Judge Orders Meta to Pay $25 Billion in New Mexico Data Case
A New Mexico judge ordered Meta Platforms to pay $25 billion in civil penalties on Wednesday, October 21, 2026, for more than 43 million violations of the state's Unfair Practices Act, according to CNBC. The penalty stems from a data privacy case tied to the Cambridge Analytica scandal.
The judge set the penalty at $5,000 per violation, the maximum the statute allows. Before the reduction, the total civil penalties would have exceeded $219 billion, and the judge brought the figure down to $25 billion, The Verge reported. The judge cited the number of willful violations the jury found, the duration and repetition of the conduct, the breadth of subjects involved, and the involvement of senior Facebook leadership as grounds for applying the maximum rate.
The case began with a 2021 complaint filed after revelations that Cambridge Analytica, a political consulting firm, had harvested data from millions of Facebook accounts. A New Mexico jury later found that Meta misled consumers about how it protected their data and about how it prevented misinformation and hate speech on its platforms. The verdict followed a trial that ran nearly seven weeks. The New Mexico Department of Justice said the jury found more than 43 million violations, with a potential civil penalty exceeding $219 billion.
New Mexico Attorney General Raúl Torrez said the case established millions of violations of state law. His office described the $25 billion penalty as one of the largest financial penalties against a corporation in U.S. history. Meta's chief legal officer, C.J. Mahoney, said the company is confident it will prevail on appeal.
This is not the only New Mexico judgment against the company in 2026. In a separate earlier state court ruling, Meta was ordered to pay nearly $1 billion in civil penalties and abatement, meaning court-ordered funds to remedy the harm, for misleading the public about the safety of its products. Earlier in the case, Reuters reported a jury-ordered total of $375 million, calculated as 75,000 violations at $5,000 each.
The penalties also sit alongside a wider settlement track. Meta settled kids online safety complaints brought by most other state attorneys general for $17.1 billion. Of that amount, $5.3 billion is contingent on YouTube and TikTok installing similar measures.
The broader context here is the arithmetic. Per-violation statutes, which set a fixed fine for each separate infraction, scale quickly when the unit of violation is a user-facing interaction on a platform with billions of accounts. The distance between the $219 billion theoretical exposure and the $25 billion ordered indicates how much the outcome depends on judicial discretion within that range. An appeal will have to address both the counting of violations and whether a penalty of this size is proportionate under the statute. Neither question is settled by the ruling itself.
In my view, the more lasting effect may be on product engineering rather than on Meta's balance sheet. Claims about consent flows (the screens that ask users to agree to data use), data access controls and content moderation are being litigated as representations about how a product works. That makes these behaviors measurable and auditable in a way that a privacy policy alone is not. For teams building consumer platforms, that gives a clearer target: controls that can be demonstrated, logged and tested, rather than merely described. Whether the appellate process narrows or upholds the ruling will determine how far that lesson travels.
