Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Meta and WhatsApp won a major legal victory over NSO Group, but “$168 million judgment” is no longer the precise description. A federal jury awarded the plaintiffs $167,698,719 on May 6, 2025. After the court reduced the punitive damages and Meta accepted the reduction, the operative judgment entered on November 12, 2025 was $4,447,190, plus post-judgment interest. The court also permanently barred NSO and related parties from interacting with or emulating WhatsApp without Meta’s written permission.
What the jury awarded—and what NSO ultimately owes
The case was decided in two stages. On December 20, 2024, the Northern District of California granted summary judgment for WhatsApp LLC and Meta Platforms, Inc. on liability against NSO Group Technologies Limited and Q Cyber Technologies Limited. The May 2025 trial therefore concerned damages, not whether NSO was liable.
As an Amazon Associate I earn from qualifying purchases.
The jury’s May 6, 2025 award was overwhelmingly punitive:
| Component | Jury award | Final judgment |
|---|---|---|
| Compensatory damages | $444,719 | $444,719 |
| Punitive damages | $167,254,000 | $4,002,471 |
| Total | $167,698,719 | $4,447,190 |
The court remitted, or reduced, the punitive award on October 17, 2025. Meta accepted that remittitur on October 31, and the court entered final judgment on November 12. The final order also provides for interest under 28 U.S.C. § 1961. The public record establishes the judgment, but not whether Meta has collected it in full.
#1 Best Overall
The final-judgment record is available from the U.S. court record. Calling the original figure a final $168 million judgment would therefore be misleading.
What NSO was accused of doing
NSO Group develops and licenses Pegasus, commercial spyware designed to give government customers covert access to targeted mobile devices and their data. Meta alleged that NSO reverse-engineered WhatsApp code and used WhatsApp servers and related installation vectors to deliver malicious traffic that enabled Pegasus to be placed on targeted devices.
Meta said the 2019 campaign involved about 1,400 WhatsApp users or devices, including journalists, human-rights activists, diplomats, government officials and other civil-society figures. That number describes the population identified in Meta’s account and related case reporting; it should not be read as proof that every person was successfully infected.
Meta’s description of the campaign appears in its May 2025 announcement, while the court materials describe the alleged reverse engineering and use of WhatsApp infrastructure.
NSO, Pegasus and government customers are different actors
- NSO Group: the commercial developer and licensor.
- Pegasus: the spyware product.
- Government customers: entities that select targets and operate the tool under their own authority.
- WhatsApp: the platform whose infrastructure Meta said was abused.
This lawsuit addressed NSO’s conduct involving WhatsApp. It did not decide the legality of every Pegasus deployment worldwide or adjudicate every government customer’s actions.
Why this was not a case about “breaking WhatsApp encryption”
The allegations focused on abuse of WhatsApp servers and client software to facilitate installation. That is different from proving that Pegasus defeated WhatsApp’s end-to-end encryption protocol by decrypting messages in transit.
Rank #3
Spyware can read information at the endpoint: before a message is encrypted on a sender’s device or after it is decrypted on a recipient’s device. Endpoint compromise can therefore expose chats and other data without demonstrating that the underlying cryptographic design was cracked.
How the case reached the damages verdict
- 2019: WhatsApp and Meta sued NSO over the alleged use of WhatsApp infrastructure to deploy Pegasus.
- December 20, 2024: the court granted summary judgment for Meta and WhatsApp on liability.
- May 6, 2025: a jury awarded $167,698,719 in damages in a trial limited to the amount of loss and punishment.
- October 17, 2025: the court reduced the punitive component to $4,002,471 and issued the permanent injunction.
- October 31, 2025: Meta accepted the reduced punitive award.
- November 12, 2025: the court entered the $4,447,190 final judgment and incorporated the injunction.
What the permanent injunction does
The injunction is tied to the WhatsApp Platform, including WhatsApp servers and client applications. It binds NSO, Q Cyber, their officers, agents, employees and people acting in concert with them; foreign sovereign customers and outside counsel are expressly treated differently under the order.
Without Meta’s express written permission, the covered parties may not develop, use, sell, offer, distribute, transfer or license technology that interacts with or emulates WhatsApp, including an installation vector. The complete terms are in the permanent-injunction order.
NSO asked the district court to stay the injunction while it appealed. On December 19, 2025, the court denied that request while extending an administrative stay for 45 days. A request for a stay is not an appellate victory, and the denial did not resolve every possible issue on appeal. The injunction remained the central operative remedy unless later modified by an appellate court; the stay order records that ruling.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the ruling means for commercial spyware
A direct platform-enforcement precedent
For technology platforms, the case shows that alleged misuse of servers, client applications and installation paths can support a civil claim against a spyware vendor. The injunction may matter more operationally than the reduced damages because it restricts NSO’s ability to interact with WhatsApp infrastructure or imitate WhatsApp functionality for deployment.
Not a universal spyware ban
The order does not outlaw Pegasus everywhere, prohibit all commercial spyware, or bind vendors that were not parties to this case. Its restrictions are broad within the WhatsApp context, but they are not a worldwide prohibition on the industry.
Best Value
Liability is separate from collectability
A court judgment establishes what is owed; it does not prove that the money has been paid. The available record does not establish Meta’s collection status or NSO’s assets, solvency or ability to satisfy the judgment.
What happened after the judgment
In June 2026, Meta alleged that NSO violated the WhatsApp injunction through new attacks. Ars Technica reported on Meta’s court filing. As of August 16, 2026, that remained an allegation and an enforcement dispute, not an established contempt finding in the materials available here.
Bottom line
Meta and WhatsApp won on liability, secured a historic but later reduced damages award, and obtained a permanent WhatsApp-specific injunction. The headline-making jury verdict was $167.7 million; the operative final judgment was $4.447 million plus interest. The decision is a significant setback for NSO, but it does not settle the broader commercial-spyware market.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
