Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case

Original Article ↗ Hacker News Discussion ↗

Meta’s $25 billion penalty in New Mexico over the Cambridge Analytica scandal is prompting debate about whether such massive fines meaningfully deter tech giants or simply become a cost of doing business. Commenters argue over the role of tort law vs. proactive regulation, the likelihood that appeals will slash the amount, and whether executives or shareholders should bear personal liability for systemic privacy abuses. The case is also framed against a broader backdrop of international enforcement, corporate personhood, and the perceived failure to impose criminal consequences for large-scale data misuse and social harms.

Scale and nature of the penalty

  • $25B stems from New Mexico’s Unfair Practices Act: ~$5,000 per violation across ~43M violations, then heavily reduced by the judge from a theoretical ~$219B.
  • Some note this is roughly 12% of Meta’s recent annual revenue or a few months of net profit; others emphasize it’s enormous for a single (relatively small) state and equals decades of local profit.
  • Debate over whether $25B is “huge” or effectively “cost of doing business” for a ~$1.5T company.

Legal process and likelihood of appeal

  • Clarifications that this is a statutory civil penalty, not a tort case and not a jury punitive-damages award; the jury found liability, the judge set the amount under statute.
  • Many expect Meta to appeal and get a large reduction; others counter that normal “jury damages” reduction logic doesn’t fully apply here.
  • Some argue these splashy first-instance numbers are often mostly “press releases” until appellate courts weigh in; others stress this is already a reduced number.

Accountability: corporations, executives, and shareholders

  • Strong calls to hold executives personally liable, via jail time, licensing regimes, or piercing the corporate veil.
  • Some argue shareholders should also bear direct financial risk for corporate misconduct; others note corporate law intentionally shields investors and that criminal liability already can apply to individuals, at least in theory.
  • Suggestions range from “corporate death penalty” or forced dissolution to “corporate jail” (temporary shutdowns) as stronger deterrents than fines.

Privacy harm and Cambridge Analytica

  • Disagreement over harm: some say there were “zero actual harms”; others emphasize democratic damage, massive willful deception, and the scale of violations.
  • Discussion of how Facebook allowed apps (e.g., quizzes) to mass-scrape user and friend data, and then misled users about protections.
  • Broader pattern flagged: repeated privacy setting changes, facial-recognition features, and a corporate culture seen as hostile to privacy.

Broader context: regulation, politics, and precedent

  • Contrast drawn between U.S. reliance on litigation versus proactive regulatory enforcement (e.g., EU-style).
  • New Mexico’s solo action compared to multistate settlements that yielded far smaller Cambridge Analytica payouts per state.
  • Some see this as a template for other states to extract much larger penalties; others expect legal and political pushback and eventual reductions.
  • Market reaction (stock rising on earnings) is cited as evidence the penalty is either not fully believed or not yet priced as a true threat.