New Mexico v. Meta: USD 25 billion for telling users they controlled their data

Facebook told New Mexicans they controlled who saw their data, that friend sharing had ended for everyone, and that it would notify people whose data apps had misused. A jury found those statements willfully deceptive 43.9 million times.

New Mexico Attorney General · Unfair Practices Act · Judgment 21 October 2026

$25bnCivil penalty in trial-court judgment; appeal expected; not paid

Regulator or court: New Mexico Attorney General (First Judicial District Court, Santa Fe County)
Jurisdiction: New Mexico, US
Framework: New Mexico Unfair Practices Act (NMSA 1978, § 57-12-11 civil penalties)
Judgment: 21 October 2026
Procedural status: Judgment entered 21 October 2026; injunctive relief reserved pending briefing; Meta says it will appeal

Notice, consent scope and assent · Undisclosed data exchanges · Breach notices not sent

The problem

New Mexico sued Facebook in 2021 over its statements to consumers after the Cambridge Analytica scandal. The case was filed under then-Attorney General Hector Balderas and tried under Attorney General Raúl Torrez (CNBC). The state alleged Facebook misled New Mexicans about how it collected, protected, shared and used their personal information, and about its handling of misinformation and hate speech (NMDOJ, 25 September 2026).

The judge found that "Facebook’s misrepresentations about users' control of their data were not isolated incidents, but rather a systematic pattern of deception at the core of Facebook’s business model" (Judgment, finding 20).

Case record

Court: First Judicial District Court, Santa Fe County, New Mexico (Judge Francis J. Mathew)
Case number: D-101-CV-2021-00132
Parties: State of New Mexico ex rel. Raúl Torrez, Attorney General v. Meta Platforms, Inc., f/k/a Facebook, Inc.
Law: New Mexico Unfair Practices Act; civil penalties of up to USD 5,000 per willful violation (§ 57-12-11)
Trial: Thirteen-day, 12-person jury trial on liability, willfulness and number of violations; penalty set by the judge
Verdict: 25 September 2026: 43,899,720 willful unfair or deceptive practice violations plus 5 willful unconscionable practice violations, a total of 43,899,725
Judgment: Filed 21 October 2026: USD 25,000,000,000 civil penalty, 15% annual interest, injunctive relief reserved
Amount: USD 25 billion (statutory maximum calculated at USD 219,498,600,000)
Source review: 21 October 2026

What the jury and court found

New Mexico v. Meta findings by subject
Subject	Representations found willfully deceptive	Violations
Users' control of their data, third-party access and monetisation	6	10,459,944
Friends' data access and the App Developer Investigation (ADI)	10 (also an unconscionable practice)	18,146,592
Misinformation and hate speech	7	Not broken out in the judgment
Equal application of Community Standards	3	Not broken out in the judgment

The jury counted violations by audience: either 1,386,648 (Facebook’s New Mexico monthly active users at 30 June 2020) or 2,100,000 (the state’s population) for each of 26 statements made between 24 May 2010 and 18 August 2021 (Judgment, findings 7, 8 and 14).

Privacy settings: the court found Facebook’s settings did not give users meaningful control, because audience menus on posts had no bearing on what developers could pull through the API, and Facebook knew users did not understand them (findings 18 and 19).
Friend sharing: Facebook announced in 2014 that apps would lose access to friends' data after May 2015, but had planned exemptions for business partners more than a year earlier and did not disclose them (findings 22 to 25).
The promised investigation: after March 2018 Facebook promised to investigate apps, audit suspicious ones, ban misusers, ensure deletion and notify affected users. It ran 14 forensic "audits" in three years, relied on developers' self-certification of deletion, and notified users about two apps after narrowing its internal definition of misuse (findings 26 to 32).
Scale in New Mexico: 1,585 apps linked to misuse were associated with New Mexico accounts, affecting at least 1,146,225 New Mexican users (finding 34).

The court held the record supported the maximum USD 5,000 per violation, citing the number of violations, their duration, senior leadership’s involvement and the "clearly intentional and systematic nature" of the statements (conclusion 18). It then reduced the award to USD 25 billion without setting out a formula.

Technical issue

Two permission systems: the post-audience controls users saw were separate from the settings governing what third-party apps could read through the API, which the court found most users did not know existed.
Friends' data: before 2014, an app a user installed could read data about that user’s friends, who had not used the app.
Undisclosed exceptions: whitelisted partners kept friends' data access after the public cut-off.
No logging or verification: the court found Facebook let apps take data without logging what was taken and relied on developers to certify deletion.

Inth’s technical interpretation: the liability here came from statements, not from a single technical fault. Each promise ("you control your data", "friend sharing has ended", "we will notify you") was checkable against systems the company ran. A privacy claim is only as good as the access control, logging and exception list behind it.

