Privacy / Regulation

New Mexico announces $25 billion penalty against Meta over Cambridge Analytica-era privacy practices

A jury found almost 44 million violations of the state's Unfair Practices Act, covering Meta's statements and practices on third-party data access, user privacy and harmful content.

EnforcementUSImportantCourt rulingSecondary reporting
$25bn: Penalty New Mexico says it is imposing on Meta under its Unfair Practices Act

The New Mexico Department of Justice has announced that the state is imposing a $25 billion penalty on Meta for breaching New Mexico’s Unfair Practices Act, according to the Electronic Privacy Information Center (EPIC). A jury found that Meta committed 43,899,725 violations of the Act during the Cambridge Analytica scandal.

The jury examined Meta’s statements and practices on third-party access to personal data, user privacy violations and its handling of harmful content.

The penalty adds to earlier Cambridge Analytica-related costs. In 2022, Meta agreed to pay $725 million to settle a class action over the mishandling of 87 million users’ data. In August, it settled several Cambridge Analytica privacy claims as part of a settlement of nearly $17 billion with a coalition of state attorneys general. EPIC reports that $459 million of that sum relates to Cambridge Analytica claims. The source does not say whether Meta will appeal.

Editor’s note: This article is based on a secondary report by EPIC, a privacy advocacy group, not on the New Mexico Department of Justice’s own announcement.

Why it matters

The case shows that US states can use general consumer-protection statutes, rather than dedicated privacy laws, to penalise misleading statements about data sharing. Because penalties can be counted per violation, exposure can grow very large. Teams should check that public privacy statements match how partners and developers actually access personal data, and keep evidence of the controls that limit that access. Old data-sharing arrangements should be reviewed now, since this penalty arrives years after the original conduct.

Status: Court ruling. Jury verdict announced by New Mexico; reported by EPIC

Sources

  1. Meta Fined $25 Billion by New Mexican Court for Violating Privacy During Cambridge Analytica Scandal — EPIC — Electronic Privacy Information Center

Was this useful?

Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.

Governance areas

Enforcement

Action
Court ruling
Authority
New Mexico (jury verdict; state Department of Justice)
Concerning
Meta
Amount
USD 25bn
Law
New Mexico Unfair Practices Act

Case status: Open

Enforcement tracker

Who should care

  • DPO
  • Legal & compliance
  • CDO
  • Data stewards

Related

Latest

All news

Contact the editor

Tips, corrections, questions?

Write to The Steward, the editor of Data Governance Signal. Every message is read.

editor@datagovernancesignal.com