Meta respects your privacy enough to award them a $25 billion fine

AdTech has a favorite adjective. Privacy-safe.

It shows up in decks, on trust pages, and in the third paragraph of every vendor email that opens with "just circling back."

Last week a New Mexico court put a price on what happens when that adjective doesn't hold up. Twenty-five billion dollars.

What actually happened

On October 21, Judge Francis Mathew ordered Meta to pay New Mexico $25 billion. That followed a September jury verdict finding more than 43 million violations of the state's consumer protection laws, tied to how Facebook described users' control over their personal data.

For scale, the FTC's $5 billion fine against Facebook in 2019 was considered the big one. This is five of those.

Meta says it will appeal, so the final number may shrink. Even a fraction of $25 billion sends a message to every company making privacy promises.

And the pattern didn't stop there. In 2025 the EU fined Meta €200 million for making Facebook and Instagram users either pay for privacy or hand over their data.

Nobody got hacked

This is the part worth sitting with.

The case wasn't about a hack. No hoodie, no green text scrolling on a black screen. It was about promises. Facebook told users their privacy settings controlled their data. Back then, a friend's quiz app could pull that data anyway, and it ended up with Cambridge Analytica.

The judge put it plainly. "Facebook promised users that they controlled their data. This was false."

Translation for anyone running paid media. The copy on the trust page is now evidence. Every "we never share" and "fully anonymized" is a representation. Representations get audited. Sometimes by procurement. Sometimes by a jury.

AdTech and media networks are still getting fat on cookies

AdTech has been announcing the death of the cookie since 2018.

GDPR put third-party tracking on notice across Europe. Consent or consequences. In 2020, Google promised to kill the cookie in Chrome by 2022. Then 2023. Then 2024. Then never.

In 2025, Google kept the cookie after all and shut down Privacy Sandbox, the thing that was supposed to replace it.

Meanwhile the industry spent the better part of a decade selling "cookieless" everything. Cookieless in the pitch deck. Cookies in the plumbing.

Here's what the "cookie is dead" crowd missed. Chrome keeping the cookie was a browser decision. Not a legal pass.

Five months after Google kept cookies in Chrome, France fined Shein €150 million for placing ad cookies without valid consent. Shein isn't AdTech. Shein is an advertiser. Same month, same regulator, Google got fined €325 million over cookies. Its third cookie fine in five years.

$25 billion. €325 million. €150 million. And it keeps happening, because the model pays for it.

The browser still lets the cookie in. The law doesn't care. Any advertiser running cookie tracking without valid consent is carrying that risk. Most just don't know whose name will end up on the fine.

Privacy-safe is a vibe, not a protection

I've spent 15+ years on the buyer side of paid media. I've watched "privacy-safe" carry an absurd amount of weight in security reviews.

It works great right up until legal asks the five questions that actually matter.

1. What data was processed
2. Where did it go
3. Who controlled it
4. Was it deleted
5. Can anyone prove it

"Privacy-safe" answers none of them. It's a mood. A mood is not a data flow diagram.

A lot of AdTech can't answer cleanly, because the business model is the problem. Pool data across advertisers. Build an identity graph. Sell access to the graph. Hard to show a deletion trail when the product is the thing that never gets deleted.

All that surveillance and still no humans

Here's what gets me.

These platforms track everything. Every click, every scroll, every device, every household.

After all that surveillance, they should be able to put one relevant ad in front of one real person. Instead the internet keeps getting louder. More noise. Less relevance. Less human.

That's not an accident. Behavioral targeting chases signals. Visits, scrolls, clicks, time on page. And bots are very good at signals.

Fake intent attracts more bots. More bots inflate the audience. The inflated audience gets sold back to advertisers as "high intent."

That's not a targeting problem. That's a click fraud market. Surveillance feeds the waste machine, and the waste machine feeds the surveillance.

Up to 22% of paid clicks are invalid. Up to 43% of ad spend is wasted. And every one of those clicks comes with the same receipt. None.

Don't gamble compliance on a data broker in disguise

Here's one of the most important data privacy compliance checks you could do right now. One email with one simple request protects your campaigns, your company, your revenue, and probably your job.

Under HIPAA, any vendor handling patient data is supposed to return or destroy it when the contract ends. Under GDPR, the same goes for any processor, and fines can reach 4% of global revenue. Under California law, deletion requests have to be passed on to vendors. The law doesn't ask whether the vendor promised. It asks for proof.

Pick an AdTech partner. Send them one sentence.

"Send us the deletion trail for every customer contact we've uploaded."

Not the privacy policy. Not the DPA. Not the "we take privacy seriously" email. The trail. What was processed. Where it went. Who touched it. When it was deleted. And the proof.

Then start a timer.

Watch it get routed to legal. Watch a call get scheduled. Watch the word "suppressed" show up.

Suppressed isn't deleted. It's a do-not-call list for data they still have.

A system built to connect everything and forget nothing can't prove it forgot anything.

If any AdTech vendor can produce a deletion trail an auditor would sign off on, I'll publicly stand corrected.

How we built HumanClicks instead

Paid media is the only financial transaction that doesn't come with a receipt. Privacy has the exact same problem. Everyone claims compliance. Nobody hands over the receipt.

So we built HumanClicks as a processor. Not a data broker in a nicer jacket.

The boundary is simple.

• The advertiser owns the data. Full stop.
• Hashed email only. No raw personal data lying around waiting to become a headline.
• Ad network accounts stay under the advertiser's control. HumanClicks doesn't take the keys.
• No cross-advertiser identity graph. One brand's data never enriches another brand's targeting.
• Processing and deletion evidence. A record of what was handled, and proof of when it was gone.
• Verified click and outcome records. Every click gets a Verified HumanClick Receipt tied to what it actually produced.

The pitch was never "trust us." It's "here's the paper trail."

What this means for regulated advertisers

Healthcare. Financial services. Insurance. Anyone whose legal team has strong opinions and a long memory.

Legal review is already where good campaigns go to die quietly. After a $25 billion ruling over privacy statements, expect those reviews to get longer and stricter.

The teams that win the next budget cycle won't be the ones whose vendors make the best privacy claims. They'll be the ones who can hand legal one document that answers all five questions before anyone asks.

• The data flow
• The processor boundary
• The retention controls
• The deletion trail

That's not paperwork. That's permission to finally use the customer data they already own.

Promises got a price tag. Proof is the only answer

Bots Click. People Buy. And juries, apparently, take privacy promises literally.

The next phase of paid media belongs to whoever shows up with receipts. For clicks, for outcomes, and for every byte of data in between.

Only HumanClicks Count.

Start with proof. Get a comprehensive Paid Media Waste Audit and Recovery Plan at audit.humanclicks.ai

Sources. Al Jazeera · AP via Dakota News Now · AP via WAFB · CNIL · Stape, Chrome cookie timeline · EU pay or consent fine