Meta fined $25 billion for sharing user data without consent

A New Mexico judge has fined Meta $25 billion for violating data privacy laws between 2010 and 2021, a penalty that traces back to the Cambridge Analytica scandal and stands as one of the largest data protection judgments ever handed to a single company.

Judge Francis Mathew delivered the ruling after finding that Meta had committed more than 43 million violations of New Mexico's consumer protection laws. The court concluded that the company let third-party app developers access users' personal information without consent — the same conduct that surfaced when Cambridge Analytica improperly obtained Facebook user data more than a decade ago.

How big is the fine in context?

The headline number understates Meta's exposure. Under New Mexico law, Judge Mathew could have imposed damages as high as $219 billion — a sum that would have exceeded Meta's entire revenue for 2025. He reduced the demand to $25 billion without explanation, according to reports on the order.

Put simply: Meta walked away paying roughly one-ninth of what the statute allowed, and even the reduced figure dwarfs most data protection penalties issued anywhere in the world. Meta has confirmed it will appeal the judgment.

What did the court actually say?

Judge Mathew was blunt about the scale of the harm. "The harm in this matter is difficult to overstate, and goes to the heart of Facebook's basic business proposition," he wrote in his order.

That sentence matters for enterprise readers. The court did not treat the violations as a technical compliance failure. It framed the unauthorized data sharing as central to how the company made money — a finding that turns a privacy lapse into a business-model problem.

The case originated after revelations that Cambridge Analytica, a data company, had improperly obtained personal information Facebook was holding. The court action that followed examined conduct stretching from 2010 to 2021.

Is this part of a pattern?

The ruling caps a damaging stretch for Meta in the courts:

• August: Meta agreed to an $18 billion settlement over claims that Facebook and Instagram failed to prevent children from accessing its platforms.
• July: Another New Mexico judge fined the company just under $1 billion, again for failing to protect minors.

Taken together, Meta has absorbed roughly $44 billion in fines and settlements in 2026 alone — before any appeal outcomes.

What does this mean for other enterprises?

The New Mexico judgment is a warning shot with numbers attached. A company that treats consent requirements as optional now has a concrete benchmark: 43 million counted violations, a statutory ceiling of $219 billion, and a final bill of $25 billion.

European regulators are moving in the same direction. Last year, GDPR breaches rose 22%, with a record €1.2 billion in fines issued, as legislators push for tougher enforcement against large technology firms.

For any enterprise processing personal data through third-party apps or developers, the lesson from this case is structural: the exposure compounds per violation, per user, per year — and courts are willing to do the multiplication.

A $25 billion penalty is what happens when data protection failures are counted one user at a time.