Privacy & Cybersecurity Law Blog

On October 21, 2026, Meta was ordered to pay $25 billion to the state of New Mexico for alleged violations of New Mexico state consumer protection law. The order follows a jury verdict finding that Meta violated New Mexico’s Unfair Practices Act (“UPA”) by making false and misleading statements about how it collected, protected, shared and used consumers’ personal information, handled misinformation and hate speech, applied community standards and investigated app developers following the Cambridge Analytica matter. Meta has disputed the verdict. For more on Cambridge Analytica, please see our prior blog post.

As summarized in the New Mexico Department of Justice announcement of the verdict, the jury found that Meta made willfully deceptive statements in several areas:

• Data Privacy: Meta represented that consumers controlled how their information was shared, that it did not sell or provide consumers’ personal information to advertisers, and did not buy or sell users’ data.
• Misinformation and Hate Speech: Meta represented that it did not profit from misinformation or hate speech, removed harmful misinformation from its platforms, and had no incentive to retain hateful content and did not allow hate speech on its platforms. Meta also represented that it consistently applied its Community Standards, did not provide special protections to particular groups, and did not make exceptions for politicians or newsworthiness.
• Third-Party Applications: Following the Cambridge Analytica matter, Meta represented that it would investigate applications that had accessed large amounts of user information, conduct forensic audits, ban developers that misused data, and notify individuals whose information may have been affected.

The judgment underscores the power of state attorneys general to hold companies accountable for alleged privacy violations under existing consumer protection laws, even in states that have not enacted comprehensive consumer privacy legislation.