Facebook Accused of Deceiving Users in New Mexico Privacy Trial

Attorneys representing New Mexico accused Facebook of deceiving users about privacy protections on the social media platform and urged jurors to find the company liable for thousands of violations of state law during closing arguments Wednesday in a trial that has focused on a massive data breach.

Jurors heard two weeks of evidence and must now decide whether Facebook violated the state's Unfair Practices Act and, if so, how many times. The judge would then determine the penalty per violation.

New Mexico is the only state that has taken data breach claims to trial as part of its independent approach to seeking greater accountability from Meta, the parent company of Facebook and Instagram. Earlier this year, 48 other states reached a settlement with Meta concerning child safety and privacy issues related to the same data breach.

The state is seeking maximum civil penalties of up to $5,000 per violation, along with an injunction to prevent future breaches of user data.

The case centers on accusations that Facebook failed to adequately protect users from a third-party personality quiz. This quiz harvested data from approximately 87 million user profiles and subsequently sold it to a political consulting firm, Cambridge Analytica, for the creation of targeted advertisements. Clients of the now-defunct firm included the 2016 campaign for Donald Trump.

"We became the product for Facebook. They turned our dreams into data they could sell to advertisers," said Randi McGinn, an attorney for the state.

Attorneys for Facebook disputed this claim, telling jurors that the platform does not sell user information. While a majority of Facebook's revenue is derived from advertising, McGinn argued that the company was incentivized to offer targeted advertising opportunities. She also contended that enforcement was limited for third-party apps harvesting user data, and the company did not investigate whether those apps were linked to foreign countries or organizations.

Dane Butswinkas, one of Facebook's lawyers, asserted that the platform investigated suspicious third-party apps following the breach. He informed the jury that the company has significantly improved its safeguards and privacy policies since the lawsuit was filed five years ago. Butswinkas stated that Facebook’s revenue and product development teams operated separately and that despite five years of investigation into the platform's privacy practices, the state identified only two data breaches. "How many other Cambridge Analyticas have you heard about in the case? The answer is one," he said.

Butswinkas also noted that evidence indicates Facebook protects users from 99% of content violating its standards, asserting that it is in the platform's best interest to remove violent or hateful content.

The trial included a video deposition of Meta CEO Mark Zuckerberg, who was questioned about a list of thousands of accounts that required additional scrutiny before their content could be removed from Facebook or Instagram.

Prosecutors highlighted an email where Zuckerberg requested that employees add podcaster Joe Rogan’s accounts to this list. "It’s not treating people differently to say we have a policy that’s about broad misinformation and not parsing political speech," Zuckerberg stated during his deposition.

Prosecutors argued that the list created a backlog in fact-checking, enabling viral content to reach millions of users before being taken down. Zuckerberg acknowledged that the company must be cautious about removing sensitive content and that content monitoring is a complex challenge.

New Mexico estimates that around 350,000 residents were affected by the Cambridge Analytica breach. However, McGinn asked the jury to consider that Facebook deceived all New Mexicans through its statements regarding privacy and violent content. Prosecutors estimated that over 1.3 million users were in the state at the time of the breach.

If the jury finds in favor of the state, Facebook could potentially face billions of dollars in penalties. In August, Meta agreed to pay up to $18 billion to settle a multistate lawsuit concerning child safety issues. This settlement also released Meta from future liability related to the Cambridge Analytica privacy breach, leaving New Mexico as the sole state to pursue its case. Florida was the only other state that did not sign the settlement, deeming it insufficiently stringent.

Earlier this year, New Mexico secured judgments totaling $942 million from Meta in a two-phase trial concerning the company's safety protections for minors. The court also mandated that Meta implement new safeguards, including age-verification technology and usage time limits on its platforms. These judgments are currently pending appeal.