Amalgamated Bank v. Facebook, Inc.

Opinion

FOR PUBLICATION

UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT

In re: FACEBOOK, INC. No. 22-15077 SECURITIES LITIGATION, ______________________________ D.C. No. 5:18-cv- 01725-EJD AMALGAMATED BANK, Lead Plaintiff; PUBLIC EMPLOYEES’ RETIREMENT SYSTEM OF ORDER AND MISSISSIPPI; JAMES KACOURIS, AMENDED individually and on behalf of all others OPINION similarly situated,

Plaintiffs-Appellants,

v.

FACEBOOK, INC.; MARK ZUCKERBERG; SHERYL SANDBERG; DAVID M. WEHNER,

Defendants-Appellees.

Appeal from the United States District Court for the Northern District of California Edward J. Davila, District Judge, Presiding

Argued and Submitted February 8, 2023 San Francisco, California 2 AMALGAMATED BANK V. FACEBOOK, INC.

Filed October 18, 2023 Amended December 4, 2023

Before: M. Margaret McKeown, Jay S. Bybee, and Patrick J. Bumatay, Circuit Judges.

Opinion by Judge McKeown; Partial Concurrence and Partial Dissent by Judge Bumatay

SUMMARY *

Securities Fraud

The panel filed (1) an order denying a petition for panel rehearing and a petition for rehearing en banc; and (2) an amended opinion affirming in part and reversing in part the district court’s dismissal of a securities fraud action against Facebook, Inc., and three of its executives, and remanding for further proceedings. Cambridge Analytica improperly harvested personal data from millions of unwitting Facebook users and retained copies of the data beyond Facebook’s control. Facebook had known of Cambridge Analytica’s misconduct for over two years and failed to inform affected users, and Facebook surreptitiously allowed certain whitelisted third-party apps to access users’ Facebook friend data without the users’ friends’ consent.

* This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader. AMALGAMATED BANK V. FACEBOOK, INC. 3

Facebook shareholders filed suit, alleging that the defendants violated Sections 10(b), 20(a), and 20A of the Securities Exchange Act of 1934 and Rule 10b-5 by making materially misleading statements and omissions regarding the risk of improper access to Facebook users’ data, Facebook’s internal investigation into Cambridge Analytica, and the control Facebook users had over their data. The panel held that, under the heightened standard of the Private Securities Litigation Reform Act, the shareholders adequately pleaded falsity as to the some of the challenged risk statements. The panel followed In re Alphabet Sec. Litig., 1 F.4th 687 (9th Cir. 2021), which held that falsity allegations were sufficient to survive a motion to dismiss when the complaint plausibly alleged that a company’s SEC filings warned that risks “could” occur when, in fact, those risks had already materialized. The panel concluded that the shareholders adequately pleaded falsity as to the statements warning that misuse of Facebook users’ data could harm Facebook’s business, reputation, and competitive position, and the district court erred by dismissing the complaint as to those statements. The panel concluded, however, that the district court correctly dismissed the challenged statements regarding the risk of security breaches and the risk of the public not perceiving Facebook’s products to be “useful, reliable, and trustworthy.” The panel left to the district court on remand whether the shareholders could satisfy the other elements of the claims with respect to risk statements. The panel held that the shareholders did not adequately plead facts giving rise to a strong inference of scienter as to the Cambridge Analytica investigation statements, and the panel affirmed the district court’s dismissal as to these statements. 4 AMALGAMATED BANK V. FACEBOOK, INC.

The panel held that the shareholders adequately pleaded loss causation as to some of the user control statements. The panel affirmed the dismissal of the statements related to Facebook’s goals of transparency and control, and a June 2018 whitelisting revelation as a standalone claim. The panel reversed the dismissal as to other statements related to Facebook stock price drops. Concurring in part and dissenting in part, Judge Bumatay joined the majority in holding that the shareholders failed to sufficiently allege a falsity in Facebook’s Cambridge Analytica investigation statements. He also joined the majority in holding that the shareholders did allege a falsity and loss from the user control statements, but only as those statements relate to Facebook’s practice of “whitelisting.” He disagreed with the majority on two fundamental points. In his view, the shareholders failed to sufficiently allege that Facebook’s risk factor statements in its public filings were fraudulent, and they did not show that Facebook’s user control statements were false based on the Cambridge Analytica revelations.

COUNSEL

Tom Goldstein (argued) and Erica O. Evans, Goldstein & Russell PC, Bethesda, Maryland; Kevin K. Russell, Goldstein Russell & Woofter LLC, Washington, D.C.; John C. Browne and Jeremy P. Robinson, Bernstein Litowitz Berger & Grossman LLP, New York, New York; Joseph D. Daley, Danielle S. Myers, and Darren J. Robbins, Robbins Geller Rudman & Dowd LLP, San Diego, California; Jason C. Davis, Robbins Geller Rudman & Dowd LLP, San Francisco, California; Kathleen Foley, Munger Tolles & AMALGAMATED BANK V. FACEBOOK, INC. 5

Olson LLP, Washington, D.C.; Jeremy A. Lieberman, Pomerantz LLP, New York, New York; Jennifer Pafiti, Pomerantz LLP, Los Angeles, California; for Plaintiffs- Appellants. Joshua S. Lipshutz (argued), Katherine M. Meeks, and Trenton J. Van Oss, Gibson Dunn & Crutcher LLP, Washington, D.C.; Brian M. Lutz and Michael J. Kahn, Gibson Dunn & Crutcher LLP, San Francisco, California; Orin S. Snyder, Gibson Dunn & Crutcher LLP, New York, New York; Paul J. Collins, Gibson Dunn & Crutcher LLP, Palo Alto, California; for Defendants-Appellees.

ORDER

An Amended Opinion is being filed simultaneously with this Order. The panel voted to deny the petition for panel rehearing. Judges McKeown and Bybee recommended denial of the petition for rehearing en banc, and Judge Bumatay voted to grant the petition for rehearing en banc. The full court has been advised of the petition for rehearing en banc and no judge of the court has requested a vote on whether to rehear the matter en banc. Fed. R. App. P. 35. Appellees’ petition for panel rehearing and rehearing en banc, Dkt. No. 50, is DENIED. 6 AMALGAMATED BANK V. FACEBOOK, INC.

