Meta Ordered to Pay $25 Billion Over Cambridge Analytica: What It Means for Your Data in the UK
A US court has ordered Facebook to pay $25 billion over the Cambridge Analytica scandal. Here is what happened, and the data rights you can use with Meta today in the UK.
A court in New Mexico has ordered Facebook to pay $25 billion in civil penalties over the Cambridge Analytica scandal, one of the largest financial penalties against a company in US history. The case is American, but the lesson is the same here: you have strong legal rights over the data Facebook and Instagram hold about you, and you can use them today, for free.
What Happened
On 21 October 2026, the New Mexico Department of Justice announced that a court had ordered Facebook to pay $25 billion in civil penalties for breaking New Mexico's Unfair Practices Act, the state's consumer protection law.
A jury had already found that Facebook broke that law 43,899,725 times. The case arose from the Cambridge Analytica scandal, when personal information collected through Facebook was misused. New Mexico's case went further, challenging what Facebook told people about its data practices, about third-party access to their personal information, and about how it handled harmful content.
New Mexico chose to take the case to trial on its own rather than join a settlement with other states. Earlier this year, in August 2026, the same state also won a court order requiring Meta to pay $942 million and overhaul protections for children on Facebook and Instagram.
Does It Affect People in the UK?
Not directly. This is a penalty under New Mexico law, paid because Facebook broke that state's consumer protection rules. It is not compensation for users, and it does not create any claim for people in the UK.
It is still a reminder of something that matters to everyone who uses Facebook, Instagram, WhatsApp or Messenger: the companies behind these apps hold a great deal of information about you, and in the UK the law gives you real control over it.
Your Data Rights With Meta in the UK
See What They Hold
You have the right to ask an organisation whether it uses or stores your personal information, and to ask for a copy. This is called a subject access request. Organisations normally have one month to reply.
Stop Marketing
You can object to your data being used for direct marketing. The ICO says organisations cannot refuse if you object to this, and they must respond within one calendar month.
Ask for Deletion
You can ask for your data to be deleted in some situations, for example when the organisation no longer needs it for the reason it was collected. There are exceptions, such as when the law requires them to keep it.
Complain, Then Go to the ICO
Raise a data protection complaint with the company first. Since June 2026, organisations must acknowledge a data protection complaint within 30 days. If you are still unhappy, you can complain to the Information Commissioner's Office, normally within three months of your last meaningful contact with the company.
What You Can Do Today
- Ask Meta for a copy of the information it holds about you. Our free subject access request letter does the wording for you.
- If you do not want your data used to market to you, tell Meta you object. Our stop marketing letter helps.
- If you have finished with an account, ask for your data to be deleted, and keep a copy of your request.
- If Meta does not reply properly within a month, complain to Meta, then to the ICO.
- Read our full Data Protection Rights guide for the rules, deadlines and contacts.
Need a Hand?
If a company has ignored your data request, our step-by-step page explains what to do next: Company Ignored My Data Request.
- New Mexico Department of Justice: Historic $25 Billion Penalty Against Facebook (New Mexico Department of Justice, 21 October 2026)
- Federal Trade Commission: FTC Imposes $5 Billion Penalty on Facebook (Federal Trade Commission, 24 July 2019)
- ICO: Getting Copies of Your Information (Information Commissioner's Office)
- ICO: What to Expect After Making a Subject Access Request (Information Commissioner's Office)
- ICO: The Right to Object to the Use of Your Data (Information Commissioner's Office)
- ICO: Your Right to Get Your Data Deleted (Information Commissioner's Office)
- ICO: New Data Protection Complaints Law Now in Force (Information Commissioner's Office, June 2026)
- ICO: What to Do If You Don't Get a Response (Information Commissioner's Office)
- ICO: Advice Services for Members of the Public (Information Commissioner's Office)
Ready to Take Action?
Tell us what happened. Our initial case review is free.