One of the Largest Privacy Penalties in US History Meets a Company Making $64 Billion a Quarter
Judge Francis Mathew’s order hit the wire on October 21, 2026, and the number attached to it was hard to process. Meta owes New Mexico $25 billion for violating the state’s Unfair Practices Act, a figure the New Mexico Department of Justice called one of the largest ever levied against a US corporation, and Reuters covered it the same day. Buried under the headline sits a fact easy to miss.
Mathew found that state law supported a penalty north of $219 billion. He chose $25 billion anyway.
That gap is the hinge for Meta’s appeal, it explains what the jury actually did, and it frames the comparison against a company that generated $64.60 billion in revenue last quarter alone, per StockAnalysis.
From Cambridge Analytica to 43 Million Counts
The path to this judgment runs through a scandal that’s now most of a decade old. Facebook’s Open Graph API, launched in 2010, let developers see social connections between users, and researcher Aleksander Kogan exploited that access before passing the data to Cambridge Analytica, founded in 2013. When the Guardian and the New York Times broke the story on March 17, 2018, initial reports put the harvest at 50 million profiles, a figure later revised to as many as 87 million, as the Bipartisan Policy Center’s history recounts. Facebook suspended Cambridge Analytica and its parent SCL Group, and Mark Zuckerberg spent the following weeks promising investigations, forensic audits, and new restrictions on developer data access.
Those promises mattered later, and not the way Facebook intended. New Mexico sued in 2021 and litigated alone. The multistate machinery it skipped produced an August 2026 settlement worth up to $17.1 billion resolving teen mental health claims, a package that also settled six other states’ claims for $459.2 million. Raúl Torrez’s Department of Justice framed going it alone as a deliberate choice, one that let its claims get tested before a jury instead of negotiated in bulk. The payoff was 43,899,725 violations of New Mexico law.
What the Jury Actually Found
The trial ran in two phases, which matters for understanding what was decided and when. Phase one was the liability trial before a jury, which produced the violation findings, while phase two handed the penalty question to Mathew. That’s why the September 25 verdict and the October order are separate events with separate vulnerabilities on appeal. The verdict form itself is public, and jurors found 26 of 29 Meta statements misleading. The statements fell into three buckets.
- Claims about user control over data sharing, including assertions that Meta didn’t sell or buy user data and didn’t hand it to advertisers
- Claims about misinformation and hate speech, specifically that Meta didn’t profit from either, removed harmful content, and enforced its Community Standards without carve-outs for politicians or newsworthiness
- Promises made after Cambridge Analytica about investigating apps with heavy data access, running forensic audits, and banning developers who misused data
Reuters called this a data privacy case, and the shorthand is understandable, but the statute at issue is a consumer protection law and the liability theory was deception, not a privacy violation per se. Meta’s own defense leaned into that distinction.
Then there’s the counting method, and this is where the number gets built. New Mexico didn’t tally incidents of misconduct. The state’s lawyers multiplied each misleading statement by the number of people who plausibly saw it, a technique Reuters described as multiplying statements by potential audience, and twenty-six statements became more than 43 million violations. That multiplication method is the most contested piece of the judgment, and Meta’s lawyers are probably going to keep pointing that out on appeal.
The Math Behind the Reduction
Newsweek reported that New Mexico law caps penalties at $5,000 per violation. Multiply 43,899,725 by $5,000 and you land on $219.5 billion, which is precisely where the judge’s warranted figure comes from. The $25 billion he imposed works out to about $569 per violation, roughly 11% of the statutory maximum. .
Both sides laid out their positions at the October 1 penalty hearing. State lawyer Randi McGinn asked for $35 to $40 billion, and her pitch was blunt.
The court should speak to Meta in the only language it understands, which is money, and the value of its stock price.
Meta countered with a proposed $3.45 billion cap, arguing that it doesn’t sell user data and that New Mexico never proved any individual consumer was actually misled. Mathew landed well above Meta’s ceiling and comfortably below the state’s ask.
The Appeal Ahead
Chief legal officer C.J. Mahoney’s response came fast. He told Reuters the company is confident it will win on appeal and called the ruling one that makes it all but impossible to do business in New Mexico.
At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online.
Meta also argued that a multibillion-dollar penalty risks violating constitutional protections against excessive fines and due process, which frames the constitutional questions the appellate courts will face.
There’s a version of the appeal where that argument cuts both ways. Mathew already cut 89% off the statutory maximum, which gives New Mexico a strong answer to any disproportionality claim, but the $219 billion figure is now part of the record and it exceeds Meta’s entire 2025 revenue. Expect the appeal to grind. Gil Luria, an analyst at D.A. Davidson, told Reuters the ruling is costly but unlikely to affect the company’s value, predicting Meta will keep appealing and dragging cases out. (He put the company near $2 trillion; StockAnalysis lists market cap at $1.64 trillion in late October, with the difference reflecting the stock pulling back from a 52-week high near $786.80.)
What $25 Billion Buys Against Meta’s Income Statement
On a trailing twelve-month basis through September 30, 2026, StockAnalysis puts revenue at $241.61 billion, up 27.53%. The penalty is 10.3% of that, and 1.5% of market cap. Had Mathew not reduced anything, the warranted figure would have swallowed all of fiscal 2025 revenue, which came in at $200.97 billion. For perspective on how fast the ground shifted, the same company booked $164.50 billion in 2024 and $777 million back in 2009, the first year in StockAnalysis’ records.
But this is definitely the largest penalty Meta’s faced.
| Penalty or settlement | Amount | Year |
|---|---|---|
| Federal Trade Commission (FTC) privacy penalty (Cambridge Analytica era) | $5 billion | 2019 |
| Cambridge Analytica class action settlement | $725 million | 2022 |
| Texas biometric settlement | $1.4 billion | 2024 |
| New Mexico teen safety verdicts and orders | $942 million | 2026 |
| Multistate teen mental health settlement | up to $17.1 billion | 2026 |
| New Mexico civil penalty | $25 billion | 2026 |
Every prior entry on that list was billed as historic at the time. The 2019 FTC penalty was the largest privacy enforcement action the agency had ever brought, and it’s now roughly a fifth of what one state judge just imposed. It represents about 2.1% of Meta’s trailing revenue. New Mexico’s own earlier wins over teen safety, a $375 million Santa Fe jury verdict in March and $567 million ordered in August into a teen mental health fund, total $942 million. The new penalty is more than 26 times that combined figure.
Days Later, a $95 Billion Counterpoint
On October 26, days after the order, Meta announced plans to raise up to $95 billion to fund its AI buildout. The initial tranche of roughly $35 billion exceeds the entire penalty, and Nvidia, AMD, and Broadcom have indicated interest in collectively buying up to $5 billion of the offering. This is a company planning $135 to $145 billion in capital expenditures this year.
The state, for its part, frames the judgment as a precedent rather than a payday. Torrez said no corporation is too powerful to be held accountable, and that the case was never about one company or one scandal. That’s the right read even for skeptics of the enforcement theory, because nothing about the approach is unique to New Mexico. Any state attorney general with a consumer protection statute can now point to a jury verdict built on statement-times-audience multiplication and a penalty that survived its first judicial test. Whether it survives appeal is a question nobody can currently answer, including the people cheering loudest on both sides. The executives reading this should care less about the dollar figure than about what produced it, since the statute New Mexico used predates Facebook itself and most states have an equivalent sitting on the books.
