Source: JURIST
Meta Platforms has been ordered to pay 25 billion dollars in civil penalties after a New Mexico court found that Facebook repeatedly misled consumers about its data privacy practices, third-party access to personal information, and its handling of misinformation and hate speech. New Mexico Attorney General Raul Torrez announced the penalty on 21 October 2026, calling it a landmark victory for consumers and warning that powerful technology companies cannot operate beyond the reach of the law. The order is one of the largest financial penalties ever imposed on a corporation in US history.
What the court actually found
The decision follows a jury verdict from 25 September that found 43,899,720 wilful violations of New Mexico’s Unfair Practices Act. The findings covered 26 public and internal representations made between May 2010 and August 2021, including statements by Mark Zuckerberg and former chief operating officer Sheryl Sandberg. On privacy specifically, the evidence included internal communications where Zuckerberg acknowledged that users probably do not understand their current privacy settings, and findings that third-party developers could access information about users’ friends even where users believed their settings restricted that access.
The Cambridge Analytica scandal was central to the case. Facebook publicly promised in 2014 to stop apps from accessing friends’ data, yet trial evidence suggested the company planned exceptions for certain business partners. After the scandal broke in 2018, Facebook promised to investigate misusing apps, remove bad actors, ensure improperly obtained data was deleted and notify affected users. The jury found the company failed to deliver on those commitments despite internal evidence that it knew its investigation and enforcement measures were inadequate. The court also noted that an earlier 5 billion dollar FTC penalty had failed to deter the conduct.
Why this matters far beyond the US
This case was brought under consumer protection law, but the underlying pattern is exactly what European data protection authorities prosecute under GDPR: a gap between what a company tells users and what it actually does with their data. The difference is that in Europe, the enforcement machinery is already running, with regulators empowered to impose fines of up to 4 percent of global turnover. Any business that collects personal data, shares it with partners or embeds tracking tools should read this verdict as a preview of the standard that regulators and courts now apply to privacy promises. If your organisation wants an honest review of whether its privacy statements match its actual data flows, or help preparing for GDPR scrutiny before someone else finds the gap, contact Excello Digital at https://excello.digital/contact/. We help European businesses audit, document and fix their privacy posture before it becomes a courtroom exhibit.