On October 21, Judge Francis Mathew of New Mexico's First Judicial District ordered Meta to pay the state $25 billion, the civil penalty for the more than 43 million violations of the state's Unfair Practices Act that a Santa Fe jury found in September (Bloomberg Tax). The state filed the suit in January 2021 over Cambridge Analytica, a scandal the public first learned of in March 2018 (New Mexico Department of Justice). Meta says it will appeal. The number deserves attention less for its size than for its method: a per-violation statute, applied to every user who might have read a sentence, has produced a penalty five times the FTC's record privacy fine.
Twenty-six statements, 1.4 million users, $5,000 apiece
The trial opened on September 8. On September 25, jurors found 26 of 29 Meta statements false or deceptive, and five of its practices unconscionable. They sided with the state on 31 of 34 counts, covering users' control of their data, enforcement of hate speech and misinformation rules, how evenly community standards were applied, and Facebook's promise to investigate after Cambridge Analytica. Each statement was counted against at least 1.4 million New Mexicans, the estimated number of Facebook users in the state in 2020, which is how the state's trial lawyer reached 43,899,720 violations.
The jury did not take everything on offer. The state failed to prove deception in statements about removing graphic violence and fake COVID cures, fact-checking, and taking down hate-crime and terrorism posts after Charlottesville.
The statute allows up to $5,000 per violation, roughly $219 billion at the maximum. The state asked for $35 billion to $40 billion; Meta's lawyers argued for no more than $3.4 billion. Mathew chose $25 billion, citing the "clearly intentional and systemic nature of Facebook's repeated misstatements" (Bloomberg Tax). By our arithmetic that is about $570 per violation, a little over 11% of the cap. The judgment accrues interest at 15% a year until paid, the money is earmarked for a state education fund, and the state is still pursuing an injunction.
From a personality quiz to the biggest number in the room
The underlying facts are old. About 270,000 people took the personality quiz at the center of the case; its reach through friend connections exposed data on nearly 350,000 New Mexicans, and its developer sold the data to Cambridge Analytica for more than $800,000, according to the state's pre-trial fact sheet. Facebook itself disclosed in April 2018 that up to 87 million people had been affected. The federal answer came in July 2019: a $5 billion FTC penalty for violating a 2012 order by deceiving users about their privacy controls, which the agency described as almost 20 times larger than any privacy or data-security penalty imposed anywhere before.
Most states have since closed that chapter. In August, Meta agreed to pay up to $17 billion over ten years to settle youth-harm claims brought by a coalition that California, which led it, counts as 51 attorneys general; AP describes the deal as $18 billion signed by 48 states. Bloomberg Law reports the package also bought a release of all remaining state Cambridge Analytica claims for $459 million, with New Mexico and Washington, DC, as the holdouts. Meta took a $9.89 billion charge for the August agreement in the third quarter, and its 10-Q shows total legal accruals of $19.9 billion at September 30, against $7.3 billion at the end of 2025. For scale, New Mexico's judgment equals about 41% of Meta's 2025 net income of $60.46 billion, by our arithmetic.
New Mexico went to trial instead, and not for the first time this year: its separate child-safety case produced a $375 million jury penalty in March and a $567 million abatement order in August.
Meta's grounds, and the state's reply
Meta's chief legal officer, C.J. Mahoney, said the ruling makes it "all but impossible to do business in the state of New Mexico," and that the company is confident of winning on appeal (Source NM).
The arguments are already on the record. Meta's lawyers told the court the state proved neither misleading privacy statements nor harm from content moderation, and that counting violations by everyone who might have seen a statement is unprecedented. Attorney Matt Nicholson put it plainly at the October 1 hearing: "The jury didn't make findings that any New Mexican heard or saw these statements" (AP). Meta also argues that the law cannot reach New Mexicans who never used Facebook, and that an award ten times its proposed $3.4 billion would violate due process (AP). Mahoney has framed the suit as an attempt to tax speech by dictating what people can say online, and after the verdict Meta asserted a First Amendment right to manage its platforms.
