Eight years after Cambridge Analytica became shorthand for democracy's digital rot, a New Mexico courtroom has attached a number to the damage: $25 billion. The verdict, handed down Wednesday, is the largest data-privacy penalty ever imposed on a technology company in the United States, dwarfing the Federal Trade Commission's $5 billion settlement with Meta in 2019. It is also a reminder that the 2016 election's data scandals never really ended—they merely migrated to slower-moving state courts.

The jury found that Meta misled consumers when the political consultancy harvested user data without consent for Donald Trump's first presidential campaign. New Mexico's attorney general had argued that the company's privacy representations amounted to fraud under state consumer-protection law, and jurors agreed. Meta has already signaled it will appeal, calling the award "disconnected from any reasonable measure of harm."

Why New Mexico, and why now

Federal regulators moved on from Cambridge Analytica years ago, but state attorneys general kept digging. New Mexico filed suit in 2022, and the case wound through discovery while Meta fought similar actions in other jurisdictions. The state's consumer-fraud statute allows for penalties per violation, and with millions of affected users, the math spiraled. Legal observers had expected a large number; few anticipated one that exceeds Meta's entire 2025 net income.

The appeal will be brutal—but so will the precedent

Meta's lawyers will argue that the penalty is constitutionally excessive and that a state court cannot impose punishment for conduct that occurred largely outside its borders. Those arguments have merit, and the $25 billion figure will almost certainly shrink on appeal. But even a fraction of that sum would set a new benchmark for privacy litigation, emboldening plaintiffs' lawyers and state AGs nationwide. Texas, Illinois, and California all have pending actions against major platforms; their settlement calculus just changed.

Our take

The number is theatrical, and Meta will never write a $25 billion check. But theatrics matter in deterrence. For years, Silicon Valley treated privacy fines as a line item—painful, perhaps, but manageable. A jury in Albuquerque just told Mark Zuckerberg that the old math no longer applies. Whether or not the verdict survives intact, the message will linger: mislead users at scale, and eventually someone will make you pay at scale.