The Privacy Promise: Why Facebook Was Ordered to Pay $25 Billion

Facebook privacy settings can help you control who sees your posts and some of how your information is shared. But do they protect as much as you think? After a New Mexico jury found that Meta misled consumers and a judge ordered $25 billion in civil penalties, it's worth taking a fresh look at what your settings actually do—and what they don't.

Facebook told users they had control over their personal information. A New Mexico jury found that the company misled consumers. Now a judge has ordered its parent company, Meta, to pay an extraordinary penalty. What does the case reveal about the promises we make when we hand our lives to technology?

A $25 billion warning to Big Tech

On October 21, 2026, a New Mexico judge ordered Meta, the company behind Facebook, to pay $25 billion in civil penalties after a jury found that the company had misled consumers about privacy and other practices.

The decision followed a jury verdict in September. Jurors found that 26 of 29 statements made by Meta and its leadership were misleading, resulting in more than 43 million violations of New Mexico's consumer-protection laws.

The judge initially determined that the potential penalty under state law exceeded $219 billion, but reduced the amount to $25 billion.

Meta has said it intends to appeal, arguing that the ruling is legally flawed and threatens its ability to operate in New Mexico.

The distinction matters: the court has ordered Meta to pay $25 billion, but the company has not simply handed over the money. The appeal could change the outcome.

Nevertheless, the ruling raises a question that reaches far beyond one company: how much should consumers be able to trust a technology platform's promises about their privacy?

The scandal that started it all

To understand the case, we need to go back to Cambridge Analytica.

In 2018, reports revealed that the political consulting firm had obtained personal information associated with as many as 87 million Facebook users through a third-party application.

The app was designed to collect information from people who used it. Under Facebook's rules at the time, it also gained access to certain information about many of those users' Facebook friends.

Those friends had not necessarily installed the app themselves or knowingly agreed to have their information collected for this purpose.

Cambridge Analytica used the data to help build voter profiles and support political targeting. The revelations triggered international outrage and renewed scrutiny of Facebook's data practices.

The problem wasn't simply that personal information had been collected. It was that many users had little understanding of how their information could be accessed, combined and used by others.

A platform can make privacy settings available and still leave people with a poor understanding of what those settings actually protect.

What did the New Mexico case examine?

New Mexico's attorney general sued Meta in 2021.

The state alleged that Facebook had misled New Mexico consumers about who could access their personal information and about the company's handling of harmful content, including hate speech and misinformation.

The case therefore extended beyond a single privacy notice or one incident involving Cambridge Analytica. It examined a wider set of public statements about the platform's practices.

After hearing the evidence, the jury found that 26 of 29 statements at issue were misleading. The jurors also determined that the company had committed more than 43 million violations of state consumer-protection law.

The judge concluded that the number of violations, the duration of the conduct and the nature of the statements justified a substantial penalty.

Meta disputed the state's case. Among its arguments, the company maintained that it does not sell users' personal data and that the state had not demonstrated that consumers were actually misled.

Those arguments form part of the company's position and anticipated appeal. They do not erase the jury's findings, but they matter when assessing what may happen next.

How did the penalty reach $25 billion?

The size of the penalty can be difficult to comprehend.

New Mexico law allows civil penalties of up to $5,000 for each violation. The jury's finding of more than 43 million violations created the basis for a potentially enormous award.

The judge concluded that a much larger amount could be justified under the statute, but reduced the award to $25 billion.

The state had sought a penalty of between $35 billion and $40 billion. Meta had argued that the penalty should be capped at approximately $3.45 billion.

The dispute illustrates a central challenge in consumer-protection law: when a company makes a misleading statement that potentially reaches millions of people, how should the law calculate the penalty?

Should the calculation reflect the number of people potentially exposed to the statement, the number actually exposed, the number who relied on it, or some other measure?

That question is likely to be important in the appeal. Legal experts have already raised concerns about how the number of violations was calculated and whether the penalty will withstand further judicial review.

The amount is striking, but it is not yet the final word on Meta's liability.

The deeper problem: privacy is difficult to understand

Most people don't read every privacy policy, and it's easy to see why.

They can run for dozens of pages, contain technical terminology and change as products evolve. Even people who make a serious effort to understand them may struggle to work out what happens to their information after it leaves their immediate control.

