A New Mexico judge has ordered Meta Platforms to pay a US$25 billion civil penalty, roughly C$35 billion, after a jury found the company had misled the state's residents about how Facebook handled their personal data.
Judge Francis Mathew of the First Judicial District Court in Santa Fe issued the order on October 21. The case was filed in 2021 and grew out of the Cambridge Analytica affair, which also exposed data belonging to hundreds of thousands of Canadians. New Mexico Attorney General Raúl Torrez said the award may be the largest single-state verdict against a company in US history, Reuters and Bloomberg reported.
The court did not require proof that anyone lost money. Jurors multiplied a fixed statutory fine by the number of people who could have seen each statement, a method that could be applied to any company making public claims about how it protects customer data.
New Mexico sued under its Unfair Practices Act, which allows a penalty of up to US$5,000 for each wilful violation. During a trial of about two weeks, jurors reviewed 34 public statements by Facebook and its executives about privacy, access to user data and content moderation, and found most of them misleading.
They then counted each statement's potential audience in the state. Depending on the statement, that was either Facebook's roughly 1.4 million monthly users in New Mexico or the state's population of about 2.1 million. The total came to about 43.9 million violations.
At the maximum rate, the penalty would have been about US$219.5 billion. The state asked for US$35 billion to US$40 billion. Meta proposed a cap of about US$3.45 billion and argued that New Mexico had not shown anyone saw, relied on or was harmed by the statements. Mathew settled on US$25 billion, with interest of 15% a year until it is paid, CNBC reported.
Meta plans to appeal, according to the AP. Interest keeps accruing in the meantime, at about US$3.75 billion a year.
Cambridge Analytica has already cost the company heavily in the US. Facebook paid a US$5 billion penalty to the Federal Trade Commission in 2019 and settled a consumer class action for US$725 million in 2022. In August, Meta reached a settlement with other state attorneys general valued at up to US$17.1 billion, which included about US$459 million to resolve Cambridge Analytica claims. New Mexico stayed out of that deal. Its award is more than 50 times what the other states accepted for the same scandal.
In Canada, the same scandal has been in the courts since 2020. Only 272 Canadians installed the personality-quiz app at the centre of the case, but Facebook has estimated that the data of more than 600,000 Canadians may have been disclosed, according to the Supreme Court of Canada's case summary. The summary also notes that Facebook did not tell affected users when it learned in 2015 that the data had been sold.
The Office of the Privacy Commissioner of Canada found in 2019 that Facebook had failed to obtain meaningful consent and failed to safeguard user information. The Federal Court dismissed the commissioner's application in 2023. In September 2024, the Federal Court of Appeal reversed that decision and found Facebook had breached federal privacy law, calling the idea that users read long privacy policies "a dubious assumption." The Supreme Court heard Meta's appeal on March 19, 2026. Its docket, last updated October 7, shows judgment still reserved.
A loss for Meta in Ottawa would not bring a fine. Under PIPEDA, the federal private-sector privacy law, the commissioner can investigate and apply to the Federal Court but cannot impose penalties directly.
Bill C-36 would change that. Tabled on June 15, 2026, it would replace the privacy portions of PIPEDA with a new Protecting Privacy and Consumer Data Act. The bill proposes administrative penalties of up to the greater of C$10 million or 3% of gross global revenue, and up to C$25 million or 5% for certain offences. It would also create a Digital Safety and Data Protection Commission and give individuals a right to sue. Two earlier attempts at this reform, bills C-11 and C-27, died on the order paper. LEGISinfo lists C-36 at second reading in the House of Commons, with no debate recorded yet.
Quebec already has penalties of this kind. Under Law 25, the province's privacy regulator can impose administrative penalties of up to C$10 million or 2% of worldwide turnover, and penal fines of up to C$25 million or 4%. Officers and directors who direct or acquiesce in an offence can be held personally liable, and courts must award at least C$1,000 in punitive damages for intentional or grossly negligent breaches.
These Canadian penalties are written as maximums tied to an organization's revenue, so they rise with the size of the company. As an illustration only, 5% of Meta's approximately US$201 billion in 2025 revenue would be about US$10 billion.
Read next: Why wrongful data collection is the next big headache for cyber insurers
The most direct exposure for Canadian carriers is through clients that sell to American consumers. Those companies can be sued under US state consumer-protection laws, and the New Mexico case did not involve a new data breach. It turned on public statements about privacy that a jury decided were untrue.
Some Canadian cyber insurers already look at what clients say about data, not only how they protect it. Chris Gonzales, vice-president of cyber and professional lines at Arch Insurance Canada, told Insurance Business earlier this year that some markets now run privacy scans on clients' websites to check whether businesses are following the law and their own published privacy policies.
The Canadian cyber market is softening. Rates fell about 6% in each of the first two quarters of 2026 as new capacity arrived, while only about 22% of Canadian small and mid-sized businesses carry cyber cover and roughly 12% hold a standalone policy.
D&O underwriters have their own reason to pay attention. The New Mexico verdict rested partly on statements by senior executives, and jurors watched video deposition testimony from Mark Zuckerberg, Bloomberg reported. Quebec's Law 25 already allows penal liability for officers and directors. Canadian D&O wordings differ on whether fines and penalties are insurable, a question that will come up more often if C-36 passes.
Canadian privacy class actions have so far settled for modest amounts, typically C$1 to C$100 per affected person, according to Blakes. A private right of action under C-36 could raise those figures.
Read next: Canadian cyber rates are falling and only 22% of SMEs have cover
These are general prompts, not legal advice. The answers depend on policy wording, provincial law and where a client does business.
Read next: Meta's US$16.68 billion child safety settlement is a D&O and tech benchmark
Meta had not commented on the order by Wednesday afternoon. In Canada, the Supreme Court could release its Facebook decision at any time, and Bill C-36 is awaiting second-reading debate now that the House of Commons has resumed sitting.
Read next: What INTERPOL's new cyber report means for Canadian brokers and underwriters
