A New Mexico judge has ordered Meta to pay $25 billion for misleading Facebook users about their privacy — one of the largest penalties ever imposed on a tech company. India, Facebook’s biggest market, should pay attention.
Updated: October 22, 2026, 11:30 AM IST
Quick Read
- Judge Francis Mathew ordered Meta to pay $25 billion after a jury found 43M+ violations of New Mexico’s consumer protection law in the Cambridge Analytica case.
- The judge said $219 billion was legally warranted but reduced it to $25 billion. Meta says it will appeal.
- India is Facebook and WhatsApp’s largest market — the same deceptive data practices are exactly what India’s own privacy rules now target.
What the court decided
The case goes back to 2018, when Facebook admitted that the private data of as many as 87 million users had been improperly obtained by Cambridge Analytica, a political consulting firm. The firm used that data to build profiles of American voters.
New Mexico sued Facebook in 2021, accusing it of lying to users in the state about who could access their data. In September, a jury found Meta liable for more than 43 million violations of the state’s Unfair Practices Act. On Wednesday, Judge Francis Mathew decided the penalty.
His words were blunt: “Facebook’s misrepresentations about users’ control of their data were not isolated incidents, but rather a systematic pattern of deception at the core of Facebook’s business model.” He calculated that state law warranted more than $219 billion — then reduced it to $25 billion.
Also read: DeepSeek Banned in US: What It Means for India
Meta’s response
Meta says it will appeal. Chief Legal Officer C.J. Mahoney called the ruling an attack on free speech: “This ruling, and the Attorney General’s approach to this enforcement, makes it all but impossible to do business in the state of New Mexico. At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online. We are confident we will prevail on appeal.”
Notably, Meta’s shares rose 2% after the penalty was announced — investors seem to believe the company can absorb it. For context, Meta paid $5 billion to the US Federal Trade Commission in 2019 over the same scandal.
Why this matters in India
Here is the part Indian readers should not skip. India is Facebook’s largest market by users, and WhatsApp’s too — hundreds of millions of Indians use Meta’s apps every day. The deception this case punished — telling users they control their data while quietly sharing it — is the exact pattern India’s own digital privacy law (the DPDP Act) is designed to stop.
Cambridge Analytica’s story also had an Indian chapter: the firm’s parent company worked with political clients in India, a fact that came out during the 2018 investigations. When a court calls this “a systematic pattern of deception at the core of Facebook’s business model,” Indian users are part of that business model.
Also read: Rubio: India-US Trade Deal Is ‘Weeks Away, 99% Done’
Check your own settings today
Court cases take years; your privacy settings take two minutes. Open Facebook → Settings → Privacy, and check three things: who can see your posts, whether advertisers can use your activity (Ad Preferences), and “Off-Facebook Activity” — this shows which outside apps and websites share your data with Facebook. Turn off what you do not need. No court order protects your data better than your own settings.
FAQs
Why was Meta fined $25 billion?
A New Mexico jury found Meta committed 43M+ violations of consumer protection law by misleading Facebook users about data privacy in the Cambridge Analytica scandal. The judge set the penalty at $25 billion (down from a legally warranted $219 billion).
Will Meta actually pay?
Not yet — Meta says it will appeal, and appeals in cases this size take years. The company previously paid $5 billion to the FTC in 2019 over the same scandal.
What should Indian Facebook users do?
Review your Facebook privacy settings (ad preferences, off-Facebook activity, post visibility). India is Meta’s biggest market, and India’s DPDP privacy law targets exactly these deceptive practices.
Pingback: eMudhra quits global SSL after 40% crash
Pingback: DeepSeek banned in US: what it means for India