Meta ordered to pay $25 billion for misleading users about privacy

A New Mexico state court ordered Meta on October 21, 2026, to pay $25 billion in civil penalties over misleading statements to Facebook users about privacy, third-party access to personal data and platform practices. Judge Francis J. Mathew’s ruling sets the financial consequence of a jury verdict returned on September 25, but it does not end the case: Meta has announced that it will appeal.

New Mexico’s attorney general filed the lawsuit in 2021 following disclosures about Cambridge Analytica. The now-defunct British political consulting firm obtained data from as many as 87 million Facebook users through a third-party app without their informed consent and used information to build voter profiles. The state’s case, however, also examined broader company statements about who could access data and how Facebook handled misinformation, hate speech and other harmful content.

How the court arrived at $25 billion

The jury concluded that 26 of 29 statements it reviewed were misleading and calculated 43,899,725 violations of New Mexico’s Unfair Practices Act. That count was based on the statements and the potential audience they reached in the state. According to the ruling, applying the full statutory amount could have produced a penalty exceeding $219 billion.

Mathew found that the larger amount was supported under state law but reduced the order to $25 billion. During the penalty phase, New Mexico had requested between $35 billion and $40 billion. Meta argued for a $3.45 billion ceiling and said in court filings that it does not sell user data and that the state had not shown that specific consumers were actually misled.

The amount set by the judge is a court order, not a negotiated settlement. It also does not mean that $25 billion has already been transferred to the state. Meta may challenge both liability and the formula used to calculate the penalty on appeal, which could preserve, reduce or overturn parts of the judgment.

The positions of New Mexico and Meta

Attorney General Raúl Torrez presented the result as a warning that technology companies remain subject to state consumer-protection laws. The New Mexico Department of Justice emphasized that the state took its allegations to trial independently rather than resolving this set of claims through a collective settlement.

Meta rejected that interpretation. Chief legal officer C.J. Mahoney said the company is confident it will prevail on appeal and argued that the ruling turns enforcement into a restriction on speech. That is the company’s position; the jury and judge, by contrast, concluded that Facebook engaged in a pattern of misleading statements connected to its core practices.

Why the case matters for digital privacy

The size of the penalty commands attention, but the method of accountability may matter more to other platforms. New Mexico applied a general consumer-protection law to public promises about control of personal data. Rather than limiting the case to Cambridge Analytica’s improper access, the lawsuit examined whether Facebook’s own communications gave users a false understanding of who controlled their information.

The ruling does not automatically create a nationwide rule, and it does not require other states to repeat the same calculation. It does show how each public platform statement can be treated as a commercial practice and multiplied by the number of consumers reached. For digital services, privacy policies and settings screens are not merely documentation: they can become evidence of what a company promised its users.

At this stage, the confirmed developments are the liability verdict, the $25 billion order and Meta’s stated intention to appeal. The final outcome and the amount ultimately paid will depend on the next stages of litigation.