The proceedings, initiated in 2021 by New Mexico’s then Attorney General, arose from the Cambridge Analytica scandal. The scandal involved the collection of data relating to 87 million Facebook users through a third-party application without their consent. The data was subsequently used for political consulting, including work connected with the 2016 US presidential election. The dispute centred on the gap between Facebook’s public representations and its actual data practices. The State alleged that Facebook, now Meta, repeatedly represented that users controlled their data and that third parties could not access it without permission, when those representations did not reflect its practices.

In September 2026, a jury found that 26 of the 29 statements under review constituted willful violations of New Mexico’s Unfair Practices Act and determined that Facebook had committed 43,899,725 violations. The statements in question spanned more than 11 years, from May 2010 to August 2021. Following the jury’s findings on liability, willfulness and the number of violations, the judge determined the civil penalty, ordering Meta to pay USD 25 billion on 21 October 2026. Meta disputed the findings, argued that the State had failed to establish harm, and announced its intention to appeal.

The case raises an important question for Vietnam: to what extent does the existing legal framework address misleading privacy representations and the use of personal data beyond the scope of the data subject’s consent?

Potentially Applicable Laws

A comparable case in Vietnam could engage four areas of law.

First, personal data protection legislation. Law No. 91/2025/QH15 on Personal Data Protection, effective from 01 January 2026, and its implementing Decree No. 356/2025/ND-CP require personal data to be collected and used within the disclosed scope and purposes. Consent must be voluntary and informed. Article 29 also imposes specific transparency obligations on social media platforms. The Law also applies to foreign organizations involved in processing Vietnamese citizens’ personal data. Accordingly, foreign platforms may fall within the scope of the Law even if they do not have a legal entity established in Vietnam.

Second, the administrative penalties regime. Decree No. 330/2026/ND-CP, effective from 19 August 2026, is the first instrument to establish a dedicated administrative sanctions framework for personal data protection violations. It expressly covers foreign organizations involved in processing Vietnamese citizens’ personal data.

Third, consumer protection legislation. Law No. 19/2023/QH15 on Protection of Consumers’ Rights prohibits deceiving or misleading consumers through false information. Decree No. 98/2020/ND-CP, as amended by Decree No. 24/2025/ND-CP, prescribes penalties for breaches of obligations concerning information provided to consumers.

Where conduct falls within both the consumer protection and personal data protection regimes, Decree No. 330 requires the competent authority to determine the nature of the violation and select the applicable instrument accordingly. The application of consumer protection legislation would depend on whether the users and services concerned fall within its statutory scope.

Fourth, criminal and civil liability. Individuals involved may incur criminal liability under Article 288 of the Criminal Code, provided that all constituent elements of the offence are established. Commercial legal entities, however, are not subject to criminal liability for this offence, as it is not among the offences listed in Article 76 of the Criminal Code. Separately, the Law on Personal Data Protection requires persons causing damage to pay compensation.

Applicable Penalties

The applicable penalty depends on how the conduct is legally characterized. For conduct resembling the central data-related allegations in the New Mexico case, potentially relevant provisions include those governing consent, transparency and the collection of personal data.

Article 8 of the 2025 Law on Personal Data Protection establishes three statutory ceilings: VND 3 billion for other personal data protection violations; 10 times the proceeds derived from unlawful personal data trading; and 5% of the preceding year’s revenue for violations of cross-border personal data transfer requirements. These ceilings apply to organizations. The corresponding ceilings for individuals are half those amounts.

Under Article 43 of Decree No. 330/2026/ND-CP, processing personal data without the required consent, unless otherwise permitted by law, and specified breaches of consent requirements, including misleading consent interfaces, may attract a fine of VND 30–50 million. Under Article 65, a social media platform’s failure to clearly disclose the personal data it collects or to publish a clear and transparent privacy policy may attract a fine of VND 50 – 70 million. Article 48 prescribes fines of VND 100 – 800 million for using technology to collect personal data unlawfully. The highest bracket, VND 500 – 800 million, applies where the conduct involves basic personal data relating to at least 5,000 individuals or sensitive personal data relating to at least 1,000 individuals. Under Article 48, the number of affected data subjects determines the applicable fine bracket rather than serving as a multiplier for a fixed fine.

