A New Mexico state judge ordered Meta to pay the state $25 billion for deceiving Facebook users about their privacy, AFP reported Wednesday, a penalty that shows how a single state's consumer-protection law can turn a company's privacy promises into liability measured in tens of billions of dollars. The Associated Press noted that it far exceeds the $5 billion the Federal Trade Commission imposed on Facebook in 2019. The company says it will appeal.
What Happened
State District Judge Francis J. Mathew issued the order Oct. 21, about a month after a jury found Facebook had misled New Mexico users. In its quarterly report to the Securities and Exchange Commission, Meta said the Sept. 25 verdict found it liable for more than 43 million violations of the New Mexico Unfair Practices Act, and that the order adds post-judgment interest of 15%. The court has held off on ruling about injunctive relief, meaning court-ordered changes to the company's conduct, pending further briefing, according to the filing.
Each violation carried a penalty of up to $5,000, The Record reported, so the theoretical maximum ran past $200 billion. The state had asked for $35 billion to $40 billion, while Meta argued for no more than $3.4 billion and said a larger award would be unconstitutional, AP reported.
The judge wrote that the deception was intentional. "Facebook promised users that they (the users) controlled their data. This was false," he wrote, according to AP. The Record reported that he cited the scale, duration and willfulness of the violations, said senior leaders including Mark Zuckerberg and Sheryl Sandberg built a strategy to mislead consumers, and described an internal "song sheet" used to coordinate public relations messaging.
Meta Chief Legal Officer C.J. Mahoney said the suit seeks "to impose a tax on speech," and Meta said the attorney general's approach makes it "all but impossible" to do business in New Mexico, AP reported. Attorney General Raúl Torrez called the judgment "an unambiguous message" to Silicon Valley. Meta told investors it has set aside an undisclosed amount for the case and may have to post a bond or other collateral during the appeal.
Why It Matters
The case did not turn on the Cambridge Analytica data harvest itself, in which a quiz app installed by about 270,000 people reached roughly 87 million Facebook users, AFP reported. It turned on what Facebook told people about controlling their data. Jurors found the misconduct affected all of New Mexico's more than 2.1 million residents, according to AFP.
For boards and general counsel, that is the lesson: privacy statements in user-facing terms and public messaging can be counted as individual violations, and the count, multiplied across a state's population, drives the exposure. New Mexico's result shows how far a state attorney general acting alone, outside a multistate settlement, can push such a law.
Context
New Mexico and Florida stayed out of the August multistate settlement in which Meta agreed to pay $18 billion, AP reported. New Mexico separately won nearly $1 billion from Meta this year in a child-safety case: a $375 million jury award in March and a further $567 million ordered in August, according to AFP. Jurors in the privacy case rejected the state's separate claims that Facebook misled users about removing harmful content such as COVID-19 misinformation, AP reported.
Under the state constitution, the penalty money goes to education, but collection could take years because of the appeal, AP reported.
What to Watch
The judge's ruling on injunctive relief, which could require changes to how Facebook operates in New Mexico. Meta's appeal, including whether it can cut the number of violations, and the size of any bond it must post. And whether other state attorneys general bring similar per-violation privacy cases rather than joining multistate settlements.
