Cambridge Analytica and Meta’s $25B Verdict

Cambridge Analytica the company has been gone since 2018. The liability it created has not. The useful way to read this week’s order is as the closing entry on a ledger that opened with an API design decision, not with a political consultant.

Key Takeaways:

Judge Francis Mathew ordered Meta to pay New Mexico $25 billion on October 21, 2026, following a September 25 jury finding of more than 43 million violations of state consumer protection law.

The underlying mechanism was Facebook’s Graph API version 1.0, which let third-party apps read the full profile data of an installer’s friends without those friends’ consent.

Cambridge Analytica and SCL Group filed for insolvency on May 1, 2018. Enforcement did not stop, it just changed jurisdiction and plaintiff.

The Corporate Map Behind the Headlines

The org chart matters because liability scattered across four entities, and only one of them still exists in a form anyone can sue. Cambridge Analytica Ltd was founded in 2013 as a subsidiary of SCL Group, the London private intelligence and election-management firm built by Nigel Oakes, his brother Alexander Oakes, and Alexander Nix. Nix was chief executive. SCL Elections Ltd handled the group’s election work, and Nix was a director of it alongside nine other companies sharing the same registered office in London.

The App, the API, and the 87 Million Number

The money behind it came from Robert and Rebekah Mercer, and Steve Bannon was a vice president before leaving to run the 2016 Trump campaign. The firm also worked for Ted Cruz’s 2016 primary run, for Leave.EU, and, per Nix, for 44 U.S. political races in 2014. The data harvesting itself was contracted out: Aleksandr Kogan, then a University of Cambridge lecturer, built the app through his company Global Science Research.

That split is what made the story so hard to litigate. The data was collected by a researcher, transferred to a consultancy, used by a campaign, and hosted by a platform that told Congress it had been deceived by all three. No single party owned the whole chain, which is why the eventual bill landed on the only one with a balance sheet.

The App, the API, and the 87 Million Number

Kogan’s app was a personality quiz that paid respondents a small sum to answer questions for what was described as academic research. It also required a Facebook login. Under Graph API version 1.0, a token issued to a third-party app did not stop at the person who granted it. It reached the full profile data of that person’s friends, without their knowledge or consent.

This was the documented behavior available to every developer on the platform, used by tens of thousands of apps. Facebook deprecated friend-data access in April 2014 and shut it down entirely in April 2015. Data already collected stayed in developers’ hands, because nothing in the shutdown required deletion or proved it had happened.

The arithmetic is simple and was the first thing reporters checked. About 270,000 Facebook users installed the app. The average user at the time had roughly 300 friends. Multiply and you get an outer bound near 81 million, which is why the disclosed figure landed where it did.

The number moved publicly. In March 2018, The Guardian and The New York Times published simultaneously with a figure of 50 million profiles, based on whistleblower Christopher Wylie’s account. Facebook later confirmed data on potentially over 87 million users, 70.6 million of them in the United States. Wylie told NBC’s Meet the Press the true number “could be higher” and said some of the data may have been stored in Russia, as PYMNTS reported. In Congress he went further, describing voter suppression campaigns run by the firm.

Read as a disclosure timeline, the 50 million to 87 million jump is what happens when a platform reconstructs an exposure from install records and friend counts years after the fact, because it never had the transfer log in the first place.

Psychographic Targeting: Sales Copy and Evidence

The firm’s pitch was that personality profiling could identify which voters were movable and which could be discouraged from voting at all. Nix claimed Cambridge Analytica held close to five thousand data points on each participant. The Trump campaign used the resulting segments to split audiences, showing supporters triumphant imagery and polling-place logistics while showing swing voters negative material about Hillary Clinton.

Whether that changed an election is a separate question from whether the data was misused, and the two got merged in coverage. A 2024-25 review published by the Independent Institute examines and disputes the manipulation narrative, and political scientists have questioned the firm’s effectiveness claims since 2016. The auditable facts are narrower: bulk collection without consent, a transfer that breached Facebook’s terms, and a contractor who told Facebook the use was academic.

Treat the persuasion claims as sales material until someone produces the experiment. Cambridge Analytica’s own marketing was built to make clients believe the product worked; that is evidence about the sales pitch, not about voter behavior.

Smartphone displaying a social networking app beside a laptop — The quiz required a Facebook login, and the token it minted reached past the person who granted it.

The 2018 Collapse and a 500,000 Pound Fine

The story broke in stages. Harry Davies reported in The Guardian in December 2015 that Cambridge Analytica was working for Ted Cruz using data harvested from Facebook accounts. Wylie then spent a year working with reporter Carole Cadwalladr before going public in March 2018. Channel 4 News aired undercover footage of Nix describing bribery and honey-trap stings and claiming the firm “ran all of” Trump’s digital campaign.

