Meta has been ordered to pay New Mexico $25 billion after a court found that Facebook repeatedly misled people about control of their personal information. The October 21 judgment goes beyond the familiar Cambridge Analytica headline: it describes a gap between the privacy controls people could see and the access third-party developers actually retained.
The new development is a civil penalty in an older case, not a newly discovered Facebook breach. A September jury verdict established liability; Judge Francis J. Mathew’s October order sets the financial consequences. Meta says it will appeal. [1] [3]
A private post did not answer the app-access question
One of the clearest distinctions appears on page 5 of the judgment. The court recounts expert evidence that choosing a limited audience for a Facebook post did not determine what developers could retrieve through the platform’s API. Those were separate controls, and users often did not know the second set existed. [2]
That separation matters because the visible setting answered a narrower question: who could see a post. It did not necessarily answer who could obtain information through a connected application. The court found that Facebook possessed internal knowledge about its data-access architecture that ordinary users could not independently verify.
The historical access model extended beyond people who installed an app. Before 2014, developers could also obtain information about those users’ friends, including people unaware that their information was being shared. Facebook announced an end to that practice in 2014, with a transition ending in May 2015. According to the judgment, favored business partners continued receiving exceptions that were not disclosed to users.
Our earlier report on Facebook’s disclosures about deep data-access partnerships provides historical background. The new judgment makes the promises surrounding access central to the penalty decision.
The investigation promise had its own verification gap
After the Cambridge Analytica revelations in March 2018, Facebook promised to investigate apps with substantial historical access, audit suspicious activity, remove abusive developers, ensure improperly obtained data was deleted and notify affected users. The judgment examines what happened behind those commitments.
The App Developer Investigation ran approximately from March 2018 to March 2021. The court found that Facebook conducted only 14 forensic data audits during that period. It also found that the company generally relied on developers certifying deletion themselves, rather than independently verifying that the information had been erased.
Those are different failure points. An app ban can restrict an account’s future access, while already collected information remains outside the platform. A developer’s assurance that data was deleted supplies a statement; it does not supply independent proof. The judgment also says Facebook notified users of only two apps despite identifying thousands associated with misuse. These are the court’s findings about the historical investigation, not a claim that every current Facebook app operates under the same conditions.
Why 43.9 million violations does not mean 43.9 million victims
The court records 43,899,725 willful violations. That total combines 43,899,720 unfair-or-deceptive-practice violations with five additional findings of unconscionable practices. The large count reflects repeated public statements and their expected New Mexico audiences, rather than a list of that many different people whose accounts were stolen.
The judgment identifies 26 unlawful representations spanning May 2010 through August 2021. For each, the jury counted an expected audience of either 1,386,648 Facebook users in the state or approximately 2.1 million residents. Other findings concerned representations about harmful content and equal enforcement; the case was broader than one privacy toggle.
Applying the $5,000 statutory maximum to the 43,899,720 unfair-or-deceptive-practice violations produced $219,498,600,000. The judge reduced the award to $25 billion. The order sets interest at 15% annually until payment and leaves injunctive relief for further briefing.
The order is not a Facebook payout program
The decree awards the civil penalty to the state. It does not establish an individual claims form or promise each Facebook user a payment. A large judgment is also different from money already collected: Meta told ABC News it would appeal, and the court has not yet decided the reserved conduct remedies.
The practical lesson is to ask what a privacy control actually governs. Post visibility, connected-app access and deletion of previously collected information are separate questions. The judgment explains why a reassuring answer to one was not evidence that the others had been resolved.
References
- New Mexico Department of Justice. Announcement of the Facebook civil penalty. October 21, 2026; accessed October 23, 2026.
- First Judicial District Court, Santa Fe County. Findings of Fact, Conclusions of Law and Judgment, D-101-CV-2021-00132. October 21, 2026, pp. 1–9, 18–20.
- Bill Hutchinson. Meta ordered to pay New Mexico $25 billion for violating consumer protection laws. ABC News, October 21, 2026. Includes Meta’s response to ABC News.
