Twenty-five billion dollars. That was the number New Mexico state court Judge Francis Mathew attached on Wednesday to Facebook’s years of lying about privacy — one of the largest penalties ever imposed on a US company, and a verdict delivered not by a federal regulator but by a single American state of barely two million people.
The math behind the headline is what should worry every technology company. In September, a jury found Facebook liable for more than 43 million violations of New Mexico’s Unfair Practices Act. New Mexico law allows up to $5,000 per violation — which meant the judge could have awarded more than $219 billion. He reduced it to $25 billion, a mercy that still dwarfs every previous privacy penalty in American history, including the Federal Trade Commission’s $5 billion settlement with Facebook in 2019.
The case traces back to 2021, when Attorney General Raúl Torrez sued Meta over the Cambridge Analytica scandal — the harvesting of data from as many as 87 million Facebook users through a third-party personality-quiz app, later used for voter profiling and targeted ads in the 2016 Trump campaign. But the lawsuit went wider than one scandal. The state accused Meta of systematically lying to its users about who could access their data, and about how the company handled hate speech and misinformation — tolerating both, the state said, when it suited the bottom line. “Facebook’s wrongdoing — over the course of years and systematically broadcast to the public — goes to the heart of Facebook’s core business practices,” Mathew wrote in his order.
“We took on one of the largest companies in the world because New Mexicans deserve honesty, accountability and the protection of their personal information. Today’s result makes clear that no corporation is too powerful to be held accountable.”
Raúl Torrez, New Mexico Attorney General
Meta, predictably, called it extortion by another name. Chief legal officer C.J. Mahoney said the company would appeal, accusing the attorney general’s office of conduct that “makes it all but impossible to do business in the state of New Mexico.” The lawsuit, he said, “seeks to impose a tax on speech to enforce new rules for what people can say online,” adding that Meta was confident it would prevail on appeal.
Why one small state can extract $25 billion
This is the part that matters, and it has almost nothing to do with New Mexico. The $25 billion number is not a fine for one lie. It is 43 million lies, priced at retail. Consumer-protection statutes like New Mexico’s were written for shopkeepers and car dealers, where a single deceptive statement means a single penalty. Applied to a social platform that broadcast the same deceptive privacy assurances to every user, every day, for years, the arithmetic turns apocalyptic: each misleading statement multiplies into millions of violations. That is the enforcement model that terrifies Silicon Valley — not a regulator in Washington bargaining for a settlement, but fifty state attorneys general armed with penalty multipliers. Several other states settled their Cambridge Analytica claims against Meta for far smaller sums; New Mexico held out, went to trial, and walked away with a multiple of that.
There is a real argument that the math is disproportionate — that no company can absorb penalties measured in per-violation billions, and that such numbers function as a de facto operating license revoked at a judge’s discretion. Mahoney’s “tax on speech” framing is designed for exactly that appeal. But the counter-argument is the one Mathew adopted: when deception is the business model, priced per incident, the penalty must match the scale of the incidents. Facebook did not lie once. It lied systematically, to the public, over years — and per-violation law is one of the few tools calibrated for exactly that kind of mass deception.
What it signals
For a company worth roughly $2 trillion, $25 billion is painful but survivable — it was due to report quarterly earnings the same day. The damage that isn’t survivable is the precedent: any state AG with a similar statute can now run the same playbook, and there are forty-nine of them. Meta will appeal for years, and the final number will likely shrink further. But the signal has already been priced in. The era in which platforms treated privacy deception as a cost of doing business — the FTC’s $5 billion in 2019 was effectively a licensing fee — is giving way to an era in which a single state court can name a number that makes even Meta flinch. The question now is not whether other states follow. It’s which one goes first.
