Meta Hit With $25 Billion Penalty for Deceiving Facebook Users

A New Mexico judge has ordered Meta, Facebook’s parent company, to pay $25 billion for misleading users about their privacy, personal data, and content moderation.

The October 21 ruling follows a jury verdict finding nearly 44 million violations of state consumer-protection law. The case grew out of the Cambridge Analytica scandal and exposed more than a decade of deceptive practices involving users’ personal information.

From Cambridge Analytica to New Mexico

The case traces back to the 2018 Cambridge Analytica case, which revealed how personal information from as many as 87 million Facebook users reached a British political consulting firm.

Cambridge Analytica used the data to develop psychological profiles and target political advertising, including during Donald Trump’s 2016 presidential campaign.

The scandal exposed a troubling feature of Facebook’s business model. Third-party applications could collect information not only from people who installed them, but also from their Facebook friends, often without their knowledge.

In 2019, the Federal Trade Commission (FTC) fined Facebook $5 billion for violating an earlier privacy agreement. The agency accused the company of misleading users about their ability to control personal information.

Facebook acknowledged a breach of trust and promised stronger privacy controls and greater oversight of outside developers.

New Mexico, however, pursued its own case rather than join a broader settlement with other states. Its lawsuit, filed in 2021, challenged Facebook’s privacy practices and public representations.

The trial began in September 2026. Jurors examined 29 public statements by Facebook executives and company representatives. On September 25, they found 26 of them deceptive, amounting to 43,899,725 violations of the New Mexico Unfair Practices Act.

The conduct spanned more than 11 years, from May 2010 through August 2021.

Privacy Promises

The court’s 20-page judgment details how Facebook misled users about its handling of their personal information.

Facebook repeatedly assured users that they controlled their data. Former operating chief Sheryl Sandberg publicly declared:

We don’t sell your data and we don’t tell advertisers who you are.

Yet Facebook’s advertising business depended on collecting personal information and using it to target users. As one expert testified, Facebook effectively sold “everything but your name.”

The company’s privacy controls also offered less protection than users might reasonably expect. Restricting who could view a post did not necessarily prevent outside developers from accessing its information.

The court highlighted a revealing internal exchange between Facebook founder Mark Zuckerberg and executive Chris Cox. Zuckerberg observed that users:

probably don’t understand their current privacy settings or care about who sees their updates.

Rather than address that confusion, Zuckerberg proposed taking advantage of it to encourage greater public sharing:

Give them a chance to change their privacy settings but obviously don’t encourage it.

He also proposed gradually making more information public while managing users’ expectations.

The judge characterized Facebook’s conduct as a “systematic pattern of deception at the core of Facebook’s business model.”

Data Misuse

The verdict also scrutinized Facebook’s response to Cambridge Analytica.

After the scandal erupted, Facebook promised to investigate outside applications with extensive access to user information. It pledged to audit suspicious developers, ban offenders, and notify affected users.

Yet the court found that Facebook knew it lacked the systems needed to fulfill those commitments.

Its internal investigation identified at least 2,000 applications associated with data misuse that should have triggered notifications under the company’s original promises. Instead, Facebook narrowed its definition of misuse and ultimately notified users about only two applications.

The court also found that at least 1,146,225 New Mexico Facebook users had data affected by the applications examined. That represented more than 80 percent of the state’s monthly active Facebook users in 2020.

Sandberg herself recognized the scale of the problem. In an internal email after the scandal broke, she warned:

there were a MILLION developers with access to the data.

She anticipated further revelations of misuse.

The findings suggested that Cambridge Analytica was hardly an isolated failure. It exposed a much broader problem involving Facebook’s extensive collection of personal information and its limited control over outside access.

Misinformation, Hate Speech, and Unequal Rules

The jury also examined Facebook’s public promises about content moderation.

The company assured users that it removed harmful misinformation, did not profit from hateful content, and applied its Community Standards consistently. Jurors found several of these representations deceptive.

Internal documents revealed that Facebook operated a system known as CrossCheck, which granted certain prominent accounts special treatment when moderators reviewed potentially prohibited content.

Some influential users could remove offending posts before facing penalties. Others received additional reviews unavailable to ordinary users. The evidence also raised questions about political influence over moderation decisions.

These findings underscore the difference between a private company’s right to establish content policies and its obligation to describe those policies truthfully.

The verdict did not require Facebook to censor more speech. Rather, it found that the company misrepresented how it enforced its own rules, a distinction that could become important on appeal.

A $25 Billion Judgment

Under New Mexico law, courts can impose penalties of up to $5,000 per willful violation. Judge Francis Mathew initially calculated $219.5 billion in penalties, then reduced the amount to $25 billion, with 15 percent annual interest.

Meta plans to appeal. Its chief legal officer, C.J. Mahoney, argued,

At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online.

Legal experts told Reuters that Meta has substantial grounds to challenge the penalty. Among the key questions is whether the state can calculate millions of violations based on the estimated audiences for misleading statements without proving that individual consumers actually encountered them. Constitutional protections against excessive fines could also become central to the appeal.

The deeper controversy, however, goes far beyond consumer privacy.

A Larger Threat

Even more troubling are Meta’s extensive ties to the federal government. During the 2020 and 2022 election cycles, Meta maintained regular contacts with the FBI, the Department of Homeland Security (DHS), and its Cybersecurity and Infrastructure Security Agency (CISA).

In 2024, Zuckerberg acknowledged that the Biden administration had repeatedly pressured Facebook to restrict Covid-related content. He also admitted that the company wrongly limited circulation of reporting about Hunter Biden’s laptop before the 2020 election.

Zuckerberg himself poured hundreds of millions of dollars into organizations supporting election administration in 2020.

That record did not prevent President Donald Trump from appointing him to a White House technology advisory council in March 2026.

The relationship reaches into the military as well. In June 2025, Meta’s chief technology officer, Andrew Bosworth, joined the U.S. Army Reserve as a lieutenant colonel under Detachment 201, a program that recruits senior technology executives as advisors for military innovation.

Meta’s ties to the administration also extend into federal AI and defense programs.

Taken together, these relationships raise a danger considerably greater than corporate exploitation of personal information. A technology giant that collects intimate details about billions of people, shapes the information they encounter, and possesses powerful tools for political influence is also becoming increasingly integrated into government and military operations.

That convergence raises fundamental questions about privacy, political independence, and the boundaries between private enterprise and state power. It does not establish that Meta shares its users’ private data with federal agencies, but it creates legitimate concerns about oversight, conflicts of interest, and the potential abuse of concentrated informational power.

The New Mexico verdict addresses corporate deception. Yet financial penalties do little to resolve the larger question of what happens when the corporations controlling Americans’ digital lives become closely intertwined with the government itself.