Cybersecurity Policy Report, New Mexico Court Orders Meta to Pay $25B Over Privacy Misrepresentations, (Oct 21, 2026)
A New Mexico state court today imposed a $25 billion penalty on Meta Platforms, Inc., after finding that the social media giant misrepresented its privacy practices in violation of the state’s Unfair Practices Act. Meta said it would appeal.
“Facebook promised users that they (the users) controlled their data. This was false,” Francis Mathew, a judge for the state’s First Judicial District Court, said in his judgment.
“Facebook did not disclose to the public that it had designed the open platform in a manner that allowed third party applications’ illicit access to all user data. Facebook unconscionably allowed third parties to take user data without providing an explanation for what that data was for and did so without logging the data that was taken,” Judge Mathew said.
“It did this despite recognizing that bad actors hoped to take advantage of the Facebook platform by using its permissions to take excessive amounts of user data, including data from users’ friends,” he said.
The lawsuit filed by New Mexico Attorney General Raúl Torrez (D.) focused partly on the Cambridge Analytica scandal, in which Facebook was accused of violating users’ privacy by allowing Cambridge Analytica Ltd., a now-defunct political consulting firm, to deceptively harvest data from the platform.
But the AG’s litigation “went beyond the scandal itself, challenging Facebook’s representations to consumers about its data practices and its efforts to address misinformation and hate speech,” AG Torrez said in a news release.
“This case has always been about more than one company or one scandal,” AG Torrez said. “It is about whether corporations can mislead consumers about what happens to their personal information without facing meaningful consequences.”
A 12-person jury found last year that Meta’s data privacy practices violated state law. The judgment issued today followed a second phase of the trial that sought to determine the appropriate penalty.
“Among the representations that the jury found unlawful and willful were representations made personally by Facebook’s most senior leadership, including its Chief Executive Officer, Mark Zuckerberg, and its then-Chief Operating Officer, Sheryl Sandberg. These communications were part of a coherent strategy designed to mislead the public,” Judge Mathew said.
“Facebook was aware that its users did not understand its privacy settings and took advantage of that to a grossly unfair degree. For example, Mr. Zuckerberg stated in a private email to another senior executive, Chris Cox, that ‘these folks’—referring to Facebook’s users—‘probably don’t understand their current privacy settings or care about who sees their updates,’” he said.
“Rather than seek to educate Facebook’s users about their privacy settings, Mr. Zuckerberg chose instead to capitalize on that lack of understanding in order to manipulate users into sharing more of their personal information publicly,” the judge added.
“Facebook’s misrepresentations about users’ control of their data were not isolated incidents, but rather a systematic pattern of deception at the core of Facebook’s business model,” he said.
Following the Cambridge Analytica affair, Meta promised that it would institute better data protections for users, but those promises went unfulfilled, the judge asserted.
“Facebook publicly committed to notifying users when it found that an application had misused their data. In fact, however, Facebook only notified users of two apps, out of the thousands that were found to have been misusing data,” he said.
“The decision was deliberately made to narrow Facebook’s internal definition of data misuse so that Facebook would not have to notify as many people due to the operational burden of doing so,” he added.
Meta indicated it would appeal the judgment. “This ruling, and the Attorney General’s approach to this enforcement, makes it all but impossible to do business in the state of New Mexico,” C.J. Mahoney, Meta’s chief legal officer, said in a statement e-mailed to TR Daily.
“At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online,” Mr. Mahoney added. “We are confident we will prevail on appeal.”
MainStory: TopStory StateLegislation DataPrivacy LitigationEnforcement