New Mexico judge orders Meta to pay $25 billion over Facebook data privacy deception

When the Cambridge Analytica revelations broke in 2018, they exposed how a now-defunct British political consulting firm had obtained personal data from as many as 87 million Facebook users through a third-party app and used it to generate targeted political advertising during the 2016 election season, when the firm worked for Donald Trump's campaign. The scandal produced a $5 billion FTC settlement in 2019 and a $725 million class action in 2022, but its legal aftermath keeps unfolding in state courthouses.

New Mexico's own case dates to 2021, when then-Attorney General Hector Balderas sued Meta. The state accused the company of lying to New Mexico users about who had access to their data and about how it handled hate speech and misinformation, and lawyers cited a 2010 Washington Post op-ed in which Mark Zuckerberg wrote that Facebook did not sell user data. The suit was carried forward by Balderas's successor, Attorney General Raul Torrez, who declined to join the multistate settlement Meta reached in August 2026.

The trial ran for two weeks earlier this year. On September 25, jurors in Santa Fe found that 26 of 29 statements made by the company and its leadership were misleading, and that Meta had committed more than 43 million violations of the state's Unfair Practices Act, a count calculated from the number of Facebook users or residents who were the audience for each statement. Jurors also found that the company had intentionally misled the public about how it benefited from hate speech and how rules against it were enforced.

What remained was the size of the penalty. At an October 1 hearing, state lawyer Randi McGinn asked for $35 billion to $40 billion, while Meta urged a cap of $3.45 billion and argued that a higher figure would violate due process. On Wednesday, October 21, 2026, Judge Francis Mathew of New Mexico's First Judicial District Court answered the question, and the answer was considerably larger than anything the company had proposed.

Key Facts

Mathew ordered Meta Platforms to pay $25 billion in civil penalties. State law allows a penalty of up to $5,000 per violation, and the 43,899,725 violations found by the jury produced a statutory total of $219.5 billion. Mathew found that a penalty of more than $219 billion was warranted, then reduced the figure to $25 billion. All of the money is directed to New Mexico's school system. CNBC reported on October 21, 2026 that interest on the penalty accrues at 15 percent each year until the fine is paid in full.

IAPP reported on October 22, 2026 that the order applies the maximum $5,000 per-violation figure to all 43,899,725 violations before reducing the total. Mathew wrote that the extraordinary number of willful violations, the duration and repetition of the conduct, the breadth of subjects on which violations occurred, the involvement of senior Facebook leadership, the size of New Mexico audiences reached and the clear intentional and systematic nature of the repeated misstatements all supported the maximum. BBC News reported on October 21, 2026 that the judge described the violations as willful and said they spanned more than 11 years, from 2010 to 2021, with communications between senior executives, including Zuckerberg, designed to mislead the public.

In the order, Mathew wrote that the wrongdoing went "to the heart of Facebook's core business practices" and related to the way in which the platform induces people onto it and ultimately keeps them there. He also wrote that Facebook did not conduct the comprehensive investigation that it promised after the Cambridge Analytica revelations, citing pressure from senior executives to keep costs down, inadequate enforcement resources and a desire not to create precedent. Al Jazeera reported on October 22, 2026 that the order landed more than three weeks after the jury's verdict.

Torrez said the result makes clear that no corporation is too powerful to be held accountable, and that the case is about whether corporations can mislead consumers about what happens to their personal information without facing meaningful consequences. He called the judgment one of the largest, if not the largest, single state verdict against a company in American history, and said that for too long powerful technology companies have operated as though their size and influence put them beyond the reach of the law.

Meta's chief legal officer, C.J. Mahoney, said the ruling makes it all but impossible to do business in the state of New Mexico and described the suit as, at its core, a tax on speech. He said the company is confident it will prevail on appeal. Reuters reported on October 21, 2026 that six other states settled Cambridge Analytica-related claims for $459.2 million as part of a $17.1 billion multistate settlement Meta reached in August 2026 over teen mental health. In March 2026, a Santa Fe jury in a separate case ordered Meta to pay $375 million in civil penalties over child safety, and a judge later directed $567 million into a New Mexico teen mental health fund.

