A $25 Billion Penalty Cannot Undo a Privacy Choice

A judge can put a very large price on a broken privacy promise. The judge cannot put your old profile details back in the box, make a copied list forget your name, or tell you every decision that somebody made from information gathered years ago. Money can punish conduct. It cannot reverse time.

That is the useful lesson in a New Mexico court order issued on 21 October 2026. Judge Francis Mathew ordered Meta to pay the state $25 billion after a jury found that the company had made misleading statements about privacy and other practices. Meta says it will appeal, so the order is a major legal result rather than a final cheque already deposited somewhere (Reuters, 21 October 2026; BBC, 22 October 2026).

The number will dominate the headlines because $25 billion is difficult to ignore. Your useful response is much less dramatic. Spend fifteen minutes checking the apps and websites still connected to your social accounts, remove the ones you no longer use, and pause before using a social login for the next quiz, game, or shopping site. You do not need to abandon every social network tonight.

This case is also a good reason to separate three things that often get pushed into one frightening word: privacy. A company can secure your password and still make a poor decision about who may use your profile information. A third party can receive information through a permitted connection without breaking into your account. A court can later decide that the promises surrounding that arrangement were misleading. Those are related failures, but they call for different responses.

What the court actually decided

New Mexico sued Meta in 2021 over statements Facebook and its leaders had made to people in the state. The case grew out of the Cambridge Analytica scandal, in which a political consulting firm obtained Facebook data through a third-party app and used information for voter profiling and targeting. Reuters reported that the underlying data collection reached as many as 87 million Facebook users, although the New Mexico case concerned statements made to people in that state (Reuters).

A Santa Fe jury returned its verdict on 25 September 2026. It found that 26 of 29 statements about data privacy, hate speech, and related subjects were misleading. By multiplying those statements by the audience that may have received them, the jury counted more than 43 million violations of New Mexico consumer-protection law (The Guardian, 21 October 2026).

The arithmetic created a theoretical penalty above $219 billion. Judge Mathew reduced it to $25 billion in the order issued on 21 October. The state had asked for between $35 billion and $40 billion, while Meta had argued in court filings for a cap of about $3.45 billion. The company disputes the case and says it expects to win on appeal (Reuters; The Guardian).

That last sentence matters. “Ordered to pay” describes what the judge did. It does not mean every appeal has finished, that New Mexico has received the money, or that Facebook users will receive individual payments. The Guardian reported that state law directs the penalty money to New Mexico’s school system. Anybody who now contacts you promising a share of the judgment in exchange for a fee, password, or verification code is inventing a process that the court order did not create.

The case also covered more than one subject. Reports from Reuters, the BBC, and The Guardian describe findings about privacy statements as well as claims involving harmful content and the enforcement of platform rules. Cambridge Analytica is the clearest route into the privacy lesson, but it would be inaccurate to pretend that every one of the jury’s counted statements described one data transfer or one technical event.

Nor was this a fresh disclosure that somebody entered Facebook systems this week. The order dealt with conduct and public statements stretching back years. The BBC reported that the judge described the violations and misrepresentations as wilful and spanning more than eleven years, from 2010 to 2021 (BBC). Treating the ruling like a new password breach would send people toward the wrong fix.

How one person’s app reached other people’s data

The old Facebook platform model helps explain why this story still matters. A person could install a game, personality quiz, or other app and grant it access to parts of a Facebook profile. Under the platform rules that existed at the time, the app could sometimes collect information connected to that person’s friends as well. Most of those friends had never installed the app themselves.

Think of a party where one guest is allowed to copy the host’s address book. The guest does not pick the lock. The host hands over the book under rules written by the building owner. The surprise comes later, when everybody listed in the book learns that one person’s permission opened a route to information about them too.

