You can access the judgment from here.
A New Mexico court has ordered Meta Platforms to pay $25 billion in civil penalties for misleading users about their data privacy, third-party access to personal information and content moderation on Facebook. In its October 21, 2026 judgment, the court reduced the potential penalty of $219.49 billion after a jury found that the company had committed 43,899,720 willful violations of the state’s Unfair Practices Act.
“The harm in this matter is difficult to overstate, and goes to the heart of Facebook’s basic business proposition,” District Court Judge Francis J. Mathew wrote in the judgment.
The judge ordered interest to accrue at 15% annually until Meta pays the penalty in full. The court has reserved its decision on additional measures to stop the alleged violations, pending further submissions.
What is the case about?
New Mexico sued Meta in 2021, alleging that Facebook misled users about how it collected, shared and protected their personal information. The case also examined the company’s public claims about misinformation, hate speech and whether it applied its content rules equally to all users.
The court found that Facebook’s public assurances contradicted information available internally to its employees and executives. It also found that users could not independently verify the company’s claims because they lacked access to its internal systems and records.
“The violations were not confined to one statement, one speaker, one medium, or one aspect of Facebook’s business,” the judgment said.
The court further noted that Facebook continued making these representations after employees and senior personnel had identified limitations in its practices.
What does Cambridge Analytica have to do with it?
The case centres partly on Facebook’s handling of user data following the Cambridge Analytica scandal, which came to light in 2018. The political consulting firm obtained data linked to about 87 million Facebook users through a third-party app. The information was used to build voter profiles, including for political targeting connected to Donald Trump’s 2016 presidential campaign.
Before 2014, Facebook allowed third-party app developers to access information about users‘ friends, including people who had not themselves used those apps. Facebook announced in 2014 that it would end this practice, known as “friend sharing”, after a transition period ending in May 2015.
However, the court found that Facebook planned exemptions for major business partners and continued allowing them access to friends’ data without disclosing these exceptions to users.
Following the Cambridge Analytica revelations, Facebook promised to investigate apps that had accessed large amounts of user data, audit suspicious activity, ban developers who misused data, ensure improperly obtained information was deleted and notify affected users.
The court found that Facebook did not fulfil these commitments. It conducted only 14 forensic data audits during its three-year App Developer Investigation, which ran from approximately March 2018 to March 2021. The court also found that Facebook notified users about only two apps despite identifying thousands of apps associated with data misuse.
Facebook’s internal assessment in September 2019 concluded that it could not say it had fulfilled its public commitments. The company nevertheless ended the investigation in March 2021 without publicly announcing its conclusion to users.
Why did the court order Meta to pay $25 billion?
The court identified a broader pattern of misleading public statements rather than a single failure involving Cambridge Analytica.
First, Facebook misrepresented users’ control over their data. The court found that its privacy settings did not provide meaningful control in several areas and that the company knew users struggled to understand them.
“Facebook promised users that they (the users) controlled their data. This was false,” the judge wrote.
The court also found that Facebook continued making misleading assurances about privacy, misinformation and content moderation despite internal evidence showing limitations in its systems.
Second, Facebook knew about problems it did not disclose. Internal communications showed that employees and senior executives were aware of weaknesses in data protection, investigations and content enforcement.
The court found that Facebook’s systems sometimes promoted misinformation and that its internal moderation tools allowed content violating its policies to remain online and accumulate millions of views.
It also found that Facebook gave certain high-profile accounts preferential treatment through its CrossCheck system, despite publicly promising equal enforcement of its Community Standards.
Third, the court found repeated and deliberate deception. The jury determined that 26 public representations made between May 2010 and August 2021 were unlawful and wilful. Facebook and its executives made these statements on the platform, in media interviews, during public appearances and through other channels.
“Facebook’s misrepresentations about users’ control of their data were not isolated incidents, but rather a systematic pattern of deception at the core of Facebook’s business model,” the judge wrote.
These findings supported the maximum statutory penalty of $5,000 per violation, although the judge ultimately reduced the total award.
What did Meta argue, and why is the ruling significant?
Meta’s lawyers argued that New Mexico had failed to prove that the company’s statements caused harm. They also said users could choose what information to share, that Facebook’s policies on third-party data access had changed since 2018, and that the state had not established that its content moderation practices harmed residents.
The company argued that the penalty should be limited to $3.4 billion and that a much larger award would be unconstitutional. It also disputed the state’s claims about its handling of harmful content. The jury rejected several of the state’s allegations concerning false claims about the removal of harmful content, including COVID-19 misinformation.
Meta said it would appeal the judgment. Its chief legal officer, C.J. Mahoney, said in a statement: “At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online. We are confident we will prevail on appeal.”
Read more:
- Meta reaches $16.68 billion settlement in US child safety case: What it will change on its platforms
- Meta’s child safety trial opens, with up to $1.4 trillion at stake
The post Explained: Why Meta faces a $25 billion penalty in a case linked to Cambridge Analytica appeared first on MEDIANAMA.