FOR PUBLICATION
`
`UNITED STATES COURT OF APPEALS
`FOR THE NINTH CIRCUIT
`
`
`
` No. 22-15077
`
`D.C. No. 5:18-cv-
`01725-EJD
`
`
`OPINION
`
`In re: FACEBOOK, INC.
`SECURITIES LITIGATION,
`______________________________
`
`
`AMALGAMATED BANK, Lead
`Plaintiff; PUBLIC EMPLOYEES’
`RETIREMENT SYSTEM OF
`MISSISSIPPI; JAMES KACOURIS,
`individually and on behalf of all others
`similarly situated,
`
`
`
` v.
`
`
`FACEBOOK, INC.; MARK
`ZUCKERBERG; SHERYL
`SANDBERG; DAVID M. WEHNER,
`
`
`
`
`
`
`
`
`
`
`Plaintiffs-Appellants,
`
`
`
`
`
` Defendants-Appellees.
`
`Appeal from the United States District Court
`for the Northern District of California
`Edward J. Davila, District Judge, Presiding
`
`Argued and Submitted February 8, 2023
`San Francisco, California
`
`
`
`
`
`
`
`
`
`UNITED STATES COURT OF APPEALS
`FOR THE NINTH CIRCUIT
`
`
`
` No. 22-15077
`
`D.C. No. 5:18-cv-
`01725-EJD
`
`
`OPINION
`
`In re: FACEBOOK, INC.
`SECURITIES LITIGATION,
`______________________________
`
`
`AMALGAMATED BANK, Lead
`Plaintiff; PUBLIC EMPLOYEES’
`RETIREMENT SYSTEM OF
`MISSISSIPPI; JAMES KACOURIS,
`individually and on behalf of all others
`similarly situated,
`
`
`
` v.
`
`
`FACEBOOK, INC.; MARK
`ZUCKERBERG; SHERYL
`SANDBERG; DAVID M. WEHNER,
`
`
`
`
`
`
`
`
`
`
`Plaintiffs-Appellants,
`
`
`
`
`
` Defendants-Appellees.
`
`Appeal from the United States District Court
`for the Northern District of California
`Edward J. Davila, District Judge, Presiding
`
`Argued and Submitted February 8, 2023
`San Francisco, California
`
`
`
`
`
`
`
`
`
`2
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`Filed October 18, 2023
`
`Before: M. Margaret McKeown, Jay S. Bybee, and Patrick
`J. Bumatay, Circuit Judges.
`
`Opinion by Judge McKeown;
`Partial Concurrence and Partial Dissent by Judge Bumatay
`
`
`
`
`SUMMARY*
`
`Securities Exchange Act of 1934
`
`
`
`
`
`The panel affirmed in part and reversed in part the
`district court’s judgment dismissing under Fed. R. Civ. P.
`12(b)(6) for failure to state a claim a Third Amended
`Complaint in which purchasers of Facebook common stock
`between February 3, 2017, and July 25, 2018, (“the
`shareholders”) allege that Facebook and its executives
`violated Sections 10(b), 20(a), and 20A of the Securities
`Exchange Act of 1934 and Rule 10b-5 of the Exchange Act’s
`implementing regulations by making materially misleading
`statements and omissions regarding (1) the risk of improper
`access to Facebook users’ data, (2) Facebook’s internal
`investigation
`into British political consulting
`firm
`Cambridge Analytica, and (3) the control Facebook users
`have over their data.
`In March 2018, news broke that Cambridge Analytica
`improperly harvested personal data from millions of
`
`* This summary constitutes no part of the opinion of the court. It has
`been prepared by court staff for the convenience of the reader.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`3
`
`unwitting Facebook users and retained copies of the data
`beyond Facebook’s control. In the months that followed, the
`public learned that Facebook had known of Cambridge
`Analytica’s misconduct for over two years and failed to
`inform affected users, and that Facebook surreptitiously
`allowed certain whitelisted third-party apps to access users’
`friend data without
`the users’
`friends’
`consent. Facebook and
`its executives made various
`statements before and after the news announcements
`assuring users that they fully controlled their data on
`Facebook and that no third party would access the data
`without their consent. In the wake of the Cambridge
`Analytica and whitelisting scandals, Facebook’s stock price
`suffered two significant drops totaling more than $200
`billion in market capitalization.
