Meta Faces $25 Billion New Mexico Penalty Over Facebook Data Sharing

The judgment and what it covers

Meta’s New Mexico judgment puts a steep price on Facebook’s handling of personal data. Judge Francis Mathew ordered the company to pay $25 billion for violations spanning 2010 to 2021, finding that Facebook gave third-party app developers access to user information without consent. The case includes data improperly obtained by Cambridge Analytica, a reminder that information shared through an app can travel beyond the people and services a user expects to receive it.

That distinction matters. A platform can offer users settings and explanations about data use, but those measures carry little weight if outside developers can obtain personal information without meaningful consent. The dispute is about the gap between what users understood and what happened to their data. For people using a social platform, the practical question is simple: who can see information, and did the user agree to that access?

The court found more than 43 million violations of New Mexico consumer protection laws. State law could have allowed damages as high as $219 billion, exceeding Meta’s 2025 revenue, but Mathew reduced the amount to $25 billion without explaining why in the order described here. Meta plans to appeal.

The difference between the maximum amount and the judgment is enormous, but the $25 billion figure remains striking on its own. This is more significant than it looks: the ruling ties the alleged conduct to millions of individual violations, rather than treating the matter as a single technical failure. That framing can affect how the public understands responsibility when a company’s data practices operate at platform scale.

Why the court’s language matters

Mathew’s order described the impact as central to Facebook’s business model: “The harm in this matter is difficult to overstate, and goes to the heart of Facebook’s basic business proposition.” That is a forceful characterization. It places the dispute closer to the platform’s core operations than to an isolated mistake by an employee or a single outside developer.

The quote also points to a broader tension in services built around personal information. Users may receive a service at no direct monetary cost, while their information helps shape the product and its commercial value. That general model doesn’t, by itself, establish wrongdoing; the judgment concerns the way data was shared and whether users consented. The distinction is important because a business model can depend on data without giving a company permission to distribute it in ways users didn’t accept.

For companies that rely on outside apps or other partners, the case raises a basic operational question: can they track where user data goes after it leaves their own systems? Policies and permission prompts are only part of the picture. Monitoring access, limiting what partners receive, and responding when information is misused are also central to keeping a stated privacy commitment meaningful.

Pressure across Meta’s platforms

The judgment adds to a difficult stretch for the company. In August, Meta agreed to an $18 billion settlement over claims that Facebook and Instagram failed to keep children off the platforms. In July, a separate New Mexico judge imposed a penalty of just under $1 billion over the company’s failure to protect minors.

Those matters concern different alleged harms, and the figures shouldn’t be collapsed into one account of the company’s conduct. Still, their proximity makes the data judgment harder to view as a narrow dispute. It arrives amid multiple cases involving how Meta’s services affect users and how the company responds to those risks. The cases may turn on different facts, but together they put sustained attention on the company’s systems and decisions.

That said, a large judgment is not the final word while an appeal is planned. The appeal will determine what portion of the $25 billion order stands, and the source doesn’t establish how long that process will take or what the result will be. The size of the initial award signals the seriousness with which the court viewed the violations; the final amount remains unsettled.

What the case could mean for data practices

Data enforcement is also intensifying in Europe. GDPR breaches rose 22% last year, while fines reached a record €1.2 billion. Those figures describe a separate enforcement environment, but they offer useful context: regulators and courts are paying close attention to how organizations handle personal information, and penalties can reach substantial levels.

Similar systems typically depend on clear rules about consent, access, and accountability across the chain of companies that handle data. A service may collect information directly, while third-party developers or other partners receive it for particular purposes. If those boundaries aren’t clear or enforced, users can lose control without seeing an obvious change in the product. (And this is the part most people overlook.) The risk can arise after information is shared, when the original platform has less direct visibility into how it’s used.

If you’re working in this space, the case is a reminder that privacy promises need to match the actual flow of information. That takes more than a well-written notice: companies need to know what data partners can access and whether that access fits what users agreed to. The numbers here are underwhelming as a measure of trust. A court can set a financial penalty, but the judgment alone can’t show whether users will feel confident sharing information again.

For now, the practical significance rests on two points: the court found millions of violations, and Meta intends to challenge the judgment. The appeal may change the amount, but the order’s central claim—that the conduct reached into Facebook’s basic business proposition—will remain part of the public record and the debate over platform data practices.

This article first appeared on Computerworld.