Meta’s Data Control Promises Found Misleading

On October 21, 2026, New Mexico’s First Judicial District Court ordered Meta to pay $25 billion in civil penalties. The case concerned public statements Facebook made before and after the Cambridge Analytica scandal under New Mexico’s Unfair Practices Act (UPA). On September 25, a jury had found that Facebook made unlawful representations about users’ control of their data, third-party data access and investigations, and content governance.

The jury found all six representations about users’ control of their data to be unfair or deceptive trade practices, and found each violation willful. In the subsequent judgment, the judge further stated that Facebook’s promise that users controlled their data was false.

The court found that choosing a post’s audience did not determine whether developers could obtain the data; Facebook retained undisclosed exceptions for certain business partners when it announced tighter third-party access restrictions; and its subsequent investigation and deletion promises exceeded its actual enforcement capabilities. These limitations directly affected what users could control, yet Facebook’s public promises did not accurately disclose them.

1. The Data Control Representations at Issue

The first part of the Special Verdict Form addressed users’ control of their data, examining six public representations Facebook and its executives made between 2010 and 2019. They concerned whether users could decide how information was shared, whether third parties could obtain personal information, and whether Facebook sold data and how its advertising business operated.

In a Washington Post article published on May 24, 2010, Mark Zuckerberg stated: “You have control over how your information is shared.” The promises that followed described the scope of that control: Facebook would not share personal information with people or services users did not want, would not give advertisers access to personal information, and would never sell users’ information to anyone.

The other five representations appeared between 2018 and 2019. Interviews, company newsroom posts, social media posts, and an earnings call continued to explain Facebook’s data practices and advertising business to the public.

Verdict question	Speaker and date	Channel	Summary of the representation
Question 1	Mark Zuckerberg, May 24, 2010	Washington Post article	Users control information sharing; Facebook does not share information with people or services users do not want, give advertisers access to personal information, or sell user information.
Question 2	Mark Zuckerberg, April 4, 2018	Meta Newsroom Q&A	Distinguished Facebook from internet companies or data brokers that might track and sell data, and denied buying and selling data.
Question 3	Sheryl Sandberg, April 5, 2018	PBS interview	Denied selling data or giving personal data to advertisers.
Question 4	Mark Zuckerberg, July 18, 2018	Interview with Kara Swisher	Denied selling data or giving it to anyone else, and said users wanted ads relevant to their interests.
Question 5	Sheryl Sandberg, January 24, 2019	Facebook post	Denied selling people’s data or sharing personal information with advertisers without permission.
Question 6	Sheryl Sandberg, January 30, 2019	Facebook Q4 2018 earnings call	Denied selling data or telling advertisers who users were, describing the business as helping advertisers reach people interested in their products.

The jury found each of these six representations to be an unfair or deceptive trade practice and found Facebook’s conduct willful in each instance. Each verdict question addressed the complete statement presented, including related promises about user choice, information sharing, and data sales.

Reviewing privacy promises requires comparing public statements with actual data practices. A promise that users can limit sharing calls for checking which recipients their choices constrain and whether undisclosed exceptions exist. Promises to investigate misuse, verify deletion, or notify users require records, audits, and enforcement capabilities sufficient to support them.

Executive interviews, press releases, and other public communications require the same review. When a company promises users control over particular data, recipients’ access, or processing activities, it should provide that control. Limitations and exceptions that affect users’ decisions need to be disclosed alongside the promise.

2. Privacy Settings and Third-Party Data Access

Facebook’s post-audience settings and developer access permissions governed different uses of data. Finding of Fact 18 cited expert Dr. Egelman’s testimony that selecting who could see a post through a drop-down menu did not determine what developers could extract from a user’s profile through an application programming interface (API), or whether they could read the post. A separate set of privacy settings governed developer access, and research showed that most users did not know those settings existed.

After a user limited a post’s audience, developers could still potentially obtain the information under a separate set of permissions. The choice displayed in the posting interface therefore described visibility within a particular context; it did not establish whether all third-party access was restricted. The scope of each set of controls directly affected the accuracy of Facebook’s promise that users controlled information sharing.

Third-party application access also extended to users’ friends. Findings of Fact 22–25 stated that, before 2014, applications could obtain information not only about people using the application but also about their friends, even when those friends did not know their information was being shared. One person’s use of an application could therefore put another person’s data in a developer’s hands.

In 2014, Facebook announced that it would end this “friend sharing” mechanism, with a transition period ending in May 2015. Its public explanation was that applications would no longer be able to obtain detailed information about users’ friends; each user would decide whether to share their own information with an application.

The court found that, more than a year before the announcement, Facebook had already planned exceptions for certain important business partners, allowing them continued access to friends’ data after the transition period. Facebook implemented those exceptions without disclosing them to users.

The public policy described sharing as each user’s own choice, while the actual access arrangements still allowed certain business partners to obtain friends’ data. Users could not determine from the public policy and interface settings alone which recipients could still obtain their information. This was an important factual basis for the court’s assessment of Facebook’s data control promises.

3. The Legal Findings on Misleading Representations

Final Jury Instruction 7 required the state to prove four elements: Facebook made a false or misleading representation; it did so knowingly; the representation related to the sale, lease, rental, or loan of goods or services in the regular course of its business; and it might, tended to, or did deceive or mislead a person. Under Instruction 6, the state had to establish those elements by the greater weight of the evidence, meaning the matter to be proved was more likely true than not true.

The assessment of a representation also included material omissions. Instruction 7 explained that omitting a material fact could violate the UPA if it made the representation one that might deceive, tended to deceive, or actually deceived a person. A fact was material if a reasonable person would consider it important when deciding how to act, or if the speaker knew or had reason to know that the recipient would consider it important. A company must disclose material facts reasonably necessary to keep its public representations from being misleading.

That standard directly related to the data access arrangements in this case. Whether users could restrict developers’ access, and whether certain business partners had exceptions, affected the meaning of “control” over information sharing. In Conclusions of Law 13 and 14, the court found that Facebook promised users control over their data without disclosing the open platform’s design allowing third-party applications to obtain data improperly. It also concealed continued access for favored business partners when it announced the end of friend sharing.

As to Facebook’s awareness of problems with its representations, Instruction 8 explained that “knowingly” included both actual awareness that a statement was false or misleading and circumstances in which reasonable diligence should have made Facebook aware of that fact. Instruction 12 separately defined “willful” conduct as intentionally doing an act with knowledge that harm might result.

Internal evidence cited in the judgment showed what Facebook knew. Finding of Fact 19 cited an email from Zuckerberg to executive Chris Cox. Zuckerberg discussed the possibility that users did not understand their existing privacy settings and proposed giving users an opportunity to change them without encouraging changes, while gradually expanding the visibility of information. The court found that Facebook exploited users’ lack of understanding to encourage them to make more personal information public and compete more effectively with Twitter. It also found that Facebook continued making public representations after employees, researchers, and senior personnel had identified that its actual capabilities could not deliver on its promises.

In addition to finding the six representations unlawful and willful, the jury answered Question 30 by finding a willful unconscionable trade practice concerning users’ control of their data. Under Instruction 10, this form of liability concerned whether a company took advantage of consumers’ lack of knowledge, ability, experience, or capacity to a grossly unfair degree. Consumers could not independently verify the platform’s internal data access mechanisms, while Facebook possessed that information and exploited their misunderstanding of privacy settings. Those facts supported the court’s findings on this issue.

Facebook denied at trial that its representations were false or misleading and argued that they were unrelated to transactions in goods or services. Instruction 11 specified that no transaction between Facebook and the state or a particular New Mexico resident was required: a connection to a sale of goods or services to a third party was sufficient. Finding of Fact 17 stated that Facebook’s primary revenue came from advertising targeted using users’ personal information. A company witness confirmed that the advertising platform depended on user data and that users could neither stop Facebook’s collection of their data nor turn off ads. The connection between user data and advertising revenue therefore formed part of the court’s review of Facebook’s public representations.

Facebook also raised defenses under Section 230 of the Communications Decency Act and freedom of speech. Instruction 14 distinguished publishing third-party content from a platform’s own unlawful conduct. Instruction 15 specified that the First Amendment does not protect false or misleading representations made in commercial speech. These instructions directed the jury to assess liability based on Facebook’s own statements and conduct.

4. The App Developer Investigation and Remediation Promises

After the Cambridge Analytica scandal became public in 2018, Facebook launched the App Developer Investigation (ADI), which continued until March 2021. The company publicly promised to investigate applications that had accessed large amounts of user data before the 2014 platform changes, fully audit applications exhibiting suspicious activity, ban developers that misused data, ensure deletion of improperly obtained data, and notify affected users.

Findings of Fact 26–36 compared these promises with Facebook’s execution.

For investigations and audits, Facebook’s own investigation identified thousands of applications exhibiting suspicious activity, but the company conducted only 14 forensic data audits over roughly three years. Those audits also did not adequately verify misuse: the auditor disclaimed independent verification of the accuracy of information supplied by the developers under investigation. Facebook ultimately banned approximately 116 developers, but inadequate developer controls meant they could potentially create or operate other applications.

For data deletion, Facebook’s internal materials acknowledged the difficulty of effectively verifying whether third parties had actually deleted data. Despite admitting after the Cambridge Analytica scandal that relying solely on developers’ deletion certifications had been a mistake, Facebook continued to rely primarily on such certifications in practice.

For user notification, Facebook narrowed its internal definition of “data misuse” to reduce the notification workload without disclosing that change to users. The court found that the investigation identified misuse by many applications, yet Facebook ultimately notified users about only two applications. By September 2019, Facebook’s own internal legal assessment concluded that the company could not say it had fulfilled its public ADI commitment. When it ended the investigation in March 2021, it did not publicly announce that decision to users.

Investigation records, audit methods, developer controls, and deletion verification capabilities determined how far these remediation promises could be delivered. Finding of Fact 28 stated that, because of poor historical recordkeeping and inadequate vetting when granting developers access, Facebook already knew when it made the promises that it lacked the ability to conduct a comprehensive investigation or ensure deletion. The court found the investigation’s ineffectiveness willful, citing senior executives’ pressure to reduce costs, inadequate enforcement resources, insufficient investigative methods, and reluctance to set a precedent for future investigations.

This also corresponded to Instruction 9 on promises of future action. In addition to showing that Facebook ultimately failed to perform, the state had to establish that Facebook did not intend to perform when it made the promise, or should have known through reasonable diligence that it could not do so. The jury found all ten representations in Questions 20–29 concerning friends’ data access and the ADI unlawful and willful. In Question 34, it separately found a willful unconscionable trade practice concerning the ADI.

5. Criteria for Assessing the Penalty

The civil penalty was based on the number of violations found by the jury, with the court determining the amount. Instruction 13 required the jury to consider the specific circumstances, the representations’ reasonably expected or anticipated audiences, and repetition of the conduct. Each New Mexico resident within a representation’s reasonably expected audience could constitute a separate violation. The state did not have to identify individual consumers or prove that a particular consumer actually saw or relied on a representation, or was deceived or harmed by it.

Applying that method, the jury assigned about 1.39 million or 2.1 million violations to each of the 26 unlawful representations, corresponding to Facebook’s monthly active users in New Mexico or the state’s total population. Together they amounted to about 43.9 million violations. The six data control representations accounted for about 10.46 million. A person could belong to the audience for multiple representations, so these figures count violations rather than distinct users. The jury also made five separate findings of willful unconscionable trade practices.

In determining the per-violation amount, the court considered the duration and repetition of the conduct, the breadth of subjects involved, senior management’s participation, audience size, and Facebook’s continued misleading representations despite its knowledge of internal practices. It found that these circumstances supported the statutory maximum civil penalty of $5,000 per violation under Section 57-12-11 of the UPA.

At approximately 43.9 million violations, that calculation produced roughly $219.5 billion. In its judgment, the court reduced the penalty to $25 billion and ordered interest at 15% per year until paid in full. The judgment did not further explain the specific calculation used to reduce that amount to $25 billion. The award covers multiple subjects, including data practices and content governance; the judgment did not allocate a separate amount to data control promises.

The court reserved injunctive relief pending further briefing. As of October 22, 2026, Meta had publicly stated that it would appeal.

References

New Mexico First Judicial District Court, State of New Mexico ex rel. Raúl Torrez v. Meta Platforms, Inc., No. D-101-CV-2021-00132, Findings of Fact, Conclusions of Law and Judgment, October 21, 2026, particularly Findings 7–36 and 53–58, Conclusions 3 and 7–19, and the decretal provisions: https://nmcourts.gov/wp-content/uploads/2026/10/Findings-and-Conclusions-21-Oct-26-D101CV202100132.pdf; Special Verdict Form and Final Jury Instructions in the same case, September 25, 2026, particularly Questions 1–6, 20–30, and 34, and Instructions 6–15: https://drive.google.com/file/d/1WT94UuLovQplECZO9idnXZeyJykibsYN/view?usp=sharing; Meta’s statement on appeal is reported in Source New Mexico’s October 21, 2026 article and update: https://sourcenm.com/2026/10/21/new-mexico-judge-orders-meta-to-pay-state-25b/.