On October 21, 2026, Judge Francis Mathew of the First Judicial District Court in Santa Fe ordered Meta Platforms to pay the State of New Mexico $25 billion after a jury found the company liable for more than 43 million violations of state consumer protection law. The case stems from public statements Meta executives made between 2010 and 2021 about how Facebook handled user data. What follows is an examination of the verdict’s arithmetic, the legal theory behind it, and what it reveals about the growing use of statutory penalties as a lever against platforms.
In this article
What the Jury Found
On September 25, 2026, a Santa Fe jury found that 26 of 29 statements Meta made were misleading, resulting in more than 43 million violations of New Mexico’s Unfair Practices Act. The jury calculated violations by multiplying each misleading statement by either the number of Facebook users in New Mexico or the state’s total population in 2020. Judge Mathew wrote that Meta’s conduct, “systematically broadcast to the public,” went “to the heart of Facebook’s core business practices”.
The trial, which lasted two weeks, examined how Meta executives spoke publicly about user data. Judge Mathew found that Meta’s misrepresentations about how data was used and shared were “willful” and spanned more than 11 years, from 2010 to 2021, and that communications between senior executives, including Mark Zuckerberg, were “designed to mislead the public”. The lawsuit stemmed from Meta’s role in the Cambridge Analytica scandal, in which that firm utilized data from millions of Facebook users as part of political consulting work related to the 2016 U.S. Presidential election.
New Mexico was not part of a federal settlement involving most other states, so its case proceeded to trial in September, with former Attorney General Hector Balderas having originally filed the lawsuit in 2021.
The Arithmetic of $219 Billion
Under New Mexico law, each violation of the consumer protection statute can carry a civil penalty of up to $5,000. Judge Mathew calculated that a penalty of more than $219 billion was warranted under state law, then reduced the figure to $25 billion. The state had asked for a penalty between $35 billion and $45 billion. Meta had argued that anything beyond $3.4 billion would be unconstitutional.
The penalty was not built from proven injuries to individual consumers; it was built by multiplying statutory fines across an audience count, arithmetic that can reach almost any company that talks publicly about how it protects customer data. Each misleading statement was multiplied by the number of New Mexico Facebook users or the state’s 2020 population, giving roughly 1.3 million to 2.1 million violations per statement, for a total of about 43.9 million violations.
The judge added that interest on the penalty shall accrue at the rate of 15 percent each year until the fine is paid off in full. Meta said in a statement it plans to appeal the ruling.
What This Fits Into
The New Mexico verdict is the second trial victory the state has secured against Meta in 2026. Earlier this year, Attorney General Raul Torrez won $942 million in the first successful trial over claims that Instagram and Facebook harm children through addiction and sexual exploitation. In a separate trial that ended in March, a Santa Fe jury found Meta misled users about young users’ safety and ordered the company to pay $375 million in civil penalties.
Torrez was the first state law enforcer in the country to bring Meta to trial over the Cambridge Analytica scandal; Meta had been willing to pay a hefty price to move past the scandal without trial, agreeing to settlements totaling about $6 billion across agreements with the Federal Trade Commission, Facebook users, and a bipartisan coalition of attorneys general. The FTC in 2019 levied a $5 billion fine against the company over its data privacy practices.
At a news conference, Torrez told reporters that the multibillion-dollar judgment was a clear sign of what New Mexico is capable of by going it alone in court, and that the $25 billion is larger than settlements delivered in high-profile multi-state lawsuits that settled earlier this year. The New Mexico case illustrates a structural shift: states with consumer protection statutes that permit per-violation penalties have discovered that audience-based violation counts can produce liability far exceeding negotiated settlements.
The pattern is not confined to Meta. Statutory penalty regimes that count violations by impression, user, or message create exposure that scales with platform size. A company with 2 million users in a state and 20 misleading statements faces 40 million potential violations before any court exercises discretion. That arithmetic does not depend on proving individual harm. It depends on proving the statement was misleading and that it reached an audience.
Implications for Platforms and Email Operators
Meta’s penalty reflects what happens when public statements about data handling are later contradicted by discovered practice. The judge cited internal communications showing that executives knew their public claims were inaccurate. For platforms that make representations about encryption, data access, or third-party sharing, the New Mexico verdict is a reminder that those statements are discoverable, that juries will compare them to actual system behavior, and that statutory penalties can be applied per-user or per-statement-instance.
Email providers make similar claims. Statements like “we never read your email” or “only you control your encryption keys” become liability if a court later finds they were misleading. The distinction between what a system architecturally permits and what a company’s legal or operational practice actually is matters. If a provider has technical access to plaintext, saying “we do not access your data” may be true as policy but false as capability, and a jury may treat capability as the controlling fact.
The $25 billion figure is roughly one-eighth of the approximately $201 billion in revenue Meta reported for 2025. For smaller operators, a similar per-violation model applied to terms-of-service claims or privacy-policy statements could produce liability that exceeds annual revenue by orders of magnitude. The risk is not hypothetical. Consumer protection statutes in most U.S. states permit penalties between $1,000 and $10,000 per violation, and state attorneys general now have a tested playbook for counting violations by audience size.
Architectural Honesty and Verifiable Claims
The remedy is not silence. It is precision. If a system stores plaintext for operational reasons, say so. If a provider has technical access to decryption keys, document the architectural reason and disclose the access model. If end-to-end encryption is optional rather than default, state that clearly. The legal risk arises not from a system’s limitations but from claims that exceed what the system enforces.
Open-source post-quantum cryptography platforms illustrate this principle. PQCServer, published under AGPL-3.0 at github.com/onion-search-engine/pqcserver, provides auditable code where claims about cryptographic implementation can be tested by compiling it. Systems built on verifiable architecture demonstrate a model that withstands scrutiny: code that can be examined, claims that correspond to implementation, and documentation that acknowledges operational limits. Onion Mail’s own infrastructure operates over Tor and supports PGP encryption for users who supply their own keys, with documentation that specifies what is architecturally enforced versus what depends on user configuration.
Observation
The $25 billion New Mexico judgment will almost certainly be reduced on appeal. Meta has constitutional arguments about excessive fines, and the Eighth Amendment and state equivalents provide a basis for judicial review of penalties that are grossly disproportionate to harm. But the jury’s liability finding is harder to challenge. Meta made public statements. Those statements reached an audience. The statements were misleading. That is the structure of a consumer protection violation, and it does not require proving individual damages.
What the case reveals is that per-violation statutory schemes, when applied to platforms, produce numbers that were unimaginable when those statutes were drafted. A $5,000-per-violation penalty was designed for a car dealer who made a false claim to 100 customers, not a platform that made a claim to 2 million. The law has not caught up to the arithmetic, but state attorneys general have, and they now understand that a single misleading privacy claim, multiplied by a state’s user base, can generate liability in the tens of billions.
The result is a new discipline. Every public statement about data handling is now a potential per-user liability. Platforms that wish to avoid that exposure will need to ensure that their public claims are narrower than their technical capabilities, that their terms of service match their actual data flows, and that their executives do not make representations that internal documents later contradict. The Meta verdict is not an outlier. It is a map.