Meta’s $25 Billion Privacy Reckoning: What New Mexico’s Verdict Means
A state court has delivered Meta’s costliest verdict to date. A New Mexico judge ordered the tech giant to pay $25 billion after a jury found the company deceived users about how it protected their personal data on Facebook. The penalty dwarfs the Federal Trade Commission’s $5 billion fine against the company in 2019 and stands as the largest judgment of its kind against a Silicon Valley giant.
The ruling didn’t emerge from nowhere. It traces back to one of the most consequential data scandals of the past decade, and it signals that courts are increasingly willing to hold corporations accountable when they break their promises to the public.
The Cambridge Analytica Scandal Revisited
“The award will serve as a warning to tech companies that New Mexico will hold them accountable, state Attorney General Raúl Torrez said at a news conference.”
The case centers on events from 2016, when a seemingly harmless personality quiz on Facebook harvested personal data from roughly 87 million user profiles. That data didn’t stay private. It was sold to Cambridge Analytica, a now-defunct political consulting firm whose clients included Donald Trump’s 2016 presidential campaign. The firm used the harvested information to build targeted political advertising, exploiting personal data users never intended to share beyond the platform.
The fallout was immediate and far-reaching. Regulators around the world launched investigations, lawmakers demanded answers, and public trust in Facebook’s privacy practices eroded. New Mexico’s lawsuit, filed in 2021, sought to hold the company accountable for the deception that made the scandal possible.
A Jury’s Verdict, A Judge’s Reckoning
In September, a New Mexico jury found Meta liable for more than 43 million violations of the state’s consumer protection laws. Jurors determined that Facebook made misleading public statements about how it handled user data and about its investigations into third-party developers who harvested that data.
District Court Judge Francis J. Mathew didn’t mince words in his ruling. He found that Facebook’s deception was intentional, and that company executives consistently misled users about how the platform actually worked.
“Facebook promised users that they controlled their data,” Judge Mathew wrote. “This was false.”
Inside the $25 Billion Penalty
The $25 billion award far exceeds any previous fine levied against Meta, and it represents the court’s attempt to hold the company accountable in proportion to the scale of its deception. Under the New Mexico Constitution, all money collected from penalties for consumer protection violations must go toward the state’s education system.
The number could have been far larger. State attorneys had argued for penalties as high as $35 billion to $40 billion, while Meta’s legal team contended $3.4 billion was the maximum defensible figure. If the court had applied the full statutory penalty to every violation the jury found, Meta’s liability could have approached $200 billion. The judge determined the final penalty amount during an October hearing, weighing the severity of the violations against the company’s arguments.
Meta Pushes Back
Meta has not quietly accepted the ruling. The company maintains that it has overhauled its data practices since the lawsuit was filed in 2021 and insists the judgment makes it “all but impossible to do business in the state of New Mexico.” Meta’s defense scored one partial victory: jurors rejected the state’s claim that Facebook misrepresented its removal of harmful COVID-19 misinformation. Even so, that single concession did little to offset the scale of the jury’s findings on the core privacy deception claims. Meta has indicated it intends to appeal.
A Signal to Every Boardroom in the Country
New Mexico’s verdict against Meta is more than a single state’s legal victory. It is a warning shot to any corporation that treats consumer data protection as a public relations exercise rather than a binding obligation. Other states weighing similar action now have a roadmap, and a precedent, for pursuing accountability when companies deceive the public about how personal information is collected, shared, and safeguarded.
For everyday consumers, the case is a reminder that privacy promises carry legal weight, and that intentional deception, even by the most powerful companies in the world, can carry a steep price. When corporations place profit above the truth they owe their users, the consequences can follow them into a courtroom.
This post includes information reported by Mikella Schuettler