Meta Faces Historic $25 Billion Penalty in New Mexico as Facebook’s Long-Running Data Privacy Scandal Returns to the Spotlight

Meta, the parent company of Facebook and Instagram, has been ordered to pay US$25 billion in civil penalties to the US state of New Mexico after a court found that the company misled users about data privacy and its platform practices. The ruling, delivered on October 21, 2026, marks a major development in the long-running legal fallout from the Cambridge Analytica scandal. Meta has said it will appeal.

The case began in 2021 when New Mexico sued Meta, alleging that Facebook misled users about how their personal information was shared with third parties and how the platform handled harmful content. The lawsuit followed revelations that Cambridge Analytica, a political consulting firm linked to Donald Trump’s 2016 presidential campaign, had obtained personal data from as many as 87 million Facebook users through a third-party application. The information was used to build voter profiles for political advertising, raising widespread concerns about online privacy and the misuse of personal information.

In September 2026, a jury found that 26 of 29 statements made by Facebook and its leadership about privacy and platform practices were misleading. Jurors identified nearly 43.9 million violations of New Mexico’s consumer protection law. Under state law, each violation could attract a penalty of up to US$5,000, leading to a potential fine exceeding US$219 billion. Judge Francis Mathew ultimately reduced the penalty to US$25 billion.

New Mexico Attorney General Raúl Torrez welcomed the decision, describing it as a significant step towards holding major technology companies accountable for their treatment of consumers. The state pursued the case independently rather than joining settlements reached by other states over related privacy claims. The penalties are intended to benefit New Mexico’s public education system.

Meta has disputed the findings, arguing that the case misrepresents its record on privacy and its efforts to protect users. The company maintains that it has strengthened its privacy policies and security measures since the Cambridge Analytica scandal. It has also argued that the ruling could have wider implications for how technology companies manage their platforms and communicate with users.

The case highlights the lasting consequences of the Cambridge Analytica controversy, which prompted investigations, regulatory action and renewed demands for stronger data protection. It also comes amid wider legal scrutiny of Meta over user safety and the impact of its social media platforms.

Although the US$25 billion penalty is a major legal setback for Meta, the company’s planned appeal means the dispute is unlikely to end immediately. The outcome could have broader implications for how technology companies disclose their data practices and how governments enforce consumer protection laws in the digital age.