`The panel considered whether, under the heightened
`standard of the Private Securities Litigation Reform Act, the
`shareholders (1) adequately pleaded falsity as to the
`challenged risk statements, (2) adequately pleaded scienter
`as to the Cambridge Analytica investigation statements, and
`(3) adequately pleaded loss causation as to the user control
`statements.
`First, the panel held that the shareholders adequately
`pleaded falsity as to the statements warning that misuse of
`Facebook users’ data could harm Facebook’s business,
`reputation, and competitive position and the district court
`erred by dismissing
`the complaint as
`to
`those
`statements. The panel wrote that, as in In re Alphabet Sec.
`Litig., 1 F.4th 687 (9th Cir. 2021), the shareholders here
`adequately pleaded falsity as to statements in a 2016 Form
`10-K filing with the SEC in which Facebook represented the
`risk of third parties improperly accessing and using
`Facebook users’ data as purely hypothetical. The panel held
`
`
`
`4
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`that the district court correctly dismissed the challenged
`statements regarding the risk of security breaches and the
`risk of the public not perceiving Facebook’s products to be
`“useful, reliable, and trustworthy”; those statements do not
`relate to the misuse of Facebook user data by Cambridge
`Analytica, and the shareholders do not allege that those risks
`had materialized at the time of the 2016 10-K such that they
`were false or materially misleading. The panel left to the
`district court on remand whether the shareholders can satisfy
`the other elements of the claims with respect to risk
`statements.
`Second, the panel agreed with the district court that the
`shareholders failed to plead scienter as to Cambridge
`Analytica investigation statements, including ones made by
`a Facebook spokesperson to journalists in March 2017 that
`Facebook’s internal investigation into Cambridge Analytica
`had “not uncovered anything that suggest[ed] wrongdoing”
`related to Cambridge Analytica’s work on the Brexit and
`Trump campaigns. The panel wrote that the shareholders
`pleaded only that the spokesperson should have known that
`Facebook’s investigation had uncovered misconduct, not
`that the spokesperson actually knew of any misconduct or
`even that there was a strong inference of an “intent to
`deceive, manipulate, or defraud.”
`Third, as to Facebook’s user control statements:
`The panel affirmed the dismissal as to statements related
`to Facebook’s goals of
`transparency and control—
`statements that were not false when they were made. The
`panel also affirmed the dismissal of a standalone claim
`relating to the June 2018 whitelisting revelation, given that
`the revelation was unaccompanied by a stock price drop.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`5
`
`The panel held that the shareholders adequately pleaded
`loss causation as to Facebook’s statements—made before
`the March 16, 2018, stock price drop—assuring users that
`they control
`their content and
`information on
`the
`platform. The panel wrote that the shareholders adequately
`pleaded that the March 2018 revelation about Cambridge
`Analytica was the first time Facebook investors were alerted
`that Facebook users did not have complete control over their
`own data, and also adequately pleaded that Facebook did not
`make public statements about the Cambridge Analytica issue
`between 2015 and 2018.
`The panel held that the shareholders adequately pleaded
`that the Cambridge Analytica and whitelisting revelations,
`not any other factor, caused the July 2018 stock drop. The
`panel therefore reversed the district court’s dismissal of
`claims as to Facebook’s statements regarding data control
`that predated the June 3, 2018, whitelisting revelation.
`The panel remanded for further proceedings.
`Judge Bumatay concurred in part and dissented in
`part. He joined the majority in holding that the shareholders
`failed
`to sufficiently allege a falsity
`in Facebook’s
`Cambridge Analytica investigation statements. He also
`joined the majority in holding that the shareholders did
`allege a falsity and loss from the user control statements—
`but only as those statements relate to Facebook’s practice of
`“whitelisting.” He disagreed with the majority on two
`fundamental points. In his view, the shareholders failed to
`sufficiently allege that Facebook’s risk factor statements in
`its public filings were fraudulent, and didn’t show that
`Facebook’s user control statements were false based on the
`Cambridge Analytica revelations.