Facebook’s own account of the Cambridge Analytica episode said that roughly 300,000 people installed Aleksandr Kogan’s personality-quiz app in 2014 and shared their data and some information about friends. Facebook said the app may therefore have reached information concerning up to 87 million people, mostly in the United States (Facebook, updated account of the incident). The distance between 300,000 direct participants and tens of millions of affected profiles is the mechanism worth remembering.

Facebook also said in March 2018 that it had changed the platform in 2014 to sharply limit the information an app could request about a user’s friends, and that apps could no longer ask for information such as friends’ religious or political views, relationship status, work history, or other listed fields (Facebook, platform-abuse response). Those changes are relevant. They mean a quiz installed today does not automatically operate under every rule that existed in 2014.

Still, the broader pattern survived the old Facebook interface. We continue to connect accounts to shopping sites, games, fitness services, photo editors, newsletter tools, and workplace apps. We click “Continue with Facebook” or another large identity provider because it is quicker than making one more password. The new service may ask for a name and email address rather than a friend’s political views, but a connection and a permission decision still exist.

A social login has two jobs that are easy to confuse. It proves to the new site that you control a particular account, and it may also pass selected profile details to that site. The first job saves you from creating another password. The second gives the site information it needs, or says it needs, to set up your account. A convenient login button is therefore both a key and a small delivery envelope.

The delivery envelope is where attention pays. A simple service may reasonably need your name and email address. A quiz that asks for a friend list, birthday, location history, contacts, or permission to post on your behalf deserves a slower look. The correct question is not whether the service has a famous logo on its sign-in page. Ask what it receives, why that information fits the service, and whether you would hand over the same details on a paper form.

A privacy setting cannot collect every old copy

Privacy controls are useful, but their verbs matter. “Disconnect,” “remove,” and “stop future activity” describe what happens from now on. They do not usually promise to erase every copy that another organisation already received, every model built from that information, or every decision recorded elsewhere.

Meta’s current help page says you can review or change the information shared with apps and websites connected to a Meta account (Meta Help Center, accessed 22 October 2026). That is a worthwhile control. Removing an unused connection closes a route that no longer needs to stay open.

Imagine that you gave a local club a spare key last year. Taking the club off your authorised-key list helps if its copy was electronic and the lock honours the new list. It does not retrieve a photograph somebody took of the key, a paper membership form already filed in a cabinet, or information the club passed to its booking company. Closing access and deleting old holdings are different jobs.

This is why deletion promises deserve close reading. A platform can stop an app making new requests. The app may still hold information collected while access was active, subject to its own retention rules, legal duties, and actual behaviour. If the old app account still exists, you may need to visit that service and request deletion there as well.

The same limit applies to downloading your social-media archive. An archive can show what the platform currently associates with your account and may help you remember old connections. It cannot serve as a universal receipt for every downstream copy. A blank field in today’s download does not prove that nobody saw the field in 2014.

That sounds discouraging until you place the control in the right time direction. You cannot perfectly recover the past. You can reduce the number of open routes now, share less on the next request, and keep the most sensitive facts away from services that do not need them. Privacy works better as a habit at the doorway than as a cleanup after the furniture has left.

There is one more boundary. Changing your Facebook password does not revoke information that a third party lawfully received years ago. A password change is valuable when somebody may know the password, when you reused it elsewhere, or when the account shows an unfamiliar login. It is security theatre when used as the only response to an old privacy-sharing decision.

What this ruling means for an ordinary account

The ruling gives you no reason to assume that your account was entered this week. It does give you a reason to inspect the trust you have accumulated. Old connections are easy to forget because they rarely announce themselves after the first click.

Consider a normal family account. Years ago, somebody used Facebook to sign into a photo-printing service for a birthday present, tried two games, entered a competition, and connected a fitness challenge. The photo service is still useful. The competition ended in 2021. One game closed, while the other now belongs to a company the family has never heard of.

The useful review is not a hunt for a perfect score. Keep the photo service if the login still saves time and its access makes sense. Remove the expired competition and the games nobody uses. Then visit any surviving service that holds information you would rather delete, because removing the social connection and deleting the service account may be separate steps.

