Meta faces $25 billion penalty in New Mexico privacy ruling

Meta faces a $25 billion penalty in New Mexico over Facebook’s handling of users’ personal data and its response to the Cambridge Analytica scandal, marking another major legal setback for the social media giant over its privacy practices.

A court filing released recently said State District Court Judge Francis Mathew reduced the penalty from an initial $220 billion award after a jury found in September that Facebook had violated New Mexico’s unfair practices law 43 million times. Each violation carried a potential civil penalty of up to $5,000.

The ruling also imposes annual interest of 15% on the penalty until it is paid, according to the filing.

The case stems from the Cambridge Analytica scandal, which came to public attention in 2018 after revelations that Facebook had shared the personal data of as many as 87 million users with the British political consulting firm. Cambridge Analytica used the information to build psychological profiles of voters and support targeted political advertising, including in the 2016 US presidential election.

New Mexico’s lawsuit focused not only on Facebook’s data-sharing practices but also on what the company told users about their privacy, its handling of misinformation and hate speech, and its ability to enforce its own safeguards, according to a statement from state Attorney General Raúl Torrez’s office.

Judge cites deliberate deception by Facebook

In his ruling, Mathew pointed to the scale and persistence of the violations, as well as evidence that senior executives knew the company could not fulfil its public promises about protecting users.

“The scale, duration, repetition, breadth, and willfulness of the violations,” combined with evidence of Facebook’s internal knowledge and practices, amounted to substantial aggravating circumstances, the judge wrote.

The filing highlighted the roles of CEO Mark Zuckerberg and former chief operating officer Sheryl Sandberg, alleging that senior leadership helped shape a coordinated public relations strategy to respond to the scandal. Internal materials used for that response were referred to as a “song sheet”, according to the ruling.

The court said Facebook continued telling users they had control over their data and that the company could address third-party misuse, misinformation and hate speech, even after employees, researchers and senior personnel had identified gaps between those assurances and its actual capabilities.

The filing also said the company knew users could not independently verify its claims about data access and enforcement procedures.

Promised investigation fell short

The judge found that Facebook failed to deliver the comprehensive investigation it had promised after the Cambridge Analytica revelations.

According to the filing, the company lacked the ability to conduct such a thorough investigation or ensure that improperly accessed data had been deleted. Poor record-keeping and inadequate scrutiny of third-party developers were cited as key shortcomings.

The court also criticised Facebook’s approach to investigating app developers, saying pressure to contain costs, weak enforcement mechanisms, ineffective investigative methods and concerns about setting precedents contributed to what Mathew described as a “willfully ineffective” investigation.

The findings place the spotlight on a central issue in the case: whether Facebook’s public assurances about privacy and accountability matched the protections it could actually deliver.

Meta vows to challenge the ruling

Meta rejected the ruling and said it would appeal.

“The ruling and Torrez’s approach to the enforcement makes it all but impossible to do business in the state of New Mexico,” Meta Chief Legal Officer C.J. Mahoney said in a statement.

The company also argued that the lawsuit sought to impose restrictions on online expression, saying it aimed to “impose a tax on speech to enforce new rules for what people can say online”.

The dispute follows another major legal setback for Meta in New Mexico. In March, a jury awarded the state $375 million in damages after finding that the company had violated state law in connection with its online safety practices involving children.

Meta has also faced substantial financial consequences over the Cambridge Analytica scandal and other privacy-related disputes. These include a $725 million settlement in a class-action lawsuit over the scandal in 2022 and a separate settlement with several state attorneys general that included a $459 million penalty.

Privacy advocates call for stronger accountability

Digital rights advocates welcomed the growing legal pressure on Meta and other major technology companies, arguing that the cases could push platforms to become more transparent about how they collect, use and protect personal information.

“The message from these state actions is evident: companies must be accurate and clear about how they process and treat data,” Eric Null, director of the Privacy and Data Project at the Center for Democracy and Technology, said in an email.

He added that states should continue enforcing existing laws and strengthen privacy legislation if companies fail to improve their practices.

The New Mexico ruling underscores the growing legal and financial risks facing technology companies over their handling of personal data. However, with Meta planning an appeal, the final outcome of the case remains unresolved.