A privacy representation can reach millions of people. New Mexico’s case against Meta shows how that scale can translate into extraordinary statutory exposure.
A New Mexico judge ordered Meta to pay US$25 billion in civil penalties on October 21 following a jury verdict establishing nearly 44 million violations of the state’s Unfair Practices Act. The litigation arose from the Cambridge Analytica scandal and examined representations about Facebook’s data practices and handling of harmful content. New Mexico DOJ: penalty announcement.
The court’s statutory calculation reached approximately US$219.5 billion before the judge reduced the penalty to US$25 billion. Meta says it will appeal. Court: findings and judgment (PDF).
Liability and the penalty order
The distinction between the verdict and the penalty matters. The jury established liability; the subsequent order determined its financial consequences. The appeal will provide the next opportunity to challenge that result.
For corporate counsel, the case illustrates why privacy review cannot stop at the privacy policy. Public statements about information collection, third-party access and protective controls may create exposure of their own.
A representation that sounds reassuring in a presentation or interview still needs to match the underlying practice. Repetition and audience size can become significant when a statute permits penalties for separate violations.
Privacy representations need evidence
For Canadian businesses operating in the United States, the judgment is also a reminder to examine applicable state consumer-protection statutes alongside privacy-specific legislation. The New Mexico outcome does not establish the penalty available elsewhere, but it makes that jurisdictional analysis commercially consequential.
A useful internal review would identify the company’s most frequently repeated privacy claims, the evidence supporting them and the process for correcting statements when practices change. Counsel should also ask who approves representations outside formal legal documents.
The next stage concerns the sustainability of this particular award. Questions about proportionality and constitutional limits should be assessed against the appellate arguments and eventual reasons, rather than assumed from the size of the number alone.
Watch the appellate arguments
A privacy promise needs evidence behind it - and a governance process that keeps it accurate.
Related coverage: Clearview AI Appeal Tests How Far UK Privacy Law Reaches Overseas.
Sources: New Mexico DOJ: penalty announcement · Court: findings and judgment (PDF) · AP: judgment and Meta’s appeal response .