OPINION

McKEOWN, Circuit Judge:

In March 2018, news broke that Cambridge Analytica, a British political consulting firm, improperly harvested personal data from millions of unwitting Facebook users and retained copies of the data beyond Facebook’s control. In the months that followed, the public learned that Facebook had known of Cambridge Analytica’s misconduct for over two years and failed to inform affected users, and that Facebook surreptitiously allowed certain whitelisted third- party apps to access users’ Facebook friend data without the users’ friends’ consent. Facebook and its executives made various statements before and after the news announcements assuring users that they fully controlled their data on Facebook and that no third party would access the data without their consent. In the wake of the Cambridge Analytica and whitelisting scandals, Facebook’s stock price suffered two significant drops totaling more than $200 billion in market capitalization. 1 Appellants, collectively “the shareholders,” purchased shares of Facebook common stock between February 3, 2017, and July 25, 2018. Soon after the first stock drop in March 2018, they filed a securities fraud action against Facebook and three of its executives: Mark Zuckerberg, Facebook’s chief executive officer, Sheryl Sandberg, Facebook’s then-chief operating officer, and David Wehner,

1 In late 2021, the parent company Facebook changed its name to Meta Platforms, Inc. Because the events in this case occurred before 2021, we refer to Facebook and its former parent company, Facebook, Inc., simply as Facebook. AMALGAMATED BANK V. FACEBOOK, INC. 7

Facebook’s chief financial officer. The shareholders allege that Facebook and the executives violated Sections 10(b), 20(a), and 20A of the Securities Exchange Act of 1934 and Rule 10b-5 of the Exchange Act’s implementing regulations by making materially misleading statements and omissions regarding the risk of improper access to Facebook users’ data, Facebook’s internal investigation into Cambridge Analytica, and the control Facebook users have over their data. Although the shareholders made multiple claims in their Third Amended Complaint, only these three categories of claims are the subject of this appeal. This case calls on us to consider whether, under the heightened standard of the Private Securities Litigation Reform Act (“PSLRA”), the shareholders adequately pleaded falsity as to the challenged risk statements, adequately pleaded scienter as to the Cambridge Analytica investigation statements, and adequately pleaded loss causation as to the user control statements. We affirm in part and reverse in part. 2 I. BACKGROUND The Third Amended Complaint clocked in at 285 pages. Although impressive in terms of magnitude, we nonetheless examine the allegations individually and holistically, not by weight or volume. 3

2 For ease of reference, we use the categories laid out in the Third Amended Complaint. On appeal, the shareholders challenge the district court’s dismissal of the statements in ¶¶ 501–05, 507–14, 519, 525, 530, 533, and 537–38 of the Third Amended Complaint. 3 These facts are based on the allegations in the Third Amended Complaint and may not reflect Facebook’s current practices. 8 AMALGAMATED BANK V. FACEBOOK, INC.

Facebook, with more than 1.3 billion daily users at the inception of this case, is the world’s largest social media platform. On Facebook, users share personal content, “like” and comment on others’ shared content, play games designed by third-party app developers, and more. Facebook collects data from its users, including the types of content they access, the devices they use to access Facebook, their payment information, and their location. The collected data is used to individualize the content a user sees on Facebook. For example, Facebook may suggest local events to a user and tailor the advertisements a user sees. Additionally, a third-party app or website integrated onto the Facebook platform may access user information when the user engages with its services on the platform. For example, a Facebook user may play an online game added to the Facebook platform by a third-party developer. According to Facebook’s terms, the game developer could then access the user’s age range, location, language preference, list of friends, and other information the user shared with them. This is not the first time Facebook has found itself in legal hot water over its data sharing practices. In 2012, Facebook settled charges with the Federal Trade Commission (“FTC”) that it deceived users by representing that their personal data was private but allowing the data to be shared, including with third-party apps. Facebook entered a twenty-year consent decree as part of the settlement, agreeing not to misrepresent the extent to which Facebook users could control the privacy of their own data. In 2019, the FTC imposed a “record-breaking $5 billion penalty” on Facebook for violating the consent decree by “deceiving users about their ability to control the privacy of AMALGAMATED BANK V. FACEBOOK, INC. 9

their personal information.” 4 Facebook users have also sued the company alleging that Facebook is dishonest about its privacy practices. See, e.g., In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020); Campbell v. Facebook, Inc., 951 F.3d 1106 (9th Cir. 2020). In 2014, Zuckerberg announced publicly that Facebook would no longer allow third parties to access and collect data from users’ friends, noting that Facebook users were surprised to learn that their Facebook friends could share their data with a third party without their consent. He explained that Facebook users had grown skeptical that their data was safe on the platform, and that Facebook was doing everything it could “to put people first and give people the tools they need” to trust that Facebook would keep their data safe. That same year, however, Zuckerberg and Sandberg created a “reciprocity” system in which certain third-party apps that provided “reciprocal value to Facebook” could be “whitelisted,” meaning that those apps were exempt from the ban on third-party data access and collection. The whitelisting practice continued until mid-2018. In September 2015, Facebook employees noticed that Cambridge Analytica was “receiving vast amounts of Facebook user data.” Facebook’s political team described Cambridge Analytica as a “sketchy” firm that had “penetrated” Facebook’s market and requested an investigation into what Cambridge Analytica was doing with the data. The platform policies team concluded that it was unlikely Cambridge Analytica could use Facebook users’

4 Press Release, Fed. Trade Comm’n, FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook (July 24, 2019), https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc- imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook. 10 AMALGAMATED BANK V. FACEBOOK, INC.

data for political purposes without violating Facebook’s policies. In November 2015, Facebook paid Aleksandr Kogan, a Cambridge University academic who helped Cambridge Analytica obtain user data from Facebook, to give an internal presentation on the lessons he learned from collecting and working with the Facebook data. Trouble for Facebook began in December 2015, when The Guardian reported that Cambridge Analytica had created a database of information about American voters by harvesting their Facebook data. 5 The harvested data originated from a personality quiz integrated onto Facebook by Kogan. When Facebook users completed the quiz, Kogan gained access to their data as well as data from their Facebook friends who had not taken the quiz, including each user’s name, gender, location, birthdate, “likes,” and list of Facebook friends. Facebook’s app review team initially rejected the personality quiz because it collected more user data than necessary to operate, but the quiz nonetheless became available to Facebook users. Although only about 250,000 Facebook users took the personality quiz, Kogan harvested data from over thirty million users, most of whom did not consent to the data collection. Kogan used the Facebook “likes” collected from the quiz to train an algorithm that assigned personality scores to Facebook users, including users who had not taken the quiz. The information was saved in a database that classified American voters by scoring them on five personality traits: “openness to experience, conscientiousness, extraversion,

5 See Harry Davies, Ted Cruz Using Firm that Harvested Data on Millions of Unwitting Facebook Users, Guardian (Dec. 11, 2015), https://www.theguardian.com/us-news/2015/dec/11/senator-ted-cruz- president-campaign-facebook-user-data. AMALGAMATED BANK V. FACEBOOK, INC. 11

agreeableness, and neuroticism (the ‘OCEAN scale’).” According to The Guardian, Cambridge Analytica used the harvested OCEAN scale data to help Ted Cruz’s presidential campaign “gain an edge over Donald Trump” in the Republican Party primaries. In response to the Guardian article, a Facebook spokesperson stated that the company was “carefully investigating” the situation, that misusing user data was a violation of Facebook’s policies, and that the company would “take swift action” against third parties found to have misused Facebook users’ data. In a private email exchange in December 2015, a Facebook executive told a Cambridge Analytica executive that Cambridge Analytica violated Facebook’s policies and terms by using data that Kogan “improperly derived” from Facebook. Cambridge Analytica agreed in January 2016 to delete the personality score data harvested from Facebook. Notwithstanding Cambridge Analytica’s assurance that it would delete the data, Facebook continued to investigate the data usage. In June 2016, Facebook negotiated a confidential settlement with Kogan, who certified that he had deleted the data in his possession derived from Facebook “likes.” Kogan also provided Facebook with the identity of every entity with which he had shared raw Facebook user data. In doing so, Kogan revealed that he had shared derivative and raw data from Facebook users—not just the personality score data—with Cambridge Analytica’s chief executive, Alexander Nix, and that the data was still being used in violation of Facebook’s stated policies. Facebook asked Nix to certify that all data harvested from the Facebook personality quiz was deleted, but Nix refused to do so. In October 2016, The Washington Post reported that Cambridge Analytica continued to use data based on the 12 AMALGAMATED BANK V. FACEBOOK, INC.

