Meta has been ordered to pay New Mexico $25 billion in one of the largest corporate penalties ever imposed by a US state, but legal experts say the social-media giant has substantial grounds to seek a major reduction on appeal.
The penalty follows a September jury verdict that found Meta liable for nearly 44 million violations of New Mexico’s consumer-protection law.
The case grew out of allegations that Facebook misled users about who could access their personal information during the period associated with the Cambridge Analytica privacy scandal.
Meta has said it will appeal both the verdict and the size of the penalty.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Judge Cut Potential $219 Billion Penalty to $25 Billion
New Mexico’s Unfair Practices Act allows civil penalties of up to $5,000 for certain violations.
The jury found 43,899,725 violations after concluding that Meta had made misleading statements concerning user privacy and related practices.
Applying the statutory maximum to every violation could theoretically have produced a penalty of about $219 billion.
Judge Francis Mathew instead imposed $25 billion.
New Mexico had sought roughly $35 billion to $40 billion, while Meta argued that any penalty should be far lower.
The company had proposed a figure of no more than about $3.45 billion if penalties were imposed at all.
Even after the reduction, $25 billion remains far larger than previous financial penalties Meta has faced over privacy.
Facebook paid a $5 billion settlement to the US Federal Trade Commission in 2019 following the Cambridge Analytica scandal.
Meta Could Challenge How Violations Were Counted
A central issue on appeal is likely to be how New Mexico calculated the number of violations.
The state argued that penalties could apply every time someone in New Mexico may have been exposed to one of Meta’s misleading public statements.
Meta is expected to argue that the law should apply only where an individual actually saw and was misled by the statement.
That distinction could dramatically reduce the total number of violations.
The jury found Meta had made 26 misleading statements and calculated millions of violations based on their potential reach among Facebook users in New Mexico.
Legal experts cited by Reuters said an appeals court could decide that this method counted too many violations or duplicated the same alleged misconduct across large groups of people.
If that happens, the $25 billion figure could fall substantially even if Meta remains legally liable.
Excessive Fine Argument Could Reach US Supreme Court
Meta is also expected to argue that the penalty violates constitutional protections against excessive fines and breaches due-process requirements.
The company says the state did not prove that millions of individual users actually suffered measurable harm from each statement.
That could become important because the penalty is calculated from statutory violations rather than direct compensation for proven financial losses.
Courts can allow large civil penalties when legislatures have authorised them.
But extremely large awards can face greater scrutiny when the relationship between the underlying harm and the final amount becomes unusually wide.
Meta could first challenge the judgment through New Mexico’s appellate courts.
If the state courts uphold the award, the company could eventually ask the US Supreme Court to review federal constitutional issues.
That process could take years.
Interest may continue accumulating on the judgment while the appeals proceed.
Cambridge Analytica Case Returns to Centre Stage
The New Mexico case traces back to Facebook’s handling of personal information accessed by Cambridge Analytica.
The now-defunct political consulting firm obtained information connected to tens of millions of Facebook users through a third-party application.
The data was later used in political targeting.
New Mexico sued Meta in 2021 and accused Facebook of misleading users about privacy controls, third-party access to data and other platform practices.
Judge Mathew wrote that Facebook had told users they controlled their information when, according to the court, that was not an accurate description of how the platform actually operated.
Meta disputes New Mexico’s allegations and says its privacy systems and policies have changed substantially since the events underlying the lawsuit.
The company also argues that parts of the state’s case interfere with constitutional protections surrounding speech and online content.
New Mexico Chose to Fight Meta Separately
New Mexico has taken a more aggressive legal path against Meta than many other US states.
Rather than resolving all of its claims through broader multistate settlements, the state pursued some cases independently.
Attorney General Raúl Torrez has argued that large technology companies should face meaningful consequences when they violate consumer-protection laws.
The state says the $25 billion judgment demonstrates that existing consumer laws can be used against technology companies even when alleged misconduct occurs at enormous digital scale.
That same scale, however, creates the problem at the centre of Meta’s appeal.
When one online statement can theoretically reach hundreds of thousands or millions of users, multiplying statutory penalties for every potential exposure can produce extraordinary sums.
Future courts may therefore need to decide where to draw the line between meaningful deterrence and constitutionally excessive punishment.
The decision could matter well beyond Meta.
Other technology platforms frequently make public statements about privacy, safety, data use and content moderation to millions of users at once.
If each exposure can count as a separate consumer-law violation, state regulators could gain a powerful enforcement tool.
If appellate courts narrow that approach, states may face tighter limits on how digital-scale violations are calculated.
What this means for you:
The appeal could determine how aggressively US states can calculate penalties when misleading online statements potentially reach millions of people. The outcome may shape future privacy and consumer-protection cases against other major technology companies.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
