In a landmark ruling, a US court has ordered Meta Platforms to pay $25 billion, more than ₹2 lakh crore, for misleading consumers about data privacy. It ranks among the largest corporate penalties in American history and reopens fundamental questions about Big Tech accountability.
On October 21, 2026, New Mexico District Judge Francis Mathew imposed the penalty following a jury verdict that identified 43,899,725 violations of the state’s Unfair Practices Act. The violations concerned misleading representations about personal information, third-party access and content moderation.
The case traces back to the Cambridge Analytica scandal, in which the personal data of as many as 87 million Facebook users was harvested through a third-party application, exposing deep weaknesses in user consent, data governance and platform transparency.
New Mexico Attorney General Raúl Torrez pursued the litigation independently, arguing that Meta systematically misrepresented its privacy practices. Jurors found 26 company statements misleading, establishing liability across millions of statutory violations rather than 43 million separate data breaches.
The financial stakes are extraordinary. Although statutory penalties could have exceeded $219 billion, the judge imposed $25 billion. Meta plans to appeal, challenging both the legal findings and the proportionality of the penalty, and legal experts believe the amount could ultimately be reduced.
The ruling carries lessons for India’s digital economy too. Under the Digital Personal Data Protection framework, enterprises must strengthen consent management, transparency, data governance and accountability, as misleading privacy assurances could create serious regulatory and reputational exposure.
The larger message is unmistakable: data privacy is now a boardroom accountability issue. Companies can no longer lean solely on privacy policies and compliance declarations. Continuous monitoring, independent audits, verifiable consent and responsible data handling are essential. Meta’s setback shows that digital trust must be earned through demonstrable practice, not corporate promises.