OCEAN scale to benefit the Trump presidential campaign. 6 The article did not say explicitly that the social-media data came from Facebook, but the use of the OCEAN scale suggested that Cambridge Analytica may have been using the data originally harvested from Kogan’s personality quiz on Facebook. 1. Facebook’s Public Filings Despite the ongoing developments regarding Cambridge Analytica, Facebook represented in its 2016 Form 10-K, filed with the Securities Exchange Commission (“SEC”) in February 2017, that third-party misuse of Facebook users’ personal data was a purely hypothetical risk that could harm the company if it materialized. For example, the 10-K stated that “[a]ny failure to prevent or mitigate . . . improper access to or disclosure of our data or user data . . . could result in the loss or misuse of such data, which could harm [Facebook’s] business and reputation and diminish our competitive position.” The statements about the risks of improper access or disclosure appeared in the “Risk Factors” section of the 10-K, in a subsection that also discussed the risks of security breaches such as cyberattacks, hacking, and phishing that could result in Facebook user data falling into the wrong hands. 2. Continued Press about Cambridge Analytica In March 2017, The Guardian published another article about Cambridge Analytica’s political activity. The article

6 Michael Kranish, Trump’s Plan for a Comeback Includes Building a ‘Psychographic’ Profile of Every Voter, Wash. Post (Oct. 27, 2016), https://www.washingtonpost.com/politics/trumps-plan-for-a-comeback- includes-building-a-psychographic-profile-of-every- voter/2016/10/27/9064a706-9611-11e6-9b7c- 57290af48a49_story.html. AMALGAMATED BANK V. FACEBOOK, INC. 13

discussed how Cambridge Analytica used data derived from Facebook “likes” to train algorithms and quoted a Cambridge Analytica spokesperson’s denial that the firm had access to Facebook “likes.” 7 The article also quoted a Facebook spokesperson’s statement that Facebook’s investigation into Cambridge Analytica had not yet uncovered any misconduct related to the firm’s work on political matters, specifically the Trump presidential campaign or the Brexit Leave campaign. A Facebook spokesperson made similar comments to journalists later that month. 8 Throughout 2017 and early 2018, Facebook and its executives assured Facebook users that “no one is going to get your data that shouldn’t have it,” that Facebook and its apps had “long been focused on giving people transparency and control,” and more. On March 12, 2018, The New York Times and The Guardian contacted Facebook for comment on joint articles the outlets planned to publish about Cambridge Analytica’s misuse of Facebook users’ data. The articles would report that Cambridge Analytica had not actually deleted the improperly collected Facebook user data from 2015. Before

7 Jamie Doward, Carole Cadwalladr & Alice Gibbs, Watchdog to Launch Inquiry into Misuse of Data in Politics, Guardian (Mar. 4, 2017), https://www.theguardian.com/technology/2017/mar/04/cambridge- analytics-data-brexit-trump. 8 Tim Sculthorpe, Privacy Watchdog Launces a Probe into How the Leave Campaigns Used Voters’ Personal Data to Win Brexit, Daily Mail (Mar. 5, 2017), https://www.dailymail.co.uk/news/article- 4283102/amp/Privacy-watchdog-launches-probe-Leave-use-data.html; Mattathias Schwartz, Facebook Failed to Protect 30 Million Users From Having Their Data Harvested By Trump Campaign Affiliate, Intercept (Mar. 30, 2017), https://theintercept.com/2017/03/30/facebook-failed- to-protect-30-million-users-from-having-their-data-harvested-by- trump-campaign-affiliate/. 14 AMALGAMATED BANK V. FACEBOOK, INC.

the articles went to print, Facebook announced on its investor relations website that it was suspending Cambridge Analytica for violating its policies by sharing Facebook users’ data without the users’ consent and for failing to delete the improperly collected data. Facebook explained that, in 2015, it had demanded certification that Cambridge Analytica and Kogan had destroyed the harvested user data, but that Facebook had just learned that not all the data was deleted. Soon after, The New York Times reported that Cambridge Analytica’s use of Facebook users’ data was “one of the largest data leaks in the social network’s history.” 9 The article took the position that most people whose data was harvested had not consented to the collection, that Cambridge Analytica had used the data to benefit the Trump presidential campaign in 2016, and that “copies of the data still remain[ed] beyond Facebook’s control.” 10 Other media outlets and government officials sprang into action. Political figures in the United States and Europe called for investigation into the Cambridge Analytica privacy scandal. Reporters wrote that Facebook knew about the data breach for years and failed to disclose it to the millions of affected users. In particular, CNN observed that “[n]o one ha[d] provided an adequate explanation for why Facebook did not disclose Kogan’s violation to the more than 50 million users who were affected when the company

9 Matthew Rosenberg, Nicholas Confessore & Carole Cadwalladr, How Trump Consultants Exploited the Facebook Data of Millions, N.Y. Times (Mar. 17, 2018), https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica- trump-campaign.html. 10 Id. AMALGAMATED BANK V. FACEBOOK, INC. 15

first learned about it in 2015.” 11 That same day, an article in Seeking Alpha warned that “[i]f Cambridge Analytica was able to acquire information on tens of millions of Facebook users so quickly and easily, and then keep the information for years without Facebook suspecting otherwise, then that shows a serious flaw in Facebook’s ability to keep exclusive control over its information.” 12 3. Facebook’s Stock Price Drop and Low Revenue and Profit Growth The price of Facebook’s stock declined significantly in the week that followed the Cambridge Analytica revelations. On March 19, 2018—the first trading day after the news broke—Facebook shares fell almost 7%. The next day, Facebook shares fell an additional 2.5%. After one week, Facebook’s stock price had dropped nearly 18% from the price before the news about Cambridge Analytica was published, reflecting a loss of more than $100 billion in market capitalization. At this juncture, the shareholders filed their first securities fraud complaint against Facebook. In the aftermath, Facebook reiterated its statements that users have privacy and control over their personal data on the platform. At an April 2018 press conference, Zuckerberg stated that “you have control over everything you put on the service.” Later that month, Zuckerberg issued a public post

11 Dylan Byers, Facebook Is Facing an Existential Crisis, CNN (Mar. 19, 2018), https://money.cnn.com/2018/03/19/technology/business/facebook-data- privacy-crisis/index.html. 12 Erich Reimer, The Cambridge Analytica Mishap Is Serious for Facebook, Seeking Alpha (Mar. 19, 2018), https://seekingalpha.com/article/4157578-cambridge-analytica-mishap- is-serious-for-facebook. 16 AMALGAMATED BANK V. FACEBOOK, INC.

