Meta has been awarded $168 million after a Californian jury ruled that Israeli spyware firm NSO unlawfully planted a bug in WhatsApp to spy on users in 2019. The verdict represents one of the largest judgments ever awarded in a cybersecurity case.
The US’s biggest social-networking firm won its case in December following a ruling that the spyware company used its tool, Pegasus, to target “over a thousand” WhatsApp users. The sophisticated surveillance technology has been a subject of international controversy for several years.
However, on Tuesday (06.05.25), a jury in California agreed that NSO needed to hand over $444,719 in compensatory damages, as well as $167.3m in punitive damages to Meta. The verdict comes after years of legal battles between the tech giant and the surveillance company.
“Today’s ruling shows spyware companies that their illegal actions against American technologies will not be tolerated,” Meta – which is seeking to secure a court order to stop NSO “from ever targeting WhatsApp again” – said the jury’s decision is a “critical deterrent to this malicious industry against their illegal acts aimed at American companies and our users worldwide”. Legal experts view this case as potentially precedent-setting for future litigation involving surveillance technology.
The trial also pointed out that WhatsApp “was far from NSO’s only target” – as Pegasus has had “many other spyware installation methods to exploit other companies’ technologies to manipulate people’s devices into downloading malicious code and compromising their phones”. The spyware has reportedly been used against journalists, human rights activists, and political figures worldwide.
NSO was “forced to admit” that it splashes out “tens of millions of dollars annually” to “develop malware installation methods” on messaging services, browsers and operating systems – with Apple iOS- and Google Android-powered devices being capable of being compromised “to this day”. This revelation has raised significant concerns about mobile device security across major platforms.
In a statement published on its website, Meta said: “Given how much information people access on their devices, including through private end-to-end encrypted apps like WhatsApp, Signal and others, we will continue going after spyware vendors indiscriminately targeting people around the world. The company has positioned itself as a defender of user privacy in the wake of this legal victory.
“These malicious technologies are a threat to the entire ecosystem and it’ll take all of us to defend against it. Industry analysts suggest that collaboration between tech companies will be crucial in addressing sophisticated surveillance threats.
“Today’s ruling shows spyware companies that their illegal actions against American technologies will not be tolerated. The verdict sends a strong message about accountability in the surveillance technology industry.
“In this specific case, we know we have a long road ahead to collect awarded damages from NSO and we plan to do so. Legal experts note that collecting such damages from international companies can present significant challenges.
“Ultimately, we would like to make a donation to digital rights organizations that are working to defend people against such attacks around the world. Our next step is to secure a court order to prevent NSO from ever targeting WhatsApp again. This approach reflects Meta‘s broader strategy of supporting digital rights advocacy.
“As always, we encourage security researchers to report security bugs through our Bug Bounty program so we can work together to quickly resolve them and protect our users.” The Bug Bounty program has been a key component of Meta’s security strategy across its platforms.
The case highlights growing tensions between technology companies and surveillance software developers, with implications for user privacy globally. Digital rights advocates have welcomed the verdict as an important step toward accountability in the surveillance industry.
NSO Group has consistently maintained that its technology is only sold to government agencies for legitimate law enforcement and anti-terrorism purposes. However, investigations by various organizations have documented instances where the technology was allegedly misused against civilians.
The legal battle between Meta and NSO Group began in 2019 when WhatsApp discovered that NSO had exploited a vulnerability in its voice calling feature to install surveillance software. This discovery prompted a rapid security update and the subsequent lawsuit filed by WhatsApp’s parent company.
Privacy advocates hope that this landmark judgment will discourage other surveillance companies from developing similar technologies that could compromise user security across popular messaging platforms and mobile devices.
