Overview
A New Mexico state court has ordered Meta to pay $25 billion in penalties for privacy violations tied to the Cambridge Analytica scandal, according to a filing released Wednesday. Meta says it will appeal.
The Ruling
| Item | Detail |
|---|---|
| Court | New Mexico State District Court, Judge Francis Mathew |
| Initial award | $220 billion |
| Reduced penalty | $25 billion, plus 15% annual interest until paid |
| Jury finding (September) | Meta violated the state's unfair practices law 43 million times |
| Statutory maximum per violation | $5,000 |
The case centers on Facebook sharing the data of as many as 87 million users with Cambridge Analytica. The state's suit focused on what Facebook told consumers about its data practices and its handling of misinformation and hate speech.
Judge's Findings
Judge Mathew cited "substantial aggravating circumstances," including the scale and willfulness of the violations. He found that senior leadership, including CEO Mark Zuckerberg and then-COO Sheryl Sandberg, pursued a strategy to mislead consumers, and that Facebook's App Developer Investigation was "willfully ineffective."
Meta's Response
Chief Legal Officer C.J. Mahoney said the ruling and the attorney general's approach make it "all but impossible to do business in the state of New Mexico," and called the lawsuit an attempt to impose a tax on speech. The appeal is pending, and interest continues to accrue.
Related Penalties
- $375 million New Mexico verdict over kids' online safety (March)
- $459 million share of a roughly $17 billion multistate settlement (August)
- $725 million class action settlement over the Cambridge Analytica scandal (2022)
Why It Matters
State unfair-practices statutes can be applied per violation, so a finding across tens of millions of users produces very large exposure even when the penalty is later reduced. The judge's emphasis on misleading statements about data practices is relevant to any organization whose privacy notices and actual data handling diverge.
Recommended Actions
- Compare privacy notices with actual data flows, especially third-party and developer access.
- Audit third-party app and API access to user data, and document how that access is monitored.
- Track state-level enforcement in addition to federal regulators when assessing privacy risk.