`
`
`
`
`
`6
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`COUNSEL
`
`Thomas C. Goldstein (argued), Kevin K. Russell, and Erica
`O. Evans, Goldstein Russell & Woofter LLC, Bethesda,
`Maryland; John C. Browne and Jeremy P. Robinson,
`Bernstein Litowitz Berger & Grossman LLP, New York,
`New York; Joseph D. Daley, Danielle S. Myers, and Darren
`J. Robbins, Robbins Geller Rudman & Dowd LLP, San
`Diego, California; Jason C. Davis, Robbins Geller Rudman
`& Dowd LLP, San Francisco, California; Kathleen Foley,
`Munger Tolles & Olson LLP, Washington, D.C.; Jeremy A.
`Lieberman, Pomerantz LLP, New York, New York; Jennifer
`Pafiti, Pomerantz LLP, Los Angeles, California; for
`Plaintiff-Appellant.
`Joshua S. Lipshutz (argued), Katherine M. Meeks, and
`Trenton J. Van Oss, Gibson Dunn & Crutcher LLP,
`Washington, D.C.; Brian M. Lutz and Michael J. Kahn,
`Gibson Dunn & Crutcher LLP, San Francisco, California;
`Orin S. Snyder, Gibson Dunn & Crutcher LLP, New York,
`New York; Paul J. Collins, Gibson Dunn & Crutcher LLP,
`Palo Alto, California; for Defendant-Appellee.
`
`
`
`
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`7
`
`OPINION
`
`
`McKEOWN, Circuit Judge:
`
`In March 2018, news broke that Cambridge Analytica, a
`British political consulting firm, improperly harvested
`personal data from millions of unwitting Facebook users and
`retained copies of the data beyond Facebook’s control. In
`the months that followed, the public learned that Facebook
`had known of Cambridge Analytica’s misconduct for over
`two years and failed to inform affected users, and that
`Facebook surreptitiously allowed certain whitelisted third-
`party apps to access users’ Facebook friend data without the
`users’ friends’ consent. Facebook and its executives made
`various statements before and after the news announcements
`assuring users that they fully controlled their data on
`Facebook and that no third party would access the data
`without their consent. In the wake of the Cambridge
`Analytica and whitelisting scandals, Facebook’s stock price
`suffered two significant drops totaling more than $200
`billion in market capitalization.1
`Appellants, collectively “the shareholders,” purchased
`shares of Facebook common stock between February 3,
`2017, and July 25, 2018. Soon after the first stock drop in
`March 2018, they filed a securities fraud action against
`Facebook and three of its executives: Mark Zuckerberg,
`Facebook’s chief executive officer, Sheryl Sandberg,
`Facebook’s then-chief operating officer, and David Wehner,
`
`
`1 In late 2021, the parent company Facebook changed its name to Meta
`Platforms, Inc. Because the events in this case occurred before 2021, we
`refer to Facebook and its former parent company, Facebook, Inc., simply
`as Facebook.
`
`
`
`8
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`Facebook’s chief financial officer. The shareholders allege
`that Facebook and the executives violated Sections 10(b),
`20(a), and 20A of the Securities Exchange Act of 1934 and
`Rule 10b-5 of the Exchange Act’s implementing regulations
`by making materially misleading statements and omissions
`regarding the risk of improper access to Facebook users’
`data, Facebook’s internal investigation into Cambridge
`Analytica, and the control Facebook users have over their
`data. Although the shareholders made multiple claims in
`their Third Amended Complaint, only these three categories
`of claims are the subject of this appeal.
