Meta Owed $25B for 44M Data Violations, Vows Appeal

A New Mexico judge ordered Meta to pay $25 billion after a jury found the company deceived users about how it handled personal data on Facebook. The penalty stems from violations of the state’s Unfair Practices Act, marking one of the largest financial awards in U.S. legal history.

The risk

The case originated from the Cambridge Analytica scandal, where a political consulting firm accessed data from up to 87 million users. New Mexico Attorney General Raúl Torrez argued that Meta’s conduct went beyond that incident, citing misleading statements about privacy and inconsistent enforcement of hate speech rules.

Judge Francis Mathew wrote that Meta’s deception was intentional and that executives consistently misled users about platform operations. He stated that the company’s promise of user control over data was false. The jury’s September verdict established liability for these systemic issues.

Who is exposed

The jury found Meta liable for 43,899,725 specific violations of New Mexico law. These violations reflect the scope of the company’s conduct toward residents of the state. The findings cover years of business practices related to third-party data access and content moderation.

Cost and compliance

Judge Mathew applied the maximum penalty of $5,000 per violation, which would have totaled $219 billion. He reduced the final award to $25 billion, despite the state seeking up to $40 billion. Meta’s lawyers had argued for a cap of $3.4 billion, claiming the larger sum was unconstitutional.

Meta announced it will appeal the decision. Chief Legal Officer C.J. Mahoney said the ruling makes it nearly impossible to do business in the state and accused the lawsuit of imposing a tax on speech. The company’s shares rose slightly after the announcement.

What should you do?

Monitor official channels for updates on the appeal process. Review how your organization handles third-party data access and user consent mechanisms. Ensure your privacy disclosures accurately reflect actual data handling practices to avoid similar liability.

The background in plain language

Consumer protection laws generally require companies to be honest about how they use customer data. When a firm promises control over personal information but allows third parties to harvest it without clear consent, regulators may view this as deceptive. Legal teams usually assess whether public statements match technical realities to determine liability.

What to do and how to stay safe: Meta

• Review privacy policies to ensure they accurately describe data sharing practices.
• Audit third-party integrations for unauthorized data access risks.
• Document all user consent mechanisms for data collection.
• Monitor regulatory announcements for changes in state consumer protection laws.

Step-by-step guide: Smartphone Privacy Settings: What They Hide and What They Leak

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much is Meta ordered to pay New Mexico?

Meta is ordered to pay $25 billion in civil penalties.

How many violations did the jury find?

The jury found 43,899,725 violations of New Mexico law.

Will Meta pay the full amount immediately?

Meta plans to appeal the ruling, so the payment is not yet final.