A New Mexico judge ordered Meta Platforms to pay $25 billion (₱1.576 trillion) on Oct. 21 after a jury found the company misled Facebook users about how their personal data was handled, raising questions about whether similar legal action could be pursued in the Philippines, where more than a million users were potentially affected by the Cambridge Analytica scandal.
The case arose from Cambridge Analytica’s collection of personal information from as many as 87 million Facebook users worldwide without their consent. The British political consulting firm used the data for political profiling and targeted advertising.
In New Mexico, a jury ruled on Sept. 25 that Meta committed nearly 43.9 million violations of the state’s Unfair Practices Act, including misleading consumers about third-party access to their personal information and the company’s handling of harmful online content.
Judge Francis Mathew initially calculated the maximum statutory penalty at about $219.5 billion before reducing it to $25 billion, with 15 percent annual interest until the amount is paid. Meta said it would appeal the decision, arguing that the penalty was excessive and could affect online speech.
The Philippines was initially identified by the National Privacy Commission as the second most affected country in the Cambridge Analytica breach. In April 2018, the agency said 558 Filipino users had installed a personality quiz application that potentially exposed the information of another 1,175,312 users through their Facebook connections.
The NPC opened an investigation into Facebook that same month over possible violations of the Data Privacy Act of 2012. Social media analytics firm NapoleonCat estimated Facebook’s advertising audience in the Philippines at 104.2 million accounts in September 2026, equivalent to 85.8% of the country’s population.
Under Philippine law, authorities could take similar action against Meta if sufficient evidence shows violations of data privacy rules and the legal requirements for filing a case are satisfied.
Republic Act No. 10173, or the Data Privacy Act of 2012, gives the NPC authority to investigate complaints, enforce data protection rules and recommend criminal prosecution. The law also covers certain activities conducted outside the Philippines involving the personal information of Filipino citizens or residents.
Unauthorized processing of personal information may carry one to three years in prison and fines ranging from ₱500,000 to ₱2 million, with heavier penalties for violations involving sensitive personal information.
The NPC’s administrative fine rules, introduced in 2022, also allow monetary penalties for privacy violations, with a maximum fine of ₱5 million for a single act of data processing.
Meta is also facing additional regulatory scrutiny in the Philippines after the NPC issued Show Cause Orders against the company, as well as Roblox, Reddit and Discord, on Sept. 22, 2026, over alleged failures to comply with registration requirements under the Data Privacy Act and NPC Circular 2022-04.
The agency has stepped up its oversight of digital platforms that process Filipinos’ personal information, particularly services used by children and young people. Companies that fail to meet applicable requirements could face administrative sanctions.