`This case calls on us to consider whether, under the
`heightened standard of the Private Securities Litigation
`Reform Act (“PSLRA”), the shareholders adequately
`pleaded falsity as to the challenged risk statements,
`adequately pleaded scienter as to the Cambridge Analytica
`investigation statements, and adequately pleaded loss
`causation as to the user control statements. We affirm in part
`and reverse in part.2
`I. BACKGROUND
`The Third Amended Complaint clocked in at 285 pages.
`Although impressive in terms of magnitude, we nonetheless
`examine the allegations individually and holistically, not by
`weight or volume.3
`
`
`2 For ease of reference, we use the categories laid out in the Third
`Amended Complaint. On appeal, the shareholders challenge the district
`court’s dismissal of the statements in ¶¶ 501–05, 507–14, 519, 525, 530,
`533, and 537–38 of the Third Amended Complaint.
`3 These facts are based on the allegations in the Third Amended
`Complaint and may not reflect Facebook’s current practices.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`9
`
`Facebook, with more than 1.3 billion daily users at the
`inception of this case, is the world’s largest social media
`platform. On Facebook, users share personal content, “like”
`and comment on others’ shared content, play games
`designed by third-party app developers, and more. Facebook
`collects data from its users, including the types of content
`they access, the devices they use to access Facebook, their
`payment information, and their location. The collected data
`is used to individualize the content a user sees on Facebook.
`For example, Facebook may suggest local events to a user
`and tailor the advertisements a user sees. Additionally, a
`third-party app or website integrated onto the Facebook
`platform may access user information when the user engages
`with its services on the platform. For example, a Facebook
`user may play an online game added to the Facebook
`platform by a
`third-party developer.
` According
`to
`Facebook’s terms, the game developer could then access the
`user’s age range, location, language preference, list of
`friends, and other information the user shared with them.
`This is not the first time Facebook has found itself in
`legal hot water over its data sharing practices. In 2012,
`Facebook settled charges with
`the Federal Trade
`Commission (“FTC”) that it deceived users by representing
`that their personal data was private but allowing the data to
`be shared, including with third-party apps. Facebook
`entered a twenty-year consent decree as part of the
`settlement, agreeing not to misrepresent the extent to which
`Facebook users could control the privacy of their own data.
`In 2019, the FTC imposed a “record-breaking $5 billion
`penalty” on Facebook for violating the consent decree by
`“deceiving users about their ability to control the privacy of
`
`
`
`10
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`their personal information.”4 Facebook users have also sued
`the company alleging that Facebook is dishonest about its
`privacy practices. See, e.g., In re Facebook, Inc. Internet
`Tracking Litig., 956 F.3d 589 (9th Cir. 2020); Campbell v.
`Facebook, Inc., 951 F.3d 1106 (9th Cir. 2020).
`In 2014, Zuckerberg announced publicly that Facebook
`would no longer allow third parties to access and collect data
`from users’ friends, noting that Facebook users were
`surprised to learn that their Facebook friends could share
`their data with a third party without their consent. He
`explained that Facebook users had grown skeptical that their
`data was safe on the platform, and that Facebook was doing
`everything it could “to put people first and give people the
`tools they need” to trust that Facebook would keep their data
`safe. That same year, however, Zuckerberg and Sandberg
`created a “reciprocity” system in which certain third-party
`apps that provided “reciprocal value to Facebook” could be
`“whitelisted,” meaning that those apps were exempt from the
`ban on third-party data access and collection. The
`whitelisting practice continued until mid-2018.
`In September 2015, Facebook employees noticed that
`Cambridge Analytica was “receiving vast amounts of
`Facebook user data.” Facebook’s political team described
`Cambridge Analytica as a “sketchy” firm
`that had
`“penetrated” Facebook’s market and
`requested an
`investigation into what Cambridge Analytica was doing with
`the data. The platform policies team concluded that it was
`unlikely Cambridge Analytica could use Facebook users’
`
`4 Press Release, Fed. Trade Comm’n, FTC Imposes $5 Billion Penalty
`and Sweeping New Privacy Restrictions on Facebook (July 24, 2019),
`https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-
`imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`11
`
`data for political purposes without violating Facebook’s
`policies. In November 2015, Facebook paid Aleksandr
`Kogan, a Cambridge University academic who helped
`Cambridge Analytica obtain user data from Facebook, to
`give an internal presentation on the lessons he learned from
`collecting and working with the Facebook data.
`Trouble for Facebook began in December 2015, when
`The Guardian reported that Cambridge Analytica had
`created a database of information about American voters by
`harvesting their Facebook data.5 The harvested data
`originated from a personality quiz integrated onto Facebook
`by Kogan. When Facebook users completed the quiz, Kogan
`gained access to their data as well as data from their
`Facebook friends who had not taken the quiz, including each
`user’s name, gender, location, birthdate, “likes,” and list of
`Facebook friends. Facebook’s app review team initially
`rejected the personality quiz because it collected more user
`data than necessary to operate, but the quiz nonetheless
`became available to Facebook users. Although only about
`250,000 Facebook users took the personality quiz, Kogan
`harvested data from over thirty million users, most of whom
`did not consent to the data collection.
`Kogan used the Facebook “likes” collected from the quiz
`to train an algorithm that assigned personality scores to
`Facebook users, including users who had not taken the quiz.
`The information was saved in a database that classified
`American voters by scoring them on five personality traits:
`“openness to experience, conscientiousness, extraversion,
`
`5 See Harry Davies, Ted Cruz Using Firm that Harvested Data on
`Millions of Unwitting Facebook Users, Guardian (Dec. 11, 2015),
`https://www.theguardian.com/us-news/2015/dec/11/senator-ted-cruz-
`president-campaign-facebook-user-data.
`
`
`
`12
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`agreeableness, and neuroticism (the ‘OCEAN scale’).”
`According to The Guardian, Cambridge Analytica used the
`harvested OCEAN scale data to help Ted Cruz’s presidential
`campaign “gain an edge over Donald Trump” in the
`Republican Party primaries.
`In response to the Guardian article, a Facebook
`spokesperson stated that the company was “carefully
`investigating” the situation, that misusing user data was a
`violation of Facebook’s policies, and that the company
`would “take swift action” against third parties found to have
`misused Facebook users’ data. In a private email exchange
`in December 2015, a Facebook executive told a Cambridge
`Analytica executive that Cambridge Analytica violated
`Facebook’s policies and terms by using data that Kogan
`“improperly derived” from Facebook. Cambridge Analytica
`agreed in January 2016 to delete the personality score data
`harvested from Facebook.
`Notwithstanding Cambridge Analytica’s assurance that
`it would delete the data, Facebook continued to investigate
`the data usage. In June 2016, Facebook negotiated a
`confidential settlement with Kogan, who certified that he
`had deleted the data in his possession derived from Facebook
`“likes.” Kogan also provided Facebook with the identity of
`every entity with which he had shared raw Facebook user
`data. In doing so, Kogan revealed that he had shared
`derivative and raw data from Facebook users—not just the
`personality score data—with Cambridge Analytica’s chief
`executive, Alexander Nix, and that the data was still being
`used in violation of Facebook’s stated policies. Facebook
`asked Nix to certify that all data harvested from the
`Facebook personality quiz was deleted, but Nix refused to
`do so. In October 2016, The Washington Post reported that
`Cambridge Analytica continued to use data based on the
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`13
`
`OCEAN scale to benefit the Trump presidential campaign.6
`The article did not say explicitly that the social-media data
`came from Facebook, but the use of the OCEAN scale
`suggested that Cambridge Analytica may have been using
`the data originally harvested from Kogan’s personality quiz
`on Facebook.
