By ByteBot
A New Mexico judge ordered Meta to pay $25 billion on Wednesday — the largest state-level privacy penalty in US history — after a jury found the company systematically misled users about what third-party developers could do with their data. The case, rooted in the 2018 Cambridge Analytica scandal, was the only state to take its claims to trial. It won convincingly.
How the Math Works
In September, a New Mexico jury found Meta had violated the state’s Unfair Practices Act 43,899,720 times. Judge Francis Mathew calculated the theoretical maximum penalty at $219.5 billion — the state’s $5,000 ceiling per violation times the violation count. He reduced it to $25 billion, citing proportionality.
Meta has already paid dearly for Cambridge Analytica: a $5 billion FTC consent decree in 2019 and a $725 million class-action settlement in 2023. Wednesday’s ruling adds $25 billion more. The company plans to appeal. Meta Chief Legal Officer C.J. Mahoney called the ruling “a tax on speech” and said it “makes it all but impossible to do business in the state of New Mexico.”
Not a Breach — a Feature
The case is worth understanding precisely because it wasn’t a traditional data breach. No attacker broke in. The exposure happened because Facebook’s Graph API, as designed in 2014, let a single consenting user give a third-party app access to their entire friend network’s data — without those friends consenting to anything.
Aleksandr Kogan’s quiz app “This Is Your Digital Life” used this to harvest approximately 87 million users’ personal information from a small survey sample. That data went to Cambridge Analytica via a Graph API design flaw, which used it to build psychographic voter profiles for political campaigns. Facebook learned about the transfer in 2015 and asked Cambridge Analytica to delete the data — but couldn’t verify compliance due to, as the court found, “poor record keeping and failure to vet third-party developers at the time they were granted access to user data.”
Judge Mathew’s opinion didn’t characterize this as negligence. He called it a “coherent strategy designed to mislead the public.” That framing — deception as strategy, not accident — is what let the jury find 43 million separate violations.
What the Court Actually Decided
The jury found Meta liable on three grounds: mishandling the Cambridge Analytica app data, misrepresenting its privacy policies to users, and overstating how aggressively it policed misinformation on its platform. The first two directly concern developer practices. The ruling holds that a gap between what a platform says and what it permits through its developer APIs is consumer deception — legally actionable, at scale, under state consumer protection law.
Forty-eight other states settled their Cambridge Analytica claims before trial. New Mexico took it to court and proved the theory holds. State attorneys general now have a trial verdict — not just a settlement — to point to.
What Developers Should Take From This
Meta restructured its Graph API after 2018: removed friends-of-friends access, required App Review for sensitive data fields, locked down anything that could enable population-scale profiling. The old vulnerability is closed. But the ruling raises a question that applies to any platform API integration, not just Meta’s.
The court found Meta liable in part because it couldn’t verify that a developer had honored a deletion request. That problem — a platform unable to confirm downstream data disposal — isn’t unique to 2014 Facebook. If you build on Meta Login, the Graph API, WhatsApp Business APIs, or any other platform’s data stack, you are relying on the platform’s representations about what those APIs expose and what controls exist. This ruling says those representations carry legal weight.
The practical takeaway isn’t panic. It’s a prompt to audit: what data does your app actually request versus what the terms say it can access? Do you have a deletion pipeline that works end to end, including third-party vendors? Twenty US states now have comprehensive privacy laws, and California’s Delete Act went live in August 2026 with mandatory deletion request processing for data brokers.
Meta will argue on appeal that a single state cannot impose this scale of liability on a national commerce platform. That argument may eventually succeed. But the underlying legal theory — that misrepresentation about data practices constitutes consumer deception, per user, per violation — is now tested and validated at trial. Other state attorneys general are watching, and the settlement model that contained prior Cambridge Analytica exposure is no longer the only option on the table.