on Facebook, saying: “You’ve been hearing a lot about Facebook lately and how your data is being used. While this information can sometimes be confusing and technical, it’s important to know that you are in control of your Facebook, what you see, what you share, and what people see about you.” Zuckerberg also testified before the United States Senate that users have control over both what they share on Facebook and their personal data connected to advertisements on the platform. On June 3, 2018, more news emerged about Facebook’s privacy practices. The New York Times reported that Facebook had continued sharing the data of users and their Facebook friends with dozens of whitelisted third parties like Apple, Microsoft, and Samsung without the users’ express consent. 13 The article reported that Facebook’s whitelisting policy violated the company’s FTC consent decree and contradicted Zuckerberg’s 2014 announcement that Facebook’s third-party data sharing practice had been shuttered. 14 An FTC investigator testified before the Parliament of the United Kingdom that, for nearly a decade, the whitelisted apps were allowed to completely override Facebook users’ privacy settings. Multiple news outlets subsequently reported that Facebook shared its users’ data with foreign entities “believed to be national security risks” without the users’ knowledge. Finally, on July 25, 2018, Facebook announced unexpectedly low revenue growth, profitability, and user growth in its Q2 earnings call. Facebook stated that the

13 Gabriel J.X. Dance, Nicholas Confessore & Michael Laforgia, Facebook Gave Device Makers Deep Access to Data on Users and Friends, N.Y. Times (June 3, 2018), https://nyti.ms/3aFIMAI. 14 Id. AMALGAMATED BANK V. FACEBOOK, INC. 17

disappointing revenue growth occurred because it was “putting privacy first” as well as implementing the European Union’s General Data Protection Regulation (“GDPR”). Zuckerberg reported that the GDPR rollout also resulted in a decline in monthly Facebook users across Europe. The day after the earnings call, Facebook’s stock price dropped nearly 19%. Analysts and investors attributed the stock drop to the company’s GDPR implementation, the requisite increased security and privacy required of tech companies, and the Cambridge Analytica and whitelisting scandals. 4. Filing of Amended Complaints The revelation of the Cambridge Analytica and whitelisting scandals and the two Facebook stock price drops precipitated an amended filing by the shareholders in October 2018. The shareholders amended the complaint again in November 2019 (Second Amended Complaint) and October 2020 (Third Amended Complaint). They brought claims against Facebook, Zuckerberg, Sandberg, and Wehner under Sections 10(b), 20(a), and 20A of the Securities Exchange Act of 1934 and Rule 10b-5 of the Exchange Act’s implementing regulations. The shareholders allege that Facebook, through the executive defendants or a company spokesperson, made several false or materially misleading statements between February 3, 2017, and July 25, 2018, “the class period.” The challenged statements fall into three categories: (1) statements in Facebook’s 2016 Form 10-K regarding the risk of improper third-party access to and disclosure of Facebook users’ data; (2) statements regarding Facebook’s investigation into Cambridge Analytica’s 2015 misconduct; and (3) statements regarding the control Facebook users have over their data on the platform. 18 AMALGAMATED BANK V. FACEBOOK, INC.

The district court dismissed the shareholders’ First Amended Complaint and Second Amended Complaint without prejudice under Federal Rule of Civil Procedure 12(b)(6), giving the shareholders leave to amend both times. After determining that the Third Amended Complaint failed to remedy the deficiencies of the first two amended filings, the district court dismissed the shareholders’ claims without leave to amend. II. ANALYSIS Although the scope of claims under Section 10(b) of the Exchange Act and Rule 10b-5 of the Exchange Act’s implementing regulations is well understood and well-tread in the Ninth Circuit, these principles bear repeating so that our analysis is viewed in context. Section 10(b) of the Exchange Act, 15 U.S.C. § 78j(b), prohibits “manipulative or deceptive” practices in connection with the purchase or sale of a security. See In re Alphabet Sec. Litig., 1 F.4th 687, 699 (9th Cir. 2021). Rule 10b-5 of the Exchange Act’s implementing regulations is coextensive with Section 10(b). S.E.C. v. Zandford, 535 U.S. 813, 816 n.1 (2002). The Rule prohibits making “any untrue statement of a material fact” or omitting material facts “necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading.” Glazer Cap. Mgmt., L.P. v. Forescout Techs., Inc. (Glazer II), 63 F.4th 747, 764 (9th Cir. 2023) (quoting 17 C.F.R. § 240.10b-5(b)). To state a claim under Section 10(b) and Rule 10b-5, “a plaintiff must allege: (1) a material misrepresentation or omission by the defendant (‘falsity’); (2) scienter; (3) a connection between the misrepresentation or omission and the purchase or sale of a security; (4) reliance upon the misrepresentation or omission; (5) AMALGAMATED BANK V. FACEBOOK, INC. 19

economic loss; and (6) loss causation.” Id. (internal quotation marks omitted) (quoting In re NVIDIA Corp. Sec. Litig., 768 F.3d 1046, 1052 (9th Cir. 2014)). Claims under Sections 20(a) and 20A of the Exchange Act are derivative “and therefore require an independent violation of the Exchange Act,” so the shareholders must successfully plead a Section 10(b) claim to succeed on their claims under Sections 20(a) and 20A. See Johnson v. Aljian, 490 F.3d 778, 781 (9th Cir. 2007); see also Glazer II, 63 F.4th at 765. Complaints alleging securities fraud are also subject to heightened pleading requirements under the Private Securities Litigation Reform Act (“PSLRA”) and Rule 9(b). Glazer II, 63 F.4th at 765. The PSLRA requires that complaints alleging falsity “specify each statement alleged to have been misleading, the reason or reasons why the statement is misleading, and, if an allegation regarding the statement or omission is made on information and belief, the complaint shall state with particularity all facts on which that belief is formed.” Id. (quoting 15 U.S.C. § 78u-4(b)(1)). To plead scienter under the PSLRA, “the complaint must ‘state with particularity facts giving rise to a strong inference that the defendant acted with the required state of mind.’” Id. at 766 (quoting 15 U.S.C. § 78u-4(b)(2)(A)). When evaluating “whether the strong inference standard is met,” the court first “determines whether any one of the plaintiff’s allegations is alone sufficient to give rise to a strong inference of scienter.” Id. If no individual allegation is sufficient, the court “conducts a ‘holistic’ review to determine whether the allegations combine to give rise to a strong inference of scienter.” Id. (quoting Zucco Partners, LLC v. Digimarc Corp., 552 F.3d 981, 992 (9th Cir. 2009)). Rule 9(b) similarly requires plaintiffs to “state with particularity the circumstances constituting fraud.” Id. at 765 (quoting Fed. 20 AMALGAMATED BANK V. FACEBOOK, INC.

