A New Mexico jury finds Facebook deceived users about protecting their data: over 43 million violations. Keep your privacy promises.

A New Mexico jury found Facebook liable for deceiving users about privacy protections, the Associated Press reports, finding over 43 million violations of the state's consumer protection law. The two-week trial in Santa Fe centered on the Cambridge Analytica affair, in which a third-party personality quiz harvested data from roughly 87 million profiles and sold it to the political consulting firm. Jurors found Facebook made deceptive statements about protecting users' data that affected New Mexico's entire population of more than two million people, and misled the public about investigations into third-party app developers that harvest user data. A judge will set penalties at an Oct. 1 hearing. The state is asking for the maximum $5,000 per violation, which could mean over $200 billion, and is also seeking an injunction. "We disagree with the verdict and will continue to defend ourselves against efforts to distort our record," Meta spokesperson Alex Burgos said. Notably, jurors found the state didn't prove Facebook made false claims about removing harmful content. Villanova law professor Peter Ormerod doubts any penalty will change much: "It's unlikely that this is going to be the case that effectively penalizes the company in a meaningful way." My view: the jury drew the right line. Punishing a platform over what it lets people say is dangerous ground for any government, of either party. Holding a company to what it promised about your data is simply enforcing a deal. The fair caution is that a penalty in the hundreds of billions would be out of all proportion. But the principle stands: if you tell people their information is protected, it had better be. One more question for New Mexico, which also won an order this year requiring Meta to add age-verification technology: who holds that verification data, and for how long?