Wednesday evening, Brussels. Hugo closes his laptop, then opens it again right away. An alert has just landed on his phone: a New Mexico judge has ordered Meta to pay the state $25 billion (7sur7).
Hugo runs a mid-sized online retail company. Eighty employees, two hundred thousand customers and a “Privacy” page nobody has reread in three years. He calls Sarah, his data protection officer.
“Sarah, did you see the Meta news?”
“Yes. Twenty-six statements out of twenty-nine found misleading.”
“And us? How many sentences on our privacy page could we defend in front of a jury?”
Silence on the line.
“I’ll answer you tomorrow morning. I’d rather not answer tonight.”
Hugo doesn’t exist. He is a composite of the leaders I work with. His question, however, is very real, and it should keep more than one executive committee awake tonight.
What happened in Santa Fe
On September 25, a Santa Fe jury found that twenty-six of the twenty-nine public statements made by Meta and its leadership about privacy and content moderation misled users (Reuters). The jurors counted 43,899,725 violations of the state’s Unfair Practices Act (KVIA).
The law allows up to $5,000 per violation. Do the math: the theoretical ceiling was above $219 billion (Next). The state asked for $35 to $40 billion. Meta asked Judge Francis Mathew to stop at $3.45 billion, arguing that a heavier penalty could scare businesses away from New Mexico. The judge settled on $25 billion, and state law sends every dollar to New Mexico’s school system (Reuters).
Attorney General Raúl Torrez described the ruling as an unambiguous signal to Silicon Valley (AP). He added a comparison that stings: the states that settled are sharing $459 million for the same conduct, while his state alone received $25 billion (The Hill). Roughly fifty-four times more, for a state with a small population.
Eight years to present the bill
A reminder of the facts. Cambridge Analytica, a political consulting firm, used Facebook user data to target ads during the 2016 U.S. presidential campaign (KVIA). The scandal broke in 2018. In 2019, the Federal Trade Commission imposed a record $5 billion penalty on Facebook and required an overhaul of its privacy governance, including an independent committee on its board of directors (Sullivan & Cromwell). Back then, observers were already pointing out that the amount represented roughly one month of revenue (The Hacker News).
In March 2026, a first New Mexico trial, focused this time on the safety of young users, had ended with $375 million in civil penalties (SEC). Six months later, the bill is more than sixty-six times larger.
Eight years separate the misconduct from the heaviest bill. In a company, eight years means two or three successive leadership teams. The people who approved the 2018 promises are often no longer around to own them. Their sentences stayed online.
The market shrugged
The most troubling detail of the day lies elsewhere. Meta was reporting quarterly earnings that same afternoon, and its shares were up about 2% after the penalty was announced (AP).
Let me play devil’s advocate, because the executives I advise will have thought of it before me. First argument: Meta has already said it will appeal, and an appeals court could reduce the number of violations, and therefore the final amount (AP). Second argument: Meta defends itself by invoking the First Amendment of the U.S. Constitution, which it says gives it the right to run its platforms as it sees fit (Next).
These arguments hold up on legal ground. They miss one simple fact: ordinary citizens read twenty-nine sentences written by a company, and they stopped believing it. An appeals court can reduce a fine. No court ruling knows how to reduce a user’s distrust.
Trust takes years to build and one sentence to destroy
I spent a large part of my career inside the machine, at Apple, at Sony, then as CTO of Neopost. I learned something there that dashboards never measure. An organization’s culture rests on trust, and that is what makes it fragile: it takes years to establish, and a single management decision can wipe it out (My book, chapter 9).
Lawyers talk about deceptive trade practices. I see a gap between words and actions. The rule of trust I give leaders fits in one sentence: “I say what I do, and I do what I say.” When La Poste rolled out an AI to plan mail carriers’ routes, six months after defining its strategy and without telling the teams, the penalty came immediately, in the form of a strike (My book, chapter 14).
Meta went through the same mechanism at the scale of billions of users, with a much longer delay. Facebook users never went on strike. They ended up speaking through a prosecutor and a jury.
Your customers are a permanent jury
Back to Hugo. His company will never be sued in New Mexico. His customers, on the other hand, deliberate every day. Every unsubscribe, every cart abandoned after spotting a pre-checked box, every negative review is a verdict delivered without a court or a lawyer.
