The big news in the competition-plus space—where competition policy meets broader policy concerns—isn’t an antitrust matter at all. It’s New Mexico’s announcement of its “Historic $25 Billion Penalty Against Facebook” (Meta Platforms).
Here’s coverage from The New York Times, The Washington Post, The Wall Street Journal, and, for a bit of local flavor, the Albuquerque Journal.
That’s a big number for most human folks, if not for the large language models among us, but I have a few questions.
That Pesky, Precious First Amendment
This has been billed as a privacy case, but it wasn’t—or isn’t—just that. The alleged violations concerned Facebook’s representations “about its data practices and its efforts to address misinformation and hate speech.” That is, the allegations covered data privacy, data security, and content moderation—the decisions platforms make about what users can post and see.
As my International Center for Law & Economics (ICLE) colleague Ben Sperry points out in a compact thread on the platform formerly known as Twitter, the content moderation claims raise distinct constitutional issues. A social media platform’s content moderation can qualify as protected speech under the First Amendment, akin to the editorial decisions of, e.g., a newspaper. See, for example, Miami Herald on restraints on the press and Moody v. NetChoice on state-law restrictions on platforms’ content moderation policies.
New Mexico argued that it wasn’t restraining or penalizing content moderation decisions as such, but simply misrepresentations about those policies and practices—in essence, false or misleading marketing. The trial court accepted the distinction. But as Ben points out, “it is very hard to separate those promises from the editorial discretion Meta retained over enforcement of its standards.”
We might add that it’s hard to judge whether Meta’s editorial decisions matched its stated policies or assurances without judging those decisions themselves. And it’s very hard to accept enforcer or trial court workarounds without compromising—or even gutting—the First Amendment’s protections.
Even under the most favorable reading of New Mexico’s argument, the First Amendment question is likely to complicate the state’s defense of the ruling on appeal.
Attempts to regulate speech—including expressive, political, religious, and scientific speech, and, not incidentally, access to information—are nothing new. But recent federal and state efforts have taken some novel tacks. Among them are attempts to apply federal antitrust laws, as well as federal and state consumer protection laws, to this dubious task.
Ben recently had a clear and accessible op-ed in USA Today on this issue, spurred by reports that the U.S. Department of Justice’s (DOJ) Antitrust Division is investigating whether five major networks—ABC, CBS, Cable News Network (CNN), NBC, and Fox News—violated the Sherman Act. The apparent theory is a group boycott: a coordinated refusal to do business with someone.
The networks briefly suspended their pooled coverage of President Donald Trump, in which journalists share reporting with other outlets. They did so in response to the White House’s decision to bar CNN journalists from the grounds, preventing them from participating in that coverage. The networks’ decisions to suspend coverage seem conspicuously expressive, not anticompetitive, and the investigation looks manifestly dubious. Am I being optimistic when I wonder whether it’s grandstanding for the White House?
For other examples, Ben and I have a joint post on a statement of interest submitted by the Antitrust Division in a private antitrust suit. I also have a post on a Federal Trade Commission (FTC) inquiry into “tech censorship,” with more thorough ICLE comments from Ben, Geoffrey Manne, and me in response to the FTC’s request for information.
Ben and I also published an article, “Is There an Empty Set at the Intersection of Antitrust and Content Moderation,” as our contribution to a Concurrences collection on the topic edited by Bilal Sayyed.
Ben and I discuss the FTC’s artificial intelligence (AI) policy statement here, and extended ICLE comments are here from Ben, Geoff, and me. Here are Ben and Jeffrey Westling on jawboning by the Federal Communications Commission (FCC).
And just to round things out for the energetic or choosy readers among you, there’s more from Ben (here, here, here, and here).
The Land of Enchanting Penalties
First Amendment issues aside, $25 billion is a historic penalty indeed. To put it in perspective, in July 2019, the FTC announced “a record-breaking $5 billion penalty” against Facebook, along with substantial—and costly—restrictions on its practices and compliance obligations. The monetary penalty alone was, as the commission announced, “the largest ever imposed on any company for violating consumers’ privacy and almost 20 times greater than the largest privacy or data security penalty ever imposed worldwide.”
Now, in 2026, a New Mexico state judge has ordered a penalty five times that record-breaking federal penalty. It’s closer to four times as much after adjusting for inflation, but the point remains: Pending appeal, New Mexico stands to recover several times any federal (or, for that matter, Europe-wide) data penalty.
