The two-week trial in New Mexico centered on accusations Facebook deceived users about a data breach.
A New Mexico jury on Friday found Facebook liable for deceiving users about privacy protections on the social media platform.
It is now up to the judge to determine how much the company would pay, with attorneys representing the state asking for the maximum $5,000 penalty per violation.
The two-week trial in Santa Fe centered on accusations that Facebook deceived users about a data breach stemming from a third-party personality quiz that harvested data from roughly 87 million profiles and sold it to a political consulting firm, Cambridge Analytica, to generate targeted ads. The now-defunct firm's clients included the 2016 campaign for President Trump.
Jurors sided with prosecutors, finding Facebook's failure to protect users' data impacted New Mexico's entire population of more than 2 million people.
"For years, Facebook operated as if the rules that apply to everyone else didn't apply to them. Today, a jury of New Mexicans said otherwise," New Mexico Attorney General Raúl Torrez said in a statement. "This is a historic verdict, not just for New Mexico, but for every state fighting to hold Big Tech accountable."
Jurors also found Facebook misled the public about investigations into data brokers following the Cambridge Analytica scandal, finding the company liable for over 2 million violations.
During closing arguments, lawyers for Facebook claimed the state's evidence was outdated and that despite having five years to gather material, New Mexico failed to find more than one other instance of a data breach.
A Meta spokesperson told CBS News the company disagreed with the jury's verdict and will continue to defend "against efforts to distort our records." The company also noted that free speech issues "featured very prominently" in the case.
"We have a First Amendment right to manage those platforms in a way we believe best serves the interests of our community," the spokesperson said. "This means prioritizing free speech, protecting our users' information and giving them control over their data."
Meta agreed in August to pay up to $18 billion to settle the multistate lawsuit surrounding child safety issues. Buried in the 130-page settlement was an agreement to release Meta from future liability related to the Cambridge Analytica privacy breach, making New Mexico the only state to pursue a case. Florida was the only other state that did not sign the settlement, saying it was not tough enough on Meta.
Also this year, New Mexico won judgments totaling $942 million from Meta in a two-phase trial about the company's safety protections for minors. Furthermore, the court ordered Meta to implement new safeguards, including age-verification technology and time limits on its platforms.
"Let this be a warning to every technology company doing business in our state," Torrez said Friday. "If you lie to New Mexicans about how you use their data, we will find out, and we will hold you accountable."