`
`UNITED STATES COURT OF APPEALS
`FOR THE NINTH CIRCUIT
`
`
`
` No. 22-15077
`
`D.C. No. 5:18-cv-
`01725-EJD
`
`
`ORDER AND
`AMENDED
`OPINION
`
`In re: FACEBOOK, INC.
`SECURITIES LITIGATION,
`______________________________
`
`
`AMALGAMATED BANK, Lead
`Plaintiff; PUBLIC EMPLOYEES’
`RETIREMENT SYSTEM OF
`MISSISSIPPI; JAMES KACOURIS,
`individually and on behalf of all others
`similarly situated,
`
`
`
` v.
`
`
`FACEBOOK, INC.; MARK
`ZUCKERBERG; SHERYL
`SANDBERG; DAVID M. WEHNER,
`
`
`
`
`
`
`
`
`
`
`Plaintiffs-Appellants,
`
`
`
`
`
` Defendants-Appellees.
`
`Appeal from the United States District Court
`for the Northern District of California
`Edward J. Davila, District Judge, Presiding
`
`Argued and Submitted February 8, 2023
`San Francisco, California
`
`
`
`
`
`
`
`
`
`2
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`Filed October 18, 2023
`Amended December 4, 2023
`
`Before: M. Margaret McKeown, Jay S. Bybee, and Patrick
`J. Bumatay, Circuit Judges.
`
`Opinion by Judge McKeown;
`Partial Concurrence and Partial Dissent by Judge Bumatay
`
`
`
`
`SUMMARY*
`
`Securities Fraud
`
`
`
`
`
`The panel filed (1) an order denying a petition for panel
`rehearing and a petition for rehearing en banc; and (2) an
`amended opinion affirming in part and reversing in part the
`district court’s dismissal of a securities fraud action against
`Facebook, Inc., and three of its executives, and remanding
`for further proceedings.
`Cambridge Analytica improperly harvested personal
`data from millions of unwitting Facebook users and retained
`copies of the data beyond Facebook’s control. Facebook had
`known of Cambridge Analytica’s misconduct for over two
`years and failed to inform affected users, and Facebook
`surreptitiously allowed certain whitelisted third-party apps
`to access users’ Facebook friend data without the users’
`friends’ consent.
`
`
`* This summary constitutes no part of the opinion of the court. It has
`been prepared by court staff for the convenience of the reader.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`3
`
`Facebook shareholders filed suit, alleging that the
`defendants violated Sections 10(b), 20(a), and 20A of the
`Securities Exchange Act of 1934 and Rule 10b-5 by making
`materially misleading statements and omissions regarding
`the risk of improper access to Facebook users’ data,
`Facebook’s internal investigation into Cambridge Analytica,
`and the control Facebook users had over their data.
`The panel held that, under the heightened standard of the
`Private Securities Litigation Reform Act, the shareholders
`adequately pleaded falsity as to the some of the challenged
`risk statements. The panel followed In re Alphabet Sec.
`Litig., 1 F.4th 687 (9th Cir. 2021), which held that falsity
`allegations were sufficient to survive a motion to dismiss
`when the complaint plausibly alleged that a company’s SEC
`filings warned that risks “could” occur when, in fact, those
`risks had already materialized. The panel concluded that the
`shareholders adequately pleaded falsity as to the statements
`warning that misuse of Facebook users’ data could harm
`Facebook’s business, reputation, and competitive position,
`and the district court erred by dismissing the complaint as to
`those statements. The panel concluded, however, that the
`district court correctly dismissed the challenged statements
`regarding the risk of security breaches and the risk of the
`public not perceiving Facebook’s products to be “useful,
`reliable, and trustworthy.” The panel left to the district court
`on remand whether the shareholders could satisfy the other
`elements of the claims with respect to risk statements.
`The panel held that the shareholders did not adequately
`plead facts giving rise to a strong inference of scienter as to
`the Cambridge Analytica investigation statements, and the
`panel affirmed the district court’s dismissal as to these
`statements.