And that’s supposed to be giving Meta a break. Judge Francis J. Matthews ruled that “[t]he state is awarded and shall recover a civil penalty against Meta in the amount of $219,498,606,000, which penalty is reduced to the amount of $25,000,000,000.” That’s $25 billion plus interest, of course, “to accrue at fifteen percent (15%) per annum until paid in full.”
So … a penalty of nearly $220 billion, but for you, Meta, only $25 billion. Such a deal.
According to Matthews, “[t]he harm in this matter is difficult to overstate.” Perhaps, but he sure did give it the old college try.
To some extent, it’s a pile-on penalty. The FTC’s $5 billion penalty, plus commitments to change Facebook’s practices, stemmed from alleged violations of a 2012 FTC order. The commission revisited that order in the wake of the Cambridge Analytica controversy over the use of Facebook users’ data. New Mexico Attorney General Raúl Torrez now tells us that his state’s “case arose from Facebook’s conduct surrounding the Cambridge Analytica scandal.”
To be sure, neither the state case nor the FTC’s case was confined to conduct or consequences tied to Cambridge Analytica. Then again, they weren’t not about Cambridge Analytica.
There was also a much smaller fine under the United Kingdom’s Data Protection Act 1998, which capped the amount. No specific penalty followed under the General Data Protection Regulation (GDPR)—unsurprising, as the Cambridge Analytica events preceded its effective date by several years. But the matter drew European Union (EU) attention and influenced subsequent EU regulation and enforcement.
On the theme of piling on, it’s hard to avoid flights of basic computational fancy. What if every state did it? Fifty times $25 billion equals $1.25 trillion. Make it 51—the 50 states plus the District of Columbia—and we’re up to $1.275 trillion. If that seems about the same, in one sense it is; in another, you’ve just rounded off $25 billion.
Suppose we weight the awards by population. For many of the allegations, the judgment did, after all, calculate violations and penalties using the state’s entire population. Based on U.S. Census Bureau figures, New Mexico’s population is approximately 0.63% of the U.S. total. Scaling the penalty accordingly would take us to roughly $3.97 trillion, without counting federal penalties or the costs of court-ordered changes to business practices.
That’s well over half the U.S. government’s total spending for fiscal year 2026 and hence—it seems safe to say—real money, even in Washington.
What if we run the numbers again using the original $219,498,606,000 penalty? I leave that as an exercise for the reader—and not much of an exercise. If you can’t do it in your head, you can do it on your phone.
In a presumably separate matter, this judgment follows hot on the heels of an Aug. 6 New Mexico judgment against Meta Platforms. The state court assessed $375 million in civil penalties and ordered another $567 million paid into an “abatement fund” for a total of $942 million. It also ordered substantial changes to Meta’s practices.
The aim was to remedy Meta’s supposed contributions, via Facebook and Instagram, to “the youth mental health crisis”—conditions that, according to the state and the court, constituted public nuisances under New Mexico law, or harms to the public at large. That judgment also came from the state’s First Judicial District Court, albeit from a different judge.
As I noted way back in 2023, in a roundup edition on “The Bureau of Let’s Sue Meta,” two commissioners—Rebecca Slaughter and Rohit Chopra—dissented from the then-record-setting $5 billion settlement because they thought it inadequate:
I commend Chopra’s dissent, if only as an oddity. He rightly pointed out that the commissioners’ analysis of the penalty was “not empirically well grounded.” At no time did the commission produce an estimate of the magnitude of consumer harm, if any, underlying the record-breaking penalty. It never claimed to.
That’s odd enough. But then Chopra opined that “a rigorous analysis of unjust enrichment alone—which, notably, the Commission can seek without the assistance of the Attorney General—would likely yield a figure well above $5 billion.” That subjective likelihood also seemed to lack an empirical basis; certainly, Chopra provided none.
As Chopra should have known, the FTC’s Bureau of Economics had weighed in and considered how to assess consumer harm. Its economists just didn’t have evidence to support an estimate anywhere near the settlement amount—or even in the same order of magnitude.
As I said at the time:
[T]he remedies appeared to be wholly untethered from the magnitude of consumer harm wrought by the alleged violations. To be clear, I’m not disputing that Facebook violated the 2012 order, such that a 2019 complaint was warranted, even if I wonder now, as I wondered then, how a remedy that had nothing to do with the magnitude of harm could be an efficient one.
