Meta's $25B privacy penalty: audit what your apps collect

A New Mexico judge ordered Meta to pay $25 billion on October 21 in a privacy case that grew out of Cambridge Analytica. The core finding: Facebook told users one thing about data sharing with third-party apps and did another. You aren't Meta. But your privacy policy also makes promises about what your apps, plugins, and AI tools do with customer data. This Meta privacy penalty is a good reason to check those promises.

What actually happened

From AP's report via ABC News and The Washington Post:

• The ruling: Judge Francis Mathew set the penalty at $25 billion. The state asked for $35 to $40 billion. Meta argued for no more than about $3.4 billion.
• The verdict behind it: In September, a Santa Fe jury found Meta violated New Mexico's consumer protection law more than 43 million times, across 34 statements jurors assessed.
• The data: The case centered on a third-party personality quiz that pulled data from about 87 million profiles. That data ended up with Cambridge Analytica.
• What the jury rejected: The state didn't prove Meta made false claims about removing harmful content.
• Next: Meta is expected to appeal, and interest accrues while it does. The state also wants an injunction. Under the state constitution, the money goes to education.

Attorney General Raúl Torrez called it a signal to Silicon Valley. The math is the real signal: small per-violation penalties, multiplied by every user who saw a statement, add up to huge numbers.

Why the Meta privacy penalty matters for your business

Your privacy policy is a list of claims. Consumer protection law doesn't care that a plugin did the collecting. If your policy says "we don't share your data" and your review app, chat widget, or ad pixel sends it somewhere, that's the gap this case was about.

Third-party apps are where policies drift. Most stores run a dozen scripts nobody has reviewed since install. Each one has its own terms. AI tools add more: a support bot that sends transcripts to a model vendor is data sharing.

Per-violation math hits small businesses too. State laws usually charge per violation, and every customer can count. A small fine times your whole email list is not small.

The fix is boring and cheap. List every script, app, and AI tool that touches customer data. Write down where the data goes. Make the policy say that.

Sources: AP via ABC News, The Washington Post.