A judge in New Mexico wrote, “The harm in this case is beyond description.” The judge ordered tech giant Meta to pay one of the largest privacy fines in U.S. history—$25 billion—stemming from how Cambridge Analytica, a company linked to Trump’s campaign, deceitfully harvested Facebook users’ data without their consent in the lead-up to the 2016 presidential election to build psychological profiles and target voters.
However, New Mexico’s penalty targets Facebook’s misleading statements to users regarding data privacy and its response to Cambridge Analytica, not the harms caused by how the collected data was subsequently used. The harms alleged by the plaintiffs include exploiting psychological vulnerabilities, targeting people’s fears, and discouraging them from voting.
I am a political communication scholar specializing in propaganda, surveillance, and information warfare. My research helped The Guardian expose the Cambridge Analytica scandal through reporting on whistleblower testimonies, and the evidence I uncovered was submitted to investigations by the UK Parliament and the US Congress. I have been closely following these ongoing legal cases.
My conclusion from a decade of litigation is that Facebook was penalized for misleading users and regulators, exaggerating its data practices, and its response to the Cambridge Analytica scandal. But I believe the company largely escaped accountability for the fundamental issue of data being used for political manipulation.
Investigation failed
One reason litigation regarding these harms has not been pursued may be that earlier investigations did not fully uncover the extent of data misuse.
The U.S. Senate Intelligence Committee’s investigation into Russian interference in the 2016 presidential election also encompassed Cambridge Analytica. However, the committee stated in its final report that it “was unable to obtain corporate communications records from Cambridge Analytica or its parent company, SCL Group, which had previously been seized by British authorities.”
The UK’s Information Commissioner’s Office, responsible for data protection and which took custody of Cambridge Analytica’s servers, informed me in response to my 2021 Freedom of Information Act request that staff from the Senate committee had made an initial inquiry to the office but did not appear to follow up with a formal request, “so no information sharing occurred.” Without a formal request, the Senate Intelligence Committee’s investigation lacked critical data.
Meanwhile, the UK investigation into Cambridge Analytica’s use of personal data to manipulate voting behavior focused on whether UK voters chose to leave the EU in the referendum, not on events in the United States.
A 2020 documentary I participated in as a research consultant, titled "People You May Know," raised new questions: Did Cambridge Analytica collaborate with an app called Gloo, which targeted American churches, and use its psychological profiles derived from Facebook data within these communities? Evidence from the New Mexico case has reignited public curiosity about the full scope of the Cambridge Analytica scandal.
The judge ruled that Facebook knew its process for reviewing apps to detect misuse of personal data was inadequate and failed to enforce the deletion of such data. The judge also found that the company failed to notify users about thousands of apps involved in data misuse. Meta stated it will appeal the ruling.
In response to a request for comment, Meta cited its official statement regarding the New Mexico ruling, calling the case an attempt “to tax speech in order to enforce new rules about what people can say online.” Meta did not address its own role in the data privacy violations carried out by Cambridge Analytica.
Evade further review
Meta is also trying to shut the door before more claims enter litigation.
In August 2026, just before a child safety trial was set to begin in federal court in Oakland, California, Meta reached a settlement with a bipartisan coalition of state attorneys general for approximately $17 billion. The agreement involves 47 states, the District of Columbia, and two U.S. territories. It also includes $459.3 million to resolve claims held by the participating states related to Cambridge Analytica.
The attorneys general participating in the settlement agreed to, within their authority, fully, finally, and permanently waive "any and all claims, known or unknown, whether arising or not yet arisen," against Meta. By explicitly covering claims that are "unknown" and "not yet arisen," this agreement extends beyond the scope of conduct already identified by investigators. The participating states accepted payment in exchange for waiving claims arising from Meta’s conduct, even though they were unaware of those claims at the time.
A decade-old matter—Facebook’s role in the Cambridge Analytica scandal—was quietly inserted into a settlement agreement unrelated to harm to minors.
From the 2019 Federal Trade Commission order, to the 2022 class action settlement, to the multi-state agreement in August 2026, the settlements and immunity provisions mean the company paid a relatively small price for its misleading conduct, and the harms caused by data misuse were never adjudicated. Ultimately, the largest privacy judgment in U.S. history measured the cover-up, not the alleged misconduct itself.
I and other scholars frequently emphasize that the U.S. lacks comprehensive privacy legislation, but legal avenues for holding Cambridge Analytica accountable for the harm it caused still exist. States like New Mexico can continue to advance this fight, and Attorney General Raúl Torrez, who filed this case, pledged: “We’ve only just begun.”
When voting against the 2019 FTC settlement, then-Commissioner Rohit Chopra criticized the agency for failing to consider “Facebook’s unjust enrichment.” He stated that the company’s potential liability was likely “far higher” than the $5 billion fine imposed in the FTC settlement.
How much damage is there exactly?
The issue remains: what did Facebook gain by allowing Cambridge Analytica’s misuse? Authorities can also investigate whether Facebook has adequately reviewed other apps for harmful data usage, including those associated with the Cambridge Analytica project.
If the misinformation surrounding Cambridge Analytica was worth $25 billion, the public has a right to know the true value of the underlying harm. States like New Mexico, which opt out of the 2026 multistate settlement and demonstrate a willingness to take Meta to court, could win.
In my view, the next step is a comprehensive investigation and holding accountable those responsible for the harm caused by data misuse, while legal claims are still viable. Otherwise, Cambridge Analytica will remain at the heart of the most influential privacy scandal in U.S. history, with its full extent of harm never tested in court.
Emma L. Briant, Visiting Associate Professor, Lucy Family Institute for Data and Society, University of Notre Dame
This article is republished from The Conversation under a Creative Commons license. See the original article here.