A New Mexico jury turned Meta's data claims into 43.9 million violations
On September 25, 2026 a jury in New Mexico found 26 of 29 public Facebook and Meta statements deceptive under the state's consumer protection law. Violations were not counted one by one but multiplied by how far each statement travelled, reaching 43,899,720 on the verdict form. The judge, not the jury, sets the penalty.
Two weeks of trial, then 26 statements marked deceptive
Fortune reported the outcome on September 26, 2026 at 10:25 AM ET and PPC Land covered it the same day; the jury returned its verdict on September 25. The case ran as D-101-CV-2021-00132 in the First Judicial District Court for the County of Santa Fe, New Mexico, before Judge Francis Mathew, and Fortune puts the trial at two weeks. Jurors reviewed 29 public statements covering how the company collects, protects and shares user data, along with hate speech, misinformation, content moderation involving politicians and the app developer investigations that followed Cambridge Analytica. They found 26 of them deceptive.
PPC Land identifies the three statements jurors rejected: two separate instances of an Anna Stepanov statement about removing harmful content, and a Nick Clegg statement from August 2022 about fact-checking partners. Fortune adds that jurors also declined to hold Facebook liable over false claims regarding the removal of harmful content, including COVID-19 misinformation. The same verdict date and the same 43.9 million figure appear in the New Mexico Department of Justice press release and in reporting by the Santa Fe New Mexican; that paper frames it as the state's second court win against Meta.
Reach drives the count, and the two totals do not match
The statements were split across five parts: data control 6, misinformation 4, hate speech 6, content moderation involving politicians 3, and the Cambridge Analytica and app developer audits 10. The last group carries the heaviest load at 18,146,592 violations, or 41.3 percent of the total. The arithmetic behind that scale is the counting method. According to PPC Land, each statement carried by mass media counted as 2,100,000 violations, while each statement published through Facebook's own channels counted as 1,386,648. The two records of the total do not agree: the same report puts the verdict form at 43,899,720 and the state's own release at 43,899,725. The five-violation gap is left unreconciled.
Violations were also attributed to their authors. In PPC Land's breakdown, 14 statements by Mark Zuckerberg account for 24,406,536 violations, or 55.6 percent of the total. Six statements by Sheryl Sandberg account for 11,173,296, four corporate Facebook statements for 5,546,592, one by Nick Clegg for 1,386,648 and a single statement by Ime Archibong for another 1,386,648. The date range is broad: the same breakdown places the statements between May 24, 2010 and August 16, 2022, and that is the window the verdict covers.
The ceiling is framed differently by each outlet, and the judge writes the number
The money is still open. PPC Land reports a statutory maximum of 5,000 dollars per willful violation, putting the ceiling at roughly 219.5 billion dollars. Fortune rounds the same ceiling to more than 200 billion dollars and notes that interest could be added if the case is appealed, so the two reports give the same ceiling at different precision. The amount will be set by Judge Mathew rather than the jury. Fortune reports a penalty hearing on October 1, while PPC Land says the judge will schedule further proceedings on both the penalty and injunctive relief, that Attorney General Raul Torrez is seeking maximum penalties, and that a ruling is expected within weeks. Any money awarded goes to the state's public schools.
The case goes back to a third-party personality quiz that harvested roughly 87 million profiles worldwide and passed the data to the now-defunct Cambridge Analytica, whose clients Fortune notes included the 2016 Trump campaign. New Mexico estimates more than 350,000 of its residents were affected, and the state declined to join the multistate settlement that carried a 459.29 million dollar Cambridge Analytica allocation. Meta spokesperson Alex Burgos told Fortune that "we disagree with the verdict", adding that the company will continue to defend itself against what he characterised as efforts to distort its record. PPC Land adds that Meta described its platforms as forums for free expression and asserted a First Amendment right to manage them. The company has posted a 1.8 billion dollar bond while appealing earlier judgments and may appeal this verdict too, a process that could take two to three years.
The sources say nothing about Türkiye, so this section is commentary
Neither source mentions Türkiye at all. There is no figure on whether Turkish users sit inside the global pool of roughly 87 million profiles, no parallel proceeding in the country, no institution named and no local date. The reporting is built entirely on one US state's consumer protection case. What follows is therefore not a fact drawn from the sources but explicitly UNALSOFT commentary.
Our reading is that what went on trial here was not the data practice itself but the public sentences describing it, and that the violation count was multiplied by how many people each sentence reached. That logic is worth thinking about for any business repeating a data security promise on its site, in its contracts and in its ad copy. The unknowns deserve the same clarity. The sources do not say: the final penalty amount, the scope of any injunctive relief, whether Meta will appeal, whether the verdict changes the company's ad targeting practices, any figure at all about users in Türkiye, or whether a Turkish regulator will respond. We looked at local breach notification practice separately on September 16, and that article is independent of this case.
The UNALSOFT view
We read this less as a technology story and more as a discipline of statements. What was argued over was not a software flaw but sentences republished for years, and counting violations by distribution reach shows how repeating the same sentence across every channel enlarges the exposure. The practical consequence is plain: whatever you say about data on your site, in your privacy notice and in your ad copy needs a practice standing behind it, and the two should be updated together. That is why on the ad management side we treat matching campaign copy to how the product actually behaves as its own step. Because the sources carry no data about Türkiye, this article proposes no local legal conclusion.
Is there a real practice standing behind what you say about data?
A short conversation is enough to bring your site copy, your privacy notice and your ad creatives onto the same version of reality.