New Mexico Judge Caps Massive Data Deception Penalty Against Meta at $25 Billion
The ruling follows a jury finding that 26 of 29 statements about Facebook's data practices were misleading, with Meta saying it will challenge the decision.
In a decision that ranks among the largest single-state civil penalties ever imposed on a technology company, a Santa Fe court has ordered Meta Platforms to pay $25 billion for what a jury determined were systematic misleading statements about Facebook user privacy. Judge Francis Mathew issued the ruling on October 21, 2026, after reducing a statutory maximum that exceeded $219 billion. The case, brought by New Mexico officials in 2021, centers on the fallout from the Cambridge Analytica scandal and the company's public claims about data practices in the years that followed.
The underlying events date to the mid-2010s. A third-party personality quiz application on Facebook harvested personal information not only from people who installed it but also from their friends. Political consulting firm Cambridge Analytica later obtained portions of that data—estimates reached as high as 87 million accounts—and used the material to build voter profiles for clients that included the 2016 Trump campaign. When the scope of the collection became public in 2018, Facebook faced intense scrutiny over whether users had truly controlled their information and whether the company had adequately restricted third-party access.
New Mexico chose not to join multistate settlements that resolved similar claims elsewhere. Instead, its attorneys argued that the company had made a series of false or deceptive statements to residents about privacy settings, the ability of outside developers to access data, the handling of hate speech and misinformation, and the thoroughness of its internal investigations after the scandal broke. A jury that heard roughly two weeks of testimony in September 2026 agreed on most of those points. It found that 26 of 29 statements examined were misleading and calculated more than 43 million separate violations of the state's Unfair Practices Act. The count reflected both the number of statements and the estimated size of the New Mexico audience that saw them.
State law sets a maximum civil penalty of $5,000 per violation. Applied to the jury's total, that produced a figure above $219 billion. Judge Mathew wrote that the evidence supported the highest authorized amount given the duration of the conduct, the involvement of senior executives, and the central role data collection plays in the company's business model. At the same time, he exercised discretion to reduce the penalty to $25 billion. New Mexico's lawyers had requested $35 billion to $40 billion, arguing that only a sum large enough to affect the company's valuation would drive meaningful change. Meta's counsel contended that anything substantially above a few billion dollars would violate due-process limits and invited reversal on appeal.
The judgment also imposes 15 percent annual interest until the sum is paid and reserves a later decision on any request for an injunction that would restrict future practices. Under New Mexico rules, the proceeds are directed to the state's public education system. Attorney General Raúl Torrez has described the outcome as proof that even the largest technology firms remain subject to state consumer-protection laws when they mislead residents. Meta, through Chief Legal Officer C.J. Mahoney, has said the company will appeal and has characterized the attorney general's approach as making continued operations in the state effectively untenable.
The ruling arrives against a backdrop of earlier federal action. In 2019 the Federal Trade Commission imposed a $5 billion penalty on Facebook related to the same Cambridge Analytica events. More recently, Meta reached settlements with other states over claims involving teen mental health and platform design. New Mexico's decision to litigate independently produced a result that dwarfs those earlier figures, at least on paper. Whether the $25 billion figure survives appellate review remains uncertain. Appeals are expected to focus on the size of the penalty, the method used to count violations, and the constitutional limits on state enforcement actions against national platforms.
For users, the case underscores long-standing questions about how much control individuals actually exercise over personal data once it enters large social-media systems. For regulators and other states, it illustrates both the potential scale of consumer-protection remedies and the practical obstacles created by appeals and corporate resistance. Meta has not indicated any immediate change to its products or privacy tools in response to the judgment. The final financial and operational consequences will depend on the outcome of the appeal and any subsequent enforcement steps the state may pursue.