The Meta lawsuit in New Mexico ended in a court order on 21 October 2026. What it found about privacy settings, app access and promises made in public.
On 21 October 2026, a state court in Santa Fe entered judgment in New Mexico’s Meta lawsuit. A jury had found that 26 public statements Facebook made about privacy and its platform were deceptive and willful, and the court turned that into a civil penalty it calculated at 219.5 billion dollars and then reduced to 25 billion dollars. Most coverage of Meta and New Mexico stopped at the number. The order is more useful than the number. It sets promises a platform made about what its systems did against what the evidence showed they did.
I read the court’s findings of fact, conclusions of law and judgment, 20 scanned pages, page by page. This post sets out what the court found, the rule that turned 26 statements into 43.9 million violations, what the order does not settle, and what a team running a much smaller site should take from it.
The case is State of New Mexico ex rel. Raúl Torrez v. Meta Platforms, No. D-101-CV-2021-00132. The state filed this Facebook lawsuit in 2021. A 12-person jury, sitting under a stipulated order of 21 August 2025, decided liability, unconscionability, willfulness and the number of violations, and returned its verdict on 25 September 2026, as Courthouse News reported. District Judge Francis J. Mathew filed the judgment on 21 October 2026 at 10:51.
| Item | What the order says |
|---|---|
| Statements found unlawful and willful | 26, made between 24 May 2010 and 18 August 2021 |
| Violations by unfair or deceptive practices | 43,899,720 |
| Violations by unconscionable practices | 5 |
| Penalty at 5,000 dollars per violation | 219,498,600,000 dollars |
| Penalty ordered | Reduced to 25,000,000,000 dollars |
| Interest | 15 percent a year until paid |
| Injunctive relief | Reserved for further briefing |
The statements went out through Facebook’s own platform and Newsroom, earnings calls, television, print and online interviews and public conferences. Some were made by Mark Zuckerberg and by Sheryl Sandberg, then the chief operating officer (order, findings 9 and 10).
Six of the 26 statements were about users’ control of their own data, including third-party access and how Facebook made money from it. The jury found all six deceptive and willful, which on its audience count came to 10,459,944 violations.
The finding that matters most to anyone who builds a settings page is paragraph 18. An expert, Dr. Egelman, testified that the audience controls users saw, the drop-down that limits who can see a post, had no bearing on what developers can pull from your profile or whether they could even read this post when they communicate with the API
(order, finding 18). The API had its own settings, which in his account most users did not know existed.
That is a familiar shape. The interface describes one behaviour. Another path through the system produces another. The court did not need a network capture to see it, because the evidence was internal documents and testimony, but it is the same gap I look for in a browser: a control that governs the screen and not the data flow.
The second example is friend sharing. Before 2014, apps could read personal information about the friends of the people who installed them. In 2014 Facebook announced the end of that practice, with a transition ending in May 2015, and said each user would decide what to share with an app. The court found that more than a year before the announcement, Facebook was already planning exemptions for favoured business partners, and that the exemptions were not disclosed to users (findings 22 to 25).
After the Cambridge Analytica reporting in March 2018, Facebook made five public commitments, in the court’s account: investigate all apps that had access to large amounts of data before the 2014 change, audit apps with suspicious activity, ban developers found misusing data, make sure improperly obtained data was deleted, and notify the users affected. The work became the App Developer Investigation, which ran from about March 2018 to March 2021. The order takes each commitment in turn (findings 26 to 36).
[t]here is no reasonable enforcement/verification approachfor developer deletion, and gave the policy goal as partly
to optimize for external optics.
The court described the whole as a systematic pattern of deception at the core of Facebook’s business model
(finding 20). That is the court’s label, and I leave it with the court. What I would add is narrower. Each of the five failures is a gap between a sentence and a process: a promise to audit with no audit capacity behind it, a promise to delete with no way to check, a promise to notify with a definition that could be adjusted until few notices were due.
