A New Mexico judge on Wednesday ordered Meta to pay $25 billion to the state, the largest penalty yet stemming from the Cambridge Analytica data scandal. The ruling followed a two-week trial in which a jury found that the company behind Facebook and Instagram had committed 43 million violations of New Mexico's consumer protection laws, with each violation carrying a $5,000 penalty. Meta has said it will appeal.

What the jury found

The case was not limited to Cambridge Analytica. Jurors examined Meta's handling of a third-party app tied to the Cambridge Analytica breach, its broader data privacy policies, and its efforts to curb misinformation on its platforms. The verdict converts the state's consumer protection statute into a per-user, per-violation liability model, and the arithmetic is what produces the nine-figure-per-day scale of the judgment: 43 million violations multiplied by $5,000.

Cambridge Analytica was an offshoot of SLC Group, a British defense contractor that specialised in influence operations and political work. The firm worked with the Trump campaign during the 2016 presidential election and was involved in a series of controversial initiatives before its collapse.

The legal theory Meta will contest

Meta's central argument on appeal is likely to focus on how the state applied its consumer protection law to platform conduct. C.J. Mahoney, Meta's Chief Legal Officer, framed the ruling as an existential burden on doing business in New Mexico. "This ruling, and the Attorney General's approach to this enforcement, makes it all but impossible to do business in the state of New Mexico," Mahoney said in a statement. "At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online. We are confident we will prevail on appeal."

The appeal will test whether a state consumer protection statute can reach decisions about content moderation and third-party app data handling, or whether those decisions fall under speech protections. That distinction matters well beyond New Mexico: if the judgment survives, other state attorneys general have a template for per-violation penalties against large platforms.

Why the number is so large

The scale of the award reflects the structure of the statute rather than a single act. Consumer protection laws are typically enforced per violation, and when the affected population is measured in millions of users, the multiplier becomes enormous. New Mexico Attorney General Raúl Torrez, speaking to journalists at a press conference, put the figure in perspective: "We may have paid for the construction of schools for the next 100 years," he said.

For engineering and compliance teams, the verdict reinforces that data handling decisions made years ago — particularly around third-party app permissions and data sharing — remain legally live. The Cambridge Analytica episode dates to 2018, yet the liability is being assessed now, under statutes that were not written with platform-scale data flows in mind.

What happens next

Meta's appeal will determine whether the $25 billion figure stands, is reduced, or is overturned. In the meantime, the company says it will continue operating as before. "Meta will continue to build a safe and free platform to connect millions of Americans, grow small businesses, and help the country maintain its competitive edge," Mahoney said.

The case also adds to a growing set of state-level enforcement actions against large platforms, where attorneys general are using consumer protection and privacy statutes rather than federal regulation. For technology decision-makers, the practical takeaway is that state law is now a primary source of platform liability, and the penalties are calibrated to user counts rather than to the scale of any single incident.