R. Civ. P. 9(b)). Fraud allegations under Rule 9(b) “must be ‘specific enough to give defendants notice of the particular misconduct which is alleged to constitute the fraud charged so that they can defend against the charge and not just deny that they have done anything wrong.’” Id. (quoting Bly- Magee v. California, 236 F.3d 1014, 1019 (9th Cir. 2001)). We review de novo the dismissal of a complaint for failure to state a claim, accepting the factual allegations as true and viewing the facts “in the light most favorable” to the shareholders. Id. at 763. In addition to the pleading requirements of the PSLRA and Rule 9(b), Rule 8(a) requires that a complaint “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Id. (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). The factual allegations in the complaint must “allow[] the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. (quoting Iqbal, 556 U.S. at 678). A. Risk Statements The essence of the challenged risk statements is that, although Facebook knew Cambridge Analytica had improperly accessed and used Facebook users’ data, Facebook represented in its 2016 Form 10-K that only the hypothetical risk of improper third-party misuse of Facebook users’ data could harm Facebook’s business, reputation, and competitive position. For example, Facebook’s 2016 10-K warned that the “failure to prevent or mitigate security breaches and improper access to or disclosure of our data or user data could result in the loss or misuse of such data” and that if “third parties or developers fail to adopt or adhere to adequate data security practices . . . our data or our users’ data may be improperly accessed, used, AMALGAMATED BANK V. FACEBOOK, INC. 21

or disclosed.” Additionally, two of the challenged statements warn that Facebook cannot provide “absolute [data] security” and that Facebook’s business will suffer if the public does not perceive Facebook’s products to be “useful, reliable, and trustworthy.” The district court held that the shareholders failed to plead falsity as to the risk statements, but its holding predated our decision in In re Alphabet. Without the benefit of our reasoning in In re Alphabet, the district court held that the risk statements were not actionably false because Cambridge Analytica’s misconduct was public knowledge at the time the statements were made and because, while the 10-K warned of risks of harm to Facebook’s business, reputation, and competitive position, the shareholders failed to allege that Cambridge Analytica’s misconduct was causing such harm when the statements were made. This approach overlooks the reality of what Facebook knew. In the securities fraud context, statements and omissions are actionably false or misleading if they “directly contradict what the defendant knew at that time,” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1008 (9th Cir. 2018), or “create an impression of a state of affairs that differs in a material way from the one that actually exists,” Brody v. Transitional Hosps. Corp., 280 F.3d 997, 1006 (9th Cir. 2002). The Exchange Act does not, however, “create an affirmative duty to disclose any and all material information.” Glazer II, 63 F.4th at 764 (quoting Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27, 44 (2011)). Disclosure is mandatory only when necessary to ensure that a statement made is “not misleading.” Id. (quoting Matrixx Initiatives, 563 U.S. at 44). Accordingly, if the market has already “become aware of the allegedly concealed information,” the allegedly false information or material 22 AMALGAMATED BANK V. FACEBOOK, INC.

omission “‘would already be reflected in the stock’s price’ and the market ‘will not be misled.’” Provenz v. Miller, 102 F.3d 1478, 1492 (9th Cir. 1996) (quoting In re Convergent Techs. Sec. Litig., 948 F.2d 507, 513 (9th Cir. 1991)). Our recent decision in In re Alphabet is instructive. We held that falsity allegations were sufficient to survive a motion to dismiss when the complaint plausibly alleged that a company’s SEC filings warned that risks “could” occur when, in fact, those risks had already materialized. In re Alphabet, 1 F.4th at 702–05. This juxtaposition of a “could occur” situation with the fact that the risk had materialized mirrors the allegations in the Facebook scenario. In its 2017 Form 10-K, Alphabet warned of the risk that public concerns about its privacy and security practices “could” harm its reputation and operating results. Id. at 694. The following year, Alphabet discovered a privacy bug that had threatened thousands of users’ personal data for three years. Id. at 695. Nonetheless, in its April and July 2018 Form 10-Q filings, Alphabet repeated the 2017 statement that public concern about its privacy and security “could” cause harm. Id. at 696. In the 10-Qs, Alphabet also stated that there had “been no material changes” to its “risk factors” since the 2017 10- K. Id. Although news of the privacy bug had not become public at the time of the 10-Qs, we reasoned that the risks of harm to Alphabet “ripened into actual harm” when Alphabet employees discovered the privacy bug and the “new risk that this discovery would become public.” Id. at 703. The plaintiffs thus “plausibly allege[d] that Alphabet’s warning in each Form 10-Q of risks that ‘could’ or ‘may’ occur [was] misleading to a reasonable investor when Alphabet knew that those risks had materialized.” Id. at 704. As in In re Alphabet, the shareholders here adequately pleaded falsity as to the statements in Facebook’s 2016 10- AMALGAMATED BANK V. FACEBOOK, INC. 23

K that represented the risk of third parties improperly accessing and using Facebook users’ data as purely hypothetical. The shareholders pleaded with particularity that Facebook employees flagged Cambridge Analytica in September 2015 for potentially violating Facebook’s terms, that Kogan taught Facebook in November 2015 about the dataset Cambridge Analytica had compiled, and that a Facebook executive told Cambridge Analytica in December 2015 that the firm had violated Facebook’s user data policies. The shareholders also alleged that after Facebook learned in June 2016 that Cambridge Analytica lied in December 2015 about deleting the data derived from Facebook “likes,” Cambridge Analytica’s chief executive refused to certify that the data had actually been deleted. These allegations, if true, more than support the claim that Facebook was aware of Cambridge Analytica’s misconduct before February 2017, so Facebook’s statements about risk management “directly contradict[ed]” what the company knew when it filed its 2016 10-K with the SEC. Glazer II, 63 F.4th at 764. Referencing Facebook’s risk statements as including damage to its business, reputation, and competitive position, the dissent asserts that the risk statements in Facebook’s 2016 10-K were not false or materially misleading because they “do not represent that Facebook was free from significant breaches at the time of the filing.” The inadequacy of the risk statements, however, is not that Facebook did not disclose Cambridge Analytica’s breach of its security practices. Instead, the problem is that Facebook represented the risk of improper access to or disclosure of Facebook user data as purely hypothetical when that exact risk had already transpired. A reasonable investor reading the 10-K would have understood the risk of a third party 24 AMALGAMATED BANK V. FACEBOOK, INC.

accessing and utilizing Facebook user data improperly to be merely conjectural. The dissent’s suggestion that the shareholders have not adequately pleaded falsity because they “have not sufficiently alleged that Facebook knew that its reputation and business were already harmed at the time of the filing of the 10-K” fares no better. Our case law does not require harm to have materialized for a statement to be materially misleading. Facebook’s statement was plausibly materially misleading even if Facebook did not yet know the extent of the reputational harm it would suffer as a result of the breach: Because Facebook presented the prospect of a breach as purely hypothetical when it had already occurred, such a statement could be misleading even if the magnitude of the ensuing harm was still unknown. Put differently, a company may make a materially misleading statement when it “speaks entirely of as-yet-unrealized risks” when the risks have “already come to fruition.” Berson v. Applied Signal Tech., 527 F.3d 982, 987 (9th Cir. 2008); see also In re Alphabet, 1 F.4th at 702–05 (holding that risk statements in Alphabet’s SEC filings were materially misleading even where Alphabet’s identified harm of damage to its “business, financial condition, results of operations,” and more had not yet materialized at the time of the filings). The mere fact that Facebook did not know whether its reputation was already harmed when filing the 10-K does not avoid the reality that it “create[d] an impression of a state of affairs that differ[ed] in a material way from the one that actually exist[ed].” Brody, 280 F.3d at 1006. The dissent endeavors to distinguish In re Alphabet by explaining that before Alphabet made SEC filings containing material misstatements, it circulated an internal memorandum detailing that there would be immediate AMALGAMATED BANK V. FACEBOOK, INC. 25