The state's position is just as clear. Its lawyers argued that all New Mexicans, not only Facebook users, were deceived. Attorney General Raúl Torrez called the outcome possibly the largest single-state verdict against a company in American history and said he expects Meta to appeal. Bloomberg Law has noted that those appeals could stretch on for years or reverse verdicts. One neutral marker: the award is a little over seven times Meta's own proposed ceiling. Whether appellate judges accept the per-viewer counting theory is the open question, and we found no sourced forecast worth passing on.
The 30,000-foot read
The largest federal privacy penalty on record is still the FTC's $5 billion from 2019. New Mexico's figure came from a verdict form and a calculator: statements multiplied by audience, priced per unit. Audience is the thing platforms are built to maximize, so under this theory scale stops being only a moat and becomes a multiplier on exposure. Most states traded their Cambridge Analytica claims away in August, but the method has now been tested before a jury, and every attorney general can read a verdict form.
For product teams, the lesson sits closer to the sprint board than the courtroom. The liability attached less to the data flow than to the words around it: settings, help pages and policy copy that promised a control the platform's permissions did not deliver, plus moderation claims that did not match enforcement. Audit what your interface says against what your permission model actually allows, especially for third-party and friend-of-user access. What to watch: post-judgment motions and the appeal, the injunction New Mexico still seeks, and the Cambridge Analytica suit that Washington, DC, kept out of the August deal. If the counting theory survives review, the industry's biggest privacy number will no longer be set by federal regulators. It will be set one state at a time, one sentence at a time, multiplied by everyone who might have read it.
Sources: AP, via ABC30 (judge, $25 billion, 43 million violations, the $35 billion to $40 billion ask, Meta's $3.4 billion, due-process and non-user arguments, Nicholson quote, the state's whole-population argument, education fund, injunction, "$18 billion, 48 states" description); Bloomberg Tax (Unfair Practices Act, $5,000 cap, $219 billion maximum, the judge's quote, Torrez's "largest" claim, Mahoney's speech argument; case No. D-101-CV-202100132); Source NM, republished by Daily Montanan, Oct. 21 (15% interest, Mahoney quote, Torrez expecting appeal); Source NM, republished by Daily Montanan, Sept. 25 (31 of 34 counts, subjects of the findings, claims the state did not prove); Albuquerque Journal (26 of 29 statements, five unconscionable practices, 1.4 million users, 43,899,720 violations, the March and August child-safety awards, Meta's First Amendment statement); New Mexico Department of Justice pre-trial fact sheet (filing date, trial date, 270,000 quiz takers, nearly 350,000 New Mexicans, the $800,000 sale, March 2018 disclosure; primary, but the state's own advocacy document); Engadget (Facebook's April 2018 "up to 87 million" disclosure); FTC ($5 billion penalty, 2012 order, the "almost 20 times" comparison); California Attorney General (up to $17 billion over ten years, 51 attorneys general, subject to court approval); Bloomberg Law ($459 million Cambridge Analytica release within the package, holdouts, appeal timeline); Bloomberg, via Deccan Chronicle (New Mexico and DC as Cambridge Analytica holdouts with pending suits); AP, via ClickOnDetroit ($9.89 billion third-quarter charge); Meta Q3 2026 Form 10-Q (legal accruals and the footnote tying them to the August multistate agreement); Meta Q4 and full-year 2025 results (2025 net income). CAVEATS: no court order or Attorney General press release for the penalty could be retrieved, so the ruling rests on AP, Bloomberg Tax and Source NM, which agree on the judge, the amount and the date. Sources disagree on the August settlement: California's Attorney General says up to $17 billion over ten years from 51 attorneys general, while AP and Bloomberg Law say $18 billion across 48 states; treat both counts as approximate, and note that the deal was mainly a youth-harm settlement that bundled a separate Cambridge Analytica release (a correction to our discovery notes, which described it as a Cambridge Analytica settlement). The 270,000, 350,000 and $800,000 figures come from the state's fact sheet, not court findings; Facebook's own 2018 newsroom post could not be loaded, so the 87 million figure is cited via Engadget's report of it. The $9.89 billion charge is AP's figure. The 10-Q's legal-proceedings note could not be read in full, so we could not confirm how Meta's filing describes the New Mexico case or whether anything is accrued for it. The $570 per violation, 11% of the cap, seven-times and 41% of net income figures are our arithmetic.