“The harm in this matter is difficult to overstate,” wrote a New Mexico judge who ordered tech giant Meta to pay one of the largest data privacy case penalties in American history. The US$25 billion fine came in a case about how Trump campaign firm Cambridge Analytica deceptively used data from Facebook users without their permission to create psychographic profiles to target voters in the lead-up to the 2016 presidential election.

But the New Mexico penalty was for statements Facebook made that deceived users about data privacy and its response to Cambridge Analytica – not for the harm caused by how the harvested data was used. Those harms are alleged to include exploiting psychological vulnerabilities, targeting people’s fears and discouraging them from voting.

I’m a political communication scholar who studies propaganda, surveillance and information warfare. My research helped expose the Cambridge Analytica scandal through U.K. newspaper The Guardian’s reporting on whistelblower accounts and the evidence I uncovered. That evidence was submitted to parliamentary and congressional investigations. I have followed the unfolding legal cases closely.

My takeaway from a decade of litigation is that Facebook has been penalized for misleading users and regulators about its data practices and its response to the Cambridge Analytica scandal. But I would contend that the company has largely escaped accountability for the underlying political exploitation of that data.

Investigative failures

The failure to bring cases around harms may be partly due to earlier failures to fully investigate the data misuse.

The Senate Intelligence Committee’s investigation into Russian interference in the 2016 presidential election encompassed Cambridge Analytica. However, the committee stated in its final report that it “was unable to obtain the corporate communications of Cambridge Analytica or its parent company SCL Group, which had already been seized by U.K. authorities.”

The relevant U.K. authorities, the Information Commissioner’s Office, which governs data protection and took possession of Cambridge Analytica’s servers, told me in response to my 2021 Freedom of Information Act request that the Senate committee staff made initial inquiries to the office but appear not to have followed up with a formal request, “so no information sharing has taken place.” Without a formal request, the Senate Intelligence Committee’s investigation lacked important data.

At the same time, the U.K. investigations of Cambridge Analytica’s use of personal data to manipulate voting behavior focused on the referendum of British voters over whether to leave the E.U., not events in the U.S.

Facebook user data was at the heart of the Cambridge Analytica scandal.

A 2020 documentary film I advised as a researcher, “People You May Know,” raised questions about Cambridge Analytica’s work with an app marketed to American churches, called Gloo, that used Cambridge Analytica’s Facebook data-derived psychographic profiling in their communities. Evidence in the New Mexico case reinvigorates these questions about the full extent of the Cambridge Analytica scandal.

The judge in the case ruled Facebook knew that its own processes for investigating whether apps misused personal data were inadequate and that it could not enforce deletion of the data. The judge also concluded the company failed to notify users about thousands of applications associated with data misuse. Meta said it would appeal the decision.

Meta responded to a request for comment with the company’s official statement about the New Mexico ruling, arguing the case “seeks to impose a tax on speech to enforce new rules for what people can say online.” Meta did not address the issue of its own role in the data privacy violations committed by Cambridge Analytica.

Escaping further scrutiny

Meta is also trying to close the door on further claims before they are litigated.

In August 2026, on the eve of a child-safety trial in federal court in Oakland, California, Meta settled with a bipartisan coalition of state attorneys general for roughly $17 billion. The agreement includes 47 states, the District of Columbia and two U.S. territories. Folded into that deal was an allocation of $459.3 million to settle Cambridge Analytica-related claims held by participating states.

The participating attorneys general agreed, to the extent of their authority, to “fully, finally, and forever” release Meta from “any and all Claims, whether known or unknown, whether accrued or unaccrued.” By expressly encompassing “unknown” and “unaccrued” claims, the agreement reached beyond what investigators had already uncovered. Participating states accepted payment to give up claims arising from Meta’s conduct even if they did not yet know those claims existed.

From the 2019 Federal Trade Commission order to the 2022 class action settlement to August 2026’s multistate deal, settlements and releases have meant the company paid a relatively small price for its deception while not having the harms from the data exploitation adjudicated. Ultimately, the biggest privacy judgment in American history stands as a measure of the cover-up, not the alleged crime.

Other scholars and I regularly call attention to the lack of comprehensive U.S. privacy legislation, but there remain other legal pathways to pursue the harms Cambridge Analytica wrought. States like New Mexico can continue the fight, and Attorney General Raúl Torrez, who brought the case, promised, “We’re just getting started.”

Dissenting from the FTC’s 2019 settlement, then-Commissioner Rohit Chopra criticized the failure to consider “Facebook’s unjust enrichment.” He said “the company’s potential exposure is likely far greater” than the $5 billion imposed by the FTC settlement.

What price for the harm?

The question remains what exactly Facebook gained from enabling Cambridge Analytica’s abuses. Authorities could also investigate harmful data use for any other apps Facebook may have failed to fully assess, including any associated with Cambridge Analytica’s projects.

If the deception about Cambridge Analytica is worth $25 billion, I believe the public is entitled to know what the underlying harms to them are worth. New Mexico opted out of the 2026 multistate settlement and proved that a state willing to go to trial against Meta can win.

The next task, in my view, is to investigate fully and, where legal claims remain available, pursue accountability for harms resulting from the data exploitation. Otherwise, Cambridge Analytica will remain at the heart of the most consequential privacy scandal in American history, whose full harms have not been tested in court.

Emma L. Briant does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.

By Emma L. Briant, Visiting Associate Professor at the Lucy Family Institute for Data and Society, University of Notre Dame. This article is republished from The Conversation under a Creative Commons license. Read the original article.