A New Mexico judge who ordered Meta to pay $25 billion — one of the largest data privacy penalties in American history — wrote that "the harm in this matter is difficult to overstate."

The record fine stems from a case tied to Cambridge Analytica, the firm that worked with Donald Trump's campaign and deceptively used Facebook users' data without their permission to build psychographic profiles for targeting voters in the lead-up to the 2016 presidential election. Yet as Emma L. Briant, a scholar of political communication, argues in an analysis published by The Conversation, the New Mexico penalty was imposed for statements Facebook made that deceived users about data privacy and about its response to the Cambridge Analytica scandal — not for the harm caused by how the harvested data was used.

Those alleged harms include exploiting psychological vulnerabilities, targeting people's fears and discouraging them from voting.

Briant, a visiting associate professor at the University of Notre Dame's Lucy Family Institute for Data and Society who studies propaganda, surveillance and information warfare, said her research helped expose the Cambridge Analytica scandal through whistleblower accounts featured in reporting by the U.K. newspaper The Guardian. Her evidence was submitted to parliamentary and congressional investigations, and she has followed the ensuing legal cases closely. Her takeaway from a decade of litigation: Facebook has been penalized for misleading users and regulators about its data practices and its response to the scandal, while largely escaping accountability for the underlying political exploitation of the data.

Investigative failures

Briant attributes the failure to litigate those harms, in part, to earlier failures to fully investigate the data misuse.

The U.S. Senate Intelligence Committee's investigation into Russian interference in the 2016 presidential election encompassed Cambridge Analytica. In its final report, however, the committee said it "was unable to obtain the corporate communications of Cambridge Analytica or its parent company SCL Group, which had already been seized by U.K. authorities."

The relevant U.K. authority, the Information Commissioner's Office — which regulates data protection and took possession of Cambridge Analytica's servers — told Briant, in response to her 2021 Freedom of Information Act request, that Senate committee staff made initial inquiries to the office but appear not to have followed up with a formal request, "so no information sharing has taken place." Without a formal request, the Senate Intelligence Committee's investigation lacked important data.

At the same time, U.K. investigations into Cambridge Analytica's use of personal data to manipulate voting behavior focused on the referendum of British voters over whether to leave the European Union, not on events in the United States.

A 2020 documentary Briant advised as a researcher, "People You May Know," raised questions about Cambridge Analytica's work with Gloo, an app marketed to American churches that used Cambridge Analytica's Facebook data-derived psychographic profiling in their communities. Evidence in the New Mexico case, she writes, reinvigorates those questions about the full extent of the Cambridge Analytica scandal.

In his ruling, the judge found that Facebook knew its own processes for investigating whether apps misused personal data were inadequate and that it could not enforce deletion of the data. The judge also concluded the company failed to notify users about thousands of applications associated with data misuse. Meta said it would appeal the decision.

Responding to a request for comment, Meta pointed to its official statement on the New Mexico ruling, arguing the case "seeks to impose a tax on speech to enforce new rules for what people can say online." The company did not address its own role in the data privacy violations committed by Cambridge Analytica.

Escaping further scrutiny

Meta is also working to close the door on further claims before they are litigated.

In August 2026, on the eve of a child-safety trial in federal court in Oakland, California, Meta settled with a bipartisan coalition of state attorneys general for roughly $17 billion. The agreement includes 47 states, the District of Columbia and two U.S. territories. Folded into that deal was an allocation of $459.3 million to settle Cambridge Analytica-related claims held by participating states.

Under the settlement, the participating attorneys general agreed, to the extent of their authority, to "fully, finally, and forever" release Meta from "any and all Claims, whether known or unknown, whether accrued or unaccrued." By expressly encompassing "unknown" and "unaccrued" claims, the agreement reached beyond what investigators had already uncovered: participating states accepted payment to give up claims arising from Meta's conduct even if they did not yet know those claims existed.

In effect, a decade-old matter — Facebook's role in the Cambridge Analytica scandal — was quietly resolved inside an unrelated lawsuit about harm to teens.

From the Federal Trade Commission's 2019 order, which imposed a $5 billion penalty, to the 2022 class action settlement to August 2026's multistate deal, settlements and releases have meant the company paid a relatively small price for its deception while the harms from the data exploitation went unadjudicated, Briant argues. The biggest privacy judgment in American history, she contends, stands as a measure of the cover-up, not the alleged crime.

Briant and other scholars have regularly called attention to the lack of comprehensive U.S. privacy legislation, but other legal pathways remain to pursue the harms Cambridge Analytica wrought. States like New Mexico can continue the fight, and Attorney General Raúl Torrez, who brought the case, promised, "We're just getting started."

Then-Commissioner Rohit Chopra dissented from the FTC's 2019 settlement, criticizing the failure to consider "Facebook's unjust enrichment." He said "the company's potential exposure is likely far greater" than the $5 billion imposed by the FTC settlement.

What price for the harm?

The question remains what exactly Facebook gained from enabling Cambridge Analytica's abuses. Authorities could also investigate harmful data use for any other apps Facebook may have failed to fully assess, including any associated with Cambridge Analytica's projects.

If the deception about Cambridge Analytica was worth $25 billion, Briant believes the public is entitled to know what the underlying harms to them are worth. New Mexico opted out of the 2026 multistate settlement and proved that a state willing to go to trial against Meta can win. The next task, in her view, is to investigate fully and, where legal claims remain available, pursue accountability for harms resulting from the data exploitation. Otherwise, Cambridge Analytica will remain at the heart of the most consequential privacy scandal in American history, whose full harms have not been tested in court.

Emma L. Briant is a visiting associate professor at the Lucy Family Institute for Data and Society, University of Notre Dame. This article is republished from The Conversation under a Creative Commons license. Read the original article. This story was originally featured on Fortune.com.