Your team would never let a product claim go live without someone checking it. The sentence under your newsletter form that says "we never share your information" probably went live without anyone checking it at all.
That sentence is a claim too, and on October 21, 2026, a court showed how expensive an unchecked one can get. A New Mexico judge ordered Meta to pay $25 billion in civil penalties under the state's consumer protection law, after a jury found 43,899,725 violations. According to Reuters, as published by NBC News, the judge found that a penalty of more than $219 billion was warranted under state law and reduced it to $25 billion.
The case grew out of the Cambridge Analytica scandal, but the theory was not only about what happened to the data. As the BBC reported, the state's lawyers built the case on statements the company made over the years that user data was never shared with or accessed by third parties without permission, when in reality it had been. The jury also found the company misled the public about how it enforced its own content rules. Meta disputes the findings and says it will appeal, so the final number may change. The lesson for every other company does not depend on the appeal.
The words were the violation
Most companies think about privacy as a data problem: what we collect, where it goes, how long we keep it. This case is a reminder that it is also a copy problem. The public statements were what the state put in front of the jury, and the gap between those statements and actual practice was the violation.
Marketing writes a large share of the words a company says about data. Think about where those words live:
- The privacy page, and the summary someone wrote above it to make it friendlier
- The cookie banner and the preference center
- The small print under every form, download, and demo request
- The chatbot's answer when a visitor asks what happens to their details
- Email footers, event registration pages, and webinar sign ups
- The security and trust page sales sends to procurement
- Sales decks and proposal templates that promise how customer data is handled
Each of those was accurate on the day someone wrote it. Then the site gained a new analytics tag, an enrichment vendor started matching form fills to company records, an AI assistant began reading chat transcripts, and an agency added an ad pixel to the thank you page. None of those changes came with a request to update the sentence under the form.
Absolute words age the fastest
Look for the words "never," "only," "always," and "all." "We never share your data" was perhaps true before the site sent conversions to three ad platforms. "We only use your email to send the newsletter" stops being true the day that list is uploaded to build a lookalike audience.
Accurate copy is not weaker copy. "We share limited data with the advertising and analytics partners listed here, and you can opt out at any time" is a promise you can keep. A promise you can keep is the only kind that builds trust, with buyers and with anyone who later reads your words looking for a gap.
A four step check for this quarter
- Collect every promise. Ask someone outside the team that wrote them to gather every statement your brand makes about data, from every surface in the list above, into one document with the page address next to each line.
- Test each one against reality. For each statement, write down what actually happens: which tags fire on that page, which vendors receive the data, which AI tools read it, and how long it is kept. Your web team can show you what fires on the page. Your contracts show where the data goes after that.
- Rewrite the gaps. Where the promise and the practice differ, decide which one changes. Sometimes the right fix is to remove a vendor. Sometimes it is to say plainly what you do. Bring in counsel for the final wording; this is not legal advice, and the rules vary by state and country.
- Make it someone's job. Give the promise register a named owner and add one step to every launch: any new tag, vendor, AI tool, or data use triggers a check of the copy it touches.
Three questions for the leadership team
- Who in the company could list every public statement we make about customer data?
- When we add a new marketing tool, who checks whether our promises are still true?
- If a regulator read our privacy copy next to our tag list tomorrow, would they find a gap?
In New Mexico, a company's own words about data became the case against it. Your promises about data are marketing claims. Hold them to the same standard as the claims you make about the product.
