Misleading Privacy Claims Can Trigger Massive Consumer-Protection Liability

At a glance: A New Mexico jury found Meta liable for nearly 44 million deceptive trade practice violations based on misleading privacy and platform-safety statements—showing that public-facing privacy claims can create significant consumer-protection exposure.

On September 25, 2026, a jury in the State of New Mexico v. Facebook, Inc. trial found that Meta, formerly Facebook, violated New Mexico’s Unfair Practices Act (UPA) almost 44 million times. The violations consisted of false and misleading statements that the social media company made to New Mexico consumers detailing how the company collected, protected, shared and used their personal information, as well as claims pertaining to Meta’s efforts to mitigate misinformation and hate speech on its platform.

Details of the verdict

Specifically, the jury found statements by Meta assuring consumers that they controlled how their information was shared, that their personal information would not be sold to or shared with advertisers, and that Meta did not buy or sell their data amounted to willful unfair or deceptive trade practices.

Moreover, Meta’s statements that it did not profit from misinformation or hate, lacked incentives to host hateful content, and prohibited hate speech from its platform were found to be willfully deceptive. The jury also found statements regarding Meta’s application of its Community Standards, as well as statements concerning its investigation of third-party applications in the wake of the Cambridge Analytica scandal, to be willfully deceptive.

With each willful violation subject to a civil penalty of up to $5,000, Meta’s damages could reach billions of dollars, with the final damages amount to be determined by the court.

Who is affected by this verdict?

Any business that has an online presence and that makes public statements about how it collects, handles, and uses personal information may be affected by this verdict.

While the verdict is directed at Meta, New Mexico Attorney General Raúl Torrez made it clear that the precedent extends well beyond one company: “I hope that the message is unmistakable for . . . Meta and well beyond that,” Torrez said. “Anyone in big tech who thinks that they can mislead and misrepresent the way in which they do business in the State of New Mexico will not be tolerated.”

The verdict could also spur similar enforcement actions in other states against companies that process personal data and deviate from their stated privacy practices. In fact, the verdict could have significant reach considering the action was brought under the state’s consumer protection law rather than a data privacy law. In other words, a regulated business that misrepresents its privacy practices could face public litigation in any state, not just those that have personal data privacy laws. With a comprehensive U.S. federal personal data privacy law still unlikely, state attorneys general have been filling enforcement gaps through state laws. 

What should companies do now?

The verdict is the result of statements made by Meta in its public privacy notice, not necessarily an underlying data breach or failure to implement best privacy practices. It’s a good reminder that what a business says about privacy is just as important as what it does about privacy. With that in mind, how can businesses ensure that what they say aligns with what they actually do?

• Substantiate the veracity of privacy statements.
  • No matter the messaging channel—whether a privacy notice, advertisement, blog post, or FAQ page—ensure that claims regarding privacy match actual practices.
  • Companies should conduct a privacy and data-use “claims audit,” comparing public statements with actual data flows to confirm alignment or remediate any gaps. In addition, they should create a workflow that keeps representations current with evolving privacy programs.
  • Vendor agreements should be negotiated to align with relevant statements about third-party access and use of personal data.
•  Take care with key terms.
  • Making ambiguous or overly broad claims with terms like “sell,” “share,” and “control” can create potential ambiguity or false impressions. If it is represented that “users control how and with whom their data is shared,” make sure that aligns with actual data flows and use.
  • Companies should review privacy notices, targeted advertising disclosures, consent agreements, opt-out messages, and other notices to ensure they accurately describe the degree of control individuals have over their data.
• Review third-party access on a rolling basis.
  • One particular issue the verdict addressed was Meta’s claims about third-party access to user data and how those claims did not align with Meta’s actual practices, including statements about investigating and banning developers who misused data. Such third-party access rights need to be reviewed not only at the beginning of any relationship but also on an ongoing basis to ensure that use continues to align with public disclosures. 
  • Companies should design and build a third-party data access governance model that includes aligned agreements, least-privilege software development kits and API access, anomaly detection, functional audit rights, offboarding assurances, and incident response preparedness when third-party misuse is detected, all of which should be reviewed on a rolling basis.
• Take data misuse seriously.
  • Even when third parties are authorized to access and use data, there are likely limits on the way they can use it. If those limits are violated, it may require an investigation and notification obligations to regulators and impacted users.
  • Companies should seek privileged investigation support, negotiation and notification strategy, multi-state regulator coordination, legal holds and document preservation, and litigation management.

The State of New Mexico v. Facebook, Inc. jury verdict is a reminder that privacy statements—across notices, blogs, interviews, and communications of all types—can be treated as enforceable consumer-protection representations, creating “per-violation” exposure at scale. To ensure your business can avoid massive consumer-protection liability, Crowell is standing by to assist with privacy claims audits, third-party governance, investigations, and related litigation strategy.