“The hurt on this matter is troublesome to overstate,” wrote a New Mexico judge who ordered tech giant Meta to pay one of many largest information privateness case penalties in American historical past. The US$25 billion tremendous got here in a case about how Trump marketing campaign agency Cambridge Analytica deceptively used data from Facebook users with out their permission to create psychographic profiles to focus on voters within the lead-up to the 2016 presidential election.
However the New Mexico penalty was for statements Fb made that deceived customers about information privateness and its response to Cambridge Analytica – not for the hurt attributable to how the harvested information was used. These harms are alleged to incorporate exploiting psychological vulnerabilities, targeting people’s fears and discouraging them from voting.
I’m a political communication scholar who studies propaganda, surveillance and information warfare. My analysis helped expose the Cambridge Analytica scandal via U.Ok. newspaper The Guardian’s reporting on whistelblower accounts and the evidence I uncovered. That proof was submitted to parliamentary and congressional investigations. I’ve adopted the unfolding authorized circumstances intently.
My takeaway from a decade of litigation is that Fb has been penalized for deceptive customers and regulators about its information practices and its response to the Cambridge Analytica scandal. However I might contend that the corporate has largely escaped accountability for the underlying political exploitation of that information.
Investigative failures
The failure to convey circumstances round harms could also be partly on account of earlier failures to completely examine the information misuse.
The Senate Intelligence Committee’s investigation into Russian interference within the 2016 presidential election encompassed Cambridge Analytica. Nonetheless, the committee said in its final report that it “was unable to acquire the company communications of Cambridge Analytica or its father or mother firm SCL Group, which had already been seized by U.Ok. authorities.”
The related U.Ok. authorities, the Info Commissioner’s Workplace, which governs information safety and took possession of Cambridge Analytica’s servers, informed me in response to my 2021 Freedom of Info Act request that the Senate committee employees made preliminary inquiries to the workplace however seem to not have adopted up with a proper request, “so no info sharing has taken place.” With no formal request, the Senate Intelligence Committee’s investigation lacked vital information.
On the identical time, the U.Ok. investigations of Cambridge Analytica’s use of personal data to manipulate voting behavior targeted on the referendum of British voters over whether or not to go away the E.U., not occasions within the U.S.
A 2020 documentary movie I suggested as a researcher, “People You May Know,” raised questions on Cambridge Analytica’s work with an app marketed to American church buildings, referred to as Gloo, that used Cambridge Analytica’s Fb data-derived psychographic profiling of their communities. Proof within the New Mexico case reinvigorates these questions concerning the full extent of the Cambridge Analytica scandal.
The choose within the case dominated Fb knew that its personal processes for investigating whether or not apps misused private information have been insufficient and that it couldn’t implement deletion of the information. The choose additionally concluded the corporate did not notify customers about thousands of applications associated with data misuse. Meta stated it could attraction the choice.
Meta responded to a request for remark with the corporate’s official assertion concerning the New Mexico ruling, arguing the case “seeks to impose a tax on speech to implement new guidelines for what folks can say on-line.” Meta didn’t handle the difficulty of its personal position within the information privateness violations dedicated by Cambridge Analytica.
Escaping additional scrutiny
Meta can be attempting to shut the door on additional claims earlier than they’re litigated.
In August 2026, on the eve of a child-safety trial in federal court docket in Oakland, California, Meta settled with a bipartisan coalition of state attorneys common for roughly $17 billion. The settlement consists of 47 states, the District of Columbia and two U.S. territories. Folded into that deal was an allocation of $459.3 million to settle Cambridge Analytica-related claims held by taking part states.
The taking part attorneys common agreed, to the extent of their authority, to “totally, lastly, and eternally” release Meta from “any and all Claims, whether or not identified or unknown, whether or not accrued or unaccrued.” By expressly encompassing “unknown” and “unaccrued” claims, the settlement reached past what investigators had already uncovered. Taking part states accepted fee to surrender claims arising from Meta’s conduct even when they didn’t but know these claims existed.
A decade-old matter – Fb’s position within the Cambridge Analytica scandal – was quietly brushed underneath the rug in an unrelated lawsuit about hurt to teenagers.
From the 2019 Federal Trade Commission order to the 2022 class action settlement to August 2026’s multistate deal, settlements and releases have meant the corporate paid a comparatively small worth for its deception without having the harms from the information exploitation adjudicated. Finally, the most important privateness judgment in American historical past stands as a measure of the cover-up, not the alleged crime.
Different students and I commonly name consideration to the lack of comprehensive U.S. privacy legislation, however there stay different authorized pathways to pursue the harms Cambridge Analytica wrought. States like New Mexico can proceed the struggle, and Legal professional Basic Raúl Torrez, who introduced the case, promised, “We’re just getting started.”
Dissenting from the FTC’s 2019 settlement, then-Commissioner Rohit Chopra criticized the failure to think about “Facebook’s unjust enrichment.” He stated “the corporate’s potential publicity is probably going far larger” than the $5 billion imposed by the FTC settlement.
What worth for the hurt?
The query stays what precisely Fb gained from enabling Cambridge Analytica’s abuses. Authorities might additionally examine dangerous information use for some other apps Fb might have failed to completely assess, together with any related to Cambridge Analytica’s initiatives.
If the deception about Cambridge Analytica is price $25 billion, I imagine the general public is entitled to know what the underlying harms to them are price. New Mexico opted out of the 2026 multistate settlement and proved {that a} state prepared to go to trial towards Meta can win.
The following process, in my opinion, is to research totally and, the place authorized claims stay out there, pursue accountability for harms ensuing from the information exploitation. In any other case, Cambridge Analytica will stay on the coronary heart of essentially the most consequential privateness scandal in American historical past, whose full harms haven’t been examined in court docket.