A New Mexico state judge has ordered Meta to pay $25 billion after a jury found the company liable for deceiving Facebook users about privacy practices in litigation tied to the Cambridge Analytica fallout. The ruling, issued by Judge Francis J. Mathew in New Mexico state district court, is notable not just because of the underlying allegations, but because of the sheer size of the award—placing it among the most significant privacy-related judgments ever entered against a technology company.
The case centers on claims that Facebook users were misled about how their personal data would be accessed, shared, and exploited, issues that became globally prominent after revelations involving Cambridge Analytica. While Meta has spent years confronting regulatory investigations, private suits, and reputational damage connected to those events, this judgment underscores that state consumer protection theories can still pose enormous exposure years after the initial scandal broke.
For litigators, the decision is a reminder that privacy cases are no longer confined to federal multidistrict proceedings or agency settlements. State-court juries may be willing to award eye-catching sums where plaintiffs successfully frame privacy representations as deceptive trade practices rather than technical data-governance failures. That distinction matters: consumer-facing statements, disclosures, and product design choices can become the foundation for expansive damages arguments.
For in-house counsel and compliance teams, the ruling highlights the continuing risk of mismatch between public privacy messaging and actual platform practices. Companies often focus on privacy compliance through the lens of notice-and-consent frameworks, but this case illustrates how those same disclosures may later be used as affirmative evidence of deception. Legal departments advising on product rollouts, data-sharing arrangements, and user disclosures should view this as another signal that privacy governance needs to be tightly integrated with marketing, platform operations, and board-level risk oversight.
The judgment may also influence future settlement dynamics. A verdict of this magnitude—if it survives post-trial motions and appellate review—could embolden state attorneys general and private plaintiffs pursuing privacy and consumer fraud theories against large platforms. Even if reduced on appeal, the order raises the stakes for defendants evaluating whether to litigate or resolve cases earlier, especially where user communications and internal knowledge of data practices are central themes.
More broadly, the case shows how legacy privacy controversies can continue generating major litigation risk long after the initial public reckoning. For legal professionals tracking platform liability, data practices, and state consumer protection enforcement, this is a decision worth watching closely.