Meta has been ordered to pay $25 billion following a New Mexico court ruling on Wednesday, stemming from data privacy breaches connected to the Cambridge Analytica affair that surfaced nearly a decade ago. A jury determined in September that Meta violated the state's unfair practices law on 43 million separate occasions for its involvement in the incident, which a whistleblower exposed in 2018, with each violation subject to civil penalties reaching $5,000.
State District Court Judge Francis Mathew reduced the original award of $220 billion to the current $25 billion figure, according to court documents. The company will accrue 15% annual interest on the outstanding balance until payment is complete.
The dispute centers on Facebook, owned by Meta, which disclosed approximately 87 million users' personal information to Cambridge Analytica, a British political consulting operation. That firm leveraged the information to construct voter psychological profiles for purposes of microtargeted advertising campaigns, including during the 2016 presidential election.
New Mexico's Attorney General Raúl Torrez pursued the case by examining Facebook's public statements regarding data handling practices and its efforts to manage misinformation and hateful content following the scandal's emergence.
Judge Mathew emphasized in his ruling that "The scale, duration, repetition, breadth, and willfulness of the violations, together with the evidence concerning Facebook's internal knowledge and practices … constitute substantial aggravating circumstances."
The court document highlighted that top-ranking Facebook executives, including CEO Mark Zuckerberg and then-COO Sheryl Sandberg, orchestrated a deliberate campaign to deceive the public. This strategy involved overseeing the development of materials referred to internally as a "song sheet" to manage public relations messaging.
"Facebook continued making public representations concerning users' control of data, third-party data misuse, misinformation, hate speech, and equal enforcement after employees, researchers, and senior personnel had internally identified that Facebook could not make good on its public promises," the filing stated, with the court noting Zuckerberg's awareness of the deception.
The platform deliberately withheld from users the fact that information about its data access systems and enforcement procedures could not be independently verified, exploiting this information asymmetry to its advantage, according to the court filing.
Facebook also neglected to deliver on the "comprehensive" investigation it had pledged to undertake following the public disclosure of the scandal, Judge Mathew determined.
"Facebook was aware at the time it made the promises that it did not have the ability to conduct such a thorough investigation or enforce deletion of the data due in large part to Facebook's poor record keeping and failure to vet third party developers at the time they were granted access to user data," the filing explained.
Directives from senior management to control expenditures, inadequate enforcement systems, deficient investigative procedures, and reluctance to establish precedent for subsequent inquiries rendered Facebook's App Developer Investigation deliberately ineffectual, according to Mathew's assessment.
Meta's Chief Legal Officer C.J. Mahoney responded to the decision by stating, "The ruling and Torrez's approach to the enforcement makes it all but impossible to do business in the state of New Mexico. At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online." The company announced its intention to challenge the ruling.
Torrez previously secured $375 million from Meta in March after a jury concluded the technology company had violated state regulations concerning children's online safety protections.
Meta has already incurred substantial financial consequences related to the Cambridge Analytica matter. The company paid $459 million as part of a broader $17 billion settlement reached in August with multiple state attorneys general investigating the firm's child safety conduct. Additionally, Meta resolved a class action lawsuit connected to the scandal in 2022 through a $725 million settlement.
Privacy advocates have praised the momentum building through state-level enforcement actions targeting Meta and comparable technology firms for data privacy infractions.
"The message from these state actions is evident: companies must be accurate and clear about how they process and treat data," stated Eric Null, director of the Privacy and Data Project at the Center for Democracy and Technology. "If companies don't improve their practices, states should ratchet up the pressure by continuing to hold companies accountable under current law and updating their privacy statutes to prevent such harms from happening in the first place."
