Key points
- Meta must pay $25 billion for misleading users about data privacy practices in New Mexico.
- The ruling stems from violations linked to the Cambridge Analytica scandal and the 2016 election.
- The company faces ongoing scrutiny over its AI tools and hardware despite previous settlements.
A New Mexico judge ordered Meta to pay a $25 billion penalty on Wednesday after a jury found the company misled users regarding its data privacy practices. This decision represents one of the largest corporate fines ever issued against a technology firm, marking a significant legal milestone for social media accountability.
The court imposed civil penalties for violating New Mexico’s Unfair Practices Act, with the jury identifying nearly 44 million individual violations of that state law. According to CNET, the case traces back to the Cambridge Analytica privacy breaches associated with the 2016 presidential election, where user data was accessed without proper consent.
Legal context and financial scale
Meta attempted to limit its financial exposure by filing motions to cap the penalties at $3.45 billion, but the court rejected these efforts. The company may still choose to appeal the verdict. Some legal estimates had suggested the potential liability could reach as high as $219 billion, making the final $25 billion figure a substantial but lower-than-expected outcome for the firm.
New Mexico Attorney General Raúl Torrez stated that the penalty order demonstrates real consequences for violating consumer protection statutes. He emphasised that the result proves no corporation is too powerful to be held accountable for misleading its users about how their personal information is handled and shared.
Who is affected and what data is involved
The ruling specifically impacts users of Meta-owned platforms, including Facebook and Instagram, who were misled about their data privacy settings. The core issue involves the handling of personal data that was previously exposed through third-party applications, most notably during the Cambridge Analytica incident. This data was used to influence political outcomes, highlighting the severe risks associated with unchecked data harvesting.
Meta has faced multiple legal challenges recently, including an $18 billion settlement with US states over allegations that its platforms were designed to be addictive and harmful to children. Additionally, the company paid hundreds of millions in New Mexico for failing to warn the public about dangers posed by its services to young users.
Our take on the response
Despite these massive financial penalties and ongoing legal battles, Meta’s approach to privacy and product design appears unchanged. According to CNET, the company continues to face weekly criticism for privacy overreach, particularly regarding its new Muse agentic AI platform and Meta Glasses hardware. The lack of a confirmed operational shift suggests that legal fines alone may not alter the company’s fundamental business practices.
What affected people can do
Security teams should audit how users interact with third-party applications connected to social media accounts. Review permission settings to ensure minimal data access is granted to external services. Monitor for phishing attempts that reference this legal ruling to trick users into revealing credentials. Encourage users to regularly review their privacy dashboards and remove unnecessary app connections. Stay alert for fraudulent communications claiming to offer refunds or legal aid related to this case.
What to do and how to stay safe: Meta
- Review connected third-party applications in your social media settings and revoke access for unused services.
- Enable multi-factor authentication on all social media accounts to protect against credential theft.
- Monitor account activity logs for unfamiliar logins or unusual data access patterns.
- Be sceptical of unsolicited messages offering compensation or legal advice related to this verdict.
Step-by-step guide: Detect Online Tracking: Signs in Logs, Browsers and Network Traffic
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much did Meta have to pay in the New Mexico ruling?
Meta was ordered to pay a $25 billion penalty for misleading users about data privacy practices.
What law did Meta violate in this case?
The jury found Meta liable for violating New Mexico’s Unfair Practices Act with nearly 44 million violations.
Can Meta appeal this decision?
Yes, Meta could appeal the verdict, although it previously failed to cap its penalties at a lower amount.