Meta's 43M violations: your public claims are evidence

On Friday, a Santa Fe jury found Facebook liable for roughly 43 million violations of New Mexico's Unfair Practices Act. The number is not a count of hacked accounts or leaked records. It is a count of public statements the company made about privacy and data handling, multiplied by the people who could have read them. That arithmetic is the part every operator should study, because it applies to your trust page too.

What actually happened

Per the Santa Fe New Mexican and Fortune:

• The verdict landed September 25 in New Mexico's First Judicial District Court in Santa Fe, before Judge Francis Mathew. It resolves a lawsuit the state filed in 2021 over the Cambridge Analytica episode, in which a third-party personality quiz harvested data from roughly 87 million profiles.
• The jury reviewed about three dozen public statements — the Santa Fe New Mexican reports 34 instances evaluated, with 31 found to violate the state's Unfair Practices Act. Subjects included privacy protections, hate speech, misinformation, and the company's account of its investigations into third-party app developers after Cambridge Analytica.
• Violations are counted per person reached. Roughly 43 million, against a state population of just over 2 million.
• The statutory maximum is $5,000 per violation. Attorney General Raúl Torrez said the state will seek it, putting the theoretical ceiling near $219 billion. The judge sets the actual figure; the penalty hearing is October 1.
• Meta is contesting it. The company points to free-expression grounds: "We have a First Amendment right to manage those platforms in a way we believe best serves the interests of our community." Torrez called the verdict "a seminal moment in holding big tech accountable."
• This is the state's second win against Meta this year, following a $375 million verdict over minors' exposure to predators.

Why your public claims matter for your business

Consumer-protection law does not care how big you are. New Mexico's Unfair Practices Act is a garden-variety state consumer statute. Every state has one. It does not require a data breach, a regulator's prior approval, or a federal hook — just a public claim a jury decides was misleading, and people who saw it. The per-violation multiplier is what turns a marketing decision into a balance-sheet event, and that multiplier scales with your customer list, not your headcount.

Audit the claims you have already shipped. Go read your own site the way a plaintiff's attorney would: the security page, the privacy policy, the FAQ, the onboarding copy, the pricing page footnotes, the sales deck, the trust badges. Every sentence asserting a fact about what you do with data — "we never sell your information," "encrypted end to end," "we audit our integrations," "your data stays in the US" — is a claim you may have to prove was true on the date you published it. Most studios have never checked whether the copy still matches the code.

Then make the claim and the configuration the same object. If your privacy page says you delete records after 90 days, the retention job's configured value should be the thing that page renders — not a number someone typed in a CMS two years ago. Assertions that drift from their implementation are the specific failure mode here. Bind them: pull the claim from config, or at minimum put both under the same review.

Keep the evidence, not just the policy. The statements at issue spanned years. Version-control your public claims the way you version code — every change to a privacy or security assertion should have a commit, a date, and a reviewer. When a claim is challenged four years later, "here is the diff and the audit log proving it was accurate" is a defense. "We think it was true" is not.

Third-party integrations are where the exposure actually lives. Part of the jury's finding concerned what Facebook said about investigating outside app developers. If you resell, embed, or pipe customer data to a vendor — an analytics SDK, a CRM, a support tool, an AI API — you own the claims you make about that vendor's behavior. Saying you vet your integrations creates a duty to vet them. Keep the vendor reviews you promised, in writing.

Sources: Santa Fe New Mexican, Fortune.