I continue to puzzle over such things.
While the attention to the dollar figure is understandable, it’s not the only large number in the news from New Mexico. As the state’s attorney general puts it, “[a] New Mexico jury found nearly 44 million violations of our consumer protection statute, and this penalty order demonstrates that those violations carry real consequences.” Lower down, the press release gives a more precise number: 43,899,725 violations.
How? For context, the Census Bureau puts New Mexico’s population at approximately 2.1 million. That’s everyone: adults, kids—including toddlers and newborns—people in their 90s, prison inmates. Everyone.
Facebook is an immensely popular platform, but nobody imagines that everyone in the state uses it—or even has internet access. According to the decision, Facebook had “1,386,648 New Mexico active monthly users as of June 30, 2020.” That’s quite a share of the population, but it’s not everyone, and it does little to explain how the count reached 44 million violations.
Nobody will be surprised to learn that the state didn’t allege, and the jury didn’t find, those 43,899,725 violations one by one. Rather, the jury found that 26 separate statements constituted willful violations of state law. Then, “[p]ursuant to the Court’s instructions,” it found that the “reasonably expected or anticipated audience” for some statements numbered 1,386,648—the estimated number of Facebook users in New Mexico in 2020. For others, the audience numbered 2.1 million—the state’s entire population.
The tally came to 43,899,720 instances of unfair or deceptive trade practices, plus five instances of “unconscionable” trade practices—conduct the law treats as grossly unfair. In brief, the findings treated some statements as harming every Facebook user in New Mexico and others as harming every living soul in the state, including people who’d never accessed Facebook.
If Meta Platforms changed its ways in response to the New Mexico judgments, precisely as the state desired and its court ordered, what would consumers who never access Meta’s platforms—including Facebook and Instagram—be protected against?
I like New Mexico, I do. I’ve trekked in the mountains near Cimarron, visited Taos Pueblo, and skied at Taos Ski Valley. I’ve even been to a Seder in Santa Fe. It’s a beautiful state. And yet, I can’t escape this sneaking feeling that … this judgment is nuts.
My objection isn’t that there couldn’t be a viable complaint against Meta under New Mexico law. I’ve looked at some of the state’s exhibits. Some allegations seem strained, at best, but I’m not a New Mexico lawyer and can’t claim expertise in the state’s law.
For that matter, I haven’t closely examined all of Meta’s representations about its data practices over the years—express or implied, on its platforms or elsewhere. So it would be hard for me to argue that none of those statements caused any New Mexico citizens harm that could support a legal claim.
Acknowledging those limitations, something seems deeply wrong here.
The FTC Act Has Standards
Looking back at that $5 billion federal penalty—and the drama surrounding it—highlights a few key questions. So does the FTC’s 2023 order to show cause, which required Meta to explain why the commission shouldn’t revise its earlier order and impose new requirements. I discussed that briefly here.
That order referred to the $5 billion penalty—really, an agreement to settle the FTC’s 2019 complaint. The complaint alleged that Facebook had violated a 2012 consent order. That earlier order, in turn, resolved a 2012 FTC complaint alleging violations of Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive acts or practices in commerce. Of the initial complaint’s eight counts, five alleged deception and three alleged “unfair or deceptive” acts or practices. For whatever it’s worth, the 2012 consent order imposed no monetary penalty.
Still with me? The FTC framework seems useful here because the cases involve the same defendant—now Meta Platforms, then Facebook—and overlapping conduct. More fundamentally, it offers a useful framework for assessing deception and unfairness claims under Section 5.
Congress imposed distinct limits on the commission’s unfairness claims through Section 5(n), which it added to the FTC Act through the Federal Trade Commission Act Amendments of 1994. That provision reined in the commission’s expansive interpretation of its unfairness authority.
Under Section 5(n), an act or practice cannot qualify as unfair unless it “causes or is likely to cause substantial injury to consumers,” consumers cannot reasonably avoid that injury themselves, and the injury is “not outweighed by countervailing benefits to consumers or to competition. Section 5(n) also provides that “public policy considerations may not serve as a primary basis” for a determination of unfairness, although they can be considered along with other evidence.
