What happened
A New Mexico state court ordered Meta to pay $25 billion on Wednesday, after finding that the company made misleading statements about how much control Facebook users had over their own information. State District Court Judge Francis J. Mathew put the finding in plain terms. Facebook promised users that they controlled their data, he wrote, and that promise was false. The penalty covers more than 43 million violations of the state's unfair practices law.
The case was filed in 2021, three years after the Cambridge Analytica revelations. A personality quiz app called "thisisyourdigitallife" collected data from around 300,000 people who took the test, then also pulled in information about their friends, building a dataset of roughly 87 million profiles. Meta banned the app in 2015 for breaking its platform rules and sent Cambridge Analytica a legal request to delete what it held.
This is not Meta's first financial consequence from that period. The US Federal Trade Commission fined it $5 billion in 2019, and it agreed to a $725 million class action settlement in December 2022. In August it settled with nearly every US state and territory for $18 billion over a decade, with $459 million set aside for the Cambridge Analytica claims. New Mexico and Florida did not join. New Mexico's case has now produced by far the largest number. Meta's chief legal officer, C.J. Mahoney, called the penalty excessive and said the company will appeal.
Why this is a GRC story
The violation was a sentence, not a server. Nobody alleged that an attacker stole the data. The finding is that a public statement about user control did not match how the system actually behaved. That gap is where privacy programmes tend to be thin. Policies are drafted once by lawyers, while the data flows they describe are rewritten by product teams every few weeks.
The multiplier is volume. Forty three million violations rather than one incident is what turns a state consumer law into a nine figure number. Any regime that counts affected records behaves the same way. The practical audit question is whether an organisation can evidence that its published notice still matches its current data flows, and how fast it could prove it.
Remediation does not reset the clock. Banning the app and demanding deletion did not reduce exposure for statements made before that. A dated record of what was known, when it was known, and what changed is worth more than a clean press release issued years later.
Two states refusing to settle produced the biggest penalty. Settlement strategy is a governance decision with a balance sheet consequence. That belongs in front of the board, not only the general counsel.
What to watch
The appeal, and whether New Mexico's per-violation arithmetic survives it. Florida's case is still open, so the same theory gets a second test, and a second penalty figure to compare against the $18 billion multistate deal.
For practitioners the useful question is smaller. If a regulator asked today for every third party that receives user data, and the exact wording that promised users otherwise, how long would that take? Most organisations can produce the policy. Far fewer can produce the mapping, and the mapping is what gets tested.
Attribution: Analysis based on The Hacker News and related public reporting. This article is original commentary, not a repost of the source material.