The recent $25 billion data privacy judgment in New Mexico state court against Meta was attention-grabbing, if for no other reason than for the sheer size of the award. The award also highlights the fact that privacy-related issues are increasingly important, in ways that can potentially, through subsequent litigation, translate into D&O matters. As discussed below, if for no other reason than the scale of the exposure, privacy risk increasingly is becoming management liability risk. A copy of the New Mexico state court’s October 21, 2026, judgment in the Meta case can be found here.

Background

The New Mexico Attorney General filed the lawsuit in New Mexico District Court in the wake of the Cambridge Analytica scandal but the state’s allegations ultimately swept much more broadly to include more than two dozen misrepresentations concerning Meta’s alleged data privacy practices during the period May 24, 2010 through August 18, 2021.

The lawsuit accused Meta of lying to users and misleading the public about who had access to their data; failing to conduct a proper internal investigation; and claiming that it did not sell or misuse user information while knowing that third parties had broad access.  Among the statements the jury ultimately found to be unlawful and willful were statements by the company’s CEO, Mark Zuckerberg, and its then-COO Sheryl Sandberg. 

The Verdict

In an August 25, 2026, verdict, a 12-person jury found that 26 of the alleged misrepresentations were willful violations of the New Mexico Unfair Practices Act; that the audience for these representations included either the 1.3 million active monthly New Mexico Facebook users or the state’s total population of approximately 2.1 million; and therefore that Meta had committed a total of 43,899,725 willful violations of the Act.

The Judgment

On October 21, 2026, New Mexico Judge Francis J. Matthew entered post-verdict Findings of Fact, Conclusions of Law, and Judgment. Among other things, Judge Matthew concluded that the state was entitled to recover the maximum civil penalty allowed under the Act of $5,000 per violation.

In reaching the conclusion that the state was entitled to recover the maximum amount, Judge Matthew made a number of observations, including, among other things, that “The harm in this matter is difficult to overstate, and goes to the heart of Facebook’s business proposition.” He added the observation that “Penalties, consent agreements, and decrees have not deterred Meta from using deceptive trade practices in its representations to the citizens of New Mexico.”

Moreover, he noted, “the violations were not confined to one statement, one speaker, one medium, or one aspect of Facebook’s business.” He also added that there are aggravating circumstances, including the “scale, repetition, breadth, and willfulness of the violations.”

After noting that in 2025, Facebook had revenues of $200 billion and year-end shareholder equity of $217 billion, he then found that the state was entitled under the Act to penalties of $219 billion (calculated as $5,000 x 43,899,720), which the court in its discretion reduced to $25 billion.

Discussion

One take on the massive Meta judgment is that it represents a developing comeuppance for the tech giants. The New York Times, for example, referred to the judgment as the centerpiece of an October 22, 2026, news analysis article entitled “How a Legal Backlash Against Big Tech is Forcing Big Changes” (here). It may well be that the judgment does represent some sort of watershed development for the tech industry. More about that below.

From my perspective, the significance of the Meta judgment is that it highlights the extent to which privacy issues are a very big deal, a point that I have tried to make numerous times over the years. And while the judgment was entered in a consumer protection action and not a D&O lawsuit per se, the fact is that, as we have emphasized in recent posts (most recently here), privacy is not and has not been merely a consumer protection or regulatory issue.

As evidence of the importance of privacy as a D&O risk concern, there is the fact that the Cambridge Analytica debacle that was the catalyst of the New Mexico action is itself already the subject of a D&O lawsuit. The case, first filed in 2018 in the Northern District of California, involves allegations of securities law violations against Facebook and certain of its executives. The case alleges, in connection with the Cambridge Analytica revelations, that the defendant company had misled investors with respect to the company’s user data and privacy policies and controls. The case in fact previously made its way all the way to the U.S. Supreme Court before the Court dismissed its grant of the cert petition as improvidently granted. Following the Supreme Court’s action, the case was remanded to the district court, where it apparently remains pending.

Nor is the Cambridge Analytica lawsuit the only example of a D&O lawsuit arising out of privacy concerns. To the contrary, there have been numerous other prior privacy-related D&O actions, including, most recently, the shareholder derivative lawsuit filed in September 2026 against the board of Alphabet, as discussed here.  Indeed, the new Alphabet case arguably is the one most salient for the present circumstances when it comes to the issue of privacy as a D&O liability risk.

In the recently filed Alphabet suit, a plaintiff shareholder alleges that the company’s board and controlling shareholders of Alphabet violated their fiduciary duties by failing to take steps to protect the company from over $4.5 billion in fines, penalties, and settlements arising from alleged privacy violations. Those $4.5 billion in fines and penalties represent less than 20% of the penalties assessed against Meta in just this one case.

It is worth noting that the Alphabet case is just one example of the follow-up lawsuit phenomenon, in which allegations in underlying claims, of a type that would not typically be covered under a D&O insurance policy, are translated into the kinds of claims that presumptively could be covered under a D&O policy. In the Alphabet case, the underlying privacy violations, not typically covered under a D&O policy, were converted into a claim (the derivative lawsuit) that presumptively would be covered under a D&O policy.

The recent Alphabet claim shows how the claims in a consumer protection action like the one filed against Meta could become a D&O claim. As the Alphabet case shows, plaintiffs’ counsel increasingly frame privacy failures as a failure of corporate governance, risk oversight, disclosure controls, and compliance systems. The size of the penalties assessed against Meta highlights the scale of the risks involved, both with respect to the underlying privacy issues, and with respect to potential follow-on related D&O litigation.

The sheer fact of the $25 billion amount of the New Mexico judgment makes a statement of its own. It certainly underscores the fact that the potential stakes associated with alleged privacy violations are huge. There is no doubt given the size of the award that Meta will appeal the ruling and the judgment amount. While the size of the award unquestionably is arresting, New Mexico will argue that while the award is sizeable, it represents only a small fraction of the maximum amount the court calculated could have been awarded.

The $25 billion award is in fact only one of several recent substantial privacy-, data security-, and online safety-related awards. Indeed, the $25 billion award is the second substantial award that New Mexico has secured against Meta. As discussed here, in August 2026, New Mexico separately recovered $942 million in a prior lawsuit in which the state accused Meta of systemic child safety failures. The state accused Meta of knowingly building addictive platforms (Instagram and Facebook) that optimized user engagement at the direct expense of teen safety.

In addition, separately, and also in August 2026, Meta reached a $17 billion settlement in a case brought by a coalition of states’ attorneys general, in which the state AGs alleged that Meta designed and deployed harmful features on Instagram and Facebook that drove compulsive use by children and teens to their mental and physical detriment, while misleading users, their families, and the public regarding the existence and severity of these risks.

While these latter two matters are not necessarily privacy matters as such, they involve related topics of user safety and security and data protection. These matters highlight the significance of these factors and the financial and operating risk they present. Given the scale alone, these matters, while not involving D&O claims as such, clearly can become D&O matters, as the size of the exposure alone presents itself as a matter of importance for corporate governance and oversight. The likelihood is that as the frequency and scale of the underlying allegations develop further, the chances of follow-on D&O litigation likely will increase as well.