The ruling, issued on Wednesday, follows a jury verdict last month that found Meta liable for violating New Mexico’s unfair practices law. State officials described the penalty as one of the largest in US legal history, underscoring the financial and reputational risks facing technology companies accused of misleading consumers about how their personal information is collected, protected and used.
The case centres on approximately 44 million violations identified by the jury, with the potential penalties calculated under a state law that allows fines of up to $5,000 for each violation. The findings relate to public statements made by Meta over more than a decade, including statements by chief executive Mark Zuckerberg.
The jury concluded that the company had misled users about its approach to data privacy, its efforts to combat hate speech and misinformation, and its handling of a third-party application connected to the Cambridge Analytica scandal.
That scandal, which came to public attention in 2018, involved the harvesting of data belonging to tens of millions of Facebook users without their consent. The information was obtained through an application developed by a third party and subsequently used by the political consulting firm Cambridge Analytica, raising widespread concerns about the security of personal information on social media platforms.
New Mexico’s lawsuit, filed in 2021, argued that the controversy was not an isolated incident but part of a broader pattern of misleading representations concerning privacy safeguards, content moderation and the handling of user data.
The state maintained that consumers were entitled to accurate information about how their personal information was being managed and whether the company was taking adequate measures to protect them.
The $25 billion penalty highlights the potential consequences when a court finds that a company’s public assurances about consumer protection do not match its practices. However, the case also raises questions about the appropriate scale of financial penalties and how they should be calculated when alleged violations involve millions of users and statements made over many years.
New Mexico had sought a substantially higher amount during a hearing earlier this month, urging the judge to impose a penalty ranging from $35 billion to $40 billion. Although that request was below the maximum theoretically available under the state’s per-violation penalty framework, it would still have represented an extraordinary financial judgment.
Meta’s legal team strongly opposed the state’s demand. Company lawyer Matt Nicholson argued that the proposed penalty was unconstitutional and disproportionate to the alleged misconduct. He also compared the requested amount with the approximately $20.8 billion in settlements associated with the 2010 Deepwater Horizon oil spill involving BP, arguing that the proposed fine would exceed the financial consequences of a major environmental disaster.
The disagreement illustrates a central issue in large-scale consumer-protection litigation: how courts should balance the need to deter corporate misconduct against the principle that financial penalties must be legally justified and proportionate.
For regulators, a substantial penalty can serve as a warning to companies whose business models depend on collecting and processing vast quantities of consumer data. For businesses, however, exceptionally large judgments raise questions about predictability, liability and the circumstances under which individual statements or actions can be counted as separate violations.
Meta may challenge the outcome through further legal proceedings. The financial consequences will therefore depend on the status of the judgment, any subsequent challenges and the final resolution of the case.
Beyond the monetary penalty, the litigation could have implications for how Meta operates its platforms. New Mexico has indicated that it will seek additional measures requiring changes to the company’s services in later proceedings.
Such remedies could prove important because financial penalties alone do not necessarily resolve concerns about privacy practices, platform safety or the treatment of vulnerable users. Changes to data-handling procedures, transparency measures and safeguards against harmful content could have longer-term effects on how the company serves consumers.
The case also forms part of a wider legal campaign against major social media companies in the United States. Governments and regulators have increasingly examined whether platforms provide adequate protection for users, particularly younger audiences, and whether their public statements accurately describe the risks associated with their services.
New Mexico’s decision to pursue its own case followed a separate multistate settlement involving Meta. Earlier this year, the state opted out of an agreement involving 48 states that resolved similar litigation.
That settlement, valued at approximately $17 billion according to the figures cited in the case, focused primarily on allegations concerning social media addiction. It also resolved state consumer-protection claims associated with Cambridge Analytica for $459 million. California had previously settled its own case for $50 million.
The differing outcomes demonstrate how litigation involving the same company can produce substantially different financial consequences depending on the legal claims, evidence, settlement arrangements and remedies pursued by individual jurisdictions.
For Meta, the New Mexico case is about more than the size of a fine: it puts the company’s approach to privacy, transparency and accountability under renewed scrutiny. For other technology businesses, it highlights the risks associated with public assurances that consumers may rely on when deciding whether to use a service.
The case also raises a broader question about the responsibilities of platforms that have become central to communication, news consumption and commercial activity. As social media companies accumulate increasingly detailed information about their users, governments are facing pressure to ensure that privacy protections are meaningful and that consumers are not misled about how their data is handled.
Whether the $25 billion judgment ultimately stands will depend on the subsequent legal process. But the verdict already illustrates the potential scale of exposure for companies facing allegations of widespread consumer deception.
The outcome could become an important reference point in debates over corporate accountability and the enforcement of consumer-protection laws. The central test will be whether the legal action produces lasting improvements in privacy and transparency while ensuring that penalties remain grounded in evidence and the law.
