2026. That comparison measures the breadth of the judge's discretion; it is not a forecast of the outcome.

Third-party developer access is the thread that runs from 2014 to the present. A San Francisco court entered a $50 million judgment and permanent injunction against Meta on March 3, 2026 over Facebook user data shared with third-party developers, requiring a new application review process and affirmative express consent for data beyond four baseline categories. Canada's Federal Court of Appeal ruled on September 10, 2024 that Facebook had breached federal privacy law in its handling of the same episode. Meta's shareholders settled a derivative suit for $190 million in November 2025over board oversight failures linked to Cambridge Analytica and the $5 billion Federal Trade Commission settlement that followed. Advertisers felt the aftermath directly as well: Facebook moved in June 2018 to require advertisers to confirm consent for uploaded contact lists.

The verdict also adds to a record of juries ruling on Meta's data practices. A federal jury in San Francisco found on August 4, 2025 that Meta violated the California Invasion of Privacy Act by collecting health data from Flo app users without consent. And the day after New Mexico's March verdict, a Los Angeles jury found Meta and YouTube negligentin the first social media addiction trial. New Mexico's September verdict differs from both in its subject. It concerns neither a product design nor a tracking technology, but what executives said in public about data, hate and moderation - and whether those words amounted to a trade practice.

Timeline

Summary

Who: The State of New Mexico, acting through Attorney General Raúl Torrez, against Meta Platforms, Inc., formerly Facebook, Inc. The statements at issue came from Mark Zuckerberg, Sheryl Sandberg, Nick Clegg, Anna Stepanov, Ime Archibong and the company itself. Judge Francis Mathew presides.

What: A special verdict form finding that 26 of 29 quoted statements were willful unfair or deceptive trade practices, adding up to 43,899,720 violations on the form's figures and 43,899,725 in the state's release, plus willful unconscionable trade practices in all five subject areas. Each violation can carry a civil penalty of up to $5,000, a ceiling of about $219.5 billion.

When: The jury returned its verdict on Friday, September 25, 2026, after a trial that began with jury selection on September 8. The statements date from May 24, 2010 to August 16, 2022, and the case was filed in 2021.

Where: The First Judicial District Court for the County of Santa Fe, New Mexico, in case D-101-CV-2021-00132. The violations were counted against New Mexico's population and its Facebook users.

Why: The verdict finds that Facebook's public assurances about not selling data, about hate speech and misinformation, about even-handed enforcement and about its post-Cambridge Analytica audits misled New Mexico consumers. For the advertising market, it puts a jury's view on record about the language platforms use to explain targeting and brand safety, while the size of any penalty now rests with the judge, and potentially with appellate courts after that.