On 21 October 2026, Santa Fe judge Francis Mathew ordered Meta to pay $25 billion in civil penalties under New Mexico's Unfair Practices Act. A September jury had found roughly 43.9 million violations tied to Facebook's statements about data privacy and harmful-content enforcement. At the Act's maximum of $5,000 per violation, that implied about $219.5 billion in exposure. The judge cut it by almost 90 percent, and Meta says it will appeal (PPC Land).
The case deserves a serious reading, because the strongest argument for the state is a good one. The penalty is not mainly about Meta's size. It is about whether a company can tell users one thing and do another.
The case for the state
Meta has been told before that deceiving users about privacy is unlawful. In August 2012 the Federal Trade Commission finalized a settlement alleging that Facebook told consumers they could keep information private and then repeatedly allowed it to be shared and made public. The order required express consent before sharing beyond a user's privacy settings, a comprehensive privacy program and independent audits every two years (FTC, 2012).
In July 2019 the FTC imposed a $5 billion penalty for violating that order. It called the sum the largest ever imposed on any company for violating consumers' privacy and almost 20 times greater than the largest privacy or data-security penalty imposed worldwide before it (FTC, 2019).
If the earlier sanction had deterred, a second case might not be needed. A repeat offender facing a nine-figure fine that it can absorb as a cost of business is the situation penalty statutes exist for. The judge cited the number of willful violations, how long and how often they occurred, the involvement of senior Facebook leadership and the size of New Mexico audiences (NewsChannel 9). He described the conduct as systematic and as going to the heart of Facebook's core business practices. Those are findings about deception, and deception is not protected speech or innovation.
Where the method fails
The trouble is the arithmetic. As reported, the 43.9 million violations came from a verdict form applied to a handful of challenged statements, with jurors finding 26 of 29 statements misleading (PPC Land). A violation count of that size cannot be a count of statements or of proven victims. It follows from multiplying each statement by how many people could have been exposed to it.
Meta's lawyers argue that no one was shown to have heard the statements or been harmed. That argument is not frivolous. It points to a real gap between the legal wrong, a misleading public claim, and the unit of punishment, every person in a large audience.
Once the unit of punishment is audience size, the penalty scales with a company's success rather than with the gravity of the conduct. The same false sentence costs a small platform thousands of dollars and a large one hundreds of billions. A rule like that taxes reach, which is the thing a healthy internet economy should want to encourage. It also creates a perverse incentive to say less. Companies that fear audience-multiplied liability will write vaguer, more defensive safety and privacy statements, and users learn less.
The judge's own remittitur concedes the point. He found that more than $219 billion was warranted, then reduced it to $25 billion. The state had asked for $35 billion to $40 billion. Meta argued for no more than about $3.4 billion and said a $40 billion sum would be unconstitutional (PPC Land). The $25 billion figure is five times the FTC's record penalty, imposed by one state court for one theory of deception. No statutory formula produced it. It reflects judicial discretion.
What proportionate enforcement looks like
None of this requires going easy on deception. Three principles would keep platform accountability both credible and predictable.
- Count what was proven. Violations should be tied to specific, provable misstatements or to identified consumers, not to hypothetical audience reach. Statutes should say so, and legislatures, not juries, should set the unit.
- Anchor penalties to harm and culpability. The FTC's 2019 penalty sat inside a 20-year order with concrete privacy-program obligations. Behavioral remedies change conduct. A headline number mostly changes the news cycle.
- Keep regulators consistent. Fifty states running different multiplication schemes against one company for one set of statements is a recipe for stacked, uncoordinated penalties that no company can price.
There is also a precedent problem. This is not New Mexico's first win against Meta. A Santa Fe jury found in March 2026 that Meta misled users about youth safety and set $375 million in civil penalties (Tech Policy Press). If the state's approach holds on appeal, other attorneys general will copy it, and every large platform will face audience-scaled exposure in every state.
What to watch
The appeal will decide whether the number survives, and the issue that matters most is whether penalties of this size are consistent with due process limits. Interest will accrue while the case is pending, so the figure could grow. Whatever the appellate courts decide, Congress and state legislatures should not leave the counting rule to the accident of a verdict form. Accountability for platform deception is legitimate. Penalties that scale with a platform's audience rather than with the harm it caused are not.