Social media companies have asked their users to trust its privacy and content policies to protect their personal data. However, a jury in New Mexico has decided that those assurances were not valid.
On September 25, a Santa Fe jury found Facebook liable for 43,899,725 willful violations of the state’s Unfair Practices Act. The jury found that the company made misleading statements about how it handled personal information and about its efforts to combat misinformation and hate speech.
If the statutory limit of $5,000 applies to each violation, the social media giant could face a staggering fine of $219.5 billion. But on October 1, the state’s lawyers requested that Judge Francis Mathew impose civil penalties amounting to between $35 billion and $40 billion. Still, Meta’s lawyers were advocating for a much lower figure.
While the financial implications are enormous, the significance of the ruling could well go far beyond the amount of any possible fine.
More than data breach
The jurors were not asked to determine if there was a data breach. Instead, they have had to decide whether the particular statements and representations made to consumers were unfair or deceptive, and also whether Facebook’s actions were deliberate.
The New Mexico Department of Justice stated that the jury had found Facebook to have given deceptive assurances regarding users’ control over their information, concerning whether Facebook sold or provided personal information to advertisers, and as to whether the company bought or sold users’ data.
The jury also identified willful deceptive statements which included the spread of misinformation, hate speech, a violation of Facebook’s Community Standards, and the company’s promise to investigate third-party applications after the Cambridge Analytica scandal.
This distinction is important because a platform’s statements on its practices may appear to be marketing, corporate messaging, or an explanation of its policy. However, the ruling in New Mexico indicates that, under the state’s consumer-protection law, such statements can also be used as evidence in a jury trial.
43.9 million violations
When the jury found there were 43.9 million violations, it does not follow that there were 43.9 million users. The figure refers to the number of violations allocated in accordance with the jury’s findings regarding specific statements.
The verdict included 26 out of the 29 statements that had been challenged, as reported by several sources. In some cases the number of violations was in the millions, the figures being determined by the format of the jury’s special verdict.
Under New Mexico law a civil penalty of as much as $5,000 can be imposed for each willful violation. Multiplying 43,899,725 violations by $5,000, the mathematical maximum comes to $219,498,625,000.
However, on October 1, the state asked for considerably less than that theoretical maximum, the lawyers from New Mexico asking for an amount between $35 billion and $40 billion and stressing that it would have a deterrent effect while at the same time taking into account the constitutional due-process considerations.
The Cambridge Analytica shadow still hangs over the case
The lawsuit arose as a result of the Cambridge Analytica scandal, when user data from Facebook was acquired via a third-party application without the users’ consent.
The scandal marked a significant point in the public discussion about social-media privacy. Nevertheless, the New Mexico case involved more than the initial data controversy.
As the state describes the verdict, the jurors took into account the statements made over a number of years, including those concerning the collection and sharing of data as well as the company’s commitments regarding moderation and its handling of third-party developers.
This could make the New Mexico case particularly important for social media platforms. These technology companies treat their privacy notices, safety policies, terms of service, and statements by executives and their public transparency reports as a way to keep in touch with users regarding the functions of their systems.
The jury’s ruling could serve as a reminder that more particular the promises are, the easier it will be for regulators or the people who have sued to compare them with the actual behaviour.
In addition to monetary fine, the state also asked for alterations to the company’s disclosures and practices, and the judge has still not decided whether any relief will be granted.
If the final order requires more detailed disclosures, audits, or changes to Facebook’s privacy and moderation policies, it could serve as a compliance blueprint for other regulators.
Meta, however, is challenging the ruling. Meta spokesperson named Alex Burgos said, Meta does not agree with the decision and will keep defending itself against what he called attempts to distort its record.
During the October 1 penalty hearing, the company’s lawyers argued that the penalty requested by the state was too high and asked for a much lower limit.
There remains another aspect of uncertainty, namely that anything Matthew decides upon might be the subject of further legal challenges.
The verdict reached on September 25 determined that liability had been established together with the violation claim. But it neither settled the final financial penalty nor set up a nationwide rule applicable to every technology company.
If the court will either levy billions of dollars in fines or require major changes to Facebook’s disclosures, it could potentially shape future platform disclosure to be less concerned with making users feel safe and more about enabling companies to prove that what they tell users is true.
