A US judge has imposed a $25 billion civil penalty on Meta after a jury found millions of violations of consumer-protection law, adding to the company's legal challenges over user privacy and platform safety.

Meta Platforms, the parent company of Facebook and Instagram, has been ordered to pay $25 billion to the US state of New Mexico after a court found that the company repeatedly misled consumers about its handling of personal information.

The ruling, issued on October 21, 2026, follows a jury verdict in September that found Facebook committed 43,899,725 violations of New Mexico's Unfair Practices Act. The violations involved misleading statements about how the platform collected, protected, shared and used personal data, alongside representations about its handling of misinformation and hate speech.

The penalty is one of the largest civil awards imposed on a technology company in the United States. Meta disputes the ruling and plans to appeal.

Why was Meta penalised?

New Mexico filed its lawsuit in 2021 following renewed scrutiny of Facebook's data practices, including the Cambridge Analytica scandal.

The controversy centred on the improper access to personal information belonging to millions of Facebook users by a third-party application. The data was subsequently obtained by Cambridge Analytica, a political consulting firm, which became associated with the use of personal information for targeted political advertising.

New Mexico's case challenged Facebook's representations to users about who could access their data and how the company handled privacy risks and harmful content.

After the September 2026 jury verdict established liability, Judge Francis Mathew determined the financial penalty. The court calculated a potential penalty of approximately $219.5 billion before reducing the amount to $25 billion. The order also provides for interest at 15% annually until the penalty is paid in full. 

Meta plans to challenge the ruling

The $25 billion order does not mean Meta has accepted the penalty or that the legal dispute is over.

The company has indicated that it will appeal, arguing that the ruling is unjustified and creates difficulties for its ability to operate in the state. An appeal could affect the final amount payable or other aspects of the judgment.

Until the appeal process develops, the ordered penalty should be distinguished from a final, uncontested payment.

The case also differs from New Mexico's separate legal action concerning child safety on Facebook and Instagram. That earlier proceeding resulted in a $375 million civil penalty and a further $567 million in remedies announced in August 2026. Those amounts arose from a different case and should not be confused with the new $25 billion privacy-related penalty. 

What this means for data privacy and Big Tech

The ruling highlights the financial and legal risks technology companies face when regulators and courts find that their statements about personal-data practices violate consumer-protection laws.

For platforms that rely on personal information to personalise content and sell advertising, transparency about data collection, sharing and safeguards is central to maintaining user trust.

The case also demonstrates the role state-level enforcement can play in holding large technology companies accountable. Companies operating across multiple jurisdictions may face different legal actions, penalties and requirements depending on the conduct under investigation and the laws involved.

However, the ruling does not automatically establish that every allegation in every privacy dispute against Meta has been proven. Its findings apply to the specific claims and violations addressed in this case.

What users should take away

The case is a reminder that users should understand the permissions they grant apps, review privacy settings and be cautious about third-party applications requesting access to social media accounts.

Checking connected apps, limiting unnecessary permissions and avoiding quizzes or services that request excessive personal information can reduce exposure to data misuse.

These steps cannot prevent every privacy risk, but they give users more control over the information they share.

Meta has been ordered to pay $25 billion after a New Mexico jury found tens of millions of consumer-protection violations involving Facebook's statements and data practices. The company plans to appeal, meaning the legal process is not necessarily over.

The case puts renewed attention on a central question for the technology industry: how should companies be held accountable when their handling of personal information conflicts with what consumers have been told?