Pay special attention to services that can act, not merely read. Permission to publish, manage a page, read private messages, reach contacts, or administer advertising carries more consequence than permission to receive a display name. A stale connection with authority can become a forgotten side door.

You should also look at the account’s own security page while you are there. Review active sessions, remove devices you no longer recognise or own, and turn on two-factor authentication if it is still missing. These steps address account entry rather than historical data sharing, but old apps and old sessions tend to gather in the same neglected cupboard.

Do not turn the review into a weekend-long audit of every post you have ever made. Start with the connections that can still do something. Then check the profile fields that are easiest to use in impersonation: public birthday, phone number, email address, family relationships, workplace, and home town. You may decide to keep some visible. Make that a current choice rather than an old default.

A public birthday message from friends may be worth the small disclosure to you. A full birth date, personal phone number, mother’s maiden name in an old quiz answer, and public family list create a better script for somebody pretending to be your bank or a relative. Each fact looks harmless alone. Their value changes when they travel together.

Aim for fewer stale permissions and fewer unnecessary facts attached to them, rather than invisibility. You still get to use social media, join groups, share photographs, and sign in conveniently where the trade makes sense.

There is a practical choice hiding inside every social-login button. Using it means the new service does not receive a fresh password from you, which can be helpful. It also means the social account becomes part of the route back into that service. If you lose the social account, leave the platform, or have the connection disabled, you may need another recovery route.

Before relying on that button, add a recovery email address directly to any service you would hate to lose. Save important receipts or files outside the social platform. For a throwaway quiz, none of this matters. For a family photo service or a shop holding years of orders, it does.

A separate login can be the cleaner choice when the service matters and you use a password manager. The manager makes a unique password, while your email account handles recovery. That arrangement creates one more entry in the password manager, but it avoids making a social account the master key for an unrelated service.

Convenience still wins sometimes. If a service needs only your name and email address, you expect to keep both accounts, and you can see a sensible recovery path, a social login may be perfectly reasonable. The review is there to remove accidental dependencies, not to demand the most complicated option every time.

Do this once, then return to your life

Open the settings for the social account you use most. The exact menu names may move, so use the settings search if the path looks different from a guide. Search for “apps and websites,” “permissions,” “connected experiences,” or “accounts.” Meta’s current help material places connected-app controls under its account settings, but interfaces vary by device and region (Meta Help Center).

Work through the review in this order. The sequence matters because it closes live access before you spend time tidying old data.

1. List the active connections. Read every service name once. If you cannot remember what a service is, open a separate browser tab and find its official site before clicking anything in the settings list.

2. Remove what you no longer use. An expired quiz, dead game, old campaign tool, or abandoned shop has no reason to keep a current route into your account. Take a screenshot first if you want a small record of what was connected.

3. Inspect what remains. Check the information and actions each service can access. Keep the permissions that match the job. Remove optional access where the setting allows it, especially posting, contact, message, page-management, or advertising authority.

4. Visit the service itself when deletion matters. Closing a connection may stop future requests without deleting the service’s account or stored records. Use the service’s official privacy or account page, not a link in an unexpected email, and save the confirmation if you submit a deletion request.

5. Check sessions and two-factor protection. Sign out old phones, shared computers, and places you no longer recognise. Add an authenticator app or another strong second step to the social account, because the account often opens the door to connected services.

6. Use a smaller envelope next time. Before approving a new social login, read the requested fields. If the request feels too broad for the service, use an email address instead, create a normal account with a password manager, or leave.

Most people can complete the useful part in fifteen minutes. Stop when the active list makes sense. You do not need to download years of data, read every privacy policy, or delete a working account merely to prove that you took the ruling seriously.

If a connected service has disappeared and you cannot reach its operator, remove the connection and keep a note of its name. Watch the social account for unexpected posts or permission requests. There may be no practical route to force deletion from a vanished company, and pretending otherwise would turn a useful review into false reassurance.