Separate penalty provisions apply to unlawful personal data trading and specified breaches of cross-border personal data transfer requirements.

Under Article 53, unlawful personal data trading attracts a fine of between two and 10 times the proceeds derived from the violation. Proceeds of VND 10 billion could therefore result in a fine of VND 20 – 100 billion. For this purpose, the proceeds are determined based on the recorded value of the personal data trading transaction. Advertising revenue is not automatically included, although it may separately be subject to disgorgement as an unlawful benefit.

Article 56(3) provides for fines ranging from 1% to 5% of an organization’s total revenue generated in the Vietnamese market during the preceding financial year for the specific cross-border personal data transfer violations set out in that clause. These include transfers without the required impact assessment documentation, or involving concealment or misreporting of data flows, resulting in data leakage or loss affecting at least 10,000 Vietnamese citizens. The provision also addresses continued transfers in breach of an order to stop transfers, with the highest bracket covering such conduct where it harms national defence or national security. The applicable percentage depends on the circumstances specified in the relevant subparagraph. For example, where the conditions under Article 56(3)(c) are met, including data leakage or loss affecting at least one million Vietnamese citizens, and the relevant revenue is VND 1 trillion, the applicable fine would range from VND 30 billion to VND 50 billion.

The fine is calculated based on revenue generated in the Vietnamese market during the preceding financial year, rather than the organization’s global revenue. Where the organization generated no such revenue, or the percentage-based fine falls below VND 3 billion, the fixed monetary fine brackets under Article 56(4) apply instead, with the applicable bracket depending on the circumstances specified in that clause. Depending on the violation, additional sanctions and remedial measures may include suspension of licences or operations, mandatory deletion of data, disgorgement of unlawful benefits, correction of false information and a public apology. Affected data subjects may also be entitled to compensation for any damage suffered, subject to the applicable legal requirements.

To What Extent Does Vietnamese Law Address Such Conduct?

As regards the conduct, existing provisions address the core issues raised in the New Mexico case: public representations that do not reflect actual data processing practices, third-party access without valid consent where consent is legally required, and insufficient transparency. Depending on the violation, competent authorities may impose remedial measures, including requiring the correction of misleading information, deletion of data and disgorgement of unlawful gains.

As regards penalties, breaches of requirements concerning information, consent and transparency in data processing may fall within fine brackets ranging from tens or hundreds of thousands to even billions of Vietnamese dong, depending on the specific conduct. The Law on Personal Data Protection sets a maximum fine of VND 3 billion for organizations committing other personal data protection violations. It also provides for fines calculated by reference to proceeds from personal data trading or revenue for breaches of cross-border data transfer requirements in specified statutory circumstances. The New Mexico penalty was determined by reference to the number of violations found by the jury, a structure that differs from the approach to calculating fines under Vietnamese law. Direct comparisons between the two amounts therefore serve as a reference only. Any assessment of the penalty applicable in Vietnam requires consideration of the conduct, the relevant legal provisions and the circumstances of the individual case.

As regards enforcement, the applicable limitation period must be assessed by distinguishing between completed and continuing violations. Administrative fines are paid into the State budget, while compensation is determined under the relevant legal grounds and procedures. For foreign organizations with no presence in Vietnam, evidence gathering and enforcement of decisions must be considered in light of the particular conditions and circumstances.

From a compliance perspective, the case highlights the importance of ensuring that public statements about privacy accurately reflect actual data processing practices. Overall, the existing legal framework provides a legal basis for addressing the core types of conduct identified in the case. The applicable sanctions and enforcement procedures would depend on the legal characterization of the conduct and the circumstances of each case.