Meta faces $25 billion fine in New Mexico for 43 million data privacy violations
A state court reduced a potential $219 billion fine for Cambridge Analytica-era data misrepresentations to $25 billion, citing willful violations.
Key points
- A New Mexico jury found Meta liable for 43 million violations of state unfair practices laws regarding user data privacy.
- District Court Judge Francis Mathew reduced the maximum statutory penalty from $219 billion to $25 billion, adding 15 percent annual interest.
- The ruling targets misleading statements about data controls and content moderation, separate from recent nationwide child safety settlements.
A New Mexico judge ordered Meta to pay $25 billion in penalties for privacy violations related to the Cambridge Analytica scandal, according to a court filing released Wednesday. District Court Judge Francis Mathew reduced the penalty from an initial $219 billion award, which was based on a jury finding of 43 million violations of state law.
The jury determined that Meta broke New Mexico’s Unfair Practices Act by misleading users about data practices, with each violation carrying a potential civil penalty of up to $5,000. The state had initially sought between $35 billion and $40 billion, while Meta requested a cap of $3.45 billion. Judge Mathew’s final ruling landed at $25 billion, a figure that will accrue 15 percent annual interest until the fine is paid in full.
Court findings on misleading conduct
The litigation focused on statements Facebook made to consumers about data privacy, misinformation, and hate speech after the 2018 whistleblower revelations, according to Attorney General Raúl Torrez’s office. Judge Mathew wrote that the scale, duration, and willfulness of the violations constituted substantial aggravating circumstances. The court noted that senior leadership, including CEO Mark Zuckerberg and then-COO Sheryl Sandberg, oversaw a calculated strategy to mislead the public.
The filing highlighted that executives created internal materials, referred to as a “song sheet,” to coordinate public relations responses despite knowing the company could not fulfill its public promises. Facebook continued to make representations about user control and enforcement protocols that were not verifiable by users, according to the court document. The judge described the company’s promised post-scandal investigation as “willfully ineffective” and noted the systematic nature of the misstatements.
Impact and legal context
This case is distinct from a recent settlement Meta reached with nearly every other US state over child safety concerns, which included nearly $459 million for Cambridge Analytica-related claims. New Mexico opted out of that broader agreement, allowing this specific trial to proceed. The $25 billion penalty will be directed to New Mexico’s school system, according to Engadget.
Meta has announced plans to appeal the decision. Chief Legal Officer C.J. Mahoney characterized the penalty as a “tax on speech,” according to Engadget. The underlying data breach involved the sharing of as many as 87 million users’ data with Cambridge Analytica, a British political consulting firm that used the information for targeted advertising in the 2016 presidential election.
What should you do?
Security professionals should monitor Meta’s public disclosures for updates on this legal proceeding and any potential changes to data handling policies. Organizations using Meta platforms for advertising or data collection should review their compliance with state-specific privacy laws, particularly regarding third-party data usage.
What to do and how to stay safe: Meta
- Review internal policies on third-party data usage to ensure compliance with state unfair practices laws.
- Monitor official Meta communications for updates on the appeal and any resulting changes to data privacy settings.
- Audit current advertising strategies to verify that claims about user data control are accurate and verifiable.
- Consult legal counsel regarding the implications of this ruling on existing contracts involving user data from New Mexico residents.
Step-by-step guide: How to Remove Data from Data Brokers: The Manual Cleanup Process
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why was the penalty reduced from $219 billion?
Judge Francis Mathew reduced the maximum statutory award to $25 billion, though the jury found 43 million violations at up to $5,000 each.
Is this fine related to the recent child safety settlement?
No, this case is separate; New Mexico skipped the nationwide child safety settlement to pursue this specific trial regarding misleading privacy statements.
Where will the $25 billion penalty go?
The funds will be directed to New Mexico’s school system, with 15 percent annual interest accruing until the penalty is paid.
