A New Mexico state court ruled on October 21, 2026, that Facebook had deceived consumers in its statements about data use and other practices, and ordered its parent company, Meta, to pay the state a $25 billion civil penalty. The court set the penalty after a jury found violations in September, and it also ordered 15% annual interest until the penalty is paid in full. The lawsuit grew out of the Cambridge Analytica data misuse scandal, but the court's concerns went beyond that. At issue was the gap between what Facebook said publicly and how it actually operated, including its later reviews and its notifications to users. The violation count of roughly 43.9 million also does not reflect the number of people whose data was misused. It was built by adding up repeated statements and the audience each one was reasonably expected to reach.
Why 26 statements became about 43.9 million violations
The unlawful conduct consisted of 26 statements made over more than 11 years, from May 24, 2010, to August 18, 2021. According to the ruling of the First Judicial District Court of New Mexico, the jury counted, for each statement, the number of people in the state who could reasonably be expected to have been in its audience. The calculation used either the state's monthly user count as of June 30, 2020 (1,386,648) or a figure approximating the state's population (about 2.1 million). The statements at issue were made through channels including television interviews, earnings calls and Facebook's own communications.
Because the same user may have seen or heard multiple statements, that person could be counted repeatedly in each statement's expected audience. So about 43.9 million distinct victims were not identified. The violation count grew by multiplying the number of statements the court found problematic by the number of people each was expected to have reached. The ruling found a total of 43,899,725 violations, but the penalty was calculated on 43,899,720 of them. Five violations of a separate category were not included.
Based on Finding of Fact 3, Conclusions of Law 7–9 and Order paragraph 1, the violation counts and penalty breakdown are as follows.
| Item distinguished in the ruling | Count / amount | Meaning |
|---|---|---|
| Knowing violations of the unfair or deceptive practices provision | 43,899,720 | Audiences added up; used to calculate the penalty |
| Knowing violations of a separate category (unconscionable trade practices) | 5 | Found separately from the above |
| Penalty before reduction | $219,498.6 million | 43,899,720 × $5,000 per violation |
| Penalty ordered | $25 billion | Amount after the reduction stated in the order |
Judge Francis J. Mathew found that the conduct was repeated over a long period and involved senior executives, among other factors, and concluded that applying the $5,000-per-violation maximum under the state's Unfair Practices Act was appropriate. Multiplying that by the 43,899,720 violations used for the calculation produces a total of $219.4986 billion. The amount ultimately ordered was reduced to $25 billion, however, and the order does not set out the specific formula that produced the reduced figure. The table assigns no separate penalty to the five violations found in the separate category.
At trial, Meta cited its $5 billion settlement with the U.S. Federal Trade Commission (FTC) and argued that proportionality with earlier penalties should be considered. The court responded that comparison with the settlement amount alone is not enough, and that earlier orders, agreements and subsequent lawsuits must also be taken into account. To understand the $25 billion figure, it is necessary to distinguish between the amount mechanically derived from the violation count and the amount the court ultimately ordered.
Restricting an audience didn't stop data sharing with outside apps
At Facebook, the feature for setting who can see a post and the system controlling data access by outside apps were managed separately. According to the ruling, even when a user restricted a post's audience on screen, the same restriction did not always apply when outside developers retrieved data through an API. An API is a mechanism that lets outside apps connect to Facebook's systems and obtain information. Under this structure, a person's information could be obtained through an app used by a friend, even if that person never used the app.
In 2014, Facebook announced it would end this sharing of friends' data and set a transition deadline of May 2015. But according to the ruling, exceptions allowing continued data access remained in place for some influential partner companies afterward. Facebook did not tell users that these exceptions existed, creating a gap between the belief of users who thought limiting an audience would also limit sharing and how the system actually worked. This, however, is a finding about conduct at the time, and the court did not find that the same problem remains in every current Facebook setting.
The court found that discrepancies between statements and actions persisted even after the Cambridge Analytica scandal surfaced in March 2018. Facebook had promised to investigate outside apps and said it would conduct audits if it found suspicious activity. It also said it would confirm that improperly obtained data had been deleted and notify affected users. The court did not find that these promises had been adequately fulfilled.
According to the ruling, in its review of app developers from March 2018 to March 2021, Facebook carried out only 14 forensic audits. A forensic audit is a technical investigation into improper data collection or use, and Facebook reportedly relied mainly on developers' own statements to confirm whether data had been deleted. In addition, after narrowing internally the definition of conduct counted as "misuse of data," Facebook notified users in cases involving only two apps. The court, by contrast, found that at least 2,000 apps involved misuse that should have been reported to users.
A company that says it properly manages data sharing needs an investigation system able to identify problematic apps, as well as a mechanism to confirm deletion of improperly obtained data and notify affected users. The ruling highlights that being able to choose a sharing scope on a settings screen is a separate matter from whether actual data access is managed in line with that setting. Whether the protections promised to users were upheld in back-end operations became one of the issues in dispute.
Misinformation measures and even-handed rule enforcement were also at issue
The court examined more than statements about the handling of personal data. Also at issue were Facebook's handling of misinformation and hate speech and its statements that the same rules apply to all users. As a specific example, the ruling cites a system called "CrossCheck," which applied additional review to certain accounts. The court found that posts by influential partners and public figures could remain visible until the additional review was completed, and that removal of violating posts could be slower than for ordinary accounts.
Facebook had said it treats users fairly, but in practice the length of time violating posts stayed up differed by account. The problem was less the existence of an additional review system itself than the gap between such special treatment and public statements. The state did not win on every claim, however. On the jury verdict form, the jury did not find a violation proved in either Question 9 or Question 16, which concerned statements that Facebook removes posts that lead to real-world harm, such as violence or false COVID-19 cures. Other statements about misinformation, among others, were found unlawful, so the judgments differed from statement to statement.
Beyond the $25 billion penalty, changes to operations are still to be considered
The ruling imposes 15% annual interest on the $25 billion penalty until it is paid in full. Simply multiplying the $25 billion principal by 15% gives $3.75 billion per year. That is a simple calculation based on the interest rate, however, and does not represent the final burden once future legal proceedings and the actual timing of payment are taken into account. Beyond the size of the penalty, what changes to Facebook's operations may be required will also be important.
The court indicated that it will decide on injunctive measures, including orders to change conduct, after receiving additional written submissions. In other words, although payment of $25 billion has been ordered, what new measures Facebook must take on data-sharing settings and notification of misuse has not been determined. As a precedent, the FTC's 2019 settlement with Facebook required, in addition to the $5 billion penalty, an independent privacy committee on the board and quarterly compliance certifications by the CEO and others. That settlement resolved a federal proceeding over alleged violations of a 2012 FTC order and is separate from this ruling under New Mexico law, but it illustrates how monetary penalties and measures overseeing future operations play different roles.
If the court orders injunctive measures, the focus is likely to be how access to data by outside apps is managed and how investigations of misuse and notifications to users are verified. Whether a mechanism to check Facebook's published policies against actual operations will be required is also worth watching. How concrete the measures to ensure promises to users are kept become, in addition to the enormous $25 billion penalty, will be an important factor in judging what comes next.