Newsletter Subscribe
Enter your email address below and subscribe to our newsletter
Every time I write about Meta, somebody writes back and asks a fair question.
“Is it really that bad, or do you just not like them?”
A little of both. But I don’t expect you to take my word for it. So I’ve put Meta’s privacy track record in one place, with the fines, the scandals, and the lawsuits, and where each one came from.
Meta, if you’re new to the name, is Mark Zuckerberg’s company. It owns Facebook, Instagram, WhatsApp, and Messenger.
It also just launched an AI assistant called Muse that wants access to your email, your text messages, your calendar, and your health records. That’s why this list matters right now. When a company asks for the keys to your house, you’re allowed to check its references.
Here they are.
2018: Cambridge Analytica
This is the one most people remember, and it’s worth remembering how it worked.
A researcher built a personality quiz app on Facebook. About 270,000 people took it. But Facebook’s rules at the time let the quiz grab information about the friends of everyone who took it, too.
That’s how the data of as many as 87 million people ended up with Cambridge Analytica, a political consulting firm that used it to target voters with ads.
Most of those 87 million people never took the quiz. Their friends did.
Hold onto that detail. It comes back at the end.
Meta later paid $725 million to settle a class-action lawsuit over it. The lawyers who brought the case called it the largest amount ever recovered in a data privacy class action.
2019: A $5 billion fine from the federal government
The Federal Trade Commission (the government agency that protects consumers) fined Facebook $5 billion for misleading people about how much control they had over their personal information.
One example from the case: Facebook asked people for their phone numbers to help keep their accounts secure. Then it used those numbers to target them with ads.
Five billion dollars. The FTC said it was the largest penalty ever imposed on any company for violating consumers’ privacy, and almost 20 times bigger than the previous record anywhere in the world.
2022: Your hospital visit, sent to Facebook
An investigation by The Markup, a nonprofit newsroom, found Meta’s tracking code on the websites of 33 of Newsweek’s top 100 hospitals in America.
It was also inside the password-protected patient portals of seven health systems.
That code sent Facebook details like the names of a patient’s medications, and the medical condition someone was booking an appointment for. One example the reporters found: “Alzheimer’s.”
Meta’s response was that it has a filter that’s supposed to strip that kind of information out.
A filter. For your medical information.
2023: A record fine in Europe
Ireland’s data protection regulator, which oversees Meta for the European Union, fined the company €1.2 billion (about $1.3 billion) for sending Europeans’ personal data to the US without proper protection.
It was the largest fine ever issued under Europe’s privacy law. Meta called it “unjustified and unnecessary” and appealed.
2024: $1.4 billion to Texas, over your face
For years, Facebook ran facial recognition on the photos people uploaded, so it could suggest who to tag. Texas sued, saying Facebook was collecting people’s facial data without permission.
Meta agreed to pay Texas $1.4 billion, spread over five years. The state called it the largest settlement it had ever won against a company. Meta didn’t admit to wrongdoing.
2025: Period-tracking data
A jury in San Francisco found Meta liable for collecting women’s period-tracking data from a health app called Flo.
Meta said it would appeal. Of course it did.
2026: $17 billion over kids
This past August, Meta agreed to pay about $17 billion to settle a lawsuit brought by 47 states. The states accused the company of designing Facebook and Instagram to hook children, and of collecting data on kids under 13 without their parents’ permission.
The payments are spread out over several years.
Still waiting their turn
That settlement only covers the states’ claims. More than a thousand school districts have sued Meta and other social media companies, and lawsuits from individual families are still working their way through the courts.
Which brings us to Muse
Muse launched this September. It isn’t just a chatbot that answers questions. It logs into your accounts and does things for you.
It can connect to your Gmail, your Google Calendar, your text messages (on Android phones), and your Apple Health data (on iPhones). A partner service can even hand it your actual medical records. You choose which connections to allow.
Meta says Muse won’t share your conversations with its advertising systems. Here’s what else Meta’s own pages say:
- Meta can still get in. Muse runs on Meta’s computers, not your phone. Meta’s security write-up says staff access to your data is restricted “through operational policies,” and that this “does not prevent Meta from accessing data when necessary.” In other words, the thing keeping Meta out is a rule, not a lock. Meta says a real lock is coming later.
- Your chats train Meta’s AI by default. That setting is on the first time you use Muse. You can turn it off, if you go looking.
- Deleting doesn’t mean forgetting. Meta’s privacy policy says that after you delete something, Muse “may still ‘remember’ information it learned from what you deleted.”
And when Reuters reported on Meta employees testing Muse during launch week, the Meta vice president in charge said the product had “hit the minimum bar we needed to.”
The minimum bar. For the thing that wants your medical records.
And then it got worse
In October 2026, researchers found that Muse doesn’t stop at its own users.
A research group in Switzerland got a copy of the instructions Meta gives Muse behind the scenes. A separate security researcher found the same kind of instructions by asking the app the right questions, and shared them with Wired.
Those instructions tell Muse to keep a running file (Meta calls it a “page”) on every person in the user’s life, updated every hour. That includes people who never signed up for Muse.
According to Meta’s own template, a file can hold where you live, what you do for a living, your birthday, your anniversary, and when you last talked and what about. It can even track things the user promised you in their messages.
So if your friend has connected Muse to her texts or her email, and you message her, you can end up with a file on Meta’s computers. You never signed up. You never agreed to anything.
To be fair, the researchers found the instructions, not a finished file on a real person. The account they studied was brand new. But Meta wrote those instructions, and when TIME magazine asked, Meta didn’t dispute the findings.
Remember Cambridge Analytica? Most of those 87 million people never took the quiz. Their friends did.
Eight years and billions of dollars later, it’s the same idea. Only this time, it’s not a loophole. It’s the product.
What you can do
If you use Muse, get rid of it. Deleting the app may not be enough, because your information lives on Meta’s computers. Meta’s help page says to open Muse, go to Settings, then Data Controls, and tap Reset Muse. It can’t be undone, which is the point. If you’re not ready for that, at least disconnect it from your texts and email.
Tell the people you care about. If friends or family use Muse, let them know you’d rather not text or email about anything personal while it’s connected. For the important stuff, pick up the phone.
Tell your lawmakers. The US still doesn’t have a national privacy law that would stop this. Call or write your senators and your representative, tell them you want one, and mention Muse by name.
One last thing
I’m not anti-AI. I use AI helpers every day, and someday an assistant that reads your calendar and books your appointments could be a real help for a lot of us.
But who builds it matters. And when a company’s track record looks like this one, I’d rather not hand it the keys.
