On 21 October 2026, Judge Francis J. Mathew of New Mexico's First Judicial District Court ordered Meta to pay USD 25 billion in civil penalties under the state's Unfair Practices Act, in a case the state filed in 2021 after the Cambridge Analytica revelations. A jury had already found that Facebook wilfully misled the public about its data practices; the judge's task was to price that finding. Reports describe roughly 44 million wilful violations, counted from 26 public statements made between 2010 and 2021 and multiplied by the number of New Mexicans each statement was expected to reach. With a statutory cap of USD 5,000 per violation, the theoretical maximum was about USD 219.5 billion; the court cut this to USD 25 billion plus annual interest, rejected Meta's argument that its earlier USD 5 billion FTC penalty should serve as a benchmark, and reserved the question of injunctive relief. Meta has said it will appeal. The ruling matters because it turns a generic consumer-protection statute into one of the most powerful privacy-enforcement tools in the United States!

In my view, the decision's strength lies in its premise: a privacy promise is a representation to consumers, and a false one is deception, whatever the technical complexity behind it. The court also refused to let a prior federal settlement act as a ceiling, which I believe is right, since a penalty that a company can absorb as a cost of business deters nothing. The weakness is the counting method. Treating every person a statement "reached" as a separate violation produces numbers so large that the final figure becomes a matter of judicial discretion rather than legal calculation; the gap between USD 219.5 billion and USD 25 billion invites the proportionality and due-process challenges an appellate court will now hear. The practical lesson for in-house counsel everywhere is simple: privacy policies, help-centre pages and executive statements are not marketing copy but potential evidence, and they must be audited against actual data flows. Regulators no longer need a data protection law to punish a broken privacy promise!

Source: The Hacker News, 22 October 2026; Top Class Actions, 28 October 2026