regulatory scrutiny if the public discovered its privacy bug. While true, our holding did not rest on the internal memorandum to conclude that the statements were plausibly materially misleading; instead, we reasoned that a warning of “risks that ‘could’ or ‘may’ occur is misleading to a reasonable investor when Alphabet knew that those risks”— the privacy bug itself—“had materialized.” 1 F.4th at 704. Here, as in In re Alphabet, it is the fact of the breach itself, rather than the anticipation of reputational or financial harm, that caused anticipatory statements to be materially misleading. The shareholders have therefore adequately pleaded that the risk statements in Facebook’s 2016 10-K directly contradicted what Facebook knew at the time such that, in the dissent’s words, Facebook “knew a risk had come to fruition” and “chose to bury it.” Notably, although the dissent seemingly perceives it otherwise, the extent of Cambridge Analytica’s misconduct was not yet public when Facebook filed its 2016 10-K. At the time, the articles in The Guardian and The Washington Post had alerted readers that Cambridge Analytica collected data from “a massive pool of mainly unwitting US Facebook users.” But the Guardian article quoted a Facebook spokesperson saying that the company would take “swift action” if Cambridge Analytica was found to have violated Facebook’s policies, as well as a Ted Cruz spokesperson saying that the data was acquired legally and with the permission of Facebook users. In response to the article, Facebook stated it was “carefully investigating.” Although the articles may have raised concerns about Cambridge Analytica’s conduct, Facebook did not confirm before the 2016 10-K was filed that Cambridge Analytica had acted improperly or whether Facebook had taken the “swift action” promised if it learned of violations. 26 AMALGAMATED BANK V. FACEBOOK, INC.

Indeed, Facebook’s first public statement about the results of its investigation—which came in March 2017, a month after the 2016 10-K was filed—represented that no misconduct had been discovered. At the time the 10-K was filed in February 2017, the news of Cambridge Analytica’s misconduct was far from “transmitted to the public with a degree of intensity and credibility sufficient to effectively counterbalance any misleading impression.” Provenz, 102 F.3d at 1493 (citation omitted). Importantly, and contrary to the dissent’s position, the placement of the risk statements in Facebook’s 2016 10-K alongside the possibilities of cyberattacks, hacking, and phishing, which the shareholders do not allege had materialized at the time of the 10-K, does not rescue Facebook’s omission that the risk of improper access and disclosure had occurred from being materially misleading. A close read of the 10-K reveals that the stated hypothetical risks included the risk of a third-party developer harvesting Facebook users’ data without their consent. Indeed, the title of the 10-K subsection in which the risk statements appeared included the statement that “improper access to or disclosure of” Facebook’s “user data” could harm the company’s reputation and business. The subsection itself stated that “[a]ny failure to prevent or mitigate security breaches and improper access to or disclosure of our data or user data could result in the loss or misuse of such data.” Kogan and Cambridge Analytica’s actions, while not a cyberattack, hacking, or phishing, fit the bill of Facebook failing to prevent or mitigate improper access to or disclosure of Facebook data. The risk of a third-party improperly accessing Facebook user data through methods other than hacking, phishing, or any other security breach was prominent throughout the subsection and covered the AMALGAMATED BANK V. FACEBOOK, INC. 27

claimed misconduct of Cambridge Analytica. Collapsing the risks of improper access to and use of Facebook users’ data in the same section as the risk of cyberattacks cannot rescue the risk statements from being false or materially misleading. Additionally, Facebook’s disclosure that “computer malware, viruses, social engineering (predominantly spear phishing attacks), and general hacking have become more prevalent in our industry, have occurred on our systems in the past, and will occur on our systems in the future” does not bring the risk statements within the protection of the PSLRA’s safe harbor provision for forward-looking statements. Under the safe harbor, a company is not liable for a forward-looking statement “accompanied by meaningful cautionary statements identifying important factors that could cause actual results to differ materially from those in the forward-looking statement.” Glazer II, 63 F.4th at 767 (quoting 15 U.S.C. § 78u-5(c)(1)(A)). Our recent decision in Weston Family Partnership v. Twitter, Inc., 29 F.4th 611 (9th Cir. 2022), provides a good illustration of statements falling within the safe harbor provision. There, Twitter disclosed its plan to improve the “stability, performance, and flexibility,” of its mobile app promotion product gradually “over multiple quarters” and made clear that the company was “not there yet” in terms of its stability goals. Id. at 616. At the time, Twitter knew of a software bug affecting its mobile app promotion product but did not disclose the bug’s impact. Id. We explained that Twitter’s disclosure was both forward-looking and accompanied by the type of “meaningful cautionary language” necessary to invoke the safe harbor provision despite the nondisclosure of the software bug. Id. at 623. 28 AMALGAMATED BANK V. FACEBOOK, INC.

Here, rather than making cautionary forward-looking statements, Facebook warned that it could not provide “absolute security,” that it would continue to be subject to cyberattacks, and that third parties with inadequate data security practices could compromise users’ data. Such broad pronouncements without meaningful acknowledgement of the known risks of improper data access and disclosure does not suffice to invoke the safe harbor provision. There is a big chasm between “absolute security” and sidestepping the reality of what Facebook allegedly knew about the compromised data. At this stage, the shareholders adequately pleaded falsity as to the statements warning that misuse of Facebook users’ data could harm Facebook’s business, reputation, and competitive position and the district court erred by dismissing the complaint as to those statements. The district court, however, correctly dismissed the challenged statements regarding the risk of security breaches and the risk of the public not perceiving Facebook’s products to be “useful, reliable, and trustworthy.” Those statements do not relate to the misuse of Facebook user data by Cambridge Analytica, and the shareholders do not allege that those risks had materialized at the time of the 2016 10-K such that they were false or materially misleading. We leave to the district court on remand whether the shareholders can satisfy the other elements of the claims with respect to risk statements. B. Cambridge Analytica Investigation Statements The challenged Cambridge Analytica investigation statements include statements made by a Facebook spokesperson to journalists in March 2017 that Facebook’s internal investigation into Cambridge Analytica had “not uncovered anything that suggest[ed] wrongdoing” related to AMALGAMATED BANK V. FACEBOOK, INC. 29

Cambridge Analytica’s work on the Brexit and Trump campaigns. The district court held that the shareholders failed to plead scienter as to the Cambridge Analytica investigation statements. We agree. To plead scienter, the shareholders “must ‘state with particularity facts giving rise to a strong inference that the defendant acted with the required state of mind.’” Glazer II, 63 F.4th at 766 (quoting 15 U.S.C. § 78u-4(b)(2)(A)). “A ‘strong inference’ exists ‘if a reasonable person would deem the inference of scienter cogent and at least as compelling as any opposing inference one could draw from the facts alleged.’” Id. (quoting Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551 U.S. 308, 324 (2007)). For obvious reasons, an actionably misleading statement must be made by a spokesperson “who has actual or apparent authority.” In re ChinaCast Educ. Corp. Sec. Litig., 809 F.3d 471, 476 (9th Cir. 2015) (quoting Hollinger v. Titan Cap. Corp., 914 F.2d 1564, 1577 n.28 (9th Cir. 1990)). Thus, “a key inquiry” in evaluating a motion to dismiss “is whether the complaint sufficiently alleges scienter attributable to the corporation.” Id. at 479. Of first order is identifying “whether the complaint adequately alleged that the maker omitted material information knowingly, intentionally, or with deliberate recklessness.” In re Alphabet, 1 F.4th at 705. “Deliberate recklessness is a higher standard than mere recklessness and requires more than a motive to commit fraud.” Glazer II, 63 F.4th at 765 (quoting Schueneman v. Arena Pharms., Inc., 840 F.3d 698, 705 (9th Cir. 2016)). Instead, “deliberate recklessness” involves “an extreme departure from the standards of ordinary care” that presents “a danger of misleading buyers or sellers” that “is so obvious” that the 30 AMALGAMATED BANK V. FACEBOOK, INC.