`
`
`
`4
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`The panel held that the shareholders adequately pleaded
`loss causation as to some of the user control statements. The
`panel affirmed the dismissal of the statements related to
`Facebook’s goals of transparency and control, and a June
`2018 whitelisting revelation as a standalone claim. The
`panel reversed the dismissal as to other statements related to
`Facebook stock price drops.
`Concurring in part and dissenting in part, Judge Bumatay
`joined the majority in holding that the shareholders failed to
`sufficiently allege a falsity in Facebook’s Cambridge
`Analytica investigation statements. He also joined the
`majority in holding that the shareholders did allege a falsity
`and loss from the user control statements, but only as those
`statements
`relate
`to
`Facebook’s
`practice
`of
`“whitelisting.” He disagreed with the majority on two
`fundamental points. In his view, the shareholders failed to
`sufficiently allege that Facebook’s risk factor statements in
`its public filings were fraudulent, and they did not show that
`Facebook’s user control statements were false based on the
`Cambridge Analytica revelations.
`
`
`
`COUNSEL
`
`Tom Goldstein (argued) and Erica O. Evans, Goldstein &
`Russell PC, Bethesda, Maryland; Kevin K. Russell,
`Goldstein Russell & Woofter LLC, Washington, D.C.; John
`C. Browne and Jeremy P. Robinson, Bernstein Litowitz
`Berger & Grossman LLP, New York, New York; Joseph D.
`Daley, Danielle S. Myers, and Darren J. Robbins, Robbins
`Geller Rudman & Dowd LLP, San Diego, California; Jason
`C. Davis, Robbins Geller Rudman & Dowd LLP, San
`Francisco, California; Kathleen Foley, Munger Tolles &
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`5
`
`Olson LLP, Washington, D.C.; Jeremy A. Lieberman,
`Pomerantz LLP, New York, New York; Jennifer Pafiti,
`Pomerantz LLP, Los Angeles, California; for Plaintiffs-
`Appellants.
`Joshua S. Lipshutz (argued), Katherine M. Meeks, and
`Trenton J. Van Oss, Gibson Dunn & Crutcher LLP,
`Washington, D.C.; Brian M. Lutz and Michael J. Kahn,
`Gibson Dunn & Crutcher LLP, San Francisco, California;
`Orin S. Snyder, Gibson Dunn & Crutcher LLP, New York,
`New York; Paul J. Collins, Gibson Dunn & Crutcher LLP,
`Palo Alto, California; for Defendants-Appellees.
`
`
`
`ORDER
`
`
`
`An Amended Opinion is being filed simultaneously with
`this Order.
`The panel voted to deny the petition for panel rehearing.
`Judges McKeown and Bybee recommended denial of the
`petition for rehearing en banc, and Judge Bumatay voted to
`grant the petition for rehearing en banc.
`The full court has been advised of the petition for
`rehearing en banc and no judge of the court has requested a
`vote on whether to rehear the matter en banc. Fed. R. App.
`P. 35.
`Appellees’ petition for panel rehearing and rehearing en
`banc, Dkt. No. 50, is DENIED.
