New Mexico Jury Finds Meta Liable for 43 Million Privacy Violations

A New Mexico jury found Meta liable for more than 43 million privacy violations, stemming from a 2010 Mark Zuckerberg statement that users have "control over how your information is shared." The math: 2.1 million New Mexico residents, multiplied across the promises at issue, each worth up to $5,000 under state consumer-protection law. The statutory ceiling lands above $215 billion. The state is asking for $35 to $40 billion. Meta calls it unconstitutional.

The irony that Meta's spokesperson then repeated nearly verbatim the language the jury just called deceptive tells you something about where the company's lawyers think real exposure lands.

The dollar amount will get cut. The method might not.

The $215 billion number does not survive appeal. A penalty larger than Meta's roughly $160 billion in annual revenue triggers the Supreme Court's own proportionality rule, and no trial judge wants to author a number that gets reversed on sight. The state's own $35 to $40 billion ask signals the plaintiff doesn't expect the ceiling to hold either. This ends closer to a number a CFO can reserve against than to a number that breaks the balance sheet.

Our call: Judge Francis Mathew sets the final penalty below $40 billion, a reduction of more than 80% from the statutory ceiling. Reduction is near-certain; the size depends on the judge. Revisit by 2027-06-30.

The more durable piece is the per-resident multiplication theory itself. State attorneys general now have a damages template: take boilerplate privacy language, multiply by the census, and each state's consumer-protection statute hands you a number a CFO has to at least model. The template spreading to other states is the real risk for the industry, and it doesn't require New Mexico's number to hold.

Who this hits

Mid-tier ad-tech companies running the same "you control your data" consent copy without Meta's legal reserves get repriced on risk before they lose a single case. Walled gardens absorb it. The compliance and consent infrastructure layer, companies like LiveRamp (the data connectivity platform) and ID5 (the identity resolution provider) plus the consent-management platforms, picks up a new sales pitch built on that fear.

For any operator, the immediate task is an audit: where does your product promise "control," and do your data-sharing contracts with demand partners actually allow it? That's where the promise breaks down in practice. Fix the copy edit now. Reserving billions is harder to undo.

A New Mexico jury decided that Mark Zuckerberg's 2010 line about users having "control over how your information is shared" counts as a separate violation for each of the state's 2.1 million residents. Multiply that across the promises at issue and you land above 43 million violations, each worth up to $5,000 under state law. That puts the legal ceiling north of $215 billion. The state wants $35 to $40 billion. Meta says that's unconstitutional, and its spokesperson then repeated almost word for word the "control over their data" language the jury just called deceptive.

What's being decided, and how hard to undo: The jury verdict is done. The dollar figure is not. Judge Francis Mathew sets the number, and that number gets appealed. For the rest of the industry, nothing forces a move today. But the thing a reader cares about is whether a new way of pricing privacy promises just got born, and that is easy to undo if an appellate court kills the per-resident math. The deadline is soft, driven by how fast other state attorneys general copy the template.

The Skeptic This verdict does not survive at $215 billion, and probably not at $35 billion either. A penalty bigger than Meta's annual revenue is the kind of number that gets cut hard on appeal under the Supreme Court's own rule that fines can't be grossly out of proportion to the harm. The per-resident multiplication theory is brand new. No appeals court has blessed counting one speech once per citizen. And the loudest evidence Meta isn't scared: its spokesperson recycled the exact language the jury flagged. You don't repeat the words that just cost you $215 billion unless your lawyers have told you the real exposure is manageable. This ends in a settlement, closer to the $5 billion the FTC extracted than to $35 billion.

The Market Analyst The market will treat the headline number as noise and the precedent as real. For public ad-tech, the split matters. Walled gardens with deep legal reserves and lobbying muscle absorb a number like this. Mid-tier public names that run the same "you control your data" boilerplate without Meta's balance sheet get repriced on legal risk, even before any of them loses a case. The quieter winners are the compliance plumbers. If the pitch becomes "we are the consent and identity layer that keeps your promises defensible," then LiveRamp, ID5, and the consent-management crowd get a story to sell. That's a tailwind built on fear, and fear sells infrastructure.

The Operator Tuesday morning, the general counsel forwards this to the product team and asks one question: where does our UI say users "control" their data, and can we prove it's true? That audit is miserable. The promise language lives in consent pop-ups, privacy centers, onboarding flows, and the data-sharing disclosures you signed with every ad partner. Every state has a population and most have a consumer-protection statute with per-violation fines. New Mexico's AG just handed 49 other AGs a damages template: multiply your boilerplate by the census. The first thing that breaks is consent copy. The second is the data-sharing terms with your demand partners, because that's where "control" stops being true.

The Customer / End User Here's the part nobody in this chain is asking: did a single New Mexico resident change their behavior because of the 2010 promise? The whole $215 billion rests on treating one marketing sentence as 2.1 million separate injuries. In plain terms, the law lets the state count a billboard once for every person who drove past it. That's great for deterrence and strange as justice. For users, the practical outcome isn't a check in the mail. It's more consent screens, more friction, and platforms that promise less so they can be sued for less. Over-promise gets punished, so the rational move is to under-promise. Users get worse-sounding privacy language that is more honest.

Where the council splits. The Skeptic says the number collapses on appeal and the whole thing deflates toward a normal settlement. The Market Analyst and Strategist say the dollar amount is beside the point. Even at ten cents on the dollar, the per-resident method turns privacy promises from a reputation worry into a line a CFO has to reserve against. Both can be right: the $215 billion dies, the method lives.

The second split is who it hurts. The Operator says everyone running "you control your data" boilerplate is exposed. The Market Analyst says the giants shrug and the mid-tier pays. The hinge is legal firepower, not guilt. Same words, very different survivability.

What it actually hinges on. One belief: does any appeals court bless counting one promise once per resident? If yes, the template spreads and every scaled platform reserves against it. If no, this is a dramatic verdict that dies quietly and the consent-platform tailwind fizzles. The council leans toward the number getting cut hard while the method survives in weaker form, because state AGs love a reusable damages template and consumer-protection statutes with per-violation fines already sit on the books in most states.

What to de-risk now, cheaply: audit where your product promises "control," make the promise match what the data-sharing terms actually allow, and stop writing privacy copy your ad-partner contracts contradict. That's a copy edit, and it's reversible. Reserving billions is not.

Prediction: Judge Francis Mathew will cut the penalty against Meta to below $40 billion when he sets the final number, a reduction of more than 80% from the $215 billion statutory ceiling the jury's count produced.

Confidence: Medium. Reduction is near-certain; the exact size depends on the judge.

Why: The jury's count produced a ceiling above $215 billion, larger than Meta's roughly $160 billion in annual revenue, and US courts routinely cut penalties that dwarf a defendant's ability to pay and the actual harm shown, under the Supreme Court's rule that fines can't be grossly disproportionate. The state itself only asked for $35 to $40 billion, which signals even the plaintiff doesn't expect the ceiling to hold. The opposite outcome, Mathew imposing something near the full ceiling, would hand Meta its strongest possible appeal argument and no trial judge wants to author a number that gets reversed on sight. The open question is whether he lands near the state's $35 to $40 billion ask or well below it, which is why the call is the direction and scale of the cut, not a precise figure.

Revisit by 2027-06-30: We're right if Judge Francis Mathew sets a final penalty below $40 billion. We're wrong if he imposes $40 billion or more.