Meta Ordered to Pay $25 Billion in New Mexico Privacy Case

Judge Francis Mathew of New Mexico's First Judicial District Court in Santa Fe ordered Meta on Wednesday 21 October 2026 to pay $25 billion in civil penalties for violating the state's Unfair Practices Act. The judgment follows a jury verdict in late September that found Facebook and Meta had committed close to 44 million violations of the law, Source New Mexico reported. CNN described the same verdict as more than 43 million violations.

Related reading: OpenAI, Anthropic, Google and Meta Testify Under Oath as New York Weighs Ten AI Bills · Trump and Six AI Chiefs Sign a Voluntary Frontier-Safety Accord, With No Enforcement.

The company will appeal. No money has changed hands, and the $25 billion is a judgment rather than a collection.

What the jury found

The jury sided with the state on 31 of 34 counts. The case was filed in 2021 and concerns Facebook's conduct around Cambridge Analytica. Facebook disclosed in 2018 that information on as many as 87 million users had been improperly obtained.

The verdict identified several categories of misrepresentation. The four the sources describe are users' ability to control their data, the company's efforts against hate speech and misinformation, the uniform application of its community standards, and its commitment to a thorough investigation after the Cambridge Analytica scandal became public. CNN summarizes the same findings. Reuters, AP and the Washington Post reported the penalty the same day.

Each item on that list describes a statement Meta made about its own conduct. None of them concerns what a user posted. The state's theory was that Facebook described its privacy and moderation practices in ways that did not match what the company did, and that those descriptions shaped what people handed over and what they expected in return.

A penalty set between the statutory cap and the request

New Mexico's Unfair Practices Act caps civil penalties at $5,000 per violation. Applied to the violation count the jury accepted, the cap produces a figure in the region of $220 billion, which is where the state's calculation of about $219.5 billion came from. New Mexico asked the court for up to $40 billion. Mathew awarded $25 billion, roughly a ninth of the statutory figure and well short of the request.

The distance between those numbers is the substance of the ruling. The judge accepted the scale of the violations and then set a price. In his written explanation, he cited "the extraordinary number of willful violations found by the jury, the duration and repetition of the conduct, the breadth of subjects on which violations occurred, the involvement of senior Facebook leadership, the size of the New Mexico audiences reached, and the clearly intentional and systematic nature of Facebook's repeated misstatements established in the trial record." Those factors, he wrote, supported "the highest level of penalty."

What the published accounts do not supply is the arithmetic that turns $219.5 billion of exposure into $25 billion. The judgment explains why the conduct warranted a severe penalty; it does not, in the reporting available, show a line-by-line calculation of the final number. That matters for anyone trying to read the award as a template, because the ratio between exposure and outcome is the part other states would need to replicate.

"Facebook's misrepresentations about users' control of their data were not isolated incidents, but rather a systematic pattern of deception at the core of Facebook's business model." — Judge Francis Mathew, New Mexico First Judicial District Court

Meta's answer: a tax on speech

Meta's response treats the case as a regulation of expression rather than a consumer-protection matter. Chief Legal Officer C.J. Mahoney said the ruling "makes it all but impossible to do business in the state of New Mexico," and framed the suit as an attempt "to impose a tax on speech to enforce new rules for what people can say online." He added that the company is confident it will prevail on appeal.

The framing is a legal strategy, and it will be tested in a higher court. The record described by the jury concerns commercial statements about data handling and moderation, which sit closer to advertising and disclosure law than to the First Amendment questions that govern what users may publish. Whether a state consumer-protection statute can reach those statements, and at what price, is a separate question from whether Meta can set its own content rules. The appeal is where that distinction will be argued.

There is also a practical argument buried in the company's statement. A penalty calculated per violation, multiplied across tens of millions of users, can exceed any reasonable relationship to the harm in a single state. That is the strongest version of Meta's case, and it does not depend on the speech framing at all. It depends on whether a per-violation formula written for a smaller consumer economy can be applied at platform scale without producing a number that no court would enforce.

Why one state, not fifty

The New Mexico case was brought by a single attorney general, not a coalition of states. Multistate actions usually pool resources and produce a settlement that all parties can present as a compromise. A lone state running its own case to judgment produces a number that belongs to one jurisdiction and a record that other attorneys general can read.

New Mexico was not part of the $18 billion multistate settlement that Meta agreed in August 2026 over youth-related social media claims. It pursued its own theory under its own statute, and it won a verdict that Attorney General Raúl Torrez described as "one of the largest, if not the largest, state-led recoveries and jury verdicts in American history." Speaking at a news conference, he added: "I think today's judgment from a state which admittedly is not very big in terms of population should be a clear warning to everyone in big tech."

Other states have their own consumer-protection statutes, their own penalty caps and their own courts. A verdict in Santa Fe does not bind a judge in another state, and the facts here are tied to a specific set of representations made over a specific period. What travels is the method: take internal documents, compare them with public statements, count the users reached, and let a jury decide whether the gap was deception.

The same week, different numbers

Meta reported third-quarter results on the same day the judgment landed. Revenue was $64.6 billion, up 26 percent year on year, and net income was $9.86 billion. The results included a $9.89 billion legal charge tied to the $18 billion multistate settlement agreed in August.

The two announcements arrived within hours of each other. The $25 billion judgment is a little under 40 percent of a single quarter's revenue. Meta booked a $9.89 billion legal charge in the same three months, and its stock rose more than 3 percent in after-hours trading. Capital expenditures reached $34.91 billion including finance lease principal, which CNN rounds to nearly $35 billion and describes as up 80 percent year on year. Full-year 2026 capital spending guidance is $135 billion to $145 billion.

Those numbers say that one judgment does not change Meta's capacity to spend. They do not say the total legal exposure is small. Add the $18 billion settlement, the nearly $1 billion Meta was ordered to pay in a separate New Mexico case earlier in 2026 over claims its platforms addicted and harmed young people, and the $25 billion judgment, and the cumulative figure approaches $44 billion. Each item is separate, and each can be appealed or reduced.

A cap written for a different internet

The $5,000 cap in the Unfair Practices Act is decades old. Torrez and a state lawmaker announced plans in September 2026 to revise the law in the next legislative session, which would change how future cases are priced. A higher cap would raise the ceiling on exposure. A lower one, or a formula tied to revenue or harm, would change the shape of the calculation entirely.

The cap does two things at once, which is why the overhaul matters beyond New Mexico. It produced a statutory figure of $219.5 billion, and it also anchored the per-violation price at a level written for a local consumer economy. Any state that wants to run the same playbook has to decide which of those effects it wants.

What the appeal changes

The appeal will take years, and the judgment may be reduced or overturned before any money moves. Interest continues to accrue in the meantime, which gives Meta a reason to resolve the case rather than let it sit, and gives the state a reason to defend the award in full.

The precedent value sits outside the courtroom as well. Attorneys general in other states now have a detailed public record of how a privacy case against a platform can be built and what a jury will accept. That record is eight years removed from the Cambridge Analytica disclosures. Privacy cases move slowly, and old conduct can stay actionable for a long time.

For now the record contains a jury verdict, a $25 billion judgment, an interest clause and an appeal Meta says it will file.

Cover image: The New Mexico State Capitol in Santa Fe. Photo by Jim Bowen, Wikimedia Commons, CC BY 2.0.