A New Mexico judge on Wednesday ordered Meta to pay $25 billion in penalties, concluding a high-stakes legal battle over the social media giant’s handling of user data and its transparency regarding privacy controls. The ruling by Judge Francis Mathew follows a September jury verdict that found Facebook’s parent company had committed tens of millions of willful violations of the New Mexico Unfair Practices Act.
The massive financial penalty is the result of New Mexico’s decision to pursue its claims to trial, making it the only state to refuse a settlement that 48 other states previously accepted. The scale of the fine reflects the court’s findings on the volume of deceptive practices identified during the proceedings, which centered on how the company communicated with users about the security and accessibility of their personal information.
In his decision, Judge Mathew noted that New Mexico was technically entitled to a staggering $219.5 billion based on the state’s maximum penalty of $5,000 per violation. The court calculated that Meta was responsible for 43,899,720 distinct violations of the law. While the judge acknowledged the statutory maximum, he ultimately reduced the final penalty amount to $25 billion.
The case has its roots in the fallout from the Cambridge Analytica scandal, which emerged nearly a decade ago. That controversy revealed that the data of more than 50 million Facebook users had been harvested by a third-party firm to create targeted political advertisements during the 2016 U.S. election cycle. While Meta, then operating as Facebook, promised to implement more robust transparency measures and stricter data controls in the wake of the scandal, the New Mexico court found those efforts to be insufficient and misleading.
Evidence presented during the trial indicated that Facebook’s privacy controls failed to provide users with meaningful authority over how their data was shared. Specifically, the court found that third-party application developers were able to access sensitive user information through the platform’s internal systems, often without the explicit understanding or consent of the account holders. Furthermore, the court determined that the company failed to consistently notify users when their data had been misused or improperly accessed.
Internal communications from Meta CEO Mark Zuckerberg played a central role in the court’s determination of willful intent. Documents revealed that Zuckerberg was aware that the average user struggled to understand the complexities of data privacy settings. In one instance, the CEO wrote that users “probably don’t understand their current privacy settings or care about who sees their updates.” Another communication suggested the company should provide users with a theoretical opportunity to adjust their privacy settings but explicitly advised against encouraging them to do so.
Meta has signaled its intent to fight the ruling. C.J. Mahoney, Meta’s chief legal officer, characterized the lawsuit as an attempt to regulate online speech through financial pressure. Mahoney argued that the ruling makes it nearly impossible for the company to conduct business within the state of New Mexico and suggested the penalties serve as a “tax on speech.”
Despite the court’s findings regarding the exploitation of user confusion, Meta maintained that it remains committed to building a safe platform and helping small businesses grow. The company expressed confidence that it would prevail on appeal, potentially setting the stage for a prolonged legal challenge in higher courts.
This ruling marks one of the most significant financial consequences faced by a Big Tech firm in a domestic privacy case. It underscores the potential for individual states to leverage local consumer protection laws to challenge the business models of global technology conglomerates, even when broader federal or multi-state settlements have been reached.
