A state court in New Mexico has ordered Meta to pay $25 billion in civil penalties, ruling that Facebook misled users about how much control they had over their personal data. According to SecurityWeek, which carried the Associated Press report, it is the biggest fine ever imposed on the company. Meta says it will appeal.

The order, announced on October 21 by New Mexico Attorney General Raúl Torrez, follows a September jury verdict that found Meta liable for 43,899,725 violations of the state's Unfair Practices Act. That works out to roughly $570 per violation. "This is a historic day for New Mexico and for consumers across the country," Torrez said in the state Department of Justice's announcement.

Judge Francis J. Mathew's ruling was direct. "Facebook promised users that they (the users) controlled their data," he wrote, as quoted by SecurityWeek. "This was false." According to the same report, the judge wrote that Facebook's deception was intentional and that executives consistently misled users about how the platform worked.

A Case That Started With Cambridge Analytica

New Mexico filed the suit in 2021, The Hacker News reports, in the aftermath of the Cambridge Analytica scandal. That episode involved a personality-quiz app called thisisyourdigitallife. Around 300,000 people are said to have taken the quiz, but the app also collected data tied to their Facebook friends, building a dataset of 87 million profiles for the political consulting firm Cambridge Analytica.

According to the New Mexico Department of Justice, the lawsuit went beyond the scandal itself and challenged Facebook's statements to consumers about three things: its data practices, third-party access to personal information, and its handling of harmful content. In the state's telling, the case rested on Facebook's representations to consumers, brought under the state's consumer-protection law, rather than on a breach in the usual sense.

That distinction matters. The case was not about a hacker defeating Facebook's defenses. It was about the gap between what the company said in public and how its platform actually worked, including the third-party access to personal information that the state put at issue.

How It Stacks Up Against Earlier Penalties

Meta has paid large sums over Cambridge Analytica before. The Hacker News lists a $5 billion Federal Trade Commission fine in 2019 and a $725 million class-action settlement in December 2022. The New Mexico penalty is five times the FTC figure.

It also comes two months after a much broader settlement. SecurityWeek reports that in August, Meta settled with nearly all U.S. states and territories, except New Mexico and Florida, for $18 billion, and agreed to add stronger child-safety measures to Facebook and Instagram. The Hacker News adds that the $18 billion is paid over the next decade. New Mexico, according to its Department of Justice, pursued its case independently rather than joining a multistate settlement. Its single-state penalty is now larger than that multistate deal.

Meta's Response

Meta disputes the ruling. Chief Legal Officer C.J. Mahoney said the lawsuit "seeks to impose a tax on speech," SecurityWeek reports, and said Meta is confident it will prevail on appeal. The company also said the state's approach to enforcement "makes it all but impossible to do business in the state of New Mexico." So the $25 billion figure is not final. An appeals court could cut it, overturn it or uphold it.

Why a State Consumer-Protection Law Did This

The legal vehicle here was New Mexico's Unfair Practices Act, a state consumer-protection statute. The state's Department of Justice described the result as showing the importance of state consumer protection statutes as a tool for holding technology companies accountable. These laws were not written with social networks in mind, but the case rested on a simple idea: a public statement to consumers about their data has to be true.

The penalty was driven by the count. The jury found nearly 44 million violations, and the judge imposed roughly $570 on each on average. A platform with millions of users can accumulate violation counts quickly, which is why the arithmetic here is so striking. Whether other state attorneys general follow this approach is a question the sources do not answer, but the New Mexico Department of Justice says the case demonstrates the state's willingness to use its independent enforcement authority.

What It Means for Defenders

No patch, CVE or indicator of compromise comes with this story. The risk here is legal and governance risk, and the ruling still matters to security and IT teams, because they are often the people who know whether a company's privacy claims are true.

Who is affected: In the narrow sense, Meta. In the wider sense, any organization that tells customers how it collects, shares or protects their data: SaaS providers, app developers, retailers, healthcare and financial firms, and federal contractors whose privacy notices and security statements go out to the public. The court's reasoning, as quoted, targets the gap between what a company says and what it does, and that gap can exist at a company of any size.

What to check:

  • Read your own privacy policy and marketing copy against your actual data flows. If the policy says users "control" their data, make sure they can actually see, export and delete it, and that deletion reaches backups and downstream processors. Judge Mathew's finding turned on exactly this kind of claim.
  • Inventory third-party access. The Cambridge Analytica episode began with a third-party app that collected data tied to users' friends as well as its own users. List every API integration, OAuth app, SDK, analytics tag and data-sharing partner that can reach customer data, record what scopes each one holds, and revoke the ones you can't justify.
  • Enforce data minimization at the API layer. Grant third parties the narrowest permissions that work, expire tokens, and log what partners actually pull. Then you can prove your sharing statements are accurate.
  • Make security and privacy staff part of public-claims review. Statements like "we never share your data" or "your data is encrypted end to end" should be signed off by someone who can verify them technically, not only by legal and marketing.
  • For CMMC and federal contractors: the same lesson applies to security attestations. A self-assessment or public security statement that doesn't match the systems behind it is a liability, and this case shows how large penalties can become when every instance is counted.

Mitigations the sources give: None of the three sources lists technical fixes. The case is about deception, and the remedy the court imposed is financial. The practical defense is to keep your public data-handling claims accurate, documented and auditable, and to treat any mismatch between policy and practice as a finding you have to fix.

The appeal will decide whether Meta actually pays $25 billion. Either way, the ruling shows that a broken privacy promise can lead to a judgment in the tens of billions of dollars in a single state court.

Sources