Analysis

What this really means is that the most consequential privacy ruling against Meta in years turns less on surveillance itself than on the sentences the company wrote about surveillance. The 43,899,725 figure was not a tally of hacked accounts or scraped profiles. It was a count of statements multiplied by the audiences that saw them, calculated from the number of Facebook users or residents reached by each statement. That arithmetic converts a public relations problem into a balance sheet problem, and it hands state attorneys general a reusable template.

The judge's own math shows how the leverage works. Mathew accepted the statutory maximum of $5,000 per violation, which produced $219.5 billion, then reduced the award by nearly $195 billion to reach $25 billion. The reduction acknowledges the due process argument Meta pressed, that anything above $3.45 billion would be unconstitutional, while still leaving a figure roughly equal to Meta's quarterly profit. BBC News reported on October 21, 2026 that Meta's revenue rose 26 percent year on year to $64.5 billion in the July to September quarter and that profit tripled to $9.8 billion. A $25 billion judgment is not an existential sum for the company, but it is a persistent one, especially with interest compounding at 15 percent a year while appeals run.

The bigger picture here is that New Mexico deliberately chose a different route from its peers, and on paper it is now far ahead of them. Six other states resolved Cambridge Analytica-related claims for $459.2 million inside a $17.1 billion multistate package that also covered teen mental health allegations. Torrez skipped that deal. The result is a court judgment rather than a negotiated release, which means the number is both larger and less certain, since a single appellate panel can reduce or vacate it.

Whether the amount survives is a separate question from whether the underlying finding is sound. Mahoney's description of the lawsuit as a tax on speech previews the constitutional argument Meta will press, and the verdict's reliance on statements made to the public, including a 2010 op-ed, gives that argument its opening. Still, the factual findings are unusually detailed: 26 of 29 statements deemed misleading, a finding of intent on hate speech disclosures as well, and a documented failure to conduct the investigation the company promised. Courts reviewing penalties generally defer to findings of willfulness, and this record is built almost entirely from Meta's own words.

Why It Matters

The direct consequence is financial and local. Roughly two million New Mexicans were described by state lawyers as affected, and every dollar of the $25 billion is earmarked for the state's school system rather than its general fund. That design gives the judgment a political constituency most corporate penalties lack. It also compounds the state's existing recoveries from Meta: $375 million in civil penalties over child safety from a March 2026 jury, and a later $567 million directed into a New Mexico teen mental health fund.

The wider consequence is doctrinal. IAPP reported on October 22, 2026 that the decision is the latest example of state enforcers using consumer protection law to pursue privacy claims, following the FTC's 2019 settlement, the 2022 class action and the August 2026 multistate deal. That sequence matters because consumer protection statutes carry per-violation penalties that privacy statutes often do not, and they let a single state generate exposure measured in tens of billions of dollars. Torrez said the judgment should be a signal, an unambiguous message, to Silicon Valley.

There is also a transparency dimension that outlasts the litigation. The case was built on the gap between what Facebook told users and what its executives discussed internally, and Mathew's findings describe a company that promised a comprehensive investigation after the Cambridge Analytica revelations and then did not conduct one, citing cost pressure, thin enforcement resources and a reluctance to set precedent. Whatever an appellate court does with the $25 billion, that narrative is now a matter of judicial record, and it will be cited in the state cases still to come.

Next Up

Meta intends to appeal, and Mahoney has said he expects to win. Until the judgment is resolved, interest accrues at 15 percent each year, so the exposure grows the longer the company litigates. The appellate court will have to weigh New Mexico's per-violation scheme against Meta's due process objection, and it will do so with the judge's reduction from $219.5 billion already on the record as evidence that the trial court considered proportionality.

Other proceedings continue in parallel. Al Jazeera reported on October 22, 2026 that a trial began in August in a California federal court, brought by a coalition of 29 state attorneys general over addictive design for children, addressing claims that Meta illegally collected and used children's data. New Mexico has already shown it will litigate rather than settle, and other states now have a detailed public template if they choose to follow.