New Mexico’s Unfair Practices Act and Privacy Claims After the Meta Verdict

New Mexico’s Unfair Practices Act has a private right of action, and a recent high-profile case shows that public statements about data practices can become the basis for massive exposure under that statute. The combination does not mean New Mexico has become the next California for website-tracking demand letters, but it does mean companies that operate there should treat privacy representations with more care than they might have a few years ago.

The Unfair Practices Act (NMSA 1978 §§ 57-12-1 et seq.) prohibits unfair or deceptive trade practices and unconscionable trade practices in the conduct of trade or commerce. Section 57-12-10(B) gives a private right of action to any person who suffers any loss of money or property as a result of a method, act, or practice declared unlawful by the Act. A successful plaintiff can recover actual damages or $100, whichever is greater. If the trier of fact finds the defendant willfully engaged in the practice, the court may award up to three times actual damages or $300, whichever is greater. A prevailing plaintiff is entitled to attorney fees and costs. The remedy is cumulative with other available claims.

Those provisions have been on the books for decades and have been used in ordinary consumer cases. What has changed is the willingness of the New Mexico Attorney General to treat misleading statements about personal-data practices as actionable under the same statute, and to do so at a scale that produces large civil penalties. In September 2026 a Santa Fe jury found that Meta (Facebook) committed approximately 43.9 million violations of the Unfair Practices Act based on false or misleading statements to New Mexico consumers about how the company collected, protected, shared, and used personal information, as well as statements related to misinformation and hate speech. In October 2026 the court ordered a $25 billion civil penalty. The case was brought by the state, not private plaintiffs, and the penalty is payable to the state. It is nevertheless relevant to private litigation because it demonstrates that privacy-related representations can satisfy the elements of an Unfair Practices Act claim when they are false or misleading and made in connection with the sale of goods or services.

What the statute actually requires

An Unfair Practices Act claim is not a pure interception or pen-register theory. To succeed, a plaintiff generally must show that the defendant made a false or misleading statement (or engaged in an unconscionable practice) knowingly in connection with the sale, lease, rental, or loan of goods or services in the regular course of business, and that the plaintiff suffered a loss of money or property as a result. Courts have required a consumer-type injury and a connection to a transaction. Routine website analytics or advertising pixels do not automatically create liability under the Act simply because they transmit data. A plaintiff would still need to tie the practice to a deceptive representation and to some cognizable loss.

That is a meaningful difference from California’s Invasion of Privacy Act, which has supported a large volume of demand letters and lawsuits focused on the technical fact of data transmission before consent. New Mexico has not seen a comparable private-plaintiff wave of pixel, cookie, or session-replay cases under the Unfair Practices Act. Most of the privacy-related activity in the state has come through Attorney General enforcement rather than private class actions. Proposed bills that would create broader private rights of action for data practices have been introduced but have not become law.

Where the practical risk sits

The more immediate exposure for most businesses is not a sudden flood of tracking-pixel demand letters. It is the gap between what a company says about its data practices and what it actually does. The Meta case turned on public statements—about user control, sharing with advertisers, investigations of third-party apps, and content moderation—that the jury found false or misleading. Companies that publish privacy policies, marketing claims, consent banners, or product descriptions that overstate control, understate sharing, or make absolute promises (“we never sell your data,” “you are in full control”) create the factual predicate for an Unfair Practices Act claim if those statements are not accurate.

Willfulness is not required for liability, but it increases the available damages and is relevant to the amount of any civil penalty in an Attorney General action. Documenting the basis for privacy claims, aligning those claims with actual technical practices, and avoiding language that cannot be substantiated are straightforward steps that reduce exposure under the existing statute. Because attorney fees are available to a prevailing plaintiff, even modest individual claims can become expensive to defend if the representation is clear and the facts are unfavorable.

Bottom line for businesses

New Mexico’s Unfair Practices Act is not currently a high-volume vehicle for private website-tracking litigation. It is, however, a live consumer-protection statute with a private right of action, statutory damages, treble damages for willful violations, and attorney fees. The recent Meta verdict shows that deceptive statements about data practices can be prosecuted under the Act at large scale when the state chooses to pursue them. Companies that do business in New Mexico should review the accuracy of their public-facing privacy representations, ensure those representations match operational reality, and treat the Unfair Practices Act as a risk that exists today rather than a theoretical future development. That is a narrower and more accurate warning than predicting an imminent wave of pixel lawsuits, but it is the one the statute and the recent enforcement record actually support.