New Mexico Court Orders Meta to Pay $25 B for Cambridge Analytica Privacy Violations

What happened

Meta was found to have shared up to 87 million Facebook users’ data with Cambridge Analytica, violating New Mexico’s unfair practices law 43 million times. A jury awarded $220 billion in penalties, later reduced by the judge to $25 billion with 15 % annual interest, citing deliberate misrepresentations and inadequate data‑access controls.

Why it matters for trust and compliance

• The ruling underscores how inadequate third‑party vetting and poor data‑access record‑keeping can breach privacy obligations, making continuous privacy‑control assurance essential for audit readiness.
• Demonstrates the audit value of documented third‑party data‑sharing agreements.
• Highlights the need for continuous privacy‑control evidence to satisfy multiple regulatory frameworks.

Who is affected

Recommended actions

1. Review and formalize all third‑party data‑sharing agreements.
2. Implement auditable consent mechanisms and immutable logs of data access and deletion requests.
3. Conduct privacy impact assessments aligned with GDPR/CCPA.
4. Establish a centralized evidence repository for auditors to demonstrate ongoing compliance.