What the jury found, and what the state wants
On September 25, 2026, a Santa Fe jury found that Meta violated New Mexico's Unfair Practices Act. Jurors weighed 29 company statements and found 26 false or deceptive. They also found five unconscionable trade practices, including failing to disclose third-party app developers' access to user data and inadequate removal of hate speech, according to the Albuquerque Journal. The state counts roughly 43.9 million violations, based on an estimated 1.4 million affected New Mexico Facebook users.
The statute allows up to $5,000 per violation. Multiplied out, the theoretical ceiling is about $219 billion, per Bloomberg Government. Special prosecutor Randi McGinn asked Judge Francis Mathew for $35 billion to $40 billion, about 20% of that ceiling. She argued the lower figure would better withstand constitutional challenge on appeal. Meta wants a cap of $3.45 billion, according to TIKR. A ruling is expected later this month.
The strongest case for the state
The state's argument deserves a fair statement. Deterrence only works if penalties exceed the gains from the conduct. Meta is among the most profitable companies in the world, and a fine that is a rounding error will not change how it makes promises about privacy. The jury also found the conduct wilful. Jurors were shown, among other statements, a 2010 Mark Zuckerberg Washington Post article asserting: "We do not share your personal information with people or services you don't want." If a company knowingly misleads consumers about the core product, a large penalty is a legitimate response. The Federal Trade Commission took a similar view in 2019, when it imposed a $5 billion penalty on Facebook. The agency called it almost 20 times greater than the largest privacy or data security penalty ever imposed worldwide.
Why the arithmetic is the problem
That 2019 order is the relevant benchmark. The FTC penalty addressed Facebook's privacy conduct nationwide, over more than 200 million U.S. users, and came with sweeping structural remedies: an independent board privacy committee, compliance certifications and third-party assessments. New Mexico is asking for up to eight times that amount for one state's 1.4 million users. That works out to roughly $25,000 to $29,000 per user, for statements that national regulators had already addressed.
The gap comes from the counting method. The 43.9 million figure is not 43.9 million separate injuries. It is a multiplier applied to a user count. Meta argues the state offered no evidence that residents saw the statements or were harmed. Meta's lawyer called the request "surreal" and "shocking to the conscious," according to Bloomberg Government.
The Supreme Court has set limits on this kind of multiplication. In BMW of North America v. Gore (1996), it directed courts to weigh the reprehensibility of the conduct, the ratio to actual harm, and the comparison with civil penalties for similar misconduct. It called a 500-to-1 ratio "breathtaking." In State Farm v. Campbell (2003), it said few awards exceeding a single-digit ratio between punitive and compensatory damages will satisfy due process. Statutory penalties are not identical to punitive damages, but the logic carries over. A penalty untethered from any measured harm invites exactly the review the state is trying to pre-empt. The state itself conceded as much by discounting its own figure by 80%.
The speech dimension
Most coverage treats this as a privacy case. Half of it is about speech. Jurors found Meta's statements about removing hate speech and misinformation deceptive. They also found its actual moderation practices unconscionable. Meta responded that its platforms are "forums for free expression" and that it has a First Amendment right to manage them.
There is a real distinction between punishing a company for a false promise and punishing it for moderation choices. The first is ordinary consumer protection. The second lets a state jury decide what level of hate-speech removal a platform must achieve. A multi-billion-dollar penalty tied partly to that finding pressures platforms to moderate in whatever way minimizes litigation risk in the most aggressive state. Over-removal is the cheapest hedge.
A proportionate path
A pro-innovation reading does not excuse Meta. The company's privacy statements after Cambridge Analytica were scrutinized by the FTC and found wanting. The sound approach is a penalty that is large enough to deter, anchored to something measurable, and defensible on appeal.
- Anchor to evidence. Penalties should track the number of users who actually encountered a statement, or the revenue earned from New Mexico users during the violation period. A raw head count does not do this.
- Separate the two theories. Penalties for false privacy statements should be distinguished from penalties for moderation outcomes, so that appellate review of one does not swallow the other.
- Prefer conduct remedies. Disclosure rules and independent audits, as in the 2019 FTC order, change behavior in ways a fine alone does not.
McGinn herself warned that collection would likely take four to five years given Meta's expected appeal. A figure that invites reversal delivers neither deterrence nor compensation to New Mexicans for years. Judge Mathew's ruling will show whether state consumer-protection law can scale a per-violation cap into a national-scale penalty. Whatever number he picks, the reasoning will be copied by other attorneys general and tested on appeal.