In May 2010 Facebook's founder wrote one sentence in a newspaper column: "We do not and never will sell any of your information to anyone." Sixteen years later, at the end of a trial over the Cambridge Analytica scandal, a New Mexico jury decided that this sentence had broken the state's consumer law about 2.1 million times.
The jury found 26 statements misleading and counted 43,899,720 violations. The law allows up to $5,000 for each, a ceiling of about $219 billion. How does one sentence become two million breaches of the law?
How does one sentence become two million violations?
The jury did arithmetic, on a formula the state's trial lawyer proposed: take one statement and count everyone who could have read it. A statement in major newspapers counts about 2.1 million times, roughly the state's population; a statement on Facebook's own pages counts about 1.4 million times, the New Mexicans with a Facebook account in 2020. Twenty-six statements give the jury's total.
Illinois protects fingerprints and face scans, also at up to $5,000 per violation. In 2023 its supreme court had to decide what one violation is for White Castle, whose workers clocked in with a finger scan: one per worker, or one per scan? Four to three, every scan counts. White Castle estimated it could owe more than $17 billion; the majority wrote that the legislature should fix it if it was a problem.
The judge sets the price of each violation, up to $5,000. The state asked for $35–40 billion; Meta offered $345 million to $3.45 billion. More than a hundred times apart, yet both stand on the jury's count of 43.9 million: about $800–910 per violation against about $8–79. The two sides fight over the price; neither offer touches the count.
New Mexico's Unfair Practices Act sets a civil penalty of "not more than $5,000 per violation" (NMSA § 57-12-11) and never says what a single violation is. Count each misleading statement once and the verdict is 26 violations, $130,000 at the top price. Count one per possible reader and it is $219 billion. The price moves the fine up to 5,000 times (Meta argues the floor is $1); the choice of unit moved it more than a million times, and nobody wrote that choice down before the trial.
Write the unit into the law. In August 2024 Illinois amended its biometric law (SB 2979): the same kind of violation against the same person counts once, however many scans. By one law firm's estimate, $17 billion would have become $10–50 million. Price: the unit was chosen after the bill was visible, and it made the bill smaller for the companies being sued.
Tie the fine to the company. The EU's GDPR caps fines at 4% of worldwide annual turnover; in 2023 Ireland's regulator fined Meta €1.2 billion. The maximum is known in advance. Price: the fine follows size, not harm, and somebody still picks the point between 0 and 4%.
Tie the fine to the harm. Take back the damage done or the money the misleading claims earned. Price: when a service is free and harm is spread thin across millions, proving damage person by person is close to impossible. Meta's own defence: 26 statements over more than a decade, "no evidence that any statement harmed any New Mexicans".
Today New Mexico counts persons instead of proving harm and leaves a judge or an appeals court to cut the total. Price: the size depends on which state sues and which judge hears it.
That sentence from 2010 was one violation, or 2.1 million, and the law never said which. The price on the label is not the number to watch.
What counts as one violation, and did anyone write that down before the counting began?