`1. Facebook’s Public Filings
`Despite the ongoing developments regarding Cambridge
`Analytica, Facebook represented in its 2016 Form 10-K,
`filed with the Securities Exchange Commission (“SEC”) in
`February 2017, that third-party misuse of Facebook users’
`personal data was a purely hypothetical risk that could harm
`the company if it materialized. For example, the 10-K stated
`that “[a]ny failure to prevent or mitigate . . . improper access
`to or disclosure of our data or user data . . . could result in
`the loss or misuse of such data, which could harm
`[Facebook’s] business and reputation and diminish our
`competitive position.” The statements about the risks of
`improper access or disclosure appeared in the “Risk Factors”
`section of the 10-K, in a subsection that also discussed the
`risks of security breaches such as cyberattacks, hacking, and
`phishing that could result in Facebook user data falling into
`the wrong hands.
`2. Continued Press about Cambridge Analytica
`In March 2017, The Guardian published another article
`about Cambridge Analytica’s political activity. The article
`
`6 Michael Kranish, Trump’s Plan for a Comeback Includes Building a
`‘Psychographic’ Profile of Every Voter, Wash. Post (Oct. 27, 2016),
`https://www.washingtonpost.com/politics/trumps-plan-for-a-comeback-
`includes-building-a-psychographic-profile-of-every-
`voter/2016/10/27/9064a706-9611-11e6-9b7c-
`57290af48a49_story.html.
`
`
`
`14
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`discussed how Cambridge Analytica used data derived from
`Facebook “likes”
`to
`train algorithms and quoted a
`Cambridge Analytica spokesperson’s denial that the firm
`had access to Facebook “likes.”7 The article also quoted a
`Facebook spokesperson’s statement
`that Facebook’s
`investigation
`into Cambridge Analytica had not yet
`uncovered any misconduct related to the firm’s work on
`political matters, specifically
`the Trump presidential
`campaign or the Brexit Leave campaign. A Facebook
`spokesperson made similar comments to journalists later that
`month.8 Throughout 2017 and early 2018, Facebook and its
`executives assured Facebook users that “no one is going to
`get your data that shouldn’t have it,” that Facebook and its
`apps had “long been focused on giving people transparency
`and control,” and more.
`On March 12, 2018, The New York Times and The
`Guardian contacted Facebook for comment on joint articles
`the outlets planned to publish about Cambridge Analytica’s
`misuse of Facebook users’ data. The articles would report
`that Cambridge Analytica had not actually deleted the
`improperly collected Facebook user data from 2015. Before
`
`7 Jamie Doward, Carole Cadwalladr & Alice Gibbs, Watchdog to Launch
`Inquiry into Misuse of Data in Politics, Guardian (Mar. 4, 2017),
`https://www.theguardian.com/technology/2017/mar/04/cambridge-
`analytics-data-brexit-trump.
`8 Tim Sculthorpe, Privacy Watchdog Launces a Probe into How the
`Leave Campaigns Used Voters’ Personal Data to Win Brexit, Daily Mail
`(Mar.
`5,
`2017),
`https://www.dailymail.co.uk/news/article-
`4283102/amp/Privacy-watchdog-launches-probe-Leave-use-data.html;
`Mattathias Schwartz, Facebook Failed to Protect 30 Million Users From
`Having Their Data Harvested By Trump Campaign Affiliate, Intercept
`(Mar. 30, 2017), https://theintercept.com/2017/03/30/facebook-failed-
`to-protect-30-million-users-from-having-their-data-harvested-by-
`trump-campaign-affiliate/.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`15
`
`the articles went to print, Facebook announced on its
`investor relations website that it was suspending Cambridge
`Analytica for violating its policies by sharing Facebook
`users’ data without the users’ consent and for failing to
`delete the improperly collected data. Facebook explained
`that, in 2015, it had demanded certification that Cambridge
`Analytica and Kogan had destroyed the harvested user data,
`but that Facebook had just learned that not all the data was
`deleted. Soon after, The New York Times reported that
`Cambridge Analytica’s use of Facebook users’ data was
`“one of the largest data leaks in the social network’s
`history.”9 The article took the position that most people
`whose data was harvested had not consented to the
`collection, that Cambridge Analytica had used the data to
`benefit the Trump presidential campaign in 2016, and that
`“copies of the data still remain[ed] beyond Facebook’s
`control.”10
`Other media outlets and government officials sprang into
`action. Political figures in the United States and Europe
`called for investigation into the Cambridge Analytica
`privacy scandal. Reporters wrote that Facebook knew about
`the data breach for years and failed to disclose it to the
`millions of affected users. In particular, CNN observed that
`“[n]o one ha[d] provided an adequate explanation for why
`Facebook did not disclose Kogan’s violation to the more
`than 50 million users who were affected when the company
`
`
`9 Matthew Rosenberg, Nicholas Confessore & Carole Cadwalladr, How
`Trump Consultants Exploited the Facebook Data of Millions, N.Y.
