A jury in New Mexico has ordered Meta to pay $25 billion over claims that the company misled users about how their personal data was handled, in a case tied to the Cambridge Analytica scandal from 2018. The number is enormous, and it will generate headlines for weeks. But the gap between a jury's number and a company's actual bill is often wide, and understanding why tells you more about how corporate accountability really works than the figure itself.

What the case was actually about

The Cambridge Analytica affair, which first became public in 2018, involved a political consulting firm obtaining personal data from tens of millions of Facebook users without their meaningful consent, largely through a quiz app that harvested not just the data of people who used it but also data belonging to their friends. The firm later used that information for political targeting. The core legal question in cases like the New Mexico one is not whether the data was taken — that much has been documented for years — but whether Meta (then Facebook) made representations to users and regulators about privacy protections that it knew, or should have known, were not true. "Deceiving users" is the legal hook: privacy law in the United States is built less around banning data collection outright and more around punishing companies for telling people one thing while doing another.

How a jury gets to a number like $25 billion

Civil juries awarding damages typically separate two categories. Compensatory damages try to cover actual harm suffered by the people bringing the case. Punitive damages are different: they are meant to punish conduct the jury considers egregious and to deter the company, and any other company watching, from repeating it. Punitive awards are often calculated with reference to the size and wealth of the defendant, not just the harm to plaintiffs, which is part of why figures involving a company with Meta's market value can balloon quickly. A jury weighing punitive damages against a trillion-dollar company is working from a completely different starting point than one weighing damages against a small business, and that is by design — a penalty has to be large enough to actually register against the defendant's resources to function as a deterrent at all.

Why the number rarely survives intact

Large jury verdicts against major corporations are almost never paid out in full. The usual sequence is:

  • The trial court enters judgment on the jury's verdict.
  • The defendant appeals, arguing the award is excessive, the legal theory was flawed, or the judge made errors in how the jury was instructed.
  • Appellate courts frequently reduce punitive damages, sometimes sharply, citing constitutional limits on how far punitive awards can exceed actual harm.
  • Many cases ultimately settle for an amount well below the original verdict, avoiding years of further litigation for both sides.

None of this means the verdict is meaningless. It establishes, in the eyes of a jury that heard the evidence, that the conduct was deceptive — and that finding carries weight even if the dollar figure changes substantially on its way through the appeals process.

Why markets usually shrug at these headlines

When a verdict like this lands, investors tend to ask a narrower question than the headline suggests: how much cash is actually likely to leave the company, and when. Because the appeals process can run for years and the final payment is often a fraction of the jury number, large legal verdicts frequently produce only a modest, short-lived dip in a company's share price rather than a lasting one. Companies the size of Meta also carry legal reserves — money set aside on the balance sheet in anticipation of litigation costs — which cushions the immediate financial shock even in a worst-case outcome.

What this means for an ordinary user, not just Meta's balance sheet

The more useful question for a non-specialist reader is not how much Meta might eventually pay, but what the underlying behaviour means for anyone with a social media account. Personal data collected through apps, quizzes, likes, and friend networks feeds systems used for targeted advertising, political messaging, and increasingly, decisions made about individuals by third parties — insurers, lenders, employers — who buy or access aggregated data profiles. The mechanism of harm is usually invisible to the person affected: no one gets a notice saying their data shaped an ad, a loan offer, or a political message aimed specifically at them. Verdicts like this one are one of the few tools that force that invisible machinery into public record, because the trial process compels disclosure of internal company documents and decisions that would otherwise stay private.

This is not Meta's first privacy penalty

In 2019, Meta (then Facebook) reached a settlement with the U.S. Federal Trade Commission over privacy practices connected to the same Cambridge Analytica episode, agreeing to a multibillion-dollar penalty and new oversight requirements at the time — one of the largest privacy penalties a U.S. regulator had imposed on a technology company. That settlement did not end the broader legal fallout; state-level cases, like the New Mexico one, have continued to work through courts separately in the years since, because U.S. states can pursue their own consumer-protection claims independently of federal regulators.

A penalty only changes behaviour if the company judges future enforcement to be just as likely, and just as costly, as the one it already absorbed.

What would have to happen for this to matter in six months

For this verdict to produce real change rather than another line in Meta's legal footnotes, a few things would need to follow. The award would need to survive appeal largely intact, rather than being reduced to a figure Meta can treat as a routine cost. Other states' attorneys general would need to see this as a template and bring similar suits, turning one verdict into a pattern of exposure. And lawmakers would need to use the case as momentum toward a comprehensive federal privacy law — something the U.S. still lacks, unlike the European Union's data protection framework — rather than letting it fade as a one-off court outcome. Absent those three things, the most likely path is a long appeal, a reduced final number, and a company that keeps collecting data much as it did before.