`
`
`
`
`
`6
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`OPINION
`
`
`McKEOWN, Circuit Judge:
`
`In March 2018, news broke that Cambridge Analytica, a
`British political consulting firm, improperly harvested
`personal data from millions of unwitting Facebook users and
`retained copies of the data beyond Facebook’s control. In
`the months that followed, the public learned that Facebook
`had known of Cambridge Analytica’s misconduct for over
`two years and failed to inform affected users, and that
`Facebook surreptitiously allowed certain whitelisted third-
`party apps to access users’ Facebook friend data without the
`users’ friends’ consent. Facebook and its executives made
`various statements before and after the news announcements
`assuring users that they fully controlled their data on
`Facebook and that no third party would access the data
`without their consent. In the wake of the Cambridge
`Analytica and whitelisting scandals, Facebook’s stock price
`suffered two significant drops totaling more than $200
`billion in market capitalization.1
`Appellants, collectively “the shareholders,” purchased
`shares of Facebook common stock between February 3,
`2017, and July 25, 2018. Soon after the first stock drop in
`March 2018, they filed a securities fraud action against
`Facebook and three of its executives: Mark Zuckerberg,
`Facebook’s chief executive officer, Sheryl Sandberg,
`Facebook’s then-chief operating officer, and David Wehner,
`
`
`1 In late 2021, the parent company Facebook changed its name to Meta
`Platforms, Inc. Because the events in this case occurred before 2021, we
`refer to Facebook and its former parent company, Facebook, Inc., simply
`as Facebook.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`7
`
`Facebook’s chief financial officer. The shareholders allege
`that Facebook and the executives violated Sections 10(b),
`20(a), and 20A of the Securities Exchange Act of 1934 and
`Rule 10b-5 of the Exchange Act’s implementing regulations
`by making materially misleading statements and omissions
`regarding the risk of improper access to Facebook users’
`data, Facebook’s internal investigation into Cambridge
`Analytica, and the control Facebook users have over their
`data. Although the shareholders made multiple claims in
`their Third Amended Complaint, only these three categories
`of claims are the subject of this appeal.
`This case calls on us to consider whether, under the
`heightened standard of the Private Securities Litigation
`Reform Act (“PSLRA”), the shareholders adequately
`pleaded falsity as to the challenged risk statements,
`adequately pleaded scienter as to the Cambridge Analytica
`investigation statements, and adequately pleaded loss
`causation as to the user control statements. We affirm in part
`and reverse in part.2
`I. BACKGROUND
`The Third Amended Complaint clocked in at 285 pages.
`Although impressive in terms of magnitude, we nonetheless
`examine the allegations individually and holistically, not by
`weight or volume.3
`
`
`2 For ease of reference, we use the categories laid out in the Third
`Amended Complaint. On appeal, the shareholders challenge the district
`court’s dismissal of the statements in ¶¶ 501–05, 507–14, 519, 525, 530,
`533, and 537–38 of the Third Amended Complaint.
`3 These facts are based on the allegations in the Third Amended
`Complaint and may not reflect Facebook’s current practices.
`
`
`
`8
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`Facebook, with more than 1.3 billion daily users at the
`inception of this case, is the world’s largest social media
`platform. On Facebook, users share personal content, “like”
`and comment on others’ shared content, play games
`designed by third-party app developers, and more. Facebook
`collects data from its users, including the types of content
`they access, the devices they use to access Facebook, their
`payment information, and their location. The collected data
`is used to individualize the content a user sees on Facebook.
`For example, Facebook may suggest local events to a user
`and tailor the advertisements a user sees. Additionally, a
`third-party app or website integrated onto the Facebook
`platform may access user information when the user engages
`with its services on the platform. For example, a Facebook
`user may play an online game added to the Facebook
`platform by a
`third-party developer.
` According
`to
`Facebook’s terms, the game developer could then access the
`user’s age range, location, language preference, list of
`friends, and other information the user shared with them.
`This is not the first time Facebook has found itself in
`legal hot water over its data sharing practices. In 2012,
`Facebook settled charges with
`the Federal Trade
`Commission (“FTC”) that it deceived users by representing
`that their personal data was private but allowing the data to
`be shared, including with third-party apps. Facebook
`entered a twenty-year consent decree as part of the
`settlement, agreeing not to misrepresent the extent to which
`Facebook users could control the privacy of their own data.
`In 2019, the FTC imposed a “record-breaking $5 billion
`penalty” on Facebook for violating the consent decree by
`“deceiving users about their ability to control the privacy of
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`9
`
`their personal information.”4 Facebook users have also sued
`the company alleging that Facebook is dishonest about its
`privacy practices. See, e.g., In re Facebook, Inc. Internet
`Tracking Litig., 956 F.3d 589 (9th Cir. 2020); Campbell v.
`Facebook, Inc., 951 F.3d 1106 (9th Cir. 2020).
`In 2014, Zuckerberg announced publicly that Facebook
`would no longer allow third parties to access and collect data
`from users’ friends, noting that Facebook users were
`surprised to learn that their Facebook friends could share
`their data with a third party without their consent. He
`explained that Facebook users had grown skeptical that their
`data was safe on the platform, and that Facebook was doing
`everything it could “to put people first and give people the
`tools they need” to trust that Facebook would keep their data
`safe. That same year, however, Zuckerberg and Sandberg
`created a “reciprocity” system in which certain third-party
`apps that provided “reciprocal value to Facebook” could be
`“whitelisted,” meaning that those apps were exempt from the
`ban on third-party data access and collection. The
`whitelisting practice continued until mid-2018.
`In September 2015, Facebook employees noticed that
`Cambridge Analytica was “receiving vast amounts of
`Facebook user data.” Facebook’s political team described
`Cambridge Analytica as a “sketchy” firm
`that had
`“penetrated” Facebook’s market and
`requested an
`investigation into what Cambridge Analytica was doing with
`the data. The platform policies team concluded that it was
`unlikely Cambridge Analytica could use Facebook users’
`
`4 Press Release, Fed. Trade Comm’n, FTC Imposes $5 Billion Penalty
`and Sweeping New Privacy Restrictions on Facebook (July 24, 2019),
`https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-
`imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook.
`
`
`
`10
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`data for political purposes without violating Facebook’s
`policies. In November 2015, Facebook paid Aleksandr
`Kogan, a Cambridge University academic who helped
`Cambridge Analytica obtain user data from Facebook, to
`give an internal presentation on the lessons he learned from
`collecting and working with the Facebook data.
`Trouble for Facebook began in December 2015, when
`The Guardian reported that Cambridge Analytica had
`created a database of information about American voters by
`harvesting their Facebook data.5 The harvested data
`originated from a personality quiz integrated onto Facebook
`by Kogan. When Facebook users completed the quiz, Kogan
`gained access to their data as well as data from their
`Facebook friends who had not taken the quiz, including each
`user’s name, gender, location, birthdate, “likes,” and list of
`Facebook friends. Facebook’s app review team initially
`rejected the personality quiz because it collected more user
`data than necessary to operate, but the quiz nonetheless
`became available to Facebook users. Although only about
`250,000 Facebook users took the personality quiz, Kogan
`harvested data from over thirty million users, most of whom
`did not consent to the data collection.
`Kogan used the Facebook “likes” collected from the quiz
`to train an algorithm that assigned personality scores to
`Facebook users, including users who had not taken the quiz.
`The information was saved in a database that classified
`American voters by scoring them on five personality traits:
`“openness to experience, conscientiousness, extraversion,
`
`5 See Harry Davies, Ted Cruz Using Firm that Harvested Data on
`Millions of Unwitting Facebook Users, Guardian (Dec. 11, 2015),
`https://www.theguardian.com/us-news/2015/dec/11/senator-ted-cruz-
`president-campaign-facebook-user-data.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`11
`
`agreeableness, and neuroticism (the ‘OCEAN scale’).”
`According to The Guardian, Cambridge Analytica used the
`harvested OCEAN scale data to help Ted Cruz’s presidential
`campaign “gain an edge over Donald Trump” in the
`Republican Party primaries.
`In response to the Guardian article, a Facebook
`spokesperson stated that the company was “carefully
`investigating” the situation, that misusing user data was a
`violation of Facebook’s policies, and that the company
`would “take swift action” against third parties found to have
`misused Facebook users’ data. In a private email exchange
`in December 2015, a Facebook executive told a Cambridge
`Analytica executive that Cambridge Analytica violated
`Facebook’s policies and terms by using data that Kogan
`“improperly derived” from Facebook. Cambridge Analytica
`agreed in January 2016 to delete the personality score data
`harvested from Facebook.
`Notwithstanding Cambridge Analytica’s assurance that
`it would delete the data, Facebook continued to investigate
`the data usage. In June 2016, Facebook negotiated a
`confidential settlement with Kogan, who certified that he
`had deleted the data in his possession derived from Facebook
`“likes.” Kogan also provided Facebook with the identity of
`every entity with which he had shared raw Facebook user
`data. In doing so, Kogan revealed that he had shared
`derivative and raw data from Facebook users—not just the
`personality score data—with Cambridge Analytica’s chief
`executive, Alexander Nix, and that the data was still being
`used in violation of Facebook’s stated policies. Facebook
`asked Nix to certify that all data harvested from the
`Facebook personality quiz was deleted, but Nix refused to
`do so. In October 2016, The Washington Post reported that
`Cambridge Analytica continued to use data based on the
`
`
`
`12
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`OCEAN scale to benefit the Trump presidential campaign.6
`The article did not say explicitly that the social-media data
`came from Facebook, but the use of the OCEAN scale
`suggested that Cambridge Analytica may have been using
`the data originally harvested from Kogan’s personality quiz
`on Facebook.
`1. Facebook’s Public Filings
`Despite the ongoing developments regarding Cambridge
`Analytica, Facebook represented in its 2016 Form 10-K,
`filed with the Securities Exchange Commission (“SEC”) in
`February 2017, that third-party misuse of Facebook users’
`personal data was a purely hypothetical risk that could harm
`the company if it materialized. For example, the 10-K stated
`that “[a]ny failure to prevent or mitigate . . . improper access
`to or disclosure of our data or user data . . . could result in
`the loss or misuse of such data, which could harm
`[Facebook’s] business and reputation and diminish our
`competitive position.” The statements about the risks of
`improper access or disclosure appeared in the “Risk Factors”
`section of the 10-K, in a subsection that also discussed the
`risks of security breaches such as cyberattacks, hacking, and
`phishing that could result in Facebook user data falling into
`the wrong hands.
`2. Continued Press about Cambridge Analytica
`In March 2017, The Guardian published another article
`about Cambridge Analytica’s political activity. The article
`
`6 Michael Kranish, Trump’s Plan for a Comeback Includes Building a
`‘Psychographic’ Profile of Every Voter, Wash. Post (Oct. 27, 2016),
`https://www.washingtonpost.com/politics/trumps-plan-for-a-comeback-
`includes-building-a-psychographic-profile-of-every-
`voter/2016/10/27/9064a706-9611-11e6-9b7c-
`57290af48a49_story.html.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`13
`
`discussed how Cambridge Analytica used data derived from
`Facebook “likes”
`to
`train algorithms and quoted a
`Cambridge Analytica spokesperson’s denial that the firm
`had access to Facebook “likes.”7 The article also quoted a
`Facebook spokesperson’s statement
`that Facebook’s
`investigation
`into Cambridge Analytica had not yet
`uncovered any misconduct related to the firm’s work on
`political matters, specifically
`the Trump presidential
`campaign or the Brexit Leave campaign. A Facebook
`spokesperson made similar comments to journalists later that
`month.8 Throughout 2017 and early 2018, Facebook and its
`executives assured Facebook users that “no one is going to
`get your data that shouldn’t have it,” that Facebook and its
`apps had “long been focused on giving people transparency
`and control,” and more.
`On March 12, 2018, The New York Times and The
`Guardian contacted Facebook for comment on joint articles
`the outlets planned to publish about Cambridge Analytica’s
`misuse of Facebook users’ data. The articles would report
`that Cambridge Analytica had not actually deleted the
`improperly collected Facebook user data from 2015. Before
`
`7 Jamie Doward, Carole Cadwalladr & Alice Gibbs, Watchdog to Launch
`Inquiry into Misuse of Data in Politics, Guardian (Mar. 4, 2017),
`https://www.theguardian.com/technology/2017/mar/04/cambridge-
`analytics-data-brexit-trump.
