Meta ordered to pay New Mexico $US25 billion for deceiving users about privacy on Facebook

The order is a civil penalty against Meta, Facebook’s parent company. New Mexico’s judge imposed US$25 billion after a jury found that Facebook deceived users about privacy. The ruling matters because it treats repeated privacy statements as violations of state consumer protection laws, rather than as isolated mistakes.

The jury found more than 43 million violations. The state argued that Facebook promised users control over their information while its actual practices did not match those assurances. Judge Francis J Mathew wrote that Facebook’s deception was intentional and that executives consistently misled users about how the platform worked.

Meta strongly disputes the ruling. Its chief legal officer says the company expects to win on appeal and argues that the case threatens online speech and business in New Mexico. Interest will accrue during the appeal, although Meta might reduce the number of violations counted.

Liability under a state’s consumer protection laws means a company can be held legally responsible for conduct that misleads consumers or violates protections for them. It is a finding of responsibility, not necessarily a criminal conviction. A court can then order a penalty or other remedy under the relevant state law.

In New Mexico, jurors found Meta liable for more than 43 million violations. They accepted the state’s argument that Facebook made misleading public statements about how it handled users’ personal data. The case focused on privacy promises and conduct linked to data obtained through a third-party personality quiz.

The finding does not end the dispute. Meta argues that New Mexico failed to prove misleading privacy statements and says the penalty is unconstitutional and violates due process. The company plans to appeal, so a higher court could reduce the violations or change the award.

The alleged violation was enormous in count and value. Jurors found Meta liable for more than 43 million violations of New Mexico consumer protection laws. Each violation related to misleading public statements about Facebook’s handling of users’ personal information.

The resulting US$25 billion award far exceeds Facebook’s US$5 billion fine from the Federal Trade Commission in 2019. The scale surprised Peter Ormerod, a Villanova University associate law professor, who said the New Mexico figure was unlike previous Cambridge Analytica-related settlements. He calculated it at about US$12,000 per person in New Mexico.

The final amount may not be settled soon. Meta’s lawyers argued that the state failed to prove its case and that the award should be no more than US$3.4 billion. During an appeal, interest will accrue, but Meta could succeed in reducing the number of violations.

Facebook’s public message was simple: users controlled their information. Mark Zuckerberg wrote in a 2010 Washington Post opinion article, “You have control over how your information is shared.” He also wrote, “We do not and never will sell any of your information to anyone.”

New Mexico’s lawyers argued that these promises created a clear expectation about privacy. The jury found the statements misleading because Facebook’s handling of personal data did not provide the control users were promised. The case focused on claims that a third-party personality quiz obtained data from about 87 million profiles.

Judge Francis J Mathew said Facebook’s deception was intentional and that executives consistently misled users about how the platform worked. Meta denies that it made misleading privacy statements. The company says the state’s enforcement approach imposes new rules on online speech and says it will appeal.

Cambridge Analytica was a now-defunct political consulting firm. The article links it to the privacy case because it obtained Facebook user data through a third-party personality quiz. That data became central to accusations that Facebook misled users about how their information could be used.

The quiz was the key pathway described in the case. It harvested information from about 87 million Facebook profiles, and the data was sold to Cambridge Analytica. The firm then used it to generate targeted political advertisements during the 2016 election season. The article does not provide further technical details about the quiz.

New Mexico used this episode to challenge Facebook’s public privacy assurances. Prosecutors argued that users were told they controlled their information, while the quiz-related breach showed data could be obtained and used in ways they did not expect. The jury found Meta liable for related consumer-protection violations.

Meta’s next step is an appeal. Its chief legal officer, CJ Mahoney, said the company is confident it will prevail. The appeal could challenge both the finding of liability and the size of the award, so the US$25 billion order may not be the final amount.

The penalty does not simply disappear during the legal process. Interest will accrue while the appeal is pending. Meta could nevertheless succeed in reducing the number of violations for which it is found liable. Its lawyers also argued that the award violates due process and is unconstitutional.

That process could delay payment for years. The article says New Mexico may have to wait years before seeing any money while the appeal continues. If the state eventually receives the penalty, its constitution directs fines from consumer-protection violations toward state education spending.

Social-media companies commonly make money from advertising rather than charging users directly. Personal data can help them understand audiences and show advertisers messages to people who may be more interested in them. The article does not explain Meta’s full business model, but it centers on the privacy risks created by data use.

The conflict is straightforward. Advertisers value precise audiences, while users may expect control over who receives or uses information about them. In this case, New Mexico focused on Facebook’s promise that users controlled their data. The state connected that promise to data from a personality quiz that reached about 87 million profiles and was sold to Cambridge Analytica.

That tension gives privacy promises practical importance. If a company’s public assurances do not match its data practices, regulators may treat the mismatch as consumer deception. Meta argues this case creates impossible rules for doing business and says it will prevail on appeal.