Meta ordered to pay $25bn: what it means for the Pixel on your site

What Meta is being ordered to pay $25 billion for

On 21 October 2026, New Mexico state judge Francis Mathew ordered Meta to pay a $25 billion penalty. Earlier, on 25 September, a jury in Santa Fe found that 26 of 29 public statements by Meta and its leadership on privacy and content moderation misled users. The legal basis is the state's Unfair Practices Act, which allows a penalty of up to $5,000 per violation.

The court counted more than 43 million violations, based on the audience for each misleading statement among Facebook users and state residents. The maximum came to about $219 billion; the judge reduced it to $25 billion. The state sought $35–40 billion, Meta asked for a cap of $3.45 billion. Unpaid amounts accrue 15% interest per year, and the money is to go to the state's school system.

The lawsuit was filed in 2021. It grew out of the Cambridge Analytica affair: the firm obtained data on up to 87 million Facebook users without their consent through an outside researcher's app. The state argued that Meta knew third parties had broad access to user data while assuring users that they controlled their own data. The judge put it bluntly: Facebook promised users they controlled their data, and that was false.

Appeal and what the ruling means

Meta has announced it will appeal. Its chief legal officer C.J. Mahoney called the penalty "a tax on speech" and said the company is confident it will win on appeal. The judgment is therefore not final and the amount may change. For clarity: this is a US case based on state consumer protection law, not GDPR. It also did not concern Meta Pixel or the Conversions API.

What it shares with a Polish company is one thing: the court penalised the gap between what a company said about data and what happened in practice. The same gap is the most common problem on company websites that use advertising tools from Meta, Google or TikTok.

Where this gap most easily appears on a company website

Your cookie banner and privacy policy are your statements to users. If the banner says "nothing is collected without consent" while the Pixel loads with the page, the statement is false. In the EU there are three foundations:

• ePrivacy (implemented in Poland by the Electronic Communications Law): storing and reading cookies and similar identifiers that are not strictly necessary requires prior consent. This covers the _fbp and _fbc cookies set by the Pixel.
• GDPR: sending data to Meta needs a legal basis and disclosure in the privacy policy. In Fashion ID, the CJEU held that a website operator embedding a Facebook plugin is a joint controller for collecting and transmitting the data.
• Transfers to the US: Meta is certified under the EU-US Data Privacy Framework, which should be described in the privacy policy.

The Conversions API does not bypass consent. Data sent from the server (purchase events, hashed email or phone) is still personal data, because hashing is pseudonymisation, not anonymisation. If a user refused marketing consent, the server should not send their events either. Google Consent Mode v2 controls Google tags only; the Pixel has its own mechanism, fbq('consent', 'revoke') and fbq('consent', 'grant'), which must be wired to the banner separately.

What to check on your own site in an hour

1. Open the site in a private window, do not touch the banner, open developer tools (Network tab) and filter by facebook, google, tiktok. Any request before clicking "Accept" needs fixing.
2. In the Application tab, check whether _fbp, _ga or _gcl_au cookies appear before consent.
3. Click "Reject" and repeat the test. Refusing must be as easy as accepting and must be respected after a page reload.
4. In Google Tag Manager, review the triggers: marketing tags must not fire on "All Pages" without a consent condition.
5. If you use the Conversions API (including through a WooCommerce, Shopify or PrestaShop plugin), find out whether the server honours the banner decision.
6. In mobile apps, check whether the Meta SDK sends automatic events before consent (the FacebookAutoLogAppEventsEnabled flag and its Android equivalent).
7. Compare the list of tools in your privacy policy with what the site actually loads. Also check that you have accepted Meta's joint controller terms and have data processing agreements with the agency or provider that manages your tags.

If you are unsure about the legal basis or the wording of your privacy policy, consult a lawyer; the technical part can be verified yourself with the test above.

The longer-term lesson

Marketing tags pile up over the years: an agency adds a pixel, someone installs a plugin, the campaign ends and the script stays. Keep an inventory of the tools that process visitor data, with who added each one and on what basis it runs, and repeat the private-window test after every change to the site. That way your privacy policy describes what actually happens.