Meta hit with $25 billion penalty over its privacy promises

On 21 October 2026, Judge Francis J. Mathew of the New Mexico District Court ordered Meta to pay the state $25 billion for deceiving Facebook users about how their personal data was handled. According to SecurityWeek and Security Affairs, it is the largest penalty ever imposed on the company. The story was reported by The Record, SecurityWeek, The Hacker News, Security Affairs and CSO Online; Meta has announced an appeal.

This is not a cyberattack: the case concerns a company’s public statements about data control and third-party developer access. That is exactly why it matters to anyone managing integrations, APIs and privacy notices.

What happened

In September a jury found that Meta had violated New Mexico’s unfair practices law more than 43 million times, through misleading statements about how Facebook handled user data. Each violation carries a civil penalty of up to $5,000.

The figures on the table were far apart:

• the state sought between $35 and $40 billion, arguing that only an impact on the share price would make the company change;
• Meta’s lawyers put the ceiling at $3.4 billion, arguing that anything higher would be unconstitutional;
• multiplying the violations by the maximum penalty gave roughly $220 billion according to The Record, $219 billion according to CSO Online.

The judge set the penalty at $25 billion; CSO Online notes that the reduction was not explained. According to The Record, the amount accrues 15% annual interest until it is paid. Under the New Mexico Constitution, penalties of this kind fund education, but the appeal could delay payment for years.

Not everything went against Meta: according to SecurityWeek, the jury rejected claims of false statements about removing harmful content, including COVID-19 misinformation.

The origins: Cambridge Analytica

The case, filed in 2021, stems from the Cambridge Analytica scandal, exposed by a whistleblower in 2018. According to Security Affairs, about 300,000 people took a personality quiz in a third-party app that also collected their friends’ data: around 87 million profiles in total, later used by the British political consulting firm for targeted advertising during the 2016 US presidential election. Meta had banned the app in 2015 and asked for the data to be deleted; Cambridge Analytica shut down in May 2018. CSO Online places the violations between 2010 and 2021.

What the judge wrote

The reasoning, reported by The Record and SecurityWeek, touches on points every IT manager will recognise:

• data control claimed but not real: “Facebook promised users that they (the users) controlled their data. This was false,” the judge wrote;
• third-party developers not vetted at the time they were granted access to user data;
• poor record keeping: because of it, according to the judge, Facebook could neither carry out the “comprehensive” investigation it promised after the scandal nor enforce deletion of data already shared;
• an internal App Developer Investigation described as “willfully ineffective”, due to pressure from senior leadership to minimise costs, weak enforcement mechanisms and poor investigative techniques;
• a data access infrastructure and enforcement protocols that users could not verify, which the company, according to the judge, took advantage of.

Meta disputes the ruling: its chief legal officer C.J. Mahoney said the lawsuit seeks to “impose a tax on speech” and makes it “all but impossible” to do business in the state.

Other penalties

The amount is five times the $5 billion fine imposed by the FTC in 2019. Over Cambridge Analytica, Meta already paid $725 million in 2022 to settle a class action, and $459 million is part of the August agreement with almost all US states over child safety: $18 billion according to SecurityWeek and Security Affairs, about $17 billion according to The Record. New Mexico did not join and in March had already won $375 million in another case over child safety; CSO Online also mentions a penalty of just under $1 billion in July, not reported by the other sources.

Impact on European and Italian businesses

The ruling applies a US state consumer protection law, but its principles match those of the GDPR: transparency towards data subjects, controller accountability (demonstrating, not just declaring), control over who receives the data and the ability to enforce deletion with recipients. CSO Online notes that GDPR fines in Europe reached a record €1.2 billion last year.

For NIS2 entities (in Italy, Legislative Decree 138/2024), supply chain security, including suppliers and integrations that access systems, is among the required risk management measures. The case shows what happens when third-party access grows without an inventory, checks and records.

What to do now

1. Inventory the integrations that access personal data: OAuth apps authorised in cloud tenants, API keys, connectors; for each one, the permissions granted and an internal owner. Revoke those no longer in use.
2. Vet before granting access: supplier assessment, least privilege, special attention to permissions that expose data of people other than the authorising user.
3. Log third-party access: who read which data, when and in what volume, with retention long enough to reconstruct events years later.
4. Make deletion enforceable: contract clauses, written confirmations, audit rights and technical revocation of credentials when the relationship ends.
5. Align privacy notices and public statements with technical reality: every sentence about data control, sharing and deletion should be checked with the people who run the systems.
6. Prepare an investigation procedure for third-party misuse, with resources and criteria agreed before the incident.

How ARXDOME helps

Among the points raised by the judge is poor record keeping, which made it impossible to reconstruct who had accessed the data. ARX Sentry collects logs and events from computers, servers and firewalls; ARX Retain keeps them for the required number of years on European storage, with object lock to prevent changes, legal hold and a record of every operation, so they can be restored for an audit or an investigation.

Last updated: 23 October 2026