// Public promise: apps no longer receive friends' data after the cut-off
// Actual policy: a partner allowlist keeps the old scope
const scopes = partnerAllowlist.has(appId)
  ? ['user_profile', 'friends_data']   // undisclosed exception
  : ['user_profile'];

// Make the promise true: one rule for every app, and log every grant
const scopes = ['user_profile'];
auditLog.write({ appId, scopes, grantedAt: Date.now() });

Illustrative pattern, not Facebook’s code.

Timeline

24 May 2010 to 18 August 2021Period of the 26 representations the jury found unlawful
2014 (transition to May 2015)Facebook announces the end of friend sharing; partner exemptions continue undisclosed
March 2018Cambridge Analytica revelations; App Developer Investigation begins
September 2019Internal legal assessment concludes Facebook could not say it had met its ADI commitments
March 2021ADI shut down without public announcement
2021New Mexico files suit (D-101-CV-2021-00132); exact filing date not confirmed here
21 August 2025Stipulated order for a 12-person jury
25 September 2026Jury verdict: 43,899,725 willful violations
21 October 2026Findings of fact, conclusions of law and judgment filed: USD 25 billion penalty

Outcome

The court awarded a civil penalty of USD 219,498,600,000, "which penalty is reduced to the amount of $25,000,000,000.00", with interest at 15% a year until paid, and reserved on injunctive relief pending further briefing (Judgment, decretal paragraphs 1 to 3).

Meta’s chief legal officer, C.J. Mahoney, said the company is "confident we will prevail on appeal" (The Hill). Attorney General Torrez said the money will go to public education after the expected appeals (The Hill). No appeal filing or injunction briefing dates were confirmed for this page.

What it cost

New Mexico v. Meta costs
Item	Amount	Source
Civil penalty	USD 25,000,000,000	Judgment
Statutory maximum calculated by the court	USD 219,498,600,000 (USD 5,000 x 43,899,720)	Judgment, conclusion 7
Interest	15% a year until paid	Judgment
State’s request	USD 35 billion to 40 billion (reported)	The Hill
Meta’s position	Anything above USD 3.4 billion unconstitutional (reported)	BBC
Paid	Nothing reported; appeal expected

Why it matters

Privacy statements are counted per person reached. The jury multiplied each deceptive statement by its New Mexico audience, turning 26 statements into 43.9 million violations.
Promises after an incident are judged too. Ten of the statements were about the clean-up after Cambridge Analytica: audits, bans, deletion and notification.
A state can go it alone. New Mexico tried its case instead of joining a multistate settlement. Compare the EU transfer fine in Meta Ireland and the German consent ruling in Bundeskartellamt v Meta.

How Inth catches this

Consent banner: records the purposes and vendors each visitor was shown and what they chose, so the claim made at the point of choice is on record.
Website audit: records which third parties receive data from your pages, so a statement such as "we don’t share your data with advertisers" can be checked against observed requests.
Evidence: consent records with choice, country and policy version, and per-page runtime observations of what was sent and to whom.

Limit: Inth sees what leaves the browser on your own sites. It does not see platform APIs, partner allowlists or a company’s internal investigations, which were at the centre of this case.

Checks for your own systems

In the repository

List every exception or allowlist that gives a partner more data access than your public documentation describes.
Check that every third-party data grant is logged with scope and time.

In the browser and network

Compare your privacy policy’s sharing statements with the third-party requests your pages actually make.
Check that privacy settings shown to users control the same data flows they appear to describe.

With the people responsible

Have legal and engineering review public privacy claims, including executive interviews and newsroom posts, before release.
Write down when your incident-notification promise applies and keep a record of each decision not to notify.

Sources and limits

Findings of Fact, Conclusions of Law and Judgment, filed 21 October 2026 (scanned PDF; quotations checked against an OCR copy)
New Mexico Courts high-profile cases page
NMDOJ press release on the verdict, 25 September 2026
NMDOJ press release on the penalty, 21 October 2026
Coverage: CNBC, BBC, The Hill

The complaint, verdict form, jury instructions and trial transcripts were not opened. The exact filing date in 2021, the violation counts for the misinformation, hate speech and Community Standards statements, and the reasons for reducing the penalty to USD 25 billion are not in the sources reviewed. Meta’s appeal plans come from its statements to the press; no notice of appeal had been seen. The state’s and Meta’s penalty positions come from news reports.

Source review: 21 October 2026. This page describes the cited court record and press statements. It is separate from New Mexico’s 2023 child-safety case against Meta (D-101-CV-2023-02838). Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.