`8 Tim Sculthorpe, Privacy Watchdog Launces a Probe into How the
`Leave Campaigns Used Voters’ Personal Data to Win Brexit, Daily Mail
`(Mar.
`5,
`2017),
`https://www.dailymail.co.uk/news/article-
`4283102/amp/Privacy-watchdog-launches-probe-Leave-use-data.html;
`Mattathias Schwartz, Facebook Failed to Protect 30 Million Users From
`Having Their Data Harvested By Trump Campaign Affiliate, Intercept
`(Mar. 30, 2017), https://theintercept.com/2017/03/30/facebook-failed-
`to-protect-30-million-users-from-having-their-data-harvested-by-
`trump-campaign-affiliate/.
`
`
`
`14
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`the articles went to print, Facebook announced on its
`investor relations website that it was suspending Cambridge
`Analytica for violating its policies by sharing Facebook
`users’ data without the users’ consent and for failing to
`delete the improperly collected data. Facebook explained
`that, in 2015, it had demanded certification that Cambridge
`Analytica and Kogan had destroyed the harvested user data,
`but that Facebook had just learned that not all the data was
`deleted. Soon after, The New York Times reported that
`Cambridge Analytica’s use of Facebook users’ data was
`“one of the largest data leaks in the social network’s
`history.”9 The article took the position that most people
`whose data was harvested had not consented to the
`collection, that Cambridge Analytica had used the data to
`benefit the Trump presidential campaign in 2016, and that
`“copies of the data still remain[ed] beyond Facebook’s
`control.”10
`Other media outlets and government officials sprang into
`action. Political figures in the United States and Europe
`called for investigation into the Cambridge Analytica
`privacy scandal. Reporters wrote that Facebook knew about
`the data breach for years and failed to disclose it to the
`millions of affected users. In particular, CNN observed that
`“[n]o one ha[d] provided an adequate explanation for why
`Facebook did not disclose Kogan’s violation to the more
`than 50 million users who were affected when the company
`
`
`9 Matthew Rosenberg, Nicholas Confessore & Carole Cadwalladr, How
`Trump Consultants Exploited the Facebook Data of Millions, N.Y.
`Times
`(Mar.
`17,
`2018),
`https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-
`trump-campaign.html.
`10 Id.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`15
`
`first learned about it in 2015.”11 That same day, an article in
`Seeking Alpha warned that “[i]f Cambridge Analytica was
`able to acquire information on tens of millions of Facebook
`users so quickly and easily, and then keep the information
`for years without Facebook suspecting otherwise, then that
`shows a serious flaw in Facebook’s ability to keep exclusive
`control over its information.”12
`3. Facebook’s Stock Price Drop and Low Revenue and
`Profit Growth
`The price of Facebook’s stock declined significantly in
`the week that followed the Cambridge Analytica revelations.
`On March 19, 2018—the first trading day after the news
`broke—Facebook shares fell almost 7%. The next day,
`Facebook shares fell an additional 2.5%. After one week,
`Facebook’s stock price had dropped nearly 18% from the
`price before the news about Cambridge Analytica was
`published, reflecting a loss of more than $100 billion in
`market capitalization. At this juncture, the shareholders filed
`their first securities fraud complaint against Facebook.
`In the aftermath, Facebook reiterated its statements that
`users have privacy and control over their personal data on
`the platform. At an April 2018 press conference, Zuckerberg
`stated that “you have control over everything you put on the
`service.” Later that month, Zuckerberg issued a public post
`
`11 Dylan Byers, Facebook Is Facing an Existential Crisis, CNN (Mar.
`19,
`2018),
`https://money.cnn.com/2018/03/19/technology/business/facebook-data-
`privacy-crisis/index.html.
