Meta ordered to pay $25 billion penalty in New Mexico over data privacy case

Meta must pay a fine of $25 billion to the U.S. state of New Mexico after a jury found the company misled users about data privacy in a case tied to the Cambridge Analytica scandal. New Mexico Attorney General Raúl Torrez filed the lawsuit in 2021, accusing the company of misleading users regarding data access, hate speech, misinformation, and other internal policies.

What Happened

Facebook previously allowed third-party app developers to access personal data of users and their friends through a feature called "friend sharing". Although the platform announced it would end this feature in 2014, it created exemptions for favored partners who could still access the information without user knowledge. A personality quiz app named "thisisyourdigitallife" collected data on roughly 87 million global users, which was later used by Cambridge Analytica for targeted political advertising during the 2016 U.S. presidential campaign of Donald Trump. Facebook learned of the data breach in December 2015 but did not disclose it publicly until 2018 after a whistleblower stepped forward.

Court Ruling and Penalties

A New Mexico jury found that Facebook violated the state's Unfair Practices Act over 43 million times across an 11-year period between May 2010 and August 2021, involving statements made by leaders like CEO Mark Zuckerberg and former COO Sheryl Sandberg. New Mexico District Court Judge Francis Mathew ordered the $25 billion penalty, noting that state law could have justified a penalty above $219 billion. The fine will accrue an annual interest of 15% until paid in full.

Reaction and Response

Meta chief legal officer C. J. Mahoney stated that the company is confident it will win on appeal and claimed the lawsuit imposes a tax on speech. Meta argued that penalties over $3.45 billion were not warranted and maintained that it does not sell user data or mislead consumers.

Context

Consumer protection laws allow states to fine companies for deceptive business practices that harm local residents. Legal disputes involving large technology corporations often center on how user data is gathered, shared, and protected across state and national borders.