Imae showing Meta's office
Meta Platforms, the parent company of Facebook and Instagram, has been ordered to pay $25 billion to the U.S. state of New Mexico after a judge ruled that the company misled users about how it handled their personal information. The judgment, issued on October 21, 2026, follows a jury verdict finding millions of violations of state consumer protection laws.
The case stems from allegations that Facebook failed to adequately protect user data and misrepresented the level of privacy and control offered to its users. Meta has said it will appeal the ruling, setting the stage for a potentially lengthy legal battle.
Why Was Meta Ordered to Pay $25 Billion?
New Mexico Attorney General Raúl Torrez filed the lawsuit in 2021, alleging that Meta misled Facebook users about who could access their personal information and how the platform handled harmful content.
After reviewing the case, a jury found in September 2026 that 26 of 29 statements made by the company and its leadership were misleading. It identified approximately 43.9 million violations of New Mexico's consumer protection laws.
State law allows penalties of up to $5,000 per violation. Although the judge determined that the theoretical maximum could exceed $219 billion, the final judgment was reduced to $25 billion.
The decision represents one of the largest financial penalties imposed on a technology company in a U.S. state-level consumer protection case.
How the Cambridge Analytica Scandal Led to the Lawsuit
The case is rooted in the Cambridge Analytica scandal, which became public in 2018.
The political consulting firm obtained Facebook profile information through a third-party personality quiz application. The data was reportedly collected from as many as 87 million Facebook users and used to support political profiling and targeted advertising.
The controversy raised questions about whether Facebook users understood how their information could be accessed and used by outside organizations.
New Mexico prosecutors argued that Facebook had made misleading promises about data privacy and the control users had over their personal information. The state also challenged statements concerning the handling of hate speech, misinformation and other harmful content.
The court found that the company's representations about privacy and user control were misleading. Meta disputed the state's claims and argued that the evidence did not justify the penalties imposed.
What the Court Found About Facebook's Privacy Practices
The court concluded that Facebook's privacy assurances gave users an inaccurate impression of how their personal information could be accessed and shared.
According to the findings, the company's public representations extended across more than 11 years, from 2010 through 2021. The judge determined that previous penalties and agreements had not sufficiently deterred the conduct identified in the case.
The ruling also examined whether Facebook's privacy settings gave users meaningful control over their information, particularly when third-party applications could access profile data.
However, the jury did not accept every allegation brought by New Mexico. It rejected certain claims concerning Facebook's statements about removing harmful content, including COVID-19 misinformation.
This distinction matters because the judgment was based on specific findings under state consumer protection law, rather than a determination that every allegation against Meta was proven.
Meta Plans to Appeal the $25 Billion Judgment
Meta has strongly criticized the decision and said it expects to prevail on appeal.
The company argues that the lawsuit seeks to impose new restrictions on online speech and that New Mexico failed to establish a sufficient basis for the size of the penalty.
Meta's legal team had asked the court to limit the financial award to approximately $3.45 billion, arguing that a substantially larger amount would be unconstitutional.
The appeal could examine the number of violations, the calculation of penalties and whether the judgment complies with constitutional limits. The final amount Meta must pay could therefore change as the legal process continues.
The company has also pointed to changes it has made to its privacy and content moderation practices since the original lawsuit was filed.
Where Will the $25 Billion Go?
Under New Mexico law, penalties collected under the state's consumer protection framework are directed toward public education funding.
The judgment could therefore provide substantial resources for school construction and other eligible educational purposes if the state ultimately collects the money.
However, the appeal process could take years, and the judgment does not mean New Mexico will receive the full amount immediately.
The state has described the decision as a warning to major technology companies that misleading consumers about privacy can result in significant financial consequences.
What the Ruling Means for Facebook Users
The judgment reinforces the importance of transparency and meaningful user control over personal information.
For Facebook and Instagram users, the case highlights several practical considerations:
- Review privacy settings to understand who can see personal information and posts.
- Check which third-party applications have access to an account.
- Remove applications that are no longer needed or cannot be trusted.
- Be cautious about quizzes, games and external services requesting access to social media profiles.
These steps cannot eliminate every privacy risk, but they can help users limit unnecessary data sharing.
The ruling may also encourage technology companies to review their privacy disclosures, third-party access controls and compliance systems to reduce the risk of similar litigation.
Final Thoughts
Meta's $25 billion judgment in New Mexico marks a significant development in the ongoing debate over social media privacy and corporate accountability.
The case arose from allegations connected to the Cambridge Analytica scandal and expanded into a broader examination of Facebook's representations about user data, privacy settings and content moderation.
Although the court imposed a substantial penalty, Meta intends to appeal, and the final financial outcome remains uncertain. If the judgment stands, it could become a major example of how state consumer protection laws can be used to hold technology companies accountable for misleading privacy claims.
For users, the case is another reminder that understanding privacy settings and limiting third-party access remain important when using social media platforms.