Meta must pay $25 billion in fines for data privacy violations related to the Cambridge Analytica scandal that became public almost 10 years ago, according to a New Mexico court filing released Wednesday.
In September, a jury found Meta had broken the state’s unfair practices law 43 million times for its role in the incident, which a whistleblower made public in 2018. Each violation carried civil penalties of as much as $5,000.
The state was initially awarded $220 billion, but state District Court Judge Francis Mathew reduced the penalty to $25 billion, according to the court filing. Meta will be charged 15% annual interest on the amount until the fine is paid off.
The case is tied to Meta-owned Facebook, which shared as many as 87 million users’ data with the Cambridge Analytica. The British political consulting firm then used the data to create psychological profiles of voters to facilitate targeted advertising, including in the 2016 presidential election.
New Mexico’s litigation focused on what Facebook told consumers about its data practices and how it combats misinformation and hate speech in the wake of the scandal becoming public, according to a press release from the office of Attorney General Raúl Torrez.
“The scale, duration, repetition, breadth, and willfulness of the violations, together with the evidence concerning Facebook’s internal knowledge and practices … constitute substantial aggravating circumstances,” Mathew wrote in the filing.
Mathew highlighted the fact that senior Facebook leadership, including CEO Mark Zuckerberg and then-COO Sheryl Sandberg, created a calculated strategy to mislead consumers by among other things overseeing the creation of materials they called a “song sheet” to coordinate a public relations response.
“Facebook continued making public representations concerning users’ control of data, third-party data misuse, misinformation, hate speech, and equal enforcement after employees, researchers, and senior personnel had internally identified that Facebook could not make good on its public promises,” the filing said, noting that Zuckerberg was aware of the deception.
The platform knew at the time that information regarding its data access infrastructure and enforcement protocols were not verifiable by users and the company took advantage of that, the filing said.
Facebook also failed to follow through on the “comprehensive” probe it promised consumers after the scandal became public, Mathew said.
The social media company was “aware at the time it made the promises that it did not have the ability to conduct such a thorough investigation or enforce deletion of the data due in large part to Facebook’s poor record keeping and failure to vet third party developers at the time they were granted access to user data,” the filing said.
Pressure from senior leadership to minimize costs, a weak enforcement mechanism, poor investigative techniques and a focus on not setting a precedent for future probes caused Facebook to use an App Developer Investigation that was “willfully ineffective,” according to Mathew.
The ruling and Torrez’s approach to the enforcement “makes it all but impossible to do business in the state of New Mexico,” Meta Chief Legal Officer C.J. Mahoney said in a statement.
“At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online.”
Meta plans to appeal the ruling, the statement said.
Torrez won $375 million in damages from Meta in March after a jury found the tech behemoth broke state law related to its kids’online safety practices.
Meta has already faced steep fines related to the Cambridge Analytica scandal, including a $459 million penalty that was included in a roughly $17 billion August settlement with a group of several other state attorneys general pursuing the tech giant for its child safety practices.
The social media company also settled a class action lawsuit related to the scandal in 2022 for $725 million.
Digital freedoms advocates hailed the momentum states are gaining as they target Meta and other big tech companies for violating users’ data privacy.
“The message from these state actions is evident: companies must be accurate and clear about how they process and treat data,” Eric Null, director of the Privacy and Data Project at the Center for Democracy and Technology, said via email.
“If companies don’t improve their practices, states should ratchet up the pressure by continuing to hold companies accountable under current law and updating their privacy statutes to prevent such harms from happening in the first place.”