I like it. The provision leaves ample flexibility to address harmful conduct while linking the commission’s competition and consumer protection missions. It focuses limited resources on real and substantial consumer harm, limits the consideration of plastic “public policy considerations,” and recognizes the tradeoffs inherent in policy interventions. At bottom, it’s a law & economics provision.
No comparable amendment limits the commission’s deception authority, but that doesn’t make the authority unbounded. As the commission recognized in its 1983 Policy Statement on Deception—still cited as guidance—“[n]umerous Commission and judicial decisions have defined and elaborated on the phrase ‘deceptive acts or practices.’” To synthesize and clarify those decisions, the statement identified “certain elements [that] undergird all deception cases”:
First, there must be a representation, omission or practice that is likely to mislead the consumer. …
Second, we examine the practice from the perspective of a consumer acting reasonably in the circumstances.
Third, the representation, omission, or practice must be a “material” one. The basic question is whether the act or practice is likely to affect the consumer’s conduct or decision with regard to a product or service. If so, the practice is material, and consumer injury is likely, because consumers are likely to have chosen differently but for the deception.
This approach recalls fraud lawsuits under common law, as well as statutory fraud claims. For a recent example, there’s the FTC’s complaint, joined by 20 states, against Dollar General. As with unfairness claims under Section 5(n), the conduct must cause, or be likely to cause, concrete injury to consumers acting reasonably in the circumstances.
I recognize that New Mexico wasn’t applying Section 5’s prohibition on unfair or deceptive acts or practices to Meta. Still, it seems instructive to note that much of the state’s complaint would fall short under the FTC’s framework.
For example, a summary sheet of the “state’s allegations of false or misleading statements about users’ control of their data” cites a Jan. 24, 2018, Facebook post by Sheryl Sandberg, in which she states that “we don’t share personal information with advertisers without permission.” Her full post reads:
Sharing an important post from Mark that explains our business model. Some people have questioned this model because they worry about privacy given that our business is advertising. But showing people relevant ads and protecting their privacy are not at odds – we do both. We don’t sell peoples’ data and we don’t share personal information with advertisers without their permission. What we do is use information in a privacy-safe way that allows advertisers to reach people who may be interested in their products.
This is especially important for small businesses that now have access to the tools that previously only big companies could afford. It helps them grow and hire – and it helps us provide our services for free to billions of people so they can express themselves and connect with people they care about all around the world.
That all seems fairly reasonable … and broad, and perhaps somewhat vague as policy assurances go. Perhaps that’s to be expected in a brief Facebook post.
To be clear, I’m not arguing that the post couldn’t possibly have misled a privacy-sensitive New Mexico consumer acting reasonably in the circumstances. Suppose the consumer read it, and suppose it didn’t match Facebook’s practices at the time. Even then, one wonders whether privacy-sensitive consumers might reasonably have dug a little deeper.
But there’s a preliminary question: How many such New Mexico consumers read the post? Of those who did, how many found it misleading in a way that affected their choices? How many would have abandoned Facebook had the post accurately described its data practices?
Surely, the answer isn’t 2.1 million New Mexico consumers, acting reasonably or otherwise. Peel off infants, people in comas, people living off the grid, and those on the grid who never access Facebook. Then peel off young people—like my kids in their mid- to late 20s—who prefer other social media tools.
And surely, it’s not every regular Facebook user in the state. Did 10% of those users see the post? Dubious. One percent? That still seems dubious. But if it was 1%, what share did it materially mislead? And what harm did they suffer?
Privacy violations can cause real and substantial harm. Liad Wagman and I discuss various potential consumer harms—and how to identify and measure them—in “The Law & Economics of Privacy.” I won’t rehash all that here.
Consumers might change their online behavior because of those risks, real or perceived. They might also change it because they like or dislike a service’s price or other features, including the privacy policies its provider advertises or follows.
As I said, I’m not arguing that the post couldn’t have materially deceived or misled anyone. I’m wondering whether it did. How did the state—or the court—assess or estimate how many people the statement materially misled and the harm they suffered as a result?
That’s a rhetorical question: They did no such thing.
We can run through the same drill with other statements on the summary sheets, from emails to and from Mark Zuckerberg and others at Facebook, to newspaper quotes, to published data policies. Indeed, as Wagman and I note, there’s a body of “research indicating that many consumers do not read the privacy policies posted by firms and other organizations, and that many who do fail to comprehend those policies.”