Consider the information that can accumulate through ordinary online activity:

• Your name, contact details and approximate location.
• Your interests, searches, clicks and interactions.
• Your connections with other people.
• Information inferred from your behavior.
• Data shared with apps, advertisers, service providers or other third parties, depending on the platform's policies and settings.

Some of this information is deliberately supplied. Some is generated through activity. Some may be inferred.

The resulting picture can reveal much more about a person than any individual post or profile field suggests.

This is why a privacy promise needs to be judged by more than the appearance of a settings screen. What information is collected? Who can access it? What is shared? How long is it retained? What happens when a third party receives it?

And, crucially, do the company's public statements accurately describe the answers?

The difference between control and the appearance of control

Privacy settings can be useful. They may allow you to restrict who sees your posts, limit certain kinds of information sharing or control how other users interact with you.

But controlling the visibility of a post is not the same as controlling every use of the information associated with it.

For example, making a post visible only to friends does not necessarily tell you everything about how the platform processes associated data. Nor does it automatically establish what happens to information that has already been shared with an application or another party.

The precise protections depend on the platform, the settings, the data involved and the policies in effect.

The broader lesson is straightforward: a privacy control is only as meaningful as the protection it actually provides.

A company should explain those limits clearly. Users should not have to become data-protection specialists to understand the practical consequences of using an everyday service.

What can ordinary Facebook users do?

This court case does not mean every Facebook user's information has been exposed, nor does it establish that every privacy setting is ineffective. It does, however, offer a reason to review what information you share and what protections are available.

Here are some sensible steps.

1. Review your audience settings

Check who can see your posts, personal details and future updates. Choose settings that match what you genuinely want to share.

Remember that limiting your audience does not necessarily prevent every form of platform processing.

2. Check connected apps and websites

Review applications and services connected to your account, where those controls are available. Remove connections you no longer use or trust.

Don't assume that removing an app connection necessarily erases information the app previously obtained. Check the service's own deletion options if that matters to you.

3. Limit unnecessary personal details

Avoid publicly displaying information such as your full birth date, home address, travel plans or other details that could create privacy or security risks.

Even individually harmless details can become more revealing when combined.

4. Be cautious with quizzes and third-party apps

A personality quiz, game or seemingly harmless application may request access to information that is not necessary for its advertised purpose.

Before granting access, ask what the app needs, who operates it and whether you are comfortable with the requested permissions.

5. Revisit settings periodically

Platforms change their products, policies and controls. A review today is useful, but it cannot guarantee that the same protections will remain in place indefinitely.

Use the available privacy tools, but don't mistake them for a promise that no information will ever be misused.

Does a $25 billion penalty solve the problem?

Not by itself.

A financial penalty can punish unlawful conduct, deter future violations and signal that consumer-protection laws apply to powerful technology companies.

But a court order cannot, on its own, make every privacy policy understandable, prevent every future data breach or guarantee that consumers will always know how their information is being used.

The outcome also depends on what happens next: whether the ruling survives appeal, whether any further remedies are imposed and whether the company changes its practices.

There is another important distinction. A large penalty does not automatically tell us how much harm any individual user suffered or whether that person is entitled to compensation. The penalty in this case is a civil award to the state, not a $25 billion fund automatically payable to Facebook users.

For consumers, the most meaningful long-term outcome would be more than a headline-grabbing number. It would be clear disclosures, meaningful choices, responsible data handling and consequences when companies break the rules.

The question every platform should have to answer

We increasingly use online platforms to communicate with friends, share photographs, organize our lives, follow news and maintain relationships.

That makes trust essential.

Most users cannot independently audit a company's data systems. They rely on the company's explanations, the controls it provides and the laws that govern its behavior.

This creates an imbalance. The platform knows far more about its own systems than the people using them.

When public promises turn out to be misleading, the problem is not merely technical. It is a failure of trust between a company and the people whose information helps sustain its business.

The New Mexico case is a reminder that those promises can be tested in court. But consumers should not have to wait years for litigation to understand what happens to their information.

Evidence: STRONG — The jury verdict and court order are documented in the official record. The final legal outcome remains subject to appeal.