Meta Ordered to Pay $25 Billion Over Facebook Privacy Deceptions

A New Mexico judge on Wednesday ordered Meta to pay $25 billion for systematically misleading Facebook users about their privacy, after a jury found 43.9 million willful violations of state law. The judge ruled $219.5 billion was warranted but reduced the award; the state had sought up to $40 billion.

The order, filed Wednesday morning in state district court in Santa Fe, ends the penalty phase of a case New Mexico filed in 2021 in the wake of the Cambridge Analytica revelations — the first state-led case of its kind to reach a jury verdict. By law, the money goes to New Mexico's schools, and at $25 billion it is more than twice the state's entire annual budget.

What the judge decided

The 20-page judgment, filed at 10:51 a.m. on October 21 in the First Judicial District Court for Santa Fe County, converts the jury's September verdict into money. The jury had found that Meta committed 43,899,720 willful violations through unfair or deceptive trade practices, plus five more through willful unconscionable trade practices — 43,899,725 willful violations in total.

New Mexico's Unfair Practices Act allows up to $5,000 per violation. At that ceiling, the arithmetic the court adopted is exact: 43,899,720 × $5,000 = $219,498,600,000. The judge concluded that figure was warranted — then cut it to $25 billion. Interest runs at 15% a year until Meta pays, and the court reserved any injunctive relief for later briefing, which means court-ordered changes to Facebook's products remain on the table.

The New Mexico Department of Justice called it one of the largest financial penalties against a corporation in U.S. history. The full judgment — findings of fact, conclusions of law and the penalty order — is published on the department's site.

The penalty math

Three ratios put the number in perspective. The $25 billion is about 11% of what the judge found warranted — a steep reduction, but still five times the $5 billion FTC penalty from 2019, the previous record for the same Cambridge Analytica scandal. It equals roughly two and a half quarters of Meta's reported profit — the company earned $9.86 billion in the third quarter — and about 12% of the $200.97 billion in 2025 revenue cited in the judgment. And at 15%, the interest meter alone adds $3.75 billion a year while Meta appeals, nearly 40% of a quarter's profit annually, before a dollar of the principal is touched.

Eleven years of statements

The violations were not a single incident. The 26 representations the jury found unlawful and willful span more than eleven years, from May 24, 2010 through August 18, 2021, and they were made through Facebook's own platform, its newsroom, earnings calls, national television and print interviews, and public conferences. The expected audience for each statement was either Facebook's 1,386,648 monthly active users in New Mexico or the state's roughly 2.1 million residents — that audience math is how 26 statements became 43.9 million violations.

Among the speakers were Facebook's most senior leaders, including chief executive Mark Zuckerberg and then-chief operating officer Sheryl Sandberg. The court found the communications were "part of a coherent strategy designed to mislead the public," citing internal messaging materials — called a "song sheet" — used to coordinate external messaging across company representatives and forums. In one instance, an internal communication to Zuckerberg himself warned that proposed public communications were misleading.

A private email from Zuckerberg to another senior executive, shown at trial, captured the internal view of users: that they "probably don't understand their current privacy settings or care about who sees their updates" — and laid out a plan to change those settings without users noticing, rolling features out so that "stream info is available but the names are perhaps somewhat obscured," then adding last names back "once we set the proper user expectation."

The judgment goes to the business model itself. One expert testified that Facebook "sell[s] everything but your name," and a company witness confirmed that the advertising platform requires user data to function — and that users can neither stop Facebook's collection of their data nor turn off ads. The court concluded the misrepresentations "were not isolated incidents, but rather a systematic pattern of deception at the core of Facebook's business model."

The investigation that wasn't

The most detailed findings concern what Facebook promised after the Cambridge Analytica revelations in March 2018 — and what it actually did. The company publicly committed to investigate every app with access to large amounts of user data, conduct full audits of suspicious apps, ban developers misusing data, ensure improperly obtained data was deleted, and notify affected users.

The court found the resulting App Developer Investigation "willfully ineffective." Over three years, Facebook conducted only 14 forensic data "audits" — and even those were known to be inadequate, with the auditor expressly disclaiming any independent verification of what developers reported. Internal materials identified about 116 developers, covering roughly 125,000 apps, that Facebook ultimately banned. On deletion, the company's own documents acknowledged there was "no reasonable enforcement/verification approach" and that the policy goal was in part "to optimize for external optics."

On notification, the gap is stark: Facebook told users of only two apps that misuse had occurred. Its investigation had identified at least 2,000 apps associated with data misuse that should have triggered notifications — including 234 apps engaged in bulk collection of friends' data and 671 that kept friends'-data access after the cutoff. The company deliberately narrowed its internal definition of data misuse so it would not have to notify as many people, "due to the operational burden of doing so." Of the misusing apps, 1,585 could be tied to New Mexico accounts, affecting at least 1,146,225 New Mexicans — more than 80% of Facebook's New Mexico user base. Facebook shut the investigation down in March 2021 without telling the public it had ended.

The findings also cover content moderation. Internal research showed Facebook's systems recommending groups and pages containing known misinformation, and its CrossCheck system letting policy-violating content from high-profile accounts stay up for an average of twelve days. In one internal exchange, an executive withheld information about hate-speech enforcement failures from a news outlet, and Sandberg replied: "This is awesome."

Why $25 billion, not $219.5 billion

The judge found "substantial aggravating circumstances" — the scale, duration, repetition, breadth and willfulness of the violations, plus the involvement of senior leadership — that supported the maximum $5,000 per violation. He then reduced the total on proportionality and due-process grounds, the same constitutional concern the state's own lawyer had flagged when asking for $35–40 billion rather than the full $219.5 billion.

Meta's main proportionality argument — that it already paid $5 billion to the FTC — was rejected outright. The court ruled that settlement "cannot be viewed in a vacuum," noting the FTC's docket including subsequent litigation over violations of those very agreements. In the judge's words: "Facebook's wrongdoing — over the course of years and systematically broadcast to the public — goes to the heart of Facebook's core business practices."

Meta will appeal. Its chief legal officer, C.J. Mahoney, said the company is confident it will prevail, calling the ruling one that makes it "all but impossible to do business in the state of New Mexico" and describing the lawsuit as an attempt "to impose a tax on speech." Attorney General Raúl Torrez countered that the judgment should be "a clear warning to everyone in big tech" — and noted that New Mexico, unlike nearly every other state, refused to settle and took the case to trial.

A second legal bill

Investors should not confuse this penalty with the one already on Meta's books. The $9.89 billion legal charge that held Meta's third-quarter profit to $9.86 billion came from a separate August agreement with 52 state attorneys general over teen mental-health litigation, a framework providing for payments of up to about $18.59 billion. The $25 billion New Mexico judgment is additional, unaccrued, and — for now — unpaid, with the 15% interest clock running while the appeal proceeds.

What to watch

The appeal. Meta's challenge will test two things: whether executive statements about privacy and content moderation are protected speech, and whether stacking per-violation penalties into the tens of billions survives due-process review. The company has shown it will litigate for years — the interest meter is the price of that strategy.

Injunctive relief. The court reserved the question pending further briefing. A penalty is a number; an injunction could compel changes to how Facebook collects data, vets developers, or enforces its rules — remedies the judge noted cannot be modeled in advance, which is precisely why they matter.

The fourth quarter. Meta has not accrued the $25 billion. Watch whether its Q4 accounts recognize any portion of it, and how management frames the exposure on the next earnings call.

The copycats. New Mexico was the holdout; other attorneys general settled. A $25 billion verdict — even one cut from $219.5 billion — reprices what "take it to trial" means, and every statehouse with a consumer-protection statute just took notice.