If you find an unfamiliar active session, changed email address, message you did not send, or connection added recently without your approval, move from privacy housekeeping to account recovery. Use the platform’s official recovery page, change the password from a device you trust, sign out other sessions, and protect the email account that controls resets. Evidence of account entry deserves urgency. A court judgment about old statements does not create that evidence by itself.

What the $25 billion figure cannot tell you

Large penalties create an appealing shortcut: if the number is huge, the individual danger must be huge too. That is poor risk arithmetic. Courts calculate penalties from laws, findings, counts, conduct, and limits that do not translate directly into the chance that one particular person will be harmed tomorrow.

The $25 billion figure also tells you nothing about whether a caller knows your current password. It does not show that a particular third-party app kept your information, that a campaign changed your vote, or that your profile was among the records at issue. Those questions need their own evidence.

Likewise, Meta’s planned appeal does not erase the jury’s verdict or the judge’s order. It means the legal process continues. You can describe the result accurately without choosing between “nothing happened” and “the case is completely finished.” As of 22 October 2026, the order exists and Meta says it expects to challenge it (Reuters; BBC).

Be careful with settlement messages. The reports cited here say the penalty goes to the state, with The Guardian describing a direction to New Mexico’s school system. They do not announce a claims portal paying individual Facebook users. Search for a case on an official court or government site before giving anybody personal details, and never pay a fee to release supposed compensation.

There is a useful position between cynicism and blind trust. Companies can improve controls after a failure, and Facebook says it restricted broad friend-data access years ago. A later control cannot rewrite what earlier systems allowed. Both facts belong in the same account of the case.

Promises still matter. Most of us cannot inspect a platform’s databases, advertising systems, or contracts before sharing a birthday photograph. We depend on plain statements about who can receive information and what they may do with it. When those statements are misleading, the damage includes the choices people would have made differently with an honest description.

That is why “I have nothing to hide” misses the practical point. Privacy gives you a say in context. You may happily tell friends where you grew up while refusing to let an unknown quiz company add that fact to a profile. The words are the same. The audience, purpose, and power to copy them are different.

The small decision that survives the headline

The court order may change on appeal. The exact penalty may rise, fall, or take years to resolve. None of that changes the household rule worth keeping: a permission should last only as long as the reason you granted it.

Once a year, open the connected-app list for your main social, email, and cloud accounts. Remove the services you have forgotten, narrow the ones you keep, and check which account can reset the others. Put the reminder beside a birthday or another date you already remember.

For new connections, notice the moment before information leaves. A request for your email address may be a fair price for an account you want. A request for contacts, posting rights, detailed profile fields, and a permanent connection to play a one-minute quiz is a bad trade. Close the tab and keep your afternoon.

You are allowed to choose convenience sometimes. Social login can reduce password clutter, especially when the receiving service asks for little and you expect to keep using it. The aim is to make that choice with the envelope open, rather than discovering years later that one easy click carried more than you thought.

A $25 billion judgment is a loud way to learn a quiet lesson. The strongest privacy control happens before a copy travels, and the next best one closes a door that no longer needs to be open. Check the old connections. Then get on with your life.

For more calm, practical security guidance, join the newsletter. It is one email per month.

Sources

• Reuters: Meta ordered to pay $25 billion penalty to New Mexico in data privacy case, accessed 2026-10-22
• BBC: Meta fined $25bn for ‘lies’ over user data privacy, accessed 2026-10-22
• The Guardian: Meta ordered to pay $25bn to New Mexico in Cambridge Analytica data-privacy case, accessed 2026-10-22
• Facebook: Hard Questions, Update on Cambridge Analytica, accessed 2026-10-22
• Facebook: Cracking Down on Platform Abuse, accessed 2026-10-22
• Meta Help Center: Manage apps and websites connected with your Meta account, accessed 2026-10-22