The editorial argues that with the American Privacy Rights Act dead and no federal data-protection statute in sight, states have been forced to weaponize existing consumer-protection laws to hold tech giants accountable. New Mexico's use of its Unfair Practices Act to secure a $25B judgment is framed as vindication of this bottom-up enforcement model.
The editorial explicitly cautions that Meta will appeal and the eventual penalty may be substantially smaller than $25B. However, it notes that even a 90% reduction on appeal would still leave the final number larger than the $5B FTC settlement from 2019, so the ruling remains significant regardless of appellate outcome.
The editorial pinpoints the specific technical mechanism: between 2013-2015, apps could request a permission that returned data on all of an installing user's friends, including people who never consented, never saw the privacy policy, and never knew the app existed. This architectural choice — not just Kogan's quiz app — is identified as the actual enabling cause of the 87-million-user harvest.
A New Mexico state court has ordered Meta Platforms to pay roughly $25 billion in penalties tied to the Cambridge Analytica data-harvesting episode, according to the state attorney general's office. The judgment, reported by CNBC on October 21, is the largest state-level privacy-related penalty ever issued against the company and dwarfs the $5 billion FTC settlement Facebook paid in 2019 for the same underlying conduct.
The suit, originally filed by former AG Hector Balderas and carried forward by current AG Raúl Torrez, argued that Meta violated the New Mexico Unfair Practices Act by misrepresenting how third-party apps could access user data through what was then the Facebook Graph API v1. The specific technical conduct is well-documented: between roughly 2013 and 2015, apps could request a `user_friends` permission that returned not just the installing user's data but the profile data of all their friends — including people who had never installed the app, never seen its privacy policy, and had no idea it existed. Aleksandr Kogan's `thisisyourdigitallife` quiz used that permission to collect data on an estimated 87 million users, which Cambridge Analytica then purchased.
The $25B figure is not a settlement — it's a judgment, which means Meta will appeal, and the eventual number may be substantially smaller. But even a 90% haircut on appeal would leave the final penalty larger than the FTC's. New Mexico's AG framed the ruling as vindication for state-level enforcement in the absence of a federal privacy law, and that framing is the part worth paying attention to.
The US still has no federal data-protection statute. The American Privacy Rights Act died in committee in 2024, and no serious replacement has moved. That vacuum has pushed enforcement down to the states, and the states have gotten creative — not by passing new privacy laws, but by weaponizing existing consumer-protection statutes written for things like deceptive used-car sales. New Mexico's Unfair Practices Act is one of those. California's Unfair Competition Law is another. Texas has used its DTPA. The pattern is clear: when a platform's privacy disclosures diverge from its API behavior, state AGs will treat the gap as consumer fraud, and the penalties scale with the size of the user base in-state, not with the actual harm proven.
That scaling is why the number is so large. New Mexico has roughly 2.1 million residents. If you multiply even a modest per-violation statutory penalty by every Facebook user in the state across every day of the alleged misconduct, you get into the tens of billions quickly. This is the same arithmetic that produced the $1.4B Texas biometrics settlement against Meta in 2024 and the $520M Epic Games COPPA penalty. Statutory damages, not actual damages, are now the primary pricing mechanism for US privacy enforcement, and that math punishes scale.
Meta's public response has been predictable — the conduct is a decade old, the Graph API was rewritten in 2015, Cambridge Analytica itself no longer exists, and the company has spent billions on privacy infrastructure since. All of that is true. It's also beside the point. The judgment is not about current conduct; it's about whether platforms can be held liable for the downstream consequences of API designs that leaked data at scale, long after the leaks themselves have been patched. The court said yes.
The community reaction on Hacker News (452 points at time of writing) split roughly along two lines. One camp sees the ruling as finally putting a real price on the data-broker economy that platforms built in the 2010s. The other camp notes that $25B flows to state coffers, not to the users whose data was taken, and that nothing about this judgment changes how any current API behaves. Both are correct.
If you ship an API that returns data about users other than the authenticated caller — friend lists, org members, shared documents, contact graphs — the legal exposure of your consent flow just got more expensive. The specific risk is not that you'll be sued for a breach; it's that your privacy policy and your API's actual behavior will be compared under oath, and any delta becomes statutory damages per user per day. Three concrete implications:
First, audit any permission in your OAuth scopes that grants access to third-party data. If a scope reads data about users who are not the authorizing user, those users need to have consented through a channel your legal team can defend. "The authorizing user agreed on their behalf" is the exact argument that just cost Meta $25B.
Second, if you operate an app platform — a marketplace, a plugin store, a bot ecosystem — your terms of service with developers are not a shield. New Mexico's theory was that Meta knew or should have known that apps were exceeding what the ToS allowed, and that enforcement was lax enough to constitute a misrepresentation to end users. If your abuse-detection and app-review processes are theater, assume a motivated AG will treat them as such.
Third, retention matters. A lot of the discovery in these cases turns on internal communications showing that engineers flagged the risk and were overruled. Document retention policies that keep Slack and email longer than they need to be are now a material legal liability. Not a reason to destroy evidence — a reason to think carefully about what gets written down and why.
Meta will appeal, and the appeal will probably take two to three years. The number will come down. But the enforcement model — state AGs using 1960s-era consumer-protection statutes to produce multi-billion-dollar privacy penalties against platforms with large in-state user bases — is now firmly established, and every other state AG looking at Meta, Google, TikTok, and X just got a template. The next federal privacy law, if it ever passes, will almost certainly preempt a lot of this. Platforms that have been quietly fighting preemption on the grounds that it would weaken state-level consumer protection may want to revisit that position.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.