A New Mexico judge has ordered Meta to pay $25 billion for misleading Facebook users about data privacy, one of the largest penalties ever imposed on a company in US history. The order, issued Wednesday, October 21, 2026, by Judge Francis Mathew, follows a jury verdict last month that found the tech giant violated New Mexico's consumer-protection laws nearly 44 million times. The case, trending per news coverage across major outlets worldwide, revives the decade-old Cambridge Analytica scandal — and Meta says it will fight the ruling on appeal.
The fine dwarfs every previous privacy penalty against the company, including the $5 billion the Federal Trade Commission imposed in 2019 over the same underlying scandal. It also eclipses the $18 billion Meta recently agreed to pay California to settle separate claims — a figure New Mexico pointedly declined to join, choosing a jury trial instead.
What the jury decided
On September 25, 2026, a Santa Fe jury found that Meta had misled the public about who could access Facebook users' personal information and how the company handled harmful content on its platform. Jurors reviewed 29 specific statements Meta had made about data access, privacy protections, and platform safety policies — and found 26 of them false or misleading.
The jury also found that Meta committed "unconscionable trade practices" in every category, meaning the company took advantage of consumers' lack of knowledge "to a grossly unfair degree." In total, jurors counted 43,899,720 violations of the state's Unfair Practices Act. More than 18.1 million of those violations came from a single category: Meta's response to the Cambridge Analytica affair. After the British firm harvested Facebook user data to target 2016 election ads, Meta promised to audit suspicious apps, ban developers who misused data, and notify everyone affected. The jury concluded those promises did not hold up.
Attorney General Raúl Torrez said more than 350,000 New Mexicans may have been caught up in the data harvest, and his office plans to work with the court to notify them.
From $219 billion to $25 billion: how the number was set
Under New Mexico's Unfair Practices Act, each willful violation can carry a civil penalty of up to $5,000 — and the exact amount is left entirely to the judge's discretion. Multiplying 43.9 million violations by $5,000 yields a theoretical maximum of roughly $219.5 billion. In his order, Judge Mathew wrote that a penalty of more than $219 billion was warranted given the scale of the misconduct, but he reduced the figure to $25 billion.
Both sides had lobbied for very different numbers. Meta's lawyers argued the company should pay no more than about $3.4 billion, warning that a larger penalty would be unconstitutional and would "make it all but impossible to do business in the state of New Mexico." The state, which had instructed its trial team to seek the maximum, had pushed for as much as $35 to $40 billion. The $25 billion outcome landed well below the ceiling but far above what Meta said it could stomach.
"Facebook's wrongdoing — over the course of years and systematically broadcast to the public — goes to the heart of Facebook's core business practices," Mathew wrote in his order.
The Cambridge Analytica scandal, explained
The lawsuit traces back to one of the defining tech scandals of the last decade. In 2018, reporting revealed that Cambridge Analytica — a now-defunct London-based political consulting firm that worked for Donald Trump's 2016 presidential campaign — had obtained personal information from as many as 87 million Facebook users through a third-party personality-quiz app, without their consent. The firm used the data for voter profiling and political ad targeting.
The revelation triggered years of regulatory fallout. Meta paid the $5 billion FTC penalty in 2019. But New Mexico's case, filed in 2021, went further than the data harvesting itself: the state accused Facebook of lying to users in the state about who had access to their data, and of misleading consumers about how it handled hate speech and misinformation — claiming the company tolerated harmful content when it benefited its finances.
Why New Mexico went to trial when other states settled
The $25 billion order is notable not just for its size but for how New Mexico got there. In August, 48 other states resolved their own Meta cases through a $17.1 billion multistate settlement covering claims that the company's platforms harmed teen mental health. New Mexico declined to join and pushed its privacy case to a jury.
It was the state's second courtroom win against Meta this year. In March, a separate jury found that Meta exposed children to predators and misled consumers about the risks, ordering $375 million in penalties. Meta has not paid that earlier judgment either, instead posting a $1.8 billion bond while asking the court to reconsider its findings or grant a new trial.
"For too long, powerful technology companies have operated as though their size and influence put them beyond the reach of the law," Torrez said in a statement. "This case has always been about more than one company or one scandal. It is about whether corporations can mislead consumers about what happens to their personal information without facing meaningful consequences." He called the verdict potentially the largest single-state verdict against a company in American history.
Meta's response: an appeal that could take years
Meta says it will challenge the ruling. "This ruling, and the Attorney General's approach to this enforcement, makes it all but impossible to do business in the state of New Mexico," C.J. Mahoney, Meta's chief legal officer, said in a statement. "At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online. We are confident we will prevail on appeal."
An appeal could take two to three years, according to Torrez, with post-judgment interest accruing the entire time. The per-violation counting — the same math that produced the nine-figure violation total — is widely seen as the most likely target of Meta's challenge. The company has long argued that counting violations by audience size produces a constitutionally excessive result; the state's lawyers counter that the math simply reflects the scale of a deception aimed at millions of people.
The timing added drama: Meta was scheduled to report its quarterly earnings after the markets closed on the same day the order landed, and "Meta stock" trended on Google searches worldwide as investors digested the news. The company's business runs overwhelmingly on digital advertising — the same data-driven engine at the heart of the case.
Where the money goes — and who doesn't get paid
If the judgment survives appeal, the money would go to a New Mexico education fund, where fines for consumer-protection violations are directed under state law. The verdict pays nothing to individual Facebook users — although Torrez said residents can still pursue their own claims against the company.
That structure is by design: state consumer-protection actions punish deception on behalf of the public rather than compensating individuals. But with 350,000-plus potentially affected residents in New Mexico alone, the door to follow-on litigation is wide open, and lawyers in other states will be watching how the appeal plays out before deciding whether trial beats settlement.
What happens next
For now, the liability finding stands. Meta's appeal will test whether the violation-by-violation arithmetic holds — and whether a single state's consumer-protection law can produce a penalty on this scale. Meta is already fighting privacy battles on other fronts, including its decision to pause a conversation-sharing feature after thousands of shared chats were found exposed online. The company remains one of the most powerful advertising machines in history, and this case is a test of whether courts can price a decade of alleged deception.
Whether the $25 billion stands, shrinks, or grows on appeal, the verdict sends the signal Torrez intended: in the words of his statement, an "unambiguous message" to Silicon Valley that misleading consumers about their data carries consequences measured in the tens of billions. Other states that settled for far less will be watching — and so will the users whose data started it all.
Sources: USA Today; The Times; Fox Business; TheWrap; AAP; Gizmodo; Reuters (via TheWrap); Associated Press; Albuquerque Journal (via GadgetReview); New York Times (via GadgetReview); PBS NewsHour (via 24Signal); Fortune (via 24Signal); El País (via 24Signal); nm.news / Rio Rancho News.