Overview
A New Mexico state District Court ordered Meta to pay $25 billion in penalties in a data privacy lawsuit that grew out of the Cambridge Analytica scandal, which came to light in 2018. The penalty covers more than 43 million violations of the state's unfair practices law.
What the Court Found
The state filed the lawsuit in 2021. Judge Francis J. Mathew found that Facebook made misleading statements about how much control users had over their data. In his ruling he wrote: "Facebook promised users that they (the users) controlled their data," and "This was false."
Background
Cambridge Analytica obtained data through a personality quiz app. Roughly 300,000 people took the quiz, but the app also collected data from their friends, reaching about 87 million profiles.
Meta's Response
Chief legal officer C.J. Mahoney criticized the penalty, and Meta says it intends to appeal.
Why It Matters
- Scale: the per-violation penalty model, applied to tens of millions of affected users, produces a figure far beyond typical privacy settlements.
- Precedent: state-level unfair-practices statutes are an increasingly active enforcement route alongside federal and EU regulators.
- Governance takeaway: public statements about user control over data need to match actual platform behavior, including third-party app access to friend data.
Appeals could reduce or reverse the amount, so the final outcome remains uncertain.