spokesperson “must have been aware of it.” Id. (quoting Schueneman, 840 F.3d at 705). Simply raising an inference that a company’s executive “should have” discovered misconduct, not that the executive actually knew of misconduct, is insufficient “to meet the stringent scienter pleading requirements of the PSLRA.” Glazer Cap. Mgmt., LP v. Magistri (Glazer I), 549 F.3d 736, 748–49 (9th Cir. 2008). In Glazer I, the defendant CEO signed a merger agreement before announcing months later that an investigation early in the merger-related due diligence process uncovered possible Foreign Corrupt Practices Act violations. Id. at 740. The plaintiffs argued that because the violations were discovered early, information about the violations “must have been readily available and therefore known to [the CEO] when he signed the merger agreement.” Id. at 748. We held that the CEO learning of the violations shortly after due diligence was not enough “to create a strong inference of scienter.” Id. The only strong inference to be drawn was that the CEO should have known of the possible violations, not that he actually knew about them, which was insufficient to plead scienter. Id. As in Glazer I, the shareholders pleaded only that the Facebook spokesperson should have known that Facebook’s investigation into Cambridge Analytica had uncovered misconduct, not that the spokesperson actually knew of any misconduct or even that there was a strong inference of an “intent to deceive, manipulate, or defraud.” Id. at 742 (quoting Ernst & Ernst v. Hochfelder, 425 U.S. 185, 193 n.12 (1976)). The mere reference by an unidentified spokesperson to Facebook’s investigation is insufficient to show that the spokesperson knowingly or intentionally made false or materially misleading statements about the AMALGAMATED BANK V. FACEBOOK, INC. 31

investigation. The shareholders’ allegations do not rise to the level of showing that it was “so obvious” that Facebook’s investigation had uncovered misconduct related to Cambridge Analytica’s political work that the spokesperson “must have been aware of it.” Glazer II, 63 F.4th at 765 (citation omitted). Although one might reasonably expect the spokesperson to have verified the accuracy of the statements before making them, securities fraud actions are not tort actions, and “[m]ere negligence — even head-scratching mistakes — does not amount to fraud.” Prodanova v. H.C. Wainwright & Co., 993 F.3d 1097, 1103 (9th Cir. 2021). Nothing in the complaint suggests that the Cambridge Analytica investigation statements involved an extreme departure from the standards of ordinary care, and the shareholders thus fall short of raising a strong inference that the spokesperson acted with the necessary malintent. In light of the absence of scienter, we need not assess the alleged falsity of the statements. We affirm the district court’s dismissal of the allegations and agree that the shareholders failed to plead scienter as to the Cambridge Analytica investigation statements. C. User Control Statements Throughout the class period, Facebook made several statements about users’ control over their personal data. The statements assured Facebook users that they had control over their information and content on Facebook and that Facebook’s priorities of transparency and user control aligned with the GDPR framework. The following Facebook statements are illustrative: “People can control the audience for their posts and the apps that can receive their data,” “[e]very person gets to control who gets to see their 32 AMALGAMATED BANK V. FACEBOOK, INC.

content,” and “[w]e respected the privacy settings that people had in place.” The shareholders assert that Facebook’s stock price dropped after reporting on the Cambridge Analytica scandal in March 2018 and Facebook’s whitelisting policy in June 2018 revealed the falsity of Facebook’s statements about users’ control over their data. They allege that the stock price drops caused them to suffer economic loss. Pleading loss causation requires a showing that the “share price fell significantly after the truth became known.” In re Oracle Corp. Sec. Litig., 627 F.3d 376, 392 (9th Cir. 2010) (quoting Dura Pharms., Inc. v. Broudo, 544 U.S. 336, 347 (2005)). “[L]oss causation is simply a variant of proximate cause.” Lloyd v. CVB Fin. Corp., 811 F.3d 1200, 1210 (9th Cir. 2016). The shareholders must show that Facebook’s “misstatement, as opposed to some other fact, foreseeably caused the plaintiff’s loss.” Id. The shareholders’ “burden of pleading loss causation is typically satisfied by allegations that the defendant revealed the truth through ‘corrective disclosures’ which ‘caused the company’s stock price to drop and investors to lose money.’” Id. at 1209 (quoting Halliburton Co. v. Erica P. John Fund, Inc., 573 U.S. 258, 264 (2014)). “At the pleading stage, the plaintiff’s task is to allege with particularity facts ‘plausibly suggesting’ that [such] showings can be made.” In re BofI Holding, Inc., Sec. Litig., 977 F.3d 781, 791 (9th Cir. 2020) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 557 (2007)); see also Or. Pub. Emps. Ret. Fund v. Apollo Grp., Inc., 774 F.3d 598, 605 (9th Cir. 2014) (“Rule 9(b) applies to all elements of a securities fraud action, including loss causation.”); accord Katyle v. Penn Nat’l Gaming, Inc., 637 F.3d 462, 471 (4th Cir. 2011). “So long as the complaint alleges facts that, if taken as true, AMALGAMATED BANK V. FACEBOOK, INC. 33

plausibly establish loss causation, a Rule 12(b)(6) dismissal is inappropriate.” Grigsby v. BofI Holding, Inc., 979 F.3d 1198, 1206 (9th Cir. 2020) (quoting In re Gilead Sci. Sec. Litig., 536 F.3d 1049, 1057 (9th Cir. 2008)). As an initial matter, the district court correctly held that the shareholders failed to plead sufficiently that Facebook’s statements about the company’s commitment to transparency and control in line with the GDPR framework violated Section 10(b) and Rule 10b-5. As Facebook notes, those statements “merely reiterated Facebook’s ongoing commitment to ‘transparency and control’” rather than assuring users they controlled their Facebook data, and thus were not false when they were made. Further, the June 2018 whitelisting revelation, which was unaccompanied by a stock price drop, is not actionable. See Lloyd, 811 F.3d at 1210. We affirm the dismissal of the statements related to Facebook’s goals of transparency and control, and the June 2018 whitelisting revelation as a standalone claim. However, we reverse the dismissal as to other statements related to the stock drops. 1. March 2018 Stock Price Drop Most of the challenged user control statements occurred after the March 16, 2018, revelation about Cambridge Analytica and thus cannot be pegged to the March 2018 stock price drop. However, the user control statements that preceded the revelation are relevant here, and the shareholders adequately pleaded loss causation as to the statements assuring users that they control their content and information on the platform. The shareholders adequately pleaded that the March 2018 revelation about Cambridge Analytica was the first time Facebook investors were alerted that Facebook users 34 AMALGAMATED BANK V. FACEBOOK, INC.

