A New Mexico judge has ordered Meta Platforms, the owner of Facebook and Instagram, to pay a US$25 billion civil penalty on Wednesday US time (Thursday in Australia). That is roughly A$36 billion. A jury had found that the company misled the state's residents about how Facebook handled their personal data.
Judge Francis Mathew of the First Judicial District Court in Santa Fe issued the order on October 21. The case grew out of the Cambridge Analytica affair. In 2018 it emerged that the British political consultancy had obtained data on up to 87 million Facebook users through a third-party personality-quiz app and used it to target voters in the 2016 US presidential election. More than 300,000 Australians were among those affected.
New Mexico Attorney General Raúl Torrez said the award may be the largest single-state verdict against a company in US history, Reuters and Bloomberg reported. The court did not require proof that anyone lost money. Jurors multiplied a fixed statutory fine by the number of people who could have seen each misleading statement.
New Mexico brought the case in 2021 under its Unfair Practices Act, which allows a penalty of up to US$5,000 for each wilful violation. At a trial lasting about two weeks, jurors examined 34 public statements by Facebook and its executives on privacy, third-party access to user data and content moderation, and found most of them misleading, the Associated Press reported.
For each statement, the jury then estimated how many New Mexicans could have seen it: either the roughly 1.4 million people using Facebook in the state each month, or the whole population of about 2.1 million. Added together, that came to about 43.9 million violations.
Charged at the full rate, the penalty would have reached about US$219.5 billion. The state asked for between US$35 billion and US$40 billion. Meta's lawyers proposed a ceiling of about US$3.45 billion and argued that New Mexico had not shown anyone saw, relied on or was harmed by the statements. Mathew set the figure at US$25 billion. Interest runs at 15% a year until the penalty is paid, CNBC reported, which works out to about US$3.75 billion a year. Meta plans to appeal, according to the AP.
In the US, Cambridge Analytica has already led to a US$5 billion Federal Trade Commission penalty in 2019 and a US$725 million class action settlement in 2022. In August, a broader settlement between Meta and other US state attorneys general, valued at up to US$17.1 billion, set aside about US$459 million for Cambridge Analytica claims. New Mexico declined to join and has now been awarded more than 50 times that amount on its own.
Australia's privacy regulator ran almost the same argument six years ago. When the Office of the Australian Information Commissioner (OAIC) sued Facebook in the Federal Court in March 2020, it alleged that the personal information of 311,127 Australian users had been disclosed to the quiz app behind the Cambridge Analytica scandal. The Privacy Act then allowed a penalty of up to A$1.7 million per contravention. Multiplied across every affected user, the theoretical maximum came to about A$529 billion.
The case never got that far. After court-ordered mediation, the commissioner accepted an enforceable undertaking from Meta in December 2024 under which the company set up a A$50 million payment program for affected users, without admitting liability. The OAIC described the settlement as the largest payment dedicated to privacy concerns in Australian history. KPMG administered the scheme, and registrations closed on 31 December 2025.
The penalties available today are much larger. Since 2022, the maximum for a serious or repeated interference with privacy by a company has been the greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover during the breach period. Those limits match the maximum penalties under the Australian Consumer Law.
The first tranche of Privacy Act reforms, passed in December 2024, added lower and mid-tier civil penalties and infringement notices. It also created a statutory tort for serious invasions of privacy, which commenced on 10 June 2025 and lets individuals sue directly. The courts have started using the new powers: in October 2025, Australian Clinical Labs was ordered to pay A$5.8 million, the first civil penalty imposed under the Privacy Act, over a 2022 data breach.
A second tranche is in draft. On 31 August the Attorney-General's Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, with about 40 proposals. They include a requirement that any handling of personal information be fair and reasonable, a 72-hour deadline for notifying data breaches, and a right to erasure on large digital platforms. Consultation closed on 18 September, and the bill has not been introduced to Parliament.
Read next: Gallagher details widening cyber breach and privacy duties in Australia
Australian privacy and consumer law penalties apply per contravention, which is how the OAIC's 2020 claim could reach A$529 billion on paper. That figure was never tested, because the case settled before any penalty hearing. In New Mexico, a court has now awarded billions on a similar basis after a full trial.
Australian companies that sell to American consumers face that exposure directly under US state consumer-protection laws. The New Mexico case did not involve a new data breach. It turned on public statements about privacy that a jury found to be untrue, which puts a client's website wording, app store descriptions and investor materials within reach of a claim.
At home, the private right of action is new. Under the statutory tort, individuals can now seek up to A$478,550 in damages for a serious invasion of privacy, independently of any OAIC action. Because the tort covers reckless as well as intentional conduct, brokers are fielding questions about whether intentional-acts exclusions apply. Mark Luckin, national manager for cyber and technology at Lockton, told an IBTV cyber panel this month that the tort "has not made this area of risk uninsurable" simply because its wording overlaps with policy exclusions. Jack Petts of Marsh said on the same panel that defence costs and regulatory defence expenses may still be covered even where liability is excluded.
The local cyber market is still small. The cyber class wrote about 6,000 risks in the March 2026 quarter, against 4.78 million for domestic motor, according to APRA data, and cyber gross written premium has never exceeded A$73 million in a single quarter.
D&O underwriters have a separate concern. The New Mexico verdict rested partly on statements by senior executives, and jurors watched video deposition testimony from chief executive Mark Zuckerberg, Bloomberg reported. In Australia, regulators are already pursuing cyber and data failures as governance failures: in February 2026 the Federal Court ordered FIIG Securities to pay A$2.5 million in an ASIC case, the first civil penalties imposed for cyber security failures under general financial services licensee obligations.
Read next: Optus and Medibank class actions: The cyber moment that could reprice the market
These are general prompts, not legal advice. The answers depend on policy wording and where a client does business.
Read next: Australia records highest-ever breach notifications as costs keep rising
Meta had not commented on the order by Wednesday afternoon US time, and it plans to appeal, according to the AP. Insurance Business's US coverage of the New Mexico penalty looks at the implications for American carriers. In Australia, submissions on the second-tranche exposure draft are with the Attorney-General's Department, and the automated decision-making transparency rules from the first tranche take effect on 10 December 2026.
Read next: Data breach victims are staying silent, leaving insurers with less visibility
