How the case developed
The New Mexico Attorney General filed the lawsuit in 2021 after the Cambridge Analytica scandal and, instead of joining a multistate settlement, took the case to trial. In September 2026, the jury found 26 public statements made between May 2010 and August 2021 unlawful and willful. The statements, some of them by Mark Zuckerberg and Sheryl Sandberg, appeared in Facebook’s Newsroom, on earnings calls, in media interviews and at conferences. On 21 October, Judge Francis J. Mathew issued the judgment.
How 26 statements became 43.9 million violations
The jury counted one violation for each New Mexican in the reasonably anticipated audience of each statement: 1,386,648 people (Facebook’s monthly active users in the state as of June 2020) or 2,100,000 people (the state’s entire population). A single interview could thus generate up to 2.1 million violations, each punishable by up to USD 5,000. In total, the 26 statements produced 43,899,720 willful violations; with the five unconscionable trade practices found by the jury (see below), the total is 43,899,725.
What the jury found unlawful
Facebook told users they controlled their data. In fact, the audience settings users saw did not limit what third-party developers could obtain through the API; that depended on a separate set of settings most users did not know existed. The court cited Mr. Zuckerberg’s internal email acknowledging that users probably did not understand their privacy settings.
In 2014, Facebook announced that “friend sharing” would end for everyone, although it had been planning exemptions for favoured business partners for more than a year and never disclosed them to users. After Cambridge Analytica, it promised to investigate all apps with access to large amounts of data, audit suspicious ones, ban developers misusing data, ensure deletion and notify all affected users. Over three years, it conducted only 14 forensic “audits” and relied on developers’ self-certification of deletion. It also narrowed its definition of misuse and notified users about only two apps out of the thousands identified as misusing data.
Facebook overstated its ability to remove hate speech and misinformation and claimed to apply its Community Standards equally. Meanwhile, its CrossCheck system kept violating content from high-profile accounts online during additional review, which took about twelve days on average in the U.S.
In each area, Facebook had internal information contradicting its public statements, and employees had flagged the problems. The jury also found unconscionable trade practices in each of the five subject areas: Facebook took advantage of users’ lack of knowledge to a grossly unfair degree.
The penalty and its rationale
The court held that the record supported the USD 5,000 maximum per violation and awarded USD 219.5 billion, then reduced it to USD 25 billion in the same sentence without explaining how it reached that figure. The reduced amount is about 12% of Meta’s 2025 revenue of USD 201 billion, which the court recorded in its findings. Interest accrues at 15% per annum until payment. The State had sought USD 35-40 billion; Meta argued for no more than USD 3.45 billion.
The court refused to use the USD 5 billion FTC settlement of 2019 as a benchmark: earlier penalties and consent orders had not deterred Meta, and Meta’s violations of the FTC consent orders were treated as an aggravating factor. The court also noted that the U.S. Supreme Court has not held that the Eighth Amendment’s Excessive Fines Clause applies to corporations, and that under the Due Process Clause a statutory penalty is invalid only if it is so severe and oppressive as to be wholly disproportionate to the offence and obviously unreasonable.
Injunctive relief is reserved pending further briefing. Meta has said it will appeal.
Why this matters beyond New Mexico
This is New Mexico’s second win against Meta in 2026. In March, a jury imposed USD 375 million in civil penalties in a separate child safety case, and in August the court ordered Meta to pay another USD 567 million into an abatement fund. State attorneys general are using general consumer protection statutes, not privacy laws, to penalise gaps between what technology companies say and what they do.
In our review of the FTC case against the Genesis Tech app network, we noted that U.S. regulators treat interface design and marketing as part of a deceptive practice. The New Mexico judgment applies the same approach to executive interviews, blog posts and earnings calls. For products available in the EU, similar risks arise under the Unfair Commercial Practices Directive rules on misleading practices and under Article 14(4) of the Digital Services Act, which requires intermediary service providers to apply and enforce their terms and conditions in a diligent, objective and proportionate manner.
REVERA Recommendations
- Check what you say about privacy, security and moderation in privacy policies, App Store privacy labels, Google Play Data safety forms, marketing materials, blog posts and executive interviews against actual data flows and moderation practices.
- Avoid absolute wording (“everyone”, “never”, “full control”) where exceptions exist, such as partner integrations or legacy API access, or disclose those exceptions.
- Send public statements flagged internally as inaccurate to legal review before repeating them. Internal emails, research and policy documents were core evidence against Meta.
- Fulfil and document post-incident commitments on audits, data deletion and user notifications, or publicly revise them.
- Verify how third-party developers and SDK providers handle user data instead of relying on their self-certification: vet them at onboarding, log access and audit deletion.
- If your product has U.S. users, assess exposure to state consumer protection laws, including penalties calculated per member of the audience.
REVERA’s Arbitration & IT Disputes practice is ready to check your public statements on privacy and content moderation against actual practices, review user documentation and app store disclosures, and assess regulatory and litigation risks in the jurisdictions where your product is available.