As articles by Howard Beales and Timothy Muris and James Cooper and Joshua Wright point out, some of that may reflect rational ignorance: People may reasonably decide that learning the details isn’t worth the time and effort. As Wagman and I explain:
A consumer might attach low value to reading and comprehending a privacy policy because the consumer attaches little value to privacy generally, or because they doubt that the policy will address their individual privacy concerns or priorities. Or they might doubt the nexus between the policy and their risk of harm, perhaps because they doubt the efficacy of such policies. In any case, they may doubt that the marginal benefit of search required to understand the policy will exceed the marginal cost.
Again, false or materially misleading privacy assurances can cause harm. My point is that the state didn’t demonstrate such harms here, and the New Mexico court required no such showing.
The court required none of these basic elements of a sound FTC unfairness or deception case—either to find Meta liable for the statements or to calculate the penalty. Not even the … cough, reduced penalty of $25 billion, much less the original $219,498,606,000. Both figures rested on statutory per-violation penalties under New Mexico law, independent of demonstrable harm.
For that matter, how many New Mexico consumers made lasting changes to their online behavior because of the news about Cambridge Analytica? That scandal involved the firm’s harvesting of data from up to 87 million Facebook users, out of more than 2 billion users in 2018.
The decision found that Facebook had “1,386,648 New Mexico active monthly users as of June 30, 2020.” That’s roughly two-thirds of the state’s entire population, more than two years after the scandal broke and about a year after the FTC’s highly publicized 2019 complaint.
How many changed their behavior in response to that complaint or the ensuing consent order? How about the filing—widely reported in New Mexico—of the state’s complaint?
And what about countervailing benefits? Most New Mexico consumers apparently continued using Facebook after highly publicized complaints from federal and state enforcers. That suggests a “revealed preference”: Their choices indicate that they still valued the service. Yet the state’s determinations of liability and penalties considered no countervailing benefits—or any tradeoffs at all.
Perhaps these lacunae are unsurprising, not to mention European. As I noted above, even the relatively paltry $5 billion Facebook agreed to pay to settle the FTC’s allegations bore little, if any, relation to an assessment of the consumer harm the alleged violations caused. And may I be forgiven, and not just by Rohit Chopra, for using “paltry” in this context.
That was a negotiated settlement based on statutory penalties the company might have faced for allegedly violating the 2012 consent order.
The Fine Line Between Enforcement and Extraction
Perhaps Attorney General Torrez was right to call the decision “a historic day for New Mexico and for consumers across the country.” Was it a good one?
He followed up in exceedingly broad terms: “For too long, powerful technology companies have operated as though their size and influence put them beyond the reach of the law.” Perhaps, or perhaps not. But the statement smacks of a larger anti-tech agenda, much like statements we’ve seen from federal enforcers, and not just under Lina Khan’s leadership. A sweeping grievance isn’t a concrete legal dispute for a court to resolve. Nor does it signal enforcement of the law without fear or favor.
Meta Platforms will, of course, appeal. It may gain traction—at least in challenging the penalty—on due process or other grounds, drawing on cases like State Farm v. Campbell, BMW of North America v. Gore, and Exxon Shipping v. Baker. The state court argues otherwise, and the details of any appeal remain to be seen, but I expect the firm will find at least some relief.
The recurring mismatch between statutory penalties and the harms they’re supposed to address raises more than a technical legal issue. Those penalties should work ex post by making firms bear the costs of the harm they cause, and ex ante by giving them an incentive to avoid causing it. When penalties lose that connection to harm, the concern goes beyond whether a remedy works efficiently. At some point, it becomes a question of due process and the rule of law.
In musing on an EU fine against Meta in 2023, I asked:
Are penalties supposed to bear some relationship to actual harms, or are they supposed to be arbitrary exercises of international taxation?
Cheeky, I know. But by assessing penalties based on the actual worldwide bigness and perceived worldwide badness of certain large American tech firms, European regulators seemed to be intruding on the authority of nations outside the EU—not least the United States. Not every action taken under the color of law upholds the rule of law.
New Mexico and its First Judicial District Court say they’re holding Meta accountable under the law. Under the color of law, perhaps. But the penalty looks more like a smash-and-grab raid on the tech industry. That doesn’t look very much like the rule of law.
