Meta vows appeal of unconstitutional $25B NM fine for 44M privacy breaches

A New Mexico judge ordered Meta to pay $25 billion in civil penalties on Wednesday after a jury found the company liable for deceiving users about Facebook’s privacy practices. The ruling stems from a September verdict that identified 43,899,725 violations of the state’s Unfair Practices Act, marking one of the largest financial penalties against a corporation in U.S. history.

State District Court Judge Francis J. Mathew applied the maximum statutory penalty of $5,000 per violation, which would have totaled $219 billion, before reducing the award to $25 billion. The state had sought between $35 billion and $40 billion, while Meta’s legal team argued for no more than $3.4 billion. According to Bloomberg, the penalty addresses misleading statements about data handling and hate speech moderation.

Context and Background

The litigation originated from the Cambridge Analytica scandal, in which a political consulting firm accessed data from up to 87 million Facebook users. As Threat Times reported on 2026-10-21, the court reduced a potential $219 billion fine to $25 billion, citing willful violations. The case expanded beyond that incident to challenge Meta’s representations to consumers about third-party data access and its efforts to address misinformation.

Judge Mathew wrote that Facebook’s wrongdoing was systematic and went to the heart of its core business practices. He stated that the company promised users they controlled their data, which was false. The jury’s findings established liability for these deceptive practices over years of operation.

Who is affected

New Mexico Attorney General Raúl Torrez, who filed the case in 2021, said the money will go to a state education fund. The sum exceeds New Mexico’s expected $14.8 billion in general-fund revenue for fiscal 2028. It also surpasses the roughly $18 billion Meta agreed to pay most U.S. states in August over harm to young users.

Meta’s chief legal officer, C.J. Mahoney, said the ruling makes it nearly impossible to do business in the state. The company plans to appeal, calling the penalty a constitutional violation. Meta argued that the jury never found that anyone in New Mexico was harmed by the statements.

What should you do?

Organizations should monitor the appeal process for changes in liability standards. The outcome may influence how other states pursue consumer protection cases against tech firms. Readers should note that no technical fix exists for this legal outcome, as it involves regulatory penalties rather than software vulnerabilities.

What to do and how to stay safe: Meta

• Review your organization’s exposure to state-level consumer protection laws regarding data privacy representations.
• Monitor legal developments in New Mexico for potential precedents that could affect national compliance strategies.
• Assess current privacy disclosures to ensure they accurately reflect data handling practices and third-party access.
• Consult legal counsel regarding the potential impact of this ruling on ongoing or future litigation risks.

Step-by-step guide: How to Remove Data from Data Brokers: The Manual Cleanup Process

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much did Meta have to pay in the New Mexico ruling?

A New Mexico judge ordered Meta to pay $25 billion in civil penalties for violating state consumer protection laws.

Why was Meta fined?

Meta was fined for misleading users about privacy controls and hate speech moderation, with a jury finding nearly 44 million violations.

Will Meta pay the full amount?

Meta plans to appeal the decision, arguing the penalty is unconstitutional and that the enforcement approach is overly broad.