The trap waiting for Hugo has a name I use often: status quo bias. “Our legal notices have always been written this way, and nobody ever complained.” Our past success can be our greatest enemy. It lowers our guard. It convinces a team that a promise written in 2018 is still true in 2026, while the tools, the partners and the uses of data have changed several times in between.
Add AI to the equation. Every company that connects a language model to its customer data today is writing new promises, often without knowing it. “Your data is never shared.” “You stay in control.” These sentences bind whoever signs them. The Santa Fe jury has just shown that they can be counted one by one, and that each one carries a price.
I can already hear the objection: “We’re in Europe, we have the GDPR, our lawyers approve everything.” Good. A text approved by a lawyer can remain perfectly legal and perfectly incomprehensible to a customer. Compliance protects you in front of a regulator. Clarity protects you in front of your customers. Both take work, and the second is almost always neglected.
An exercise for Monday morning
I’d rather you do one thing than nod at ten. Open your privacy page, your terms and conditions and your last three marketing campaigns. Then rate yourself from 0 to 5 on each of the following points:
- How many of your public promises about data can you prove, with documents to back them up?
- Does your actual data practice match the story your marketing tells?
- When a customer asks for their data to be deleted, do they get it within the timeframe you announce?
- Can an employee who discovers a gap report it without fearing for their job?
The last point matters more than the others. A team that doesn’t dare tell the boss that a promise has become false is quietly building the file for its future lawsuit. Psychological safety protects your reputation long before it protects your ability to innovate.
Then experiment. Ask someone on your team to behave like an ordinary customer and test each of your promises: access to their data, deletion, refusal to share. Measure the time, the number of steps, the friction. Assumptions are highly dangerous and should be killed with experimentation, and the ones about your own honesty are the most dangerous of all (My book, chapter 6).
The essentials
Remember four things:
- A jury found twenty-six of Meta’s twenty-nine statements misleading: every public sentence about data has become a unit of account.
- The bill arrived eight years after the scandal, because promises outlive the teams who wrote them.
- The market absorbed the news within hours, while user trust can’t be bought back on appeal.
- Rate your promises from 0 to 5 and test them the way a customer would, before someone else does it for you.
Hugo called Sarah back the next morning at 8 a.m. Together they found four indefensible sentences on their privacy page, and they rewrote them before noon. Nobody will read about it in the press, and that is exactly the point. Innovate or agonize, the choice is yours!
A corporate event, a seminar, an executive committee meeting, or a management committee meeting?
Philippe’s keynotes on innovation and AI are groundbreaking, you’ve been warned!
Complement a powerful keynote with innovative and impactful workshops.
A keynote inspires and raises awareness; workshops transform!
References
- (My book) https://philippeboulanger.com/book/
- (7sur7) https://www.7sur7.be/monde/un-message-a-la-silicon-valley-meta-condamnee-a-payer-25-milliards-de-dollars-aux-etats-unis~a6095ab5/
- (Reuters) https://www.investing.com/news/stock-market-news/meta-ordered-to-pay-25-billion-to-new-mexico-after-jury-finds-company-misled-consumers-about-data-privacy-4963776
- (AP) https://www.mprnews.org/story/2026/10/21/meta-ordered-to-pay-new-mexico-25-billion-for-deceiving-users-about-privacy-on-facebook
- (KVIA) https://kvia.com/news/2026/10/21/judge-orders-meta-to-pay-25-billion-for-deceiving-facebook-users-about-privacy/
- (The Hill) https://www.ktsm.com/news/national-news/judge-orders-meta-to-pay-new-mexico-25b-in-cambridge-analytica-case/
- (Next) https://next.ink/258765/meta-condamnee-pour-le-scandale-cambridge-analytica-amende-record-en-vue/
- (Sullivan & Cromwell) https://www.sullcrom.com/ftc-settlement-with-facebook-over-privacy-policies-imposes-unprecedented-penalties-and-restrictions
- (The Hacker News) https://thehackernews.com/2019/07/facebook-data-privacy-ftc.html
- (SEC) https://www.sec.gov/Archives/edgar/data/0001326801/000162828026050705/meta-20260630.htm






