New Mexico Seeks Up to $40 Billion From Meta After Privacy Verdict
New Mexico has asked a state judge to order Meta to pay $35 billion to $40 billion in civil penalties after a jury found the company violated the state's Unfair Practices Act in the Cambridge Analytica privacy case.
The request was reported on Oct. 2, 2026. It moves the case from liability to penalty. A judge will now decide whether to impose up to $5,000 per violation, and at what level within that legal range Reuters.
Under the jury's verdict, the outside calculation reaches $219 billion. Jurors reviewed 29 Meta statements and found 26 misleading. They then counted 43 million violations of New Mexico consumer law, based on the number of Facebook users in the state exposed to those statements Engadget.
The statements were not only about data handling. The 26 statements found misleading covered user data, hate speech and misinformation. The jury concluded Meta misled residents about privacy and misinformation handling, in violation of the Unfair Practices Act.
The case began in 2021, when New Mexico sued Meta over claims it misled users about data privacy. The underlying incident involved Cambridge Analytica, which took information from more than 50 million Facebook profiles without consent for political ad campaigns. Attorney General Raúl Torrez later brought the matter to trial over alleged breach and misuse of user information.
New Mexico law allows up to $5,000 for each willful violation New Mexico Department of Justice. That per-violation rule is why a finding tied to 26 statements can scale into tens of millions of counts once multiplied across users in the state.
Meta and the state now differ sharply on the penalty. Meta asked the court to cap penalties at $3.45 billion, arguing New Mexico did not prove any residents were actually misled. Meta disputes that logic.
The state seeks roughly ten times more. Randi McGinn, a lawyer representing New Mexico, said penalties should be large enough to affect Meta. She told the court it should speak to Meta in "the only language it understands, which is money, and the value of its stock price."
Looking at what this means for technology operators, the legal theory matters more than the headline figure. This was not a finding of one breach or one false filing. It was a finding that product and policy messages, repeated across a platform and seen by millions of accounts, can each count as a separate violation under state consumer law.
In my view, that is the point for privacy, trust and safety, and legal teams to weigh. For large platforms, user count multiplies disclosure risk. Precise public statements about data use, action on hate speech, and handling of misinformation matter as much as precise code or access controls. General assurances age poorly when a jury tests them line by line.
The broader context here is enforcement leverage. State unfair-practices laws were written for individual transactions. Applied to social media distribution, they create penalty ranges no defendant can ignore, which gives the penalty-phase judge wide discretion. Whether the final figure lands near the state's $35 billion to $40 billion request, near Meta's $3.45 billion proposal, or elsewhere, the mechanism will shape how other companies write, review, and keep support for privacy claims.
The longer-term possibility is clearer privacy designs and more testable public claims, which would leave users better informed and reduce disputes over what was said and meant.