`12 Erich Reimer, The Cambridge Analytica Mishap Is Serious for
`Facebook,
`Seeking
`Alpha
`(Mar.
`19,
`2018),
`https://seekingalpha.com/article/4157578-cambridge-analytica-mishap-
`is-serious-for-facebook.
`
`
`
`16
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`on Facebook, saying: “You’ve been hearing a lot about
`Facebook lately and how your data is being used. While this
`information can sometimes be confusing and technical, it’s
`important to know that you are in control of your Facebook,
`what you see, what you share, and what people see about
`you.” Zuckerberg also testified before the United States
`Senate that users have control over both what they share on
`and
`their personal data
`connected
`to
`advertisements on the platform.
`On June 3, 2018, more news emerged about Facebook’s
`privacy practices. The New York Times reported that
`Facebook had continued sharing the data of users and their
`Facebook friends with dozens of whitelisted third parties like
`Apple, Microsoft, and Samsung without the users’ express
`consent.13 The article reported that Facebook’s whitelisting
`policy violated the company’s FTC consent decree and
`contradicted Zuckerberg’s 2014 announcement
`that
`Facebook’s third-party data sharing practice had been
`shuttered.14 An FTC investigator testified before the
`Parliament of the United Kingdom that, for nearly a decade,
`the whitelisted apps were allowed to completely override
`Facebook users’ privacy settings. Multiple news outlets
`subsequently reported that Facebook shared its users’ data
`with foreign entities “believed to be national security risks”
`without the users’ knowledge.
`Finally, on July 25, 2018, Facebook announced
`unexpectedly low revenue growth, profitability, and user
`growth in its Q2 earnings call. Facebook stated that the
`
`13 Gabriel J.X. Dance, Nicholas Confessore & Michael Laforgia,
`Facebook Gave Device Makers Deep Access to Data on Users and
`Friends, N.Y. Times (June 3, 2018), https://nyti.ms/3aFIMAI.
`14 Id.
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`17
`
`disappointing revenue growth occurred because it was
`“putting privacy first” as well as implementing the European
`Union’s General Data Protection Regulation (“GDPR”).
`Zuckerberg reported that the GDPR rollout also resulted in a
`decline in monthly Facebook users across Europe. The day
`after the earnings call, Facebook’s stock price dropped
`nearly 19%. Analysts and investors attributed the stock drop
`to the company’s GDPR implementation, the requisite
`increased security and privacy required of tech companies,
`and the Cambridge Analytica and whitelisting scandals.
`4. Filing of Amended Complaints
`The revelation of
`the Cambridge Analytica and
`whitelisting scandals and the two Facebook stock price drops
`precipitated an amended filing by the shareholders in
`October 2018. The shareholders amended the complaint
`again in November 2019 (Second Amended Complaint) and
`October 2020 (Third Amended Complaint). They brought
`claims against Facebook, Zuckerberg, Sandberg, and
`Wehner under Sections 10(b), 20(a), and 20A of the
`Securities Exchange Act of 1934 and Rule 10b-5 of the
`Exchange Act’s
`implementing
`regulations.
` The
`shareholders allege that Facebook, through the executive
`defendants or a company spokesperson, made several false
`or materially misleading statements between February 3,
`2017, and July 25, 2018, “the class period.” The challenged
`statements fall into three categories: (1) statements in
`Facebook’s 2016 Form 10-K regarding the risk of improper
`third-party access to and disclosure of Facebook users’ data;
`(2) statements regarding Facebook’s investigation into
`Cambridge Analytica’s 2015 misconduct; and (3) statements
`regarding the control Facebook users have over their data on
`the platform.
`
`
`
`18
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`The district court dismissed the shareholders’ First
`Amended Complaint and Second Amended Complaint
`without prejudice under Federal Rule of Civil Procedure
`12(b)(6), giving the shareholders leave to amend both times.
