Meta’s $25 billion privacy judgment makes the appeal the real case

A New Mexico court has assessed $25 billion in civil penalties against Meta over Facebook statements about privacy, third-party access to data, misinformation, hate speech, and post-Cambridge Analytica investigations. The October 21, 2026 order follows a September jury finding of 43,899,725 willful violations of the state’s Unfair Practices Act.

The jury has already found Meta’s conduct deceptive. The legal question is whether the $25 billion assessment, calculated under a state consumer-protection law with a maximum $5,000 penalty per willful violation, survives constitutional and appellate review. Meta says it will appeal.

The case, filed in 2021, was prompted by the 2018 exposure of Cambridge Analytica’s acquisition of Facebook data. It did not rest solely on that incident. New Mexico litigated Facebook representations that people controlled how their data was shared; that Facebook did not sell or provide personal information to advertisers; that it did not buy or sell user data; and that it adequately handled misinformation, hate speech, and its Community Standards.

The state’s official jury-verdict notice identifies another category: statements about Facebook’s response after Cambridge Analytica. Jurors found willfully deceptive its promised investigation of third-party apps that had obtained substantial user information, including promised forensic audits, developer bans, and notices to affected users. The case therefore went beyond a single quiz app or data-transfer incident.

Recommended reading

Meta’s terms retreat leaves crawler rules unwritten

Sergey Kuznetsov • Oct 17, 2026 • 8 min read

The penalty sits between the parties' positions

The jury’s violation count created a statutory ceiling of roughly $219.5 billion at $5,000 per violation. District Judge Francis J. Mathew set the judgment at $25 billion. New Mexico had sought $35 billion to $40 billion, while Meta argued for a far smaller amount; accounts describe Meta’s proposed ceiling as either $3.4 billion or $3.45 billion.

The result is neither the statutory maximum nor a conventional per-user privacy settlement. It is a court-imposed consumer-protection penalty tied to each violation the jury found. The order also imposes 15% annual interest until the penalty is paid in full, making the timing of any final payment significant.

Judge Mathew’s rationale focused on scale and intent, not only the Cambridge Analytica breach.

“The extraordinary number of willful violations found by the jury, the duration and repetition of the conduct, the breadth of subjects on which violations occurred, the involvement of senior Facebook leadership, the size of New Mexico audiences reached, and the clear intentional and systematic nature of Facebook’s repeated misstatements established in the trial record support the highest level of penalty allowed by the New Mexico Unfair Practices Act — $5,000 per violation found by the jury.”

The decision found that Facebook did not carry out the comprehensive post-scandal investigation it had promised. It attributed the failure to pressure from senior executives to control costs, inadequate enforcement resources and investigative methods, and an unwillingness to create precedent for future investigations. The judge called the inquiry “willfully ineffective.”

That finding supports treating later public statements as separate violations. The state argued, and the jury accepted, that Facebook repeatedly made assurances about controls and enforcement after internal employees, researchers, and senior personnel had identified limits on what the company could deliver.

What the jury found deceptive

The official verdict notice separates the finding into promises often grouped under “privacy.” Facebook was found liable for representations about collection, protection, sharing, and use of personal information. The jury also found willfully deceptive statements that Facebook did not profit from misinformation or hate, removed harmful misinformation, had no incentive to retain hateful content, and did not allow hate speech.

It also found deception in claims that Community Standards were applied consistently, including statements that particular groups had no special protection and that politicians or newsworthy accounts received no exceptions. The finding reaches policy-enforcement claims as well as data-access claims.

The case concerns the gap between a published policy and the systems that enforce it. A privacy control, moderation standard, or investigation commitment becomes a consumer-protection issue when a company presents it to users as a working safeguard. New Mexico turned alleged differences between those assurances and internal practices into a state-law violation count in the tens of millions.

Cambridge Analytica, a political consulting firm that worked for Donald Trump’s 2016 presidential campaign, obtained data from as many as 87 million Facebook profiles through a third-party personality quiz, according to accounts of the scandal cited in the reporting. New Mexico’s trial record also covered how Facebook explained third-party access and described its corrective actions years afterward.

