A New Mexico judge has ordered Meta to pay $25bn because Facebook misled people about privacy after the Cambridge Analytica scandal. The size of the award, and what it was for, should make every UK board look hard at the gap between its privacy promises and what its controls actually do.
What happened
On Wednesday 21 October 2026, Judge Francis Mathew of New Mexico’s First Judicial District in Santa Fe set the penalty at $25bn. Interest runs at 15 per cent a year until the sum is paid. The judgment follows a September jury verdict that held Meta responsible for upwards of 43 million breaches of the state’s Unfair Practices Act. Each breach carried a civil penalty of up to $5,000, so the theoretical maximum was more than $200bn. The state had asked for between $35bn and $40bn.
The case was brought in 2021 by Attorney General Raúl Torrez’s office. It was not about the harvesting of Facebook data as such. It was about what Facebook told the public afterwards about data access, privacy settings and content moderation. Most other US states settled with Meta in August. New Mexico stayed out of that deal, which is why its claims went to trial.
The judge’s findings are severe. He wrote that senior leadership, including Mark Zuckerberg and Sheryl Sandberg, was aware that the company’s public assurances could not be met. He also found that the investigation into app developers that Facebook promised after the scandal was “willfully ineffective”. Torrez said the judgment should be “a clear warning to everyone in big tech”, and said the money will go to the state’s education fund. Meta’s chief legal officer, C.J. Mahoney, called the lawsuit “a tax on speech” and said the company will appeal. The violation count could still be reduced on appeal.
The detail
The violation count is what makes this ruling unusual. Jurors looked at 34 separate statements by Facebook about privacy and moderation. The state’s argument was that those statements misled the whole population of New Mexico, not only people with Facebook accounts. The jury agreed, and each person exposed to a misleading statement became a separate violation. That is how a fairly small state reached a figure in the tens of millions. Meta’s lawyers argue that the jury made no finding that any resident saw the statements or was harmed by them. That point is likely to be at the centre of the appeal.
The underlying facts go back almost a decade. A personality quiz app collected data from about 87 million Facebook profiles, including friends of people who used the app. The data went to Cambridge Analytica, a British political consultancy that built voter profiles for targeted advertising and collapsed in 2018.
The judge’s criticism is less about a breach than about governance failure. In his account, Facebook made public promises about data control and third-party enforcement after its own staff had flagged that it could not keep them. Poor record keeping, weak vetting of developers and pressure to keep costs down meant the promised clean-up could not have worked.
Why it matters for UK organisations
This case has a direct UK history. In October 2018 the Information Commissioner’s Office fined Facebook £500,000 over the same harvesting, which affected at least one million UK users. The ICO found breaches of the first and seventh data protection principles, covering fairness and security. That was the maximum the Data Protection Act 1998 allowed, and the regulator said then that the fine would have been much higher under GDPR. Eight years later, one US state has imposed a penalty tens of thousands of times larger over the same events. The difference is that New Mexico treated the statements made after the breach as the offence.
UK law does not count violations person by person in this way. UK GDPR caps fines at £17.5m or 4 per cent of global annual turnover, whichever is higher. The direction of travel is still the same. Since February 2026 the Data (Use and Access) Act 2025 has brought maximum PECR fines up to UK GDPR levels. And UK GDPR’s transparency and accountability principles already mean a privacy notice, a security statement or a breach notification can be tested against the evidence.
Many UK firms also sell into the US. Their privacy policies, trust centre pages and post-incident statements are visible in every state. If a statement is false or cannot be checked, it is now a liability in its own right, separate from whatever went wrong technically.
Expert view
In my experience, the most dangerous document after an incident is the holding statement, not the forensic report. It is drafted in hours, often by people far from the technical detail. The New Mexico ruling turns that habit into a measurable risk. The state did not need to prove harm from the original data loss. It was enough that the company said things it knew it could not deliver.
The detail about the developer investigation matters to anyone who manages third-party risk. According to the judge, Facebook could not enforce deletion because it did not have reliable records of who had access to what. When we test supplier ecosystems, the same gap comes up again and again. API keys and OAuth grants go to partners and are never reviewed. If you cannot list your data recipients, you cannot honestly promise to claw the data back.
I would not overstate the immediate legal read-across. A US consumer protection statute with per-person counting is a very different instrument from UK GDPR, and an appeal may cut the figure substantially. But regulators and claimant firms in the UK read these judgments. The idea that misleading privacy statements are a harm in their own right is now firmly on the record.
What to do now
- Check public claims against your controls. List every external statement about data handling, encryption, retention and access, and match each one to evidence. Remove or rewrite any claim that cannot be backed up.
- Write incident communications templates in advance. Agree wording that states only verified facts and commits to updates. Make legal, security and communications sign-off a step in the incident response plan, not an afterthought.
- Know who has your data. Keep a live register of third parties, integrations and API grants with access to personal data. Review it at least quarterly, and remove unused accounts and tokens. This lines up with the Cyber Essentials user access control requirements.
- Make deletion enforceable. Write audit and deletion rights into supplier contracts, and test them. A right you have never exercised is a promise you cannot verify.
- Brief the board. Present privacy-statement accuracy as a governance risk, using the Cyber Governance Code of Practice and Article 5(2) UK GDPR accountability as the framework.
Bottom line
A $25bn penalty for misleading privacy statements, rather than for a breach itself, puts accountability on a new footing. UK organisations do not face New Mexico’s arithmetic. They do face regulators and claimants who increasingly compare what a company says with what it can prove. Make sure your public promises match your controls before someone else checks.
Sources
- The Record: Meta on the spot for $25 billion under New Mexico privacy ruling
- Engadget: Meta ordered to cough up $25 billion in New Mexico privacy case
- ABC News: Meta ordered to pay New Mexico $25 billion for violating consumer protection laws
- ABC7 / Associated Press: Judge orders Meta to pay $25 billion for violating New Mexico law
- ICO: Investigation into the use of data analytics in political campaigns (November 2018)