`Times
`(Mar.
`17,
`2018),
`https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-
`trump-campaign.html.
`10 Id.
`
`
`
`16
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`first learned about it in 2015.”11 That same day, an article in
`Seeking Alpha warned that “[i]f Cambridge Analytica was
`able to acquire information on tens of millions of Facebook
`users so quickly and easily, and then keep the information
`for years without Facebook suspecting otherwise, then that
`shows a serious flaw in Facebook’s ability to keep exclusive
`control over its information.”12
`3. Facebook’s Stock Price Drop and Low Revenue and
`Profit Growth
`The price of Facebook’s stock declined significantly in
`the week that followed the Cambridge Analytica revelations.
`On March 19, 2018—the first trading day after the news
`broke—Facebook shares fell almost 7%. The next day,
`Facebook shares fell an additional 2.5%. After one week,
`Facebook’s stock price had dropped nearly 18% from the
`price before the news about Cambridge Analytica was
`published, reflecting a loss of more than $100 billion in
`market capitalization. At this juncture, the shareholders filed
`their first securities fraud complaint against Facebook.
`In the aftermath, Facebook reiterated its statements that
`users have privacy and control over their personal data on
`the platform. At an April 2018 press conference, Zuckerberg
`stated that “you have control over everything you put on the
`service.” Later that month, Zuckerberg issued a public post
`
`11 Dylan Byers, Facebook Is Facing an Existential Crisis, CNN (Mar.
`19,
`2018),
`https://money.cnn.com/2018/03/19/technology/business/facebook-data-
`privacy-crisis/index.html.
`12 Erich Reimer, The Cambridge Analytica Mishap Is Serious for
`Facebook,
`Seeking
`Alpha
`(Mar.
`19,
`2018),
`https://seekingalpha.com/article/4157578-cambridge-analytica-mishap-
`is-serious-for-facebook.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`17
`
`on Facebook, saying: “You’ve been hearing a lot about
`Facebook lately and how your data is being used. While this
`information can sometimes be confusing and technical, it’s
`important to know that you are in control of your Facebook,
`what you see, what you share, and what people see about
`you.” Zuckerberg also testified before the United States
`Senate that users have control over both what they share on
`and
`their personal data
`connected
`to
`advertisements on the platform.
`On June 3, 2018, more news emerged about Facebook’s
`privacy practices. The New York Times reported that
`Facebook had continued sharing the data of users and their
`Facebook friends with dozens of whitelisted third parties like
`Apple, Microsoft, and Samsung without the users’ express
`consent.13 The article reported that Facebook’s whitelisting
`policy violated the company’s FTC consent decree and
`contradicted Zuckerberg’s 2014 announcement
`that
`Facebook’s third-party data sharing practice had been
`shuttered.14 An FTC investigator testified before the
`Parliament of the United Kingdom that, for nearly a decade,
`the whitelisted apps were allowed to completely override
`Facebook users’ privacy settings. Multiple news outlets
`subsequently reported that Facebook shared its users’ data
`with foreign entities “believed to be national security risks”
`without the users’ knowledge.
`Finally, on July 25, 2018, Facebook announced
`unexpectedly low revenue growth, profitability, and user
`growth in its Q2 earnings call. Facebook stated that the
`
`13 Gabriel J.X. Dance, Nicholas Confessore & Michael Laforgia,
`Facebook Gave Device Makers Deep Access to Data on Users and
`Friends, N.Y. Times (June 3, 2018), https://nyti.ms/3aFIMAI.