The case was not brought under a privacy statute. It was brought under the New Mexico Unfair Practices Act, the state’s general law against unfair, deceptive and unconscionable trade practices, which allows a civil penalty of up to 5,000 dollars per violation under section 57-12-11 NMSA 1978 (conclusion 3).
The count came from the audience. For each statement it found unlawful, the jury counted either 1,386,648 violations, the number of Facebook’s monthly active users in New Mexico on 30 June 2020, or 2,100,000, roughly the state’s population, depending on the expected reach of the statement. Twenty-six statements at those audiences make 43.9 million violations. The judge found the record supported the maximum per violation, calculated the 219.5 billion dollar figure, and reduced it.
The court also dealt with Meta’s reference to its 5 billion dollar settlement with the Federal Trade Commission as a measure of proportionality. That settlement, it wrote, cannot be viewed in a vacuum
(finding 5).
Reported Before the order, the state had asked for 35 to 40 billion dollars and Meta for a cap of 3.45 billion dollars, according to Reuters, carried by NBC News, which also reports that the money goes to New Mexico’s school system.
Unresolved How the court got from 219.5 billion dollars to 25 billion dollars. The order states both figures and gives no arithmetic between them.
This is a trial court’s judgment, not the last word. Reported Meta’s chief legal officer, C.J. Mahoney, told Courthouse News that This ruling, and the Attorney General’s approach to this enforcement, makes it all but impossible to do business in the state of New Mexico
, and the company said it would appeal. The attorney general, Raúl Torrez, called it a historic day for New Mexico and for consumers across the country
.
The findings are a jury’s findings about statements, reached through internal documents, testimony and exhibits. They are not a technical audit of the platform as it runs today, and nothing in the order describes what the API allows in 2026. The 26 statements also include two on misinformation and five on hate speech, which this post leaves aside. And this Facebook privacy lawsuit is one state’s case under one state’s statute: the per-violation maximum and the audience method are New Mexico’s, and other states’ consumer laws are built differently.
It is also a separate matter from the other cases reported this year, among them a March 2026 Santa Fe verdict about young users’ safety with 375 million dollars in penalties and a Meta settlement with 47 states in August 2026, which other social media platforms joined, that Courthouse News puts at 17 billion dollars. None of those figures belongs to this judgment.
The order is about Facebook, at a scale no reader of this blog operates. The mechanism does not depend on scale. The case turned on public statements about what a system does, and every website with a privacy page makes those. A privacy policy is evidence of what a company says, not proof of what its software does, and this court read the policy and the evidence side by side.
If one of those promises turns out to be false, the fix goes either to the system or to the sentence, and which one is a decision to make with a lawyer who knows your jurisdiction. Milan’s post on California’s draft rules for Global Privacy Control is the same problem at the scale of one page load: a signal that a site says it honours, and tags that fire before anyone has checked.
A privacy page is a set of claims about system behaviour. Each one can be tested, and this court tested them.
The one in the news is New Mexico's consumer protection case, filed in 2021. On 25 September 2026 a Santa Fe jury found 26 Facebook statements about privacy and its platform deceptive and willful. On 21 October 2026 the court entered judgment for a civil penalty of 25 billion dollars. Meta has said it will appeal.
Not from this one. The judgment awards a civil penalty to the State of New Mexico, not to individual users, and Reuters reports that the money goes to the state's school system. Class actions and settlements that pay individuals are separate cases with their own terms.
By audience. For each of the 26 statements found unlawful, the jury counted either 1,386,648 violations, Facebook's New Mexico monthly active users in June 2020, or 2,100,000, roughly the state's population. The order totals 43,899,720 deceptive-practice violations, each worth up to 5,000 dollars under the Unfair Practices Act.
Meta has said it will. Its chief legal officer told Courthouse News that the ruling makes it all but impossible to do business in the state. The judgment is a trial court's; the penalty, the interest and the injunctive relief the court has reserved can all change on appeal or in further briefing.
Technical investigator, Berlin. The systems behind the rules. Does the system behave the way its owners say it does, and what follows if it doesn't?
