A New Mexico court has ordered Meta Platforms to pay $25 billion after a jury concluded that Facebook repeatedly misled consumers about data privacy and other platform practices, producing one of the largest corporate penalties in American history. The litigation grew out of the Cambridge Analytica scandal.

In September, a New Mexico jury concluded that Meta and its leadership made 26 misleading statements and found approximately 43.9 million violations of the state’s Unfair Practices Act. Judge Francis Mathew calculated that applying the statutory maximum penalty of $5,000 to the violations could theoretically produce damages exceeding $219 billion. Judge Matthew ultimately reduced the final judgment to $25 billion.

The judgment is significant not only because of its extraordinary size, but because New Mexico used ordinary state consumer-protection law to impose a penalty that could reshape how technology companies think about privacy disclosures and representations to users.  The case is also important because it demonstrates how state consumer-protection laws, rather than new federal technology legislation, can potentially expose large technology companies to enormous financial liability.

The court’s reasoning was particularly damaging to Meta. Mathew concluded that Facebook’s privacy controls failed to provide users meaningful control over their information and that third-party developers were able to access personal data through Facebook’s systems. The court also considered evidence suggesting that company leadership understood that many users did not fully comprehend Facebook’s privacy settings.

Meta has strongly rejected the ruling and announced that it will appeal. Chief Legal Officer C.J. Mahoney argued that New Mexico’s approach makes it extremely difficult for companies such as Meta to operate in the state and characterized the case as an attempt to impose new restrictions on online speech. Meta also argued during the litigation that it does not sell users’ personal data and that the state failed to demonstrate that individual consumers were actually deceived by the statements at issue.

A $25 billion judgment is extraordinary, and appellate courts could reduce or overturn the award on statutory, constitutional or due-process grounds. Meta, which is valued at nearly $2 trillion, can also afford a prolonged legal battle, meaning the company is unlikely to pay the full judgment anytime soon.

The ruling demonstrates that statements about privacy, safety and platform practices can themselves become enormous sources of liability. If other states successfully adopt New Mexico’s approach, technology companies could face penalties calculated across millions of users rather than simply paying damages for a limited number of individual incidents.

The ruling could cause tech companies to become considerably more cautious about claims such as “your information is private,” “you control your data,” or “we protect users from harmful content.” Privacy policies and public assurances that once appeared primarily to be communications or compliance documents could increasingly be treated as legally enforceable representations to every consumer who receives them.

The $25 billion judgment represents something larger than another penalty stemming from Cambridge Analytica. It signals that the central regulatory risk facing technology companies may increasingly involve trust itself. When companies tell consumers how their information is collected, protected and used, courts may increasingly treat those promises not merely as corporate messaging but as commitments carrying potentially enormous financial consequences.