A New Mexico jury on Friday found Facebook liable for deceiving users about the platform's privacy protections, handing the social media giant another in a string of legal setbacks that have already cost it billions of dollars.

Jurors identified more than 43 million violations of the state's consumer protection law. The amount Facebook must now pay rests with the judge, with attorneys for the state seeking the maximum civil penalty of $5,000 per violation — a figure that could exceed $200 billion in total. Because the statute allows penalties to stack on a per-violation basis, the verdict's ultimate significance will hinge on how many of those counts the judge chooses to penalize, and at what amount.

“The verdict marks a significant victory for New Mexico consumers and holds one of the world's largest technology companies accountable for its conduct,” the New Mexico Department of Justice said in a statement.

The two-week trial in Santa Fe centered on allegations that Facebook, which is owned by Meta, misled users about a data breach originating from a third-party personality quiz. That quiz harvested information from roughly 87 million profiles, which was then sold to Cambridge Analytica, a political consulting firm that used the data to generate targeted ads. Among the now-defunct firm's clients was Donald Trump's 2016 presidential campaign.

Jurors sided with state prosecutors, finding that Facebook's deceptive statements about protecting user data affected New Mexico's entire population of more than two million people. The panel also concluded that the company misled the public about its investigations into third-party app developers that harvest user data following the Cambridge Analytica scandal.

“We disagree with the verdict and will continue to defend ourselves against efforts to distort our record,” Alex Burgos, a spokesperson for, said in an email.

During closing arguments, Facebook's lawyers contended that the state's evidence was outdated, arguing that despite having five years to gather material, New Mexico had identified only one other instance of a data breach.

Jurors handed the defense one of its few wins, finding that the state failed to prove Facebook made false claims about removing harmful content, including misinformation about the COVID-19 pandemic. The state had alleged the company favored certain accounts and allowed violent or inaccurate material to proliferate. During closing arguments, Randi McGinn, an attorney representing the state, argued that Facebook profited from harmful content.

Facebook denied those claims, arguing that it has adapted its policies since New Mexico filed its lawsuit in 2021 and that it removes 99% of content that violates its standards. In a deposition played for jurors, CEO Mark Zuckerberg said the company had robust systems to determine whether content should be taken down.

“Meta's platforms are forums for free expression. We have a First Amendment right to manage those platforms in a way we believe best serves the interests of our community. This means prioritizing free speech, protecting our users' information and giving them control over their data,” Burgos said in a statement after the verdict.

Despite the millions of violations found by jurors, the ultimate financial impact on the company remains uncertain given how profitable Meta is.

“It's unlikely that this is going to be the case that effectively penalizes the company in a meaningful way,” said Peter Ormerod, an associate professor of law at Villanova University. Ormerod noted that the social media company operates with very high margins and has previously skirted regulatory actions on its platforms.

If the state persuades the judge to impose the maximum civil penalties for every violation, Meta could owe more than $200 billion, with interest accruing if the company decides to appeal. The judge will have to weigh complex arguments from both sides about what penalties are fair.

Ormerod commended the state's “dogged prosecution” of the social media giant but questioned whether the final judgment would be significant enough to change Meta's ways. “There's been a lot of criticism that none of these amounts of money are enough to discipline the company,” he said.

The judge is scheduled to decide on penalties during a hearing on Oct. 1. That hearing is now the key date to watch, as it will determine whether penalties approach the potential $200 billion ceiling or are scaled back. Attorney General Raúl Torrez told reporters after the verdict that all money awarded will go into a fund for the state's education system. The state is also seeking an injunction to stop similar practices in the future.

Friday's verdict follows several other recent legal outcomes against Meta. Also this year, New Mexico won judgments totaling $942 million from the company in a two-phase trial over its safety protections for minors. The court ordered Meta to implement new safeguards, including age-verification technology and time limits on its platforms. Taken together, the outcomes show privacy and child-safety claims becoming a recurring, multibillion-dollar legal exposure for the company across multiple states.

In August, Meta agreed to pay up to $18 billion to settle a multistate lawsuit involving child safety issues. Buried in the 130-page settlement was an agreement releasing Meta from future liability related to the Cambridge Analytica privacy breach, making New Mexico the only state to decide to pursue a case on its own — and positioning Friday's verdict as the only one to emerge from the privacy scandal. Florida was the only other state that did not sign the settlement, saying it was not tough enough on Meta — a decision that left the door open for future litigation.

This story was originally featured on Fortune.com.