A jury said Facebook lied about privacy millions of times, and now Meta owes New Mexico a record sum.
On October 21, 2026, a New Mexico judge ordered Meta Platforms to pay the state $25 billion after a jury found the company deceived Facebook users about privacy, data control and content moderation. The ruling, issued by Judge Francis Mathew in Santa Fe, stems from the Cambridge Analytica scandal tied to Donald Trump's 2016 presidential campaign.
Prem Watsa IDBI Bank Deal: Why Fairfax Just Paid $5.6 Billion for Control
How The Meta $25 Billion New Mexico Privacy Verdict Came Together
View this post on Instagram
The case began long before this month's ruling. Back in 2018, the world learned that a personality-quiz app had pulled data from roughly 87 million Facebook profiles. That information eventually landed with Cambridge Analytica, a political consulting firm linked to targeted ads during the 2016 election. Instead of joining other states in a group settlement, New Mexico chose to go after Meta on its own.
That decision paid off in court. A Santa Fe jury ruled in September 2026 that Meta had violated the state's consumer protection law more than 43 million times. Jurors also found that 26 out of 29 statements made by Meta and its top leaders about privacy and data handling were misleading. These weren't small technical violations. They covered how Facebook described user control over personal data, plus its ability to stop hate speech and other harmful content.
Anthropic Q3 Revenue Hits $16.8 Billion, Here's Why It Matters for IPO
Judge Mathew's Order and the Math Behind $25 Billion
Judge Mathew didn't hold back in his written order. He stated plainly that Facebook promised users control over their data, and that promise was false. He went further, writing that the wrongdoing happened over years and was systematically broadcast to the public, striking at the heart of Facebook's core business.
New Mexico had actually asked for much more, somewhere between $35 billion and $40 billion. Under the state's Unfair Practices Act, each violation can carry a penalty up to $5,000. Multiply that by 43 million violations, and the math gets wild fast, potentially topping $219 billion. Mathew scaled that number way down, landing on $25 billion instead. Even reduced, it's one of the largest civil penalties ever handed to a tech company.
Why This Case Differs From Other Facebook Privacy Fights
What makes this ruling stand out is the strategy behind it. Most states that sued over Cambridge Analytica folded their claims into multistate settlements, which tend to produce smaller, shared payouts. New Mexico skipped that route entirely and took Meta to trial by itself.
That gamble let the state build its case around the number of New Mexico residents affected and the specific statements they were exposed to. Reports indicate the alleged misconduct touched all of New Mexico's more than 2.1 million residents. Treating each person's exposure to misleading statements as a separate violation is exactly what pushed the total violation count into the tens of millions, and ultimately drove the size of the penalty.
What Comes Next for Meta and Its Users
Meta now faces a tough road ahead. The company can challenge how the jury counted violations, question whether the statute even applies the way the state argued, or push back on the size of the award itself. Available reporting doesn't confirm whether Meta has filed a formal appeal yet, or whether any payment has been paused while the case moves forward.
For regular Facebook users, the ruling puts a spotlight on something many have suspected for years: the difference between what tech companies say about privacy and what actually happens behind the scenes. Privacy advocates are watching closely, since this case could become a blueprint for other states thinking about suing tech platforms directly instead of settling as a group.
A Verdict That Could Reshape State Privacy Lawsuits
Legal experts are already calling this one of the biggest verdicts in U.S. history, not just for Meta, but for how states handle big tech. The case proved that going it alone, rather than joining a crowded multistate settlement, can lead to a far bigger financial outcome.
Whether $25 billion survives appeal is still an open question. But the verdict itself sends a clear signal. Companies that make big public promises about privacy and user control may now face serious legal risk if those promises don't match what's happening inside their own systems. Other states are likely taking notes.
