New Mexico orders Meta to pay $25 billion over privacy practices

New Mexico case produces a $25 billion order

A New Mexico judge has ordered Meta to pay $25 billion in a case tied to the long-running Cambridge Analytica data scandal. The order followed a two-week trial in which a New Mexico jury found that the company behind Facebook and Instagram committed 43 million violations of the state’s consumer protection laws.

Each violation carried a $5,000 penalty, producing the multibillion-dollar total. Meta has said it will appeal the decision. New Mexico Attorney General Raúl Torrez said at a press conference that the outcome could fund the construction of schools for the next 100 years.

What the jury considered

Part of the case concerned Meta’s handling of a third-party app linked to the Cambridge Analytica data breach. Other elements examined the company’s data-privacy policies and its efforts to mitigate misinformation on its platforms.

Cambridge Analytica emerged from the British defence contractor SLC Group, which specialised in influence operations and political work. The firm worked with Donald Trump’s 2016 presidential campaign and became associated with a series of controversial initiatives.

The New Mexico ruling adds to the legal and regulatory consequences facing Meta over platform practices. The broader pattern also includes claims about youth protections: multistate claims over Meta child safety places the company’s handling of child safety at the centre of a separate multistate case.

Why the decision matters to organisations

The size of the order illustrates how consumer-protection enforcement can turn large volumes of alleged platform conduct into substantial financial exposure when penalties are assessed per violation. The appeal means the final outcome remains unresolved, but the jury’s 43 million-violation finding is central to the current judgment.

For organisations that rely on social platforms or process user data, the practical implication is to maintain clear controls over third-party access, privacy policies and platform governance, with records that can demonstrate how those controls are applied.