It’s taken a New Mexico jury about two weeks of testimony to decide that Meta Platforms misled the state's residents about how Facebook handled their personal data. It took a judge another month to put a price on it: $25 billion.
Judge Francis Mathew of the First Judicial District Court in Santa Fe handed down the civil penalty on Wednesday, October 21, closing out the penalty phase of a case New Mexico first brought in 2021 over fallout from the Cambridge Analytica scandal. Attorney General Raúl Torrez described the result as possibly the largest single-state verdict against a company in American history, speaking at an Albuquerque press conference reported by Reuters and Bloomberg.
The number is startling on its own – it’s larger than the annual GDP of about 70 countries, including Jamaica, Botswana and North Macedonia, according to IMF estimates.
What should hold the attention of insurance professionals, though, is how the court got there. The penalty was not built from proven injuries to individual consumers. It was built by multiplying statutory fines across an audience count — and that arithmetic can reach almost any company that talks publicly about how it protects customer data.
The state's case rested on the New Mexico Unfair Practices Act, which allows a civil penalty of up to $5,000 for each willful violation. Jurors in Santa Fe weighed 34 public statements about data privacy, hate speech and Facebook's response to Cambridge Analytica, and on September 25 found most of them misleading. Meta did win on a handful of content-moderation statements, including claims about removing COVID-19 misinformation.
The jury then counted violations by audience, not by victim. Each misleading statement was multiplied by the number of New Mexico Facebook users, or by the state's 2020 population, giving roughly 1.3 million to 2.1 million violations per statement. The total came to about 43.9 million violations
At the statutory maximum, that works out to roughly $219.5 billion. Neither side pretended that number would survive.
At an October 1 hearing, special prosecutor Randi McGinn asked Judge Mathew to apply the full $5,000 rate and then cut the total to between $35 billion and $40 billion — still large enough, she argued, to register on Meta's share price. "The world is watching this one," she told the court. Meta's lawyer, Matthew Nicholson, countered that anything in that range would breach the excessive-fines protections in the state and federal constitutions, and urged a cap of about $3.45 billion. He also pointed out that the state's ask would dwarf the roughly $20.8 billion BP agreed to pay over the Deepwater Horizon spill.
Mathew landed in between. He agreed the conduct justified the top per-violation rate, describing Facebook's misstatements as intentional, systematic and repeated over more than a decade. But he used the court's discretion to trim the award to $25 billion. Interest accrues at 15% a year until it is paid, according to the order as reported by CNBC. Under the New Mexico Constitution, consumer-protection penalties go to education spending, the AP reported.
The final award sits far closer to Meta's proposed cap than to the ceiling the jury's findings allowed.
For scale: $25 billion is well over a full year of state income. New Mexico expects about $14.8 billion in general-fund revenue in fiscal 2028, Bloomberg reported. Measured against Meta, it is roughly one-eighth of the approximately $201 billion in revenue the company reported for 2025.
Read next: Meta's insurers already won't defend it, and design-based liability claims may be why
A scandal that keeps sending invoices
The case traces back to 2018, when it emerged that the political consultancy Cambridge Analytica — which worked on Donald Trump's 2016 campaign — had obtained data on as many as 87 million Facebook users through a third-party app. Former Attorney General Hector Balderas sued in 2021, and Torrez took the case to trial.
The bill for that episode has been climbing ever since. Facebook paid a then-record $5 billion penalty to the Federal Trade Commission in 2019 and settled a consumer class action for $725 million in 2022. In August 2026, Meta reached a multistate deal valued by state officials at up to $17.1 billion — Meta has described it as roughly $18 billion — which mainly resolved youth-harm claims but also closed out Cambridge Analytica consumer-protection claims in other states for about $459 million.
New Mexico stayed out of that coalition. Set against the roughly $459 million other states accepted for the same underlying scandal, its decision to go to trial has now produced a penalty more than 50 times larger — at least on paper.
The New Mexico order is not, in the first instance, an insurance loss. Civil fines and penalties are commonly excluded from liability policies or treated as uninsurable under state public policy, though the rules differ by state and by policy wording. Few observers expect Meta's carriers to be writing a $25 billion check.
What the case offers the market is a template — and that is the bigger exposure question.
First, it shows how a consumer-protection statute can scale. New Mexico did not have to prove that any individual resident relied on Facebook's statements or was hurt by them, a point Meta's lawyers pressed hard. The jury simply counted the people who were in a position to hear them. Underwriters who price privacy and statutory-damages exposure will recognize the mechanic: a modest per-count figure, multiplied across a large audience, produces a number no balance sheet was built for.
