New Mexico court orders Meta to pay $25B over Cambridge Analytica incident

New Mexico's First Judicial District Court issued a landmark order for Meta to pay USD25 billion in civil penalties after a jury recently found the company liable for false statements it made about user privacy in connection with the Cambridge Analytica incident.

It has been almost a decade since the news broke about Cambridge Analytica, with Meta facing a raft of subsequent consequences stemming from the nonconsensual data harvesting of more than 87 million Facebook users in 2018. The latest penalty marks the most costly to date following August's USD18 billion multistate settlement, the Federal Trade Commission's USD5 billion settlement in 2019 and USD725 million class-action settlement in 2022.

The jury trial leading to Judge Francis Mathew's order found Meta and its executives liable for 43,899,725 violations of New Mexico's Unfair Practices Act. Mathew's ruling highlighted Meta's "extraordinary number of willful violations" and the "clear intentional and systematic nature of Facebook’s repeated misstatements" justified the USD5,000 per-violation penalty recommended by the New Mexico attorney general's office. The violations added up to USD219.5 billion before Mathew ultimately reduced the penalty.

"Facebook's wrongdoing — over the course of years and systemically broadcast to the public — goes to the heart of Facebook's core business practices," Mathew wrote. "It relates to the way in which Facebook induces people onto the platform and ultimately keeps them there."

The ruling is the result of litigation carried out by New Mexico Attorney General Raúl Torrez, who opted to forego joining fellow state attorneys general in the August settlement that covered Cambridge Analytica claims and children's online safety allegations. In a press conference highlighting the court's ruling, Torrez indicated the decision to carry on with his state's own claims and the end result "makes clear that no corporation is too powerful to be held accountable."

"This case has always been about more than one company or one scandal,” he added. "It is about whether corporations can mislead consumers about what happens to their personal information without facing meaningful consequences."

Meta has the opportunity to appeal Mathew's final judgment and Chief Legal Officer C.J. Mahoney expects a reversal.

"This ruling, and the attorney general’s approach to this enforcement, makes it all but impossible to do business in the state of New Mexico," Mahoney said in a public statement. "At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online."

Consumer protection in focus

Mathew's ruling represents the latest instance of state-level enforcers applying consumer protection law to privacy claims deemed unfair and deceptive in nature. While comprehensive state privacy laws may apply to certain practices, attorneys general have become more keen to tackling alleged misrepresentations about personal data collection and use than the processing activities themselves.

The FTC's 2019 consent agreement with Meta was aimed at bringing meaningful and long-lasting changes to company privacy practices and processes by way of required accountability and external oversight improvements, including privacy impact assessments for new products and enhanced third-party assessment of the company's privacy program. Comparatively, New Mexico's case leveraged steep penalties for alleged harm caused by deceptive claims to potentially foster organizational changes that will help avoid similar lawsuits.

In a 2026 midyear review of state privacy enforcement, Future of Privacy Forum Senior Policy Counsel Jordan Francis, CIPP/E, CIPP/US, CIPM, FIP, highlighted the trend around consumer protection and sectoral laws.

"There is nothing new about regulators bringing enforcement actions against companies that make deceptive statements or material omissions about their data practices, but those activities take on new significance when paired with a broader rise in privacy enforcement activity," Francis wrote. "Regulators have shown that they will not hesitate to use whatever levers are available to them if they think that a consumer's privacy is being violated."

Texas Attorney General Ken Paxton's office is among the enforcers casting a wide net to tamp down privacy harms. In recent years, Texas has invoked its Deceptive Trade Practices Act, Identity Theft Enforcement and Protection Act and the Biometric Identifier Act in instances where the state's comprehensive privacy law might be applicable.

As Texas' enforcement work ramped up in 2024, Kelley Drye & Warren Partner Paul Singer told the IAPP onlookers "should always expect" Texas' office "to rely on their bread and butter deceptive trade practice authority."

"The theories behind these actions aren’t overly complicated or unique," added Singer, who served two decades in the Texas attorney general's office and spent time leading the Consumer Protection Division and the office's privacy unit. "Some recent cases, for example, are heavily focused on misrepresentations in privacy policies and marketing to consumers. These same theories have been part of a number of actions over the years in a variety of industries."