Meta owes New Mexico $25 billion. State District Judge Francis J. Mathew set the civil penalty on Wednesday, Oct. 21, after a Santa Fe jury found that Facebook had misled the public for more than a decade about how much control users had over their data and how it policed its platform. Under state law the bill could have reached $219.5 billion, and the judge wrote in his judgment, posted by the state attorney general, that Facebook's conduct justified that maximum. He then cut it to $25 billion without spelling out how he got there.
Meta says it will appeal. Until it pays, the penalty grows at 15% a year in interest. None of the money goes to Facebook users. It goes to the state, which says it will spend it on education.
How Cambridge Analytica got the data
It started with a personality quiz. Aleksandr Kogan, then a psychology professor at the University of Cambridge, built a Facebook app called thisisyourdigitallife. About 270,000 people installed it. Facebook's rules at the time let an app read some data about the friends of anyone who installed it, unless those friends' privacy settings blocked it. The friends never saw the app or agreed to anything.
That is how a few hundred thousand quiz takers exposed tens of millions of people. Facebook estimated in 2018 that data on up to 87 million users, most of them in the US, may have been improperly shared with Cambridge Analytica, the British political consultancy that worked on Donald Trump's 2016 campaign and used the profiles to target election ads.
By Facebook's own account, the company learned in 2015 that Kogan had passed the data on, pulled the app, and accepted written assurances that the data had been deleted. Reports in March 2018 showed it had not been, and the scandal broke.
Why a single state could bring this case
The US has no general federal privacy law, so New Mexico did not sue under one. Attorney General Raúl Torrez filed in 2021 under the state's Unfair Practices Act, a consumer protection statute that bars companies from deceiving customers. The jury did not have to find that any resident lost money or even read the statements, only that Facebook knowingly told the public false things about its service.
The jury found 26 public statements made between May 24, 2010, and Aug. 18, 2021, to be deceptive and willful, including some by Mark Zuckerberg and by Sheryl Sandberg, then the company's chief operating officer. The judgment sums up the first category bluntly: Facebook told users they controlled their data, and "this was false."
The court's findings list other examples. In 2014, Facebook announced that apps would lose access to friends' data, while it had spent more than a year planning undisclosed exemptions for business partners. After Cambridge Analytica, it promised to notify everyone whose data an app had misused. Its internal investigation turned up more than 2,000 apps that should have triggered those notices, and Facebook notified users about two of them.
Where $219.5 billion came from, and why it became $25 billion
New Mexico law allows up to $5,000 per violation. The jury treated each misleading statement as one violation for every person in its expected audience. Depending on the statement, that was either 1,386,648 people, the number of monthly active Facebook users in the state in June 2020, or 2,100,000, the state's entire population. Across 26 statements that added up to 43,899,720 violations, plus five more for unconscionable trade practices. Multiply by $5,000 and you get the $219.5 billion ceiling.
The judge listed the aggravating factors that would support that ceiling: the length of the conduct, the repetition, the involvement of senior leadership and what Facebook knew internally while saying otherwise in public. His order then simply reduced the award to $25 billion. That works out to about $570 per violation, or roughly $11,900 for every New Mexico resident. The state had asked for $35 billion to $40 billion, and Meta had argued for no more than $3.45 billion, Reuters reported. For Meta, the penalty equals about one-eighth of the $200.97 billion in revenue it reported for 2025, a figure the judgment itself cites.
Meta's response and what is still open
Meta's chief legal officer, C.J. Mahoney, said the lawsuit amounts to a tax on speech and that the ruling makes it all but impossible to do business in New Mexico. "We are confident we will prevail on appeal," he said, according to the Associated Press. At trial, Meta's lawyers argued that the state never showed any New Mexican saw the statements or was harmed by them. An appeals court could reduce the violation count, and the penalty with it.
New Mexico and Florida were the only states that stayed out of the $18 billion settlement Meta reached with the others in August, a deal that released the company from future claims tied to the data breach. New Mexico went to trial alone. The judge has not yet ruled on the state's request for court-ordered changes to how Meta operates there.
Users elsewhere get nothing from this order, and no new rights. Facebook's newer controls, like Your algorithm, which lets people describe what they want in Feed and Reels, are product decisions rather than anything this court required. In Europe, large penalties against tech platforms come from regulators enforcing EU-wide rules, as in the European Commission's Digital Markets Act fine against Google, not from one state acting on its own.
The conversation starts here
Sign in with a supporter account to comment. Sign in
Nobody has commented yet. Want to go first?