did not have complete control over their own data. As previously discussed, the 2015 and 2016 articles in The Guardian and The Washington Post did not reveal that Cambridge Analytica had misused Facebook users’ data. Facebook’s public response to the Guardian article in 2015 was that it was “carefully investigating” Cambridge Analytica. The shareholders also adequately allege that Facebook did not make public statements about the Cambridge Analytica issue between 2015 and 2018. Before the March 2018 news broke, reasonable investors would not have known that Cambridge Analytica had improperly accessed Facebook users’ data such that users did not have control over their personal information on the platform. In the week that followed the revelation, Facebook’s stock dropped nearly 18%, representing a loss of over $100 billion in market capitalization and plausibly causing economic loss for the shareholders. The Cambridge Analytica revelation thus satisfies the pleading criteria for a corrective disclosure, which requires allegations that “the defendant’s fraud was ‘revealed to the market and caused the resulting loss[].’” Grigsby, 979 F.3d at 1205 (emphasis omitted) (quoting Loos v. Immersion Corp., 762 F.3d 880, 887 (9th Cir. 2014)). A disclosure is not corrective if the information comes entirely from public sources “of which the stock market was presumed to be aware.” Id. (quoting Loos, 762 F.3d at 889). Here, because the 2015 and 2016 articles about Cambridge Analytica did not provide investors the necessary information to learn that Facebook users did not control their data, the shareholders adequately alleged that the March 2018 revelation was a corrective disclosure as to Facebook’s statements that users control their data on the platform. We reverse the district AMALGAMATED BANK V. FACEBOOK, INC. 35

court’s dismissal of Facebook’s statements about users controlling their own Facebook data that preceded the March 16, 2018, revelation. 2. July 2018 Stock Price Drop The July 2018 drop occurred immediately after Facebook’s disappointing earnings report and was tied to approximately $100 billion of shareholder value loss. At the time, it was the largest single-day stock price drop in U.S. history. The question is whether the shareholders adequately pleaded loss causation as to Facebook’s user control statements predating the March 16, 2018, Cambridge Analytica revelation and the June 3, 2018, whitelisting revelation, even though the stock drop did not occur until July 25, 2018. Because loss causation requires that the defendant’s misstatement, rather than some other fact, foreseeably caused the plaintiff’s loss, establishing loss causation requires more than “an earnings miss” or the market’s reaction to a company’s “poor financial health generally.” In re Oracle, 627 F.3d at 392. Simply pleading “that the market reacted to the purported ‘impact’ of the alleged fraud—the earnings miss—rather than to the fraudulent acts themselves” is not sufficient. Id. Illustrative of a disconnect between earnings and causation is In re Oracle, where the shareholders argued that Oracle’s misstatements regarding the “quality and success” of its Suite 11i product, rather than its struggling financial health, caused the company’s stock price to drop. Id. at 392– 93. The shareholders posited that because the stock price drop occurred immediately after the truth about Suite 11i became public, the revelation of the truth must have caused the price drop. Id. In affirming summary judgment for 36 AMALGAMATED BANK V. FACEBOOK, INC.

Oracle, we explained that the “overwhelming evidence produced during discovery indicate[d] the market understood Oracle’s earnings miss to be a result of several deals lost in the final weeks of the quarter due to customer concern over the declining economy,” not the alleged Suite 11i fraud. Id. at 393. Another wrinkle here is whether loss causation allegations can survive a motion to dismiss even when the stock price drop did not immediately follow the revelation of the misstatement. In In re Gilead, the market learned in August 2003 that Gilead had aggressively marketed a drug by claiming that the company had “carefully complied with federal and state regulations” when, in fact, a warning letter from the Food and Drug Administration had informed Gilead that its marketing claims were unlawful. 536 F.3d at 1051. Gilead’s stock price did not drop until October 2003, following a press release revealing “less-than-expected revenues.” Id. at 1054, 1058. Despite the time gap between the revelation and the stock price drop, the shareholders claimed that Gilead’s misrepresentations caused its stock price to inflate, and the subsequent disappointing revenue performance and stock price drop sufficed to plead loss causation. Id. at 1056. Acknowledging the time gap, we held that the shareholders adequately pleaded loss causation and reiterated that there is no “bright-line rule requiring an immediate market reaction” after a revelation because “[t]he market is subject to distortions that prevent the ideal of a free and open public market from occurring.” Id. at 1057–58 (alteration in original) (citation omitted). Accordingly, the shareholders plausibly alleged that Gilead’s stock price drop occurred immediately after the company revealed its disappointing revenue numbers, and the drop was caused by AMALGAMATED BANK V. FACEBOOK, INC. 37

lower demand resulting from the warning letters. Id. As we explained, it was reasonable for the public to fail to appreciate the significance of the warning letters until learning of Gilead’s disappointing revenue posting. Id. Because the shareholders pleaded sufficient facts to raise a reasonable expectation that discovery would reveal evidence of the warning letter’s “effect on demand,” the loss causation claim survived Gilead’s motion to dismiss. Id. at 1058. For Facebook’s July 2018 stock price drop to be actionable, it must be because Facebook’s earnings report revealed new information to the market; specifically, that Facebook’s Q2 earnings call in July 2018 allowed the public to “appreciate [the] significance” of the Cambridge Analytica and whitelisting scandals. Id. The disappointing Q2 earnings performance alone cannot satisfy the shareholders’ burden of pleading loss causation. Here, as in In re Gilead, the shareholders adequately pleaded that the Cambridge Analytica and whitelisting revelations, not any other factor, caused the July 2018 stock price drop. Although the stock drop occurred nearly two months after the whitelisting revelation, the shareholders allege with particularity that the drop was caused by “dramatically lowered user engagement, substantially decreased advertising revenue and earnings, and reduced growth expectations going forward” on account of the Cambridge Analytica and whitelisting scandals. The shareholders further detail how the GDPR rollout had little impact on the July 2018 earnings report, and how investors and market analysts explicitly connected the revenue drop to the scandals. These allegations suffice to plausibly plead “a causal relationship” between the Cambridge Analytica and whitelisting revelations and the dramatic drop in Facebook’s stock price. Id. at 1057; see also Grigsby, 979 F.3d at 1206 38 AMALGAMATED BANK V. FACEBOOK, INC.

(emphasizing that while “plaintiffs must satisfy the particularity standard of Rule 9(b),” that standard “does not require that the causation inference be more than ‘plausible’”). We emphasize that this case is at the very early motion to dismiss stage, and that discovery and further proceedings are necessary to illuminate the issues surrounding loss causation. Our dissenting colleague would affirm the district court’s dismissal of the user control statements as they relate to the Cambridge Analytica revelation. Stated differently, the dissent would hold that only the July 2018 stock price drop was actionable, and only as to the whitelisting revelation, not the Cambridge Analytica revelation. In support, the dissent contends that the 2018 “Cambridge Analytica disclosures did not make the user control statements materially false,” because “Cambridge Analytica’s lies to Facebook and its continued violation of Facebook’s privacy policies do not mean that Facebook’s privacy protections do not actually exist.” But the question is not whether and when Cambridge Analytica lied to Facebook, but whether and when Facebook learned of Cambridge Analytica’s deception. It is true that in January 2016, Cambridge Analytica agreed to delete the personality score data it harvested from Facebook. But recall that the shareholders pleaded that Facebook had reason to know in June 2016—