`After determining that the Third Amended Complaint failed
`to remedy the deficiencies of the first two amended filings,
`the district court dismissed the shareholders’ claims without
`leave to amend.
`
`II. ANALYSIS
`Although the scope of claims under Section 10(b) of the
`Exchange Act and Rule 10b-5 of the Exchange Act’s
`implementing regulations is well understood and well-tread
`in the Ninth Circuit, these principles bear repeating so that
`our analysis is viewed in context.
`Section 10(b) of the Exchange Act, 15 U.S.C. § 78j(b),
`prohibits “manipulative or deceptive” practices
`in
`connection with the purchase or sale of a security. See In re
`Alphabet Sec. Litig., 1 F.4th 687, 699 (9th Cir. 2021). Rule
`10b-5 of the Exchange Act’s implementing regulations is
`coextensive with Section 10(b). S.E.C. v. Zandford, 535
`U.S. 813, 816 n.1 (2002). The Rule prohibits making “any
`untrue statement of a material fact” or omitting material facts
`“necessary in order to make the statements made, in the light
`of the circumstances under which they were made, not
`misleading.” Glazer Cap. Mgmt., L.P. v. Forescout Techs.,
`Inc. (Glazer II), 63 F.4th 747, 764 (9th Cir. 2023) (quoting
`17 C.F.R. § 240.10b-5(b)). To state a claim under Section
`10(b) and Rule 10b-5, “a plaintiff must allege: (1) a material
`misrepresentation or omission by the defendant (‘falsity’);
`(2) scienter; (3) a connection between the misrepresentation
`or omission and the purchase or sale of a security; (4)
`reliance upon the misrepresentation or omission; (5)
`
`
`
`
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`19
`
`economic loss; and (6) loss causation.” Id. (internal
`quotation marks omitted) (quoting In re NVIDIA Corp. Sec.
`Litig., 768 F.3d 1046, 1052 (9th Cir. 2014)). Claims under
`Sections 20(a) and 20A of the Exchange Act are derivative
`“and therefore require an independent violation of the
`Exchange Act,” so the shareholders must successfully plead
`a Section 10(b) claim to succeed on their claims under
`Sections 20(a) and 20A. See Johnson v. Aljian, 490 F.3d
`778, 781 (9th Cir. 2007); see also Glazer II, 63 F.4th at 765.
`Complaints alleging securities fraud are also subject to
`heightened pleading
`requirements under
`the Private
`Securities Litigation Reform Act (“PSLRA”) and Rule 9(b).
`Glazer II, 63 F.4th at 765. The PSLRA requires that
`complaints alleging falsity “specify each statement alleged
`to have been misleading, the reason or reasons why the
`statement is misleading, and, if an allegation regarding the
`statement or omission is made on information and belief, the
`complaint shall state with particularity all facts on which that
`belief is formed.” Id. (quoting 15 U.S.C. § 78u-4(b)(1)). To
`plead scienter under the PSLRA, “the complaint must ‘state
`with particularity facts giving rise to a strong inference that
`the defendant acted with the required state of mind.’” Id. at
`766 (quoting 15 U.S.C. § 78u-4(b)(2)(A)). When evaluating
`“whether the strong inference standard is met,” the court first
`“determines whether any one of the plaintiff’s allegations is
`alone sufficient to give rise to a strong inference of scienter.”
`Id. If no individual allegation is sufficient, the court
`“conducts a ‘holistic’ review to determine whether the
`allegations combine to give rise to a strong inference of
`scienter.” Id. (quoting Zucco Partners, LLC v. Digimarc
`Corp., 552 F.3d 981, 992 (9th Cir. 2009)). Rule 9(b)
`similarly requires plaintiffs to “state with particularity the
`circumstances constituting fraud.” Id. at 765 (quoting Fed.
`
`
`
`20
`
`AMALGAMATED BANK V. FACEBOOK, INC.
`
`R. Civ. P. 9(b)). Fraud allegations under Rule 9(b) “must be
`‘specific enough to