Key points
- A New Mexico judge ordered Meta to pay $25 billion to the state regarding data privacy violations.
- The penalty stems from a jury finding 43 million breaches of consumer protection laws, each fined $5,000.
- The case involved Meta's handling of a third-party app tied to the Cambridge Analytica scandal and misinformation efforts.
- Meta plans to appeal the ruling, arguing it imposes an unconstitutional tax on speech and hinders business operations.
The short version
- Meta must pay $25 billion to New Mexico following a trial concerning data privacy and consumer protection violations.
- The jury determined the company committed 43 million individual violations, each carrying a $5,000 statutory penalty.
- The lawsuit covered Meta’s management of a Cambridge Analytica-linked app and its broader privacy and misinformation policies.
The details
A judge on Wednesday ordered Meta to initiate a $25 billion payout to the state of New Mexico, according to The New York Times. This financial penalty represents the largest settlement in the ongoing legal aftermath of the Cambridge Analytica data scandal. The order follows a two-week trial where a jury deliberated on the social media giant’s conduct regarding resident users. The jury concluded that Meta, the parent company of Facebook and Instagram, had violated state consumer protection laws on 43 million separate occasions.
Each of these violations was assigned a $5,000 penalty, resulting in the total figure. New Mexico Attorney General Raúl Torrez commented on the resolution at a press conference, suggesting the funds could finance school construction for a century. He emphasized the severity of the company’s role in deceiving users about their data privacy practices. The ruling marks a significant enforcement action by the state against a major technology platform.
The context
The legal case centered partly on Meta’s handling of a third-party application connected to the Cambridge Analytica data breach, as reported by The Wall Street Journal. Cambridge Analytica originated from the SLC Group, a British defense contractor known for influence operations and political work. The firm notably supported the Trump campaign during the 2016 presidential election and participated in other controversial initiatives.
Beyond the specific app issue, the trial examined Meta’s general data privacy policies. The jury also considered the company’s efforts to mitigate misinformation on its platforms. These factors contributed to the determination that Meta had engaged in widespread wrongdoing against New Mexico residents. The scope of the case extended beyond a single data leak to encompass broader platform governance issues.
What to watch
Meta has announced its intention to appeal the decision. C.J. Mahoney, Meta’s Chief Legal Officer, stated that the ruling and the Attorney General’s enforcement approach make it nearly impossible to conduct business in New Mexico. In a statement shared with TechCrunch, Mahoney argued that the lawsuit effectively imposes a tax on speech to enforce new rules on online expression.
He expressed confidence that Meta would prevail on appeal. Mahoney added that the company will continue building a safe platform to connect users and support small businesses. The appeal process will determine whether this financial penalty stands or is modified. Observers will watch how this legal battle influences state-level tech regulation.
What it means for organisations
When a major vendor faces massive regulatory penalties for data handling, internal teams must review their own reliance on that vendor’s services. Organizations should assess whether the vendor’s past privacy violations affect the security posture of their own data stored on those platforms. Legal and compliance departments need to evaluate if new state-level enforcement trends require updates to vendor contracts or data processing agreements.
Leadership should consider the reputational risk associated with using platforms under intense regulatory scrutiny. Communication plans must be ready to address stakeholder concerns if similar issues arise with other suppliers. Proactive monitoring of regulatory actions helps maintain operational stability and trust.
What to do and how to stay safe: Meta
- Review data processing agreements with major social media platforms to ensure compliance with current privacy standards.
- Audit internal policies to verify that data shared with third-party apps is limited to what is strictly necessary.
- Monitor legal developments in your operating jurisdictions regarding consumer protection laws and data privacy enforcement.
- Update incident response plans to include scenarios involving vendor-related privacy breaches or regulatory penalties.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much does Meta have to pay New Mexico?
Meta has been ordered to pay $25 billion to the state of New Mexico.
Why was this penalty imposed?
A jury found Meta committed 43 million violations of consumer protection laws related to data privacy.
Did the case involve Cambridge Analytica?
Yes, part of the case involved Meta’s handling of a third-party app linked to the Cambridge Analytica breach.
