.jpg?w=1024)
Meta has been ordered to pay New Mexico $25 billion after a jury found that Facebook misled consumers about its privacy practices and other platform policies.
The ruling, issued Oct. 21 by New Mexico District Court Judge Francis Mathew, follows a September jury verdict that found Meta liable for 43,899,725 violations of the state’s Unfair Practices Act.
The case centered on claims that Facebook misrepresented how it protected user information, managed third-party access to personal data and addressed harmful content. The case stemmed partly from the Cambridge Analytica scandal, which came to light in 2018. Facebook estimated that information from up to 87 million users may have been improperly shared with the political consulting firm.
New Mexico’s Unfair Practices Act allows civil penalties of up to $5,000 for each willful violation. Although that calculation produced a theoretical penalty exceeding $219 billion, Mathew reduced the award to $25 billion.
“The harm in this matter is difficult to overstate, and goes to the heart of Facebook’s basic business proposition,” Mathew wrote in his ruling. The order also imposes annual interest of 15% until the penalty is paid in full.
Meta plans to appeal
Meta disputes the ruling and says it expects to overturn it in court.
“This ruling, and the Attorney General’s approach to this enforcement, makes it all but impossible to do business in the state of New Mexico,” Chief Legal Officer C.J. Mahoney said in a statement cited by CNBC. “At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online.”
The company argued during the proceedings that the state had not demonstrated that consumers were harmed and challenged how officials calculated the violations. Meta says it is confident it will prevail on appeal.
New Mexico pursued the case independently rather than joining a multistate agreement that resolved similar claims. Meta previously paid $5 billion to settle a Federal Trade Commission case in 2019 and agreed to a $725 million settlement in a Facebook user class-action lawsuit in 2022.
Why privacy promises matter for security teams
The ruling highlights the financial exposure companies can face when their public privacy assurances do not match their practices. Penalties can accumulate across repeated violations, although Meta’s planned appeal leaves the final outcome uncertain and other states operate under their own laws.
For security and privacy teams, the practical starting point is to compare privacy policies and data-sharing disclosures with actual system behavior. If a company promises users control over their information, teams should test which settings restrict collection or sharing, what exceptions apply, and whether connected applications honor those choices.
Third-party access deserves particular attention. Organizations should maintain an inventory of applications that receive personal information, document why each needs access, and check whether permissions remain appropriate as services change. Removing an integration should also trigger a review of information already transferred and any contractual requirements for its retention or deletion.
Public assurances need supporting evidence. Security, privacy, legal and product teams should review claims about data access, deletion and misuse notifications together. Access logs, permission tests and documented investigations can help establish whether the controls work as described and identify gaps before inaccurate assurances reach users.
What Facebook users should take away
The judgment does not automatically compensate Facebook users or change their account settings. Attorney General Raúl Torrez said money recovered would go into New Mexico’s education fund, but Meta’s appeal could delay collection.
Users should review connected apps, remove access they no longer need and limit the personal information they share. Anyone concerned about previous exposure can also check whether their personal information appears in known data breaches. Those steps can reduce future exposure, but users should also check what information an app has already received and whether it offers a separate deletion process. Recent major data breaches provide additional context on the types of sensitive information that can be exposed.
For employers, the same review should extend to business information employees share through social platforms and connected services. Account permissions, approved integrations and staff guidance should make clear what information may be shared and who can authorize access.
The broader lesson is that privacy controls need to be understandable and verifiable. Meta’s appeal will determine whether the penalty survives; security teams can use the case now to examine whether their organizations can demonstrate the protections they promise.
Read more: Privacy questions also extend to AI assistants — Meta Muse’s data disclosures show why users should review what connected agents may collect and which permissions they receive.