`14 Id.
`
`
`
`18
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`disappointing revenue growth occurred because it was
`“putting privacy first” as well as implementing the European
`Union’s General Data Protection Regulation (“GDPR”).
`Zuckerberg reported that the GDPR rollout also resulted in a
`decline in monthly Facebook users across Europe. The day
`after the earnings call, Facebook’s stock price dropped
`nearly 19%. Analysts and investors attributed the stock drop
`to the company’s GDPR implementation, the requisite
`increased security and privacy required of tech companies,
`and the Cambridge Analytica and whitelisting scandals.
`4. Filing of Amended Complaints
`The revelation of
`the Cambridge Analytica and
`whitelisting scandals and the two Facebook stock price drops
`precipitated an amended filing by the shareholders in
`October 2018. The shareholders amended the complaint
`again in November 2019 (Second Amended Complaint) and
`October 2020 (Third Amended Complaint). They brought
`claims against Facebook, Zuckerberg, Sandberg, and
`Wehner under Sections 10(b), 20(a), and 20A of the
`Securities Exchange Act of 1934 and Rule 10b-5 of the
`Exchange Act’s
`implementing
`regulations.
` The
`shareholders allege that Facebook, through the executive
`defendants or a company spokesperson, made several false
`or materially misleading statements between February 3,
`2017, and July 25, 2018, “the class period.” The challenged
`statements fall into three categories: (1) statements in
`Facebook’s 2016 Form 10-K regarding the risk of improper
`third-party access to and disclosure of Facebook users’ data;
`(2) statements regarding Facebook’s investigation into
`Cambridge Analytica’s 2015 misconduct; and (3) statements
`regarding the control Facebook users have over their data on
`the platform.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`19
`
`The district court dismissed the shareholders’ First
`Amended Complaint and Second Amended Complaint
`without prejudice under Federal Rule of Civil Procedure
`12(b)(6), giving the shareholders leave to amend both times.
`After determining that the Third Amended Complaint failed
`to remedy the deficiencies of the first two amended filings,
`the district court dismissed the shareholders’ claims without
`leave to amend.
`
`II. ANALYSIS
`Although the scope of claims under Section 10(b) of the
`Exchange Act and Rule 10b-5 of the Exchange Act’s
`implementing regulations is well understood and well-tread
`in the Ninth Circuit, these principles bear repeating so that
`our analysis is viewed in context.
`Section 10(b) of the Exchange Act, 15 U.S.C. § 78j(b),
`prohibits “manipulative or deceptive” practices
`in
`connection with the purchase or sale of a security. See In re
`Alphabet Sec. Litig., 1 F.4th 687, 699 (9th Cir. 2021). Rule
`10b-5 of the Exchange Act’s implementing regulations is
`coextensive with Section 10(b). S.E.C. v. Zandford, 535
`U.S. 813, 816 n.1 (2002). The Rule prohibits making “any
`untrue statement of a material fact” or omitting material facts
`“necessary in order to make the statements made, in the light
`of the circumstances under which they were made, not
`misleading.” Glazer Cap. Mgmt., L.P. v. Forescout Techs.,
`Inc. (Glazer II), 63 F.4th 747, 764 (9th Cir. 2023) (quoting
`17 C.F.R. § 240.10b-5(b)). To state a claim under Section
`10(b) and Rule 10b-5, “a plaintiff must allege: (1) a material
`misrepresentation or omission by the defendant (‘falsity’);
`(2) scienter; (3) a connection between the misrepresentation
`or omission and the purchase or sale of a security; (4)
`reliance upon the misrepresentation or omission; (5)
`
`
`
`20
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`economic loss; and (6) loss causation.” Id. (internal
`quotation marks omitted) (quoting In re NVIDIA Corp. Sec.
`Litig., 768 F.3d 1046, 1052 (9th Cir. 2014)). Claims under
`Sections 20(a) and 20A of the Exchange Act are derivative
`“and therefore require an inde
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