Second, the liability flowed from what the company said, not just what it did with data. The verdict was built on public statements about security, privacy controls and content moderation, including remarks by senior executives. Jurors watched video deposition testimony from Mark Zuckerberg and former COO Sheryl Sandberg, Bloomberg reported. For directors and officers carriers, that is a familiar pattern: misstatements found by one court tend to become source material for securities and derivative claims elsewhere. (No such follow-on suits had been reported at the time of writing; this is the author's analysis, not a reported development.)
Third, it lands in a market that is already wary of platform risk. In late February, Delaware Superior Court Judge Sheldon Rennie ruled that The Hartford, Chubb units and more than 20 other insurers had no duty to defend Meta in the consolidated social media addiction litigation, finding the complaints described deliberate design choices rather than accidents. That ruling, which Meta is challenging, has already pushed brokers to rethink how D&O and tech E&O programs respond to platform claims.
Read next: Meta, Google hammered by huge new court case — carriers have already got court protection
Insurance analysts were flagging this direction well before Wednesday. After New Mexico's first verdict against Meta in March, Moody's warned that the legal theories behind platform cases could change how insurers and reinsurers price long-tail casualty risk. Law firm Husch Blackwell said the fallout could reach coverage, loss aggregation and reserving across general liability, D&O and cyber lines.
Kenny Carmichael, technology practice leader at CFC Underwriting, has argued that the market treats platform businesses too narrowly as data risks, when their exposure spans cyber, media, product liability and casualty at once. Clyde & Co partner Katelin O'Rourke Gorman said in the firm's December 2025 risk predictions that US social media lawsuits were "creating significant liability risks for insurers".
The privacy penalty adds a new wrinkle. Most of that commentary concerned how products were designed; this exposure comes from what a company promised about customer data. That kind of claim can sit awkwardly between a cyber policy written around security events, a tech E&O policy written around system failure and a D&O policy built for securities claims — a gap brokers may want to test before a client discovers it in a claim.
The award also adds a new kind of entry to the nuclear verdicts conversation. Most of the large awards driving social inflation come from private plaintiffs in product liability, trucking and personal injury cases. Research from Marathon Strategies counted 135 verdicts above $10 million in 2024, totalling about $31.3 billion, according to Norton Rose Fulbright.The New Mexico penalty alone equals roughly four-fifths of that entire year's total.
The plaintiff here was a state attorney general who chose to go it alone. New Mexico has now won two jury trials against Meta in 2026: a child-safety case in March that ended with $375 million in civil penalties, followed by a $567 million abatement order, for a combined $942 million. Torrez made it clear he sees the outcome as a signal. "It has been a long time coming holding Big Tech accountable," he said after the ruling, according to Reuters.
Other attorneys general who settled with Meta will be watching the appeal closely. If the penalty holds up even in reduced form, the incentive for states to try cases rather than join coalitions grows — and so does the uncertainty that liability and cyber underwriters must price for any company that makes public promises about consumer data.
Read next: Will the US social inflation crisis have a contagion effect?
Meta had not commented on the order by Wednesday afternoon. The ruling landed hours before the company was due to report third-quarter results — a quarter in which Meta had already said it expected to book roughly $10 billion in legal expenses tied to the multistate settlement.
An appeal is coming. Meta plans to challenge the jury's verdict and argues the state never proved that any New Mexican saw, relied on or was harmed by the statements, the AP reported. After the September verdict, a Meta spokesperson said the company would keep defending itself against "efforts to distort our record". McGinn herself acknowledged the state was unlikely to collect for years.
Waiting is not free, though. Interest keeps accruing during an appeal, and at 15% a year on $25 billion, that is roughly $3.75 billion a year before any compounding.
Wall Street, for now, is not panicking. Gil Luria, head of technology research at D.A. Davidson, told Reuters the ruling was costly but noted Meta is worth nearly $2 trillion and is likely to keep appealing — making a material hit to its value unlikely in the near term.
The case is not finished at the trial level either. New Mexico plans to ask Mathew for court-ordered changes to Meta's platforms in later proceedings, the Wall Street Journal reported. The case is State of New Mexico v. Facebook Inc., No. D-101-CV-202100132.
For most companies, a penalty of this size would be existential. For Meta it is, as Luria suggests, a manageable line item. The lesson for the insurance market sits in that gap: the same per-violation arithmetic, aimed at a mid-sized retailer, bank or health system that has made public promises about protecting customer data, would not leave much room for appeals.
None of this requires a client to be the size of Meta. These are general prompts, not legal advice, and the answers will depend on policy wording and state law.
Read next: Verdicts go nuclear: risk management in the age of social inflation
