Newsletter
On 21 October, a judge in the US state of New Mexico ordered Meta to pay $25 billion for misleading Facebook users about their privacy. It is one of the largest financial penalties ever imposed on a company in America, and it has an unlikely starting point: a personality quiz that appeared on Facebook more than a decade ago.
In 2014, Cambridge University researcher Aleksandr Kogan used a Facebook app that asked people to answer questions about their personalities. Around 250,000 to 270,000 Americans used the app and shared information from their Facebook profiles. They were hardly alone in taking online quizzes back then. Facebook was full of them, and few people thought much about the data behind the results.
The trouble was that the app could also collect information about those users' Facebook friends. These friends had never taken the quiz or knowingly agreed to participate. Facebook's systems allowed developers to reach beyond the person using an app, giving them access to parts of an entire social circle. Facebook later estimated that information from as many as 87 million accounts worldwide may have been improperly shared in the Cambridge Analytica scandal.
The information reached Cambridge Analytica, a British political consulting firm. It combined Facebook data with voter records to build personality profiles for political campaigning and targeted advertising. The firm worked with Donald Trump's 2016 presidential campaign, although how much influence such profiling actually had on voters remains disputed. What was clear was that millions of people had lost control of information they never intended to give a political consultant.
The arrangement became a global scandal in 2018. Mark Zuckerberg was summoned to testify before US lawmakers, Facebook faced investigations, and users began questioning how much its privacy settings really protected them. In 2019, the company agreed to pay a then-record $5 billion to the US Federal Trade Commission to settle allegations that it had violated an earlier privacy order. Facebook promised stronger safeguards and more oversight.
The $5 billion settlement did not end the legal scrutiny. New Mexico's attorney general filed another lawsuit in 2021, arguing that Facebook had repeatedly misled people about what happened to their data. The case examined public promises going back to 2010, well before the Cambridge Analytica revelations, and continuing until 2021.
One of those promises was about control. A user could choose who saw a Facebook post, perhaps limiting it to friends. But those visible privacy settings did not necessarily control what outside app developers could access through Facebook's systems.
According to the court's findings, Facebook knew about the gap between what users understood and how the platform actually worked. Internal communications showed that Zuckerberg had acknowledged people probably did not understand their privacy settings.
The judge also found that Facebook had told the public it was ending the practice of apps collecting friends' data, while quietly planning exceptions for favoured business partners.
The case extended into content moderation too. Facebook publicly promised to apply its rules equally, but an internal system called CrossCheck gave some celebrities, influencers and business partners additional review before their posts were removed. The court found that the company had continued making assurances even when its own employees had raised concerns.
In September 2026, a New Mexico jury concluded that 26 of the 29 public statements it examined were misleading or unfair under state consumer protection law. The jury counted nearly 43.9 million violations.
That does not mean 43.9 million different people in New Mexico had their data taken. The state has only about 2.1 million residents. Instead, the jury counted the estimated audience for each unlawful statement, allowing the same person to be included across multiple statements.
New Mexico law permits penalties of up to $5,000 for each wilful violation. Multiply that by the jury's count and the theoretical bill comes to roughly $219.5 billion.
Judge Francis Mathew cut it to $25 billion, still five times the federal privacy penalty Facebook agreed to in 2019. His order also says interest will accrue at 15% annually until the amount is paid.
Meta is contesting the decision. Its lawyers argue that New Mexico did not establish that individual residents actually saw the statements or suffered harm, and that a penalty of this size is unconstitutional. The company has said it intends to appeal, and if succeeds, the amount or the underlying verdict could change.
If the penalty is ultimately collected, the money is intended to go towards New Mexico's public education system rather than directly compensating individual Facebook users.
Facebook's advertising business helps explain why privacy became such a prolonged fight. People use its services without paying a subscription, while businesses pay to reach audiences using detailed targeting. Meta says it does not sell people's personal data to advertisers, and that is different from allowing outsiders to take user information. Still, both depend on how the company gathers, protects and uses what it knows about people.
Eight years after Cambridge Analytica became a public scandal, the legal argument has shifted from who obtained Facebook data to whether the company told users the truth about its systems.
Meta may yet reduce the penalty through an appeal. But the ruling has put a substantial financial cost on promises that were central to Facebook's growth. Users were encouraged to share information with the assurance that they controlled it. The court has now found that those assurances repeatedly failed to match how the platform actually operated.
For a business built on knowing its users, that is a problem no privacy-settings update can settle on its own.