No payment to Facebook users

The order does not create a compensation program for Facebook users. Under New Mexico law, proceeds from consumer-protection penalties go to the state’s school system. Attorney General Raúl Torrez has said the award could finance school construction for a century, though that depends on the penalty becoming final and collectible.

“This case has always been about more than one company or one scandal. It is about whether corporations can mislead consumers about what happens to their personal information without facing meaningful consequences.”

The state is also seeking injunctive relief to stop similar conduct, but the materials supplied do not establish a final injunction or identify specific new product, privacy, or content-policy requirements from this case. The $25 billion order is a penalty ruling, not evidence that Facebook’s current settings have changed because of the judgment.

Meta’s response describes the case as an attempt to regulate speech rather than enforce consumer-protection representations.

“This ruling, and the Attorney General’s approach to this enforcement, makes it all but impossible to do business in the state of New Mexico. At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online. We are confident we will prevail on appeal.”

Meta argued at an October 1 hearing that New Mexico did not prove consumers suffered actual harm from the statements at issue. It also challenged the violation count, arguing that potential exposure to a misleading statement should not automatically count as an individual violation. Its lawyers argued that a substantially larger penalty would violate constitutional protections.

The company can challenge both the count methodology and whether a $25 billion sanction is proportionate to the conduct and the state interest. The sources do not provide a briefing schedule, an appellate court, or a payment deadline beyond the order’s 15% interest provision.

A separate track from Meta’s teen-safety cases

This privacy case is separate from the nationwide child-safety and youth mental-health litigation that Meta settled with most states in August 2026. New Mexico did not join that settlement, allowing its Cambridge Analytica-related consumer-protection case to proceed to trial. Reporting says Florida also did not sign the deal because of Cambridge Analytica-related liability.

Our August 7 coverage recorded a $567 million New Mexico order in a different case involving alleged harm to children and tighter teen privacy settings. That is distinct from the $25 billion privacy judgment, though both came from New Mexico proceedings against Meta and rely on state consumer-protection theories.

Reporting on the earlier child-safety case is inconsistent. CNBC described a $375 million jury ruling followed by a $567 million order into an abatement fund. Tom’s Guide put the separate August judgment at $942 million, while The Verge described it as nearly $1 billion in civil penalties and abatement. The supplied materials do not explain whether the higher figures include a different remedy component. The cases are separate, but the exact total cited for the earlier proceeding is not consistently reported.

The nationwide settlement figure also varies slightly across reports: several accounts describe a deal of nearly or roughly $17 billion, while our August 26 coverage stated Meta would pay up to $18 billion and adopt default time limits, night blocks, and parental controls for teen Facebook and Instagram accounts. Neither number changes the legal separation: New Mexico’s latest judgment arises from privacy and public-representation claims, not from the multistate teen-safety settlement.

The enforcement math is the point

The $25 billion headline can obscure how this enforcement model works. A $5,000 statutory maximum applied to 43,899,725 violations yields a theoretical total around $219.5 billion, and the court imposed a fraction of that ceiling. A fraction of a count that large still produces an assessment far above Meta’s proposed maximum.

The state’s theory makes broad consumer-facing statements costly when a jury finds they were willful and deceptive. It lets a state court treat repetition and audience reach as penalty multipliers without proving a discrete out-of-pocket loss for every affected consumer. Meta disputes that exposure to an allegedly deceptive statement should equal one violation.

The appeal will determine whether the violation count and penalty framework stand. If they do, the ruling gives state enforcers a model for treating platform-scale public assurances as platform-scale statutory liability. If an appellate court limits how exposure can be counted or finds the award constitutionally excessive, the judgment will be reduced substantially or overturned.

The record supplied establishes an assessment, 15% annual interest, and Meta’s stated intent to appeal. It does not establish that Meta has paid any portion of the $25 billion, that an appeals court has accepted or rejected its arguments, or that New Mexico has secured the behavioral injunction it sought.