Last Wednesday, a New Mexico judge ordered Meta to pay $25 billion in penalties in the state’s data privacy case arising from the Cambridge Analytica scandal. In September, a Santa Fe jury had found that 26 of the 29 public statements it reviewed, made by the company and its leadership about user data, third-party access, and harmful content, were misleading. The jury counted more than 43 million violations of the state’s Unfair Practices Act. The state was awarded $219.5 billion before the judge reduced the penalty to $25 billion. Meta says it is confident it will prevail on appeal.
The line I keep returning to is from Judge Francis Mathew’s filing: “Facebook did not conduct the comprehensive investigation that it promised.” He described the internal examination as “willfully ineffective,” citing “pressure from senior executives to keep costs down, lack of adequate enforcement resources, inadequate investigative techniques, and a desire not to create precedent for future investigations.”
The lesson for every leadership team is simple. The promise was made in public. The capability to keep it was not adequately resourced. And a court measured the distance between the two.
Every trust claim is now a potential exhibit
Among the statements the jury found false was one Mark Zuckerberg published in The Washington Post in 2010: “You have control over how your information is shared.” Sixteen years later, that sentence became evidence.
Most companies have dozens of sentences like it. “We take your privacy seriously.” “Our AI is tested for safety.” “We investigate every report.” They live in press releases, earnings calls, and CEO interviews. Each one can be read back, years later, by someone asking a single question: what did you actually do?
In Built for Trust, I call this the difference between Trust Theater and Trust Capability. Trust Theater is the claim without the system behind it: the reassuring statement, the announced review, the policy no one resources. Trust Capability is the claim that is engineered, measured, and owned, so that the proof exists before anyone asks for it.
Most organizations sit somewhere between those two poles. The Trust Maturity Model describes the path: Trust Theater, Awareness, Coordination, Integration, and Capability. Companies at the early levels know trust matters and talk about it often. Companies at the later levels can show you, claim by claim, the evidence that what they say matches what they do.
A short checklist for the board
Boards do not need to write trust statements, but they should know which ones the company is making and whether they would hold up. Three questions are a good start:
What trust claims do we make? Inventory the public promises about data, safety, AI, security, and fairness across every channel, including what executives say in interviews.
What proves each one? For every claim, name the control, the test, the resources, or the record that makes it true today. If the answer is “we intend to,” the claim is ahead of the capability.
Who signs off? Every claim needs an owner who is accountable for both the wording and the proof, and who reviews it on a schedule, not only when a crisis forces the question.
A claim that cannot pass those three questions should either be backed with real capability or be withdrawn. Promising less and proving more is not timidity. It is risk management.
The New Mexico ruling will be appealed, and its final number may change. The principle will not. Trust is not what you say. It is what you can show.
Where does your organization stand? Take the free Trust Maturity Diagnostic™ to see which level of the Trust Maturity Model describes you today.
Built for Trust arrives July 27, 2027. Pre-order your copy.
