Facebook owner ordered to pay $25 billion after 87 million users caught up in data scandal

Millions of Facebook users never took the quiz or or agreed to share their data, yet their details still ended up in the hands of Cambridge Analytica. A US judge has now ruled that Meta’s promise of user control was false, and the bill is bigger than anything the company has faced before.

A judge has ruled Facebook’s promise of control was false

A New Mexico judge has ordered Meta, the owner of Facebook, Instagram and WhatsApp, to pay $25 billion (about €22.3 billion) after a jury found the company misled the public about how much control people had over their personal data. Judge Francis Mathew handed down the order on Wednesday October 21, writing that “Facebook promised users that the users controlled their data. This was false.” He added that the wrongdoing “goes to the heart of Facebook’s core business practices.”

It’s the largest penalty Meta has ever faced, and well above the $5 billion (€4.45 billion) the US Federal Trade Commission imposed over the same scandal in 2019. New Mexico Attorney General Raúl Torrez called it one of the largest state verdicts against a company in American history, and said every dollar will go to the state’s schools.

Zuckerberg’s own messages were used against Meta 

The case goes back to Cambridge Analytica, the British political consultancy that worked on Donald Trump’s 2016 presidential campaign. It obtained the details of as many as 87 million Facebook users through a personality quiz app, with most of those people never having used the app themselves.

New Mexico sued in 2021, and on Friday September 25 jurors decided that 26 of 29 statements by Meta and its leadership were misleading, including how the company handled the fallout from the scandal. They then counted nearly 43.9 million violations of the state’s Unfair Practices Act, working the figure out from the number of people each statement reached.

The state argued that Meta lied to New Mexico users about who could access their data, and knew outside developers had broad access to it. Facebook’s own breakdown suggested the information of 348,472 people in the state may have been improperly shared. 

Internal messages from Mark Zuckerberg were reportedly central to the judge’s findings. In one, he wrote that people “probably don’t understand their current privacy settings or care about who sees their updates.”

How $219 billion dropped to $25 billion 

State law allows up to $5,000 (about €4,450) per violation, and the judge ruled that the full count supported a penalty of more than $219 billion (about €195 billion). He then cut it to $25 billion.

New Mexico had asked for between $35 billion and $40 billion (€31 billion to €35.6 billion), while Meta urged a cap of $3.45 billion (€3.07 billion), arguing anything larger would breach its right to due process.

Interest of 15 per cent a year will also build up while the appeal runs, according to the Associated Press. Torrez admitted the money will be tied up for now, though he still joked that the state “may have paid for the construction of schools for the next 100 years.”

Spain was caught up in the original scandal too 

Facebook’s own estimates in 2018 suggested the data of about 2.7 million people in the EU may have been exposed, with an estimated 137,000 of them in Spain. Only 44 people in Spain installed the quiz app themselves, yet the numbers climbed so high because it also reached into their friends’ accounts.

The New Mexico ruling doesn’t apply here, as it only covers that one US state. However, Spain has been taking its own action against Meta. In November 2025, a Madrid commercial court ordered the company to pay €479 million to 87 Spanish digital media outlets for breaking EU data protection rules (GDPR) in the way it used personal data for advertising, and Meta said it would appeal.

That same month, Prime Minister Pedro Sánchez announced an investigation into claims that Meta used a hidden mechanism to track the web browsing of Android users and link it to their Facebook and Instagram accounts.

Meta will appeal, and the bill could shrink

Meta’s chief legal officer, C.J. Mahoney, said the ruling makes it “all but impossible to do business in the state of New Mexico” and described the case as an attempt to “impose a tax on speech.” He said the company is confident it will win on appeal, and its lawyers have called a penalty of this size “shocking to the conscience.”

Investors don’t seem too worried. Meta’s shares were trading about 2 per cent higher after the news, and analyst Gil Luria said the company “is worth nearly two trillion dollars and will likely continue to appeal.” 

It isn’t Meta’s first loss in the state. Earlier this year, New Mexico won $942 million (€838 million) from the company in two trials over claims it misled young users about safety on Facebook and Instagram, and Meta settled with most other states in August, although New Mexico and Florida stayed out.

An appeal could also trim the total, since cutting the number of violations would cut the bill. Meanwhile, the judge has put off deciding on the state’s request for a court order forcing Meta to change how it handles user data until both sides have been heard again, so whether anything changes for ordinary Facebook users depends on that decision and on an appeal that experts expect to take years.