For most of the last decade, the Cambridge Analytica scandal has been filed under tech history: a cautionary tale, a $5 billion FTC settlement, a round of congressional hearings, a corporate rebrand. On Wednesday, a state judge in Santa Fe reopened the file and attached a new price tag. Judge Francis Mathew ordered Meta to pay New Mexico $25 billion after a jury concluded the company had spent years misleading the public about how Facebook handled its users’ data. It is the largest penalty Meta has ever faced, and it came not from Washington or Brussels but from a state of roughly two million people.
The headline number matters less than the legal theory behind it. Meta was not punished for a hack, a leak, or a single bad decision. It was punished for the gap between what it said and what its systems actually did.
The math of deception
New Mexico sued in 2021 under its Unfair Practices Act, a consumer-protection statute built for misleading advertising, not software platforms. Last month, after a two-week trial, jurors found Meta had committed more than 43 million violations, covering conduct between 2010 and 2021. They agreed that 26 of 29 public statements by the company and its leadership on privacy and content moderation were misleading, including claims about how its hate-speech rules were enforced.
At up to $5,000 per violation, the statutory ceiling was roughly $219.5 billion. Mathew cut that to $25 billion, but added teeth: the sum grows by 15 percent for every year it goes unpaid. In his ruling, he described the deception as reaching the core of how Facebook does business. Meta’s chief legal officer, CJ Mahoney, said the decision makes it “all but impossible to do business in the state of New Mexico” and promised the company would win on appeal.
How the data walked out the door
To understand why “lies” is the operative word, you have to look at the plumbing. From 2010 until 2015, version 1.0 of Facebook’s Graph API let third-party developers request not only an installing user’s data but also information about that user’s friends: likes, birthdays, locations and more. Consent was effectively transitive. One person tapping “Allow” on a personality quiz could hand over the profiles of hundreds of people who never saw the app.
That is how researcher Aleksandr Kogan’s quiz, installed by roughly 270,000 people, became a pipeline to data on as many as 87 million users, later used by Cambridge Analytica to build targeted political ads. Meanwhile, Facebook’s privacy settings told users they were in control. Those controls governed what other people could see on your profile; they said far less about what a friend’s app could quietly pull through an API. Facebook closed the friend-data loophole in 2015 and asked Cambridge Analytica to certify that it had deleted what it collected, a promise the company never independently verified.
In other words, the system worked as designed. The design simply contradicted the marketing copy. Juries grasp that kind of contradiction instinctively, which is exactly what makes this case dangerous for the rest of the industry.
Why it matters now
First, it reframes privacy enforcement. Breach cases usually require proof of concrete harm, which is notoriously hard to establish for leaked data. Deception cases require only a mismatch between public statements and actual practice, multiplied by the number of people who heard those statements. Every privacy policy, settings toggle and keynote promise becomes potential evidence.
Second, it confirms that the states are now the front line. Meta paid $459 million this summer to settle Cambridge Analytica claims with dozens of other states. New Mexico declined to join that deal and walked away with a judgment more than 50 times larger. It is Attorney General Raúl Torrez’s third courtroom win against Meta this year, after earlier verdicts over child safety. Other attorneys general are doing the arithmetic.
Third, the timing is pointed. Today’s flashpoint isn’t a quiz app on a social network; it’s AI. Companies are making sweeping assurances about whether conversations train models, how long data is retained, and what “private” means inside an assistant that can read your inbox. Those assurances are the 2026 equivalent of Facebook’s 2012 privacy settings page. If the underlying data flows don’t match the promises, New Mexico’s formula — count the statements, count the people, multiply — applies just as neatly.
The takeaway
Meta will appeal, and $25 billion may well shrink. But the lesson for engineers and executives is already clear: privacy is no longer a compliance checkbox or a settings menu. It is a factual claim about how a system behaves, and courts are now prepared to audit it line by line. For users, the verdict is a reminder that “you’re in control” is a statement worth interrogating. Every so often, someone finally does.