The UK Information Commissioner’s Office obtained a warrant to search the London offices on March 23, 2018. Nix was suspended and replaced by Julian Wheatland. Facebook banned the firm from its platform. On May 1, 2018, Cambridge Analytica and SCL filed for insolvency and closed.

Kogan, meanwhile, had changed his name to Aleksandr Spectre, which made “Dr. Spectre” the byline of the scandal in the British press. He testified to the UK Parliament in April 2018 that his app collected public profiles, birth dates, location, and page likes from users and their friends, and confirmed he shared the dataset with Cambridge Analytica.

Eight Years Later: New Mexico and the $25 Billion Order

Most states settled. That left New Mexico, which had filed its own suit in 2021, as the only state still pushing the privacy case toward trial. Opening statements in Santa Fe began on September 9, 2026, before Judge Francis Mathew.

The state’s case was that the company deceived users about how it handled their data and about its investigations into third-party apps. Randi McGinn, representing New Mexico, told jurors Facebook internally flagged more than two thousand apps but neither alerted users nor forced deletion of the data. Meta’s attorney, Dane Butswinkas, argued the state’s evidence was outdated and that the company had since banned apps and referred suspicious developers to regulators.

Sheryl Sandberg, Facebook’s former chief operating officer, testified by video deposition that the company hit roadblocks while investigating Cambridge Analytica, courtroom reporting shows. Mark Zuckerberg’s deposition was also played.

On September 25, 2026, the jury found Meta liable, concluding the company had made misleading statements and violated New Mexico’s consumer protection law more than 43 million times, counted by users reached by each statement. State law caps penalties at $5,000 per violation. New Mexico asked for $35 billion to $40 billion. Meta argued for a cap of $3.45 billion, noting it ended the second quarter with $90.3 billion in cash and marketable securities, per TIKR’s read of the filings. The judge landed at $25 billion on October 21, the largest penalty against the company to date.

Action	Amount	Year	Scope
ICO fine to Facebook	500,000 pounds (about $663,000)	2019	Failure to safeguard user data
FTC penalty	$5 billion	2019	Privacy violations tied to the scandal
New Mexico jury finding	More than 43 million violations	2026	Misleading statements on data handling and content moderation
New Mexico judge’s order	$25 billion	2026	Penalties applied to the jury’s violation count
Multistate youth-safety settlement	Up to $18 billion	2026	Child safety, with a release covering Cambridge Analytica claims

One discrepancy worth flagging: Law.com describes that settlement as $17 billion, while the Associated Press puts it at up to $18 billion. The release language is the part that matters here, and both accounts agree it covers the privacy claims.

What a Platform Can Verify After Data Leaves

The engineering lesson is not “get consent.” Kogan had consent from the people who installed his app. The failure was that a single token granted read access to an entire friend graph, and that no control existed to check what happened to the copy once it moved.

Four controls map directly onto what went wrong, and each is a question you can ask of any system you own that brokers third-party data access:

Scope by relationship, not by token. Friend-graph reads should have required each affected user to authorize the app, or been restricted to aggregate, non-identifying fields. One installer should never authorize access to 300 profiles.
Log the export, not just the request. A record of which fields left, when, and to which application ID is what turns an exposure into a countable, provable event. Without it, Facebook had to reconstruct 87 million from install counts.
Require deletion attestation on API shutdown. Deprecating an endpoint in April 2014 and closing it in April 2015 removed future access but not existing copies. A deletion requirement with evidence, enforced by contract and audit, is the only version that touches data already gone.
Treat downstream transfer as a monitored event. A contractor moving a dataset to a third party is the moment the platform loses custody. Alerts on unusual bulk reads by low-volume apps would have surfaced a quiz app pulling millions of profiles.

None of these is novel in 2026, and none is a complete answer. They also would not have stopped a determined contractor from lying about academic use, which Kogan did. What they change is the response time: a platform that can enumerate what left in hours rather than years handles the disclosure differently, and gets to notify users before a newspaper does.

That gap between detection and disclosure is the part of this story that recurs. New Mexico’s case survived eight years and a corporate dissolution because the state could point to specific statements about data handling and then measure them against what the platform knew. The $25 billion figure will be appealed, and Meta will argue the violation count double-counts. But the violation count itself came from the statements, and the statements came from a company that could not see past its own API boundary. For teams building anything that hands data to a third party, that is the reusable lesson: the audit trail is the product, and it is the only artifact that survives the vendor.

More in-depth coverage from this blog on closely related topics:

Sources and References

Sources cited while researching and writing this article: