The Maze: Meta, Facebook’s owner, faces a $25 billion civil penalty in New Mexico, the US state, plus 15% annual interest until it pays. The October 21 signed judgment sets the financial consequences of September’s consumer-deception verdict. It leaves a separate question open: whether Meta must change its practices.
Source: New Mexico Courts. The signed order sets the penalty and annual interest, and reserves any order changing Meta’s practices.
Video: New Mexico Department of Justice. The attorney general presents the state’s account of the penalty judgment.
The Details:
The new decision puts a price on waiting. Judge Francis J. Mathew’s signed judgment orders interest until the penalty is paid in full. At an unchanged $25 billion principal, that rate equals $3.75 billion for one year before compounding. This is a calculation of exposure, not money already collected. The document gives no compounding rule, payment timetable or terms governing a pause in enforcement during an appeal. Meta told ABC News it will appeal. Its chief legal officer, C.J. Mahoney, argues that the case penalizes speech and makes operating in the state extremely difficult.
The huge total comes from counting audiences repeatedly. The court’s penalty calculation uses 43,899,720 violations across 26 unlawful public statements. For each statement, jurors counted an expected audience of either roughly 1.39 million New Mexico Facebook users or 2.1 million state residents. Those are overlapping audiences, not 43.9 million distinct victims. Applying the $5,000 legal ceiling to each violation produces $219.5 billion. The judge reduced that to $25 billion without explaining the reduction’s formula. He cited repeated, deliberate deception and earlier penalties’ failure to deter Meta to justify a substantial sanction. That explains severity; it does not explain the precise reduced amount.
The findings expose the difference between a promise and a control. The court found that Facebook’s investigation of apps accessing user data ran from approximately March 2018 to March 2021, but completed only 14 forensic audits. It generally relied on developers to certify that they had deleted data. The court also found that at least 2,000 apps were associated with misuse that should have triggered notifications, while Facebook notified users about only two apps after narrowing its definition of misuse. These are findings on a contested historical record, subject to appeal. Fourteen audits does not mean only fourteen apps were examined.
MarketMaze Take: The immediate development is a financial obligation with a running annual cost. The operational outcome remains unfinished. For a business buying Facebook ads, a larger penalty and a new restriction on the platform’s use of data are different developments. This judgment establishes the former and reserves the latter.
Privacy claims belong in commercial due diligence. Advertisers outside New Mexico can draw a bounded lesson: check what actually verifies a platform’s data promises. A developer’s deletion certificate and an independent check are different controls. The court’s audit and notification findings make that distinction concrete. They do not prove that today’s advertising tools work the same way as the historical systems at trial.
Scale cuts both ways. Meta recorded $200.97 billion in 2025 revenue, including $196.18 billion from advertising. Its scale helps explain why data-control assurances matter commercially. It also makes revenue an inadequate guide to when this penalty will be collected. Neither the order nor those results establishes higher ad prices or a worldwide targeting change.
