A New Mexico courtroom has reopened one of the defining privacy controversies of the social-media era, putting Meta Platforms on trial over Facebook’s handling of user data tied to Cambridge Analytica. The state says Facebook misrepresented how personal information could be collected and used through third-party applications; Meta disputes liability. The case matters beyond New Mexico because it tests whether a state consumer-protection law can still impose substantial consequences years after federal regulators and private plaintiffs extracted multibillion-dollar settlements from the same underlying episode.
The trial began this week with New Mexico seeking penalties under its Unfair Practices Act and an injunction against future violations. According to AP reporting, the state says roughly 350,000 New Mexicans were among the Facebook users whose information was implicated, while the broader Cambridge Analytica episode touched data associated with tens of millions of people. The state’s theory is not simply that data moved improperly; it is that Facebook’s public-facing promises and platform controls gave users an inaccurate picture of what outside developers could obtain.
A controversy that never fully disappeared
The Cambridge Analytica scandal became public in 2018, but the regulatory record stretches back further. The Federal Trade Commission had already placed Facebook under a privacy order in 2012. Seven years later, the agency said Facebook violated that order by using deceptive disclosures and settings that undermined users’ privacy choices. The resulting FTC settlement required a $5 billion penalty and a new privacy-governance structure reaching from product reviews to board-level oversight.
That federal action also described how Facebook’s platform once allowed applications used by one person to obtain information about that person’s Facebook friends. The FTC said the company did not consistently police developers and, in some cases, continued sharing affected-friend data after public representations suggested the practice was being curtailed. The commission separately pursued Cambridge Analytica, its former chief executive Alexander Nix and app developer Aleksandr Kogan, alleging deceptive statements about the collection of personally identifiable information. The agency’s Cambridge action said the app gathered information from users and, through their social networks, information connected to many millions more.
The Securities and Exchange Commission reached its own settlement with Facebook in 2019. The SEC said the company’s disclosures treated misuse of user data as a hypothetical risk even after Facebook knew a developer had actually misused data. Facebook agreed to pay $100 million to resolve those charges without admitting or denying the allegations. The agency’s enforcement release framed the problem as one of investor disclosure as well as consumer privacy: a public company cannot describe a realized business risk as though it remains merely theoretical.
Why New Mexico is still in court
New Mexico’s case occupies a different legal lane. Instead of enforcing a federal consent order or securities law, the state is invoking its own consumer-protection statute. That distinction could determine both the scale and type of relief available. State officials argue that Facebook’s representations to New Mexico users amounted to unfair or deceptive trade practices. Meta can counter that the facts have already been extensively litigated, regulated and settled, and that the state must still prove the elements of its own statute rather than rely on the notoriety of Cambridge Analytica as a substitute for evidence.
The trial therefore turns on details: what Facebook told users at specific points in time, what information developers could actually access, which controls existed, how those controls were described, and whether New Mexico consumers were misled in a legally actionable way. The passage of time makes documentary evidence especially important. Jurors are being asked to evaluate platform architecture and privacy disclosures from an earlier generation of Facebook, not the company’s current products.
Meta itself continues to identify privacy, data-use and government investigations as material legal risks. In its most recent annual filing, the company notes that its platform and user-data practices have been the subject of investigations and litigation in the United States and abroad, and that such matters can lead to fines, operational changes, management distraction and other costs. The company’s 2025 filing shows why legacy privacy disputes remain financially relevant even after prior settlements have closed.
The scale of the earlier remedies matters
The 2019 federal settlement was unusually broad. The FTC required Facebook to create an independent privacy committee of the board, designate compliance officers, subject product decisions to documented privacy review, strengthen oversight of third-party applications, and require recurring certifications from senior leadership. The commission also gained stronger tools for monitoring compliance. In explaining the settlement to consumers, the agency said the order was designed to change the company’s internal privacy culture, not merely collect a penalty. The FTC’s consumer guidance emphasized that the agreement removed unilateral control over privacy decisions from the chief executive and established multiple layers of accountability.
Those remedies create an important backdrop for the New Mexico jury. The state is not trying to prove that no authority has ever acted. Rather, it is arguing that New Mexico’s law provides an additional avenue for redress for conduct that affected residents of the state. That raises a broader federalism question that frequently appears in technology regulation: when nationwide platforms operate under federal orders, how much room remains for individual states to impose separate penalties under their own consumer laws?
The answer matters to more than Meta. Major technology companies increasingly face overlapping obligations from the FTC, state attorneys general, securities regulators, European privacy authorities and private litigants. A strong New Mexico verdict could encourage states to revisit older platform conduct when local statutes provide longer-running or distinct causes of action. A defense verdict could reinforce the practical difficulty of turning a widely known privacy scandal into a state-law damages case years after the underlying events.
What the jury must separate
The public record around Cambridge Analytica is dense, but a civil trial still requires separation of established facts, allegations and legal conclusions. The FTC alleged that Facebook deceived users about privacy controls; the SEC alleged that Facebook misled investors about the realized risk of data misuse; Meta resolved those matters without admitting the underlying allegations. New Mexico now must establish its own claims under state law using evidence admissible in this case.
The historical numbers also require care. The FTC’s case against Cambridge Analytica and associated individuals described data collected directly from hundreds of thousands of app users and indirectly from tens of millions of Facebook friends. The agency’s case summary said approximately 30 million identifiable U.S. consumers were implicated in the data used for personality scoring. Other public estimates of affected Facebook profiles were larger because they used different definitions of exposure. For jurors, the legally important question is not simply the largest headline number, but which New Mexico consumers were affected and what representations governed their data at the time.
The trial is expected to continue for several weeks and could include recorded testimony from Meta chief executive Mark Zuckerberg. Whatever the verdict, the case underscores a durable lesson from the first decade of large-scale social platforms: privacy promises can become long-lived legal obligations. Years after a developer’s data practices triggered global scrutiny, courts are still deciding who bears responsibility, what remedies remain available, and how much state law can add to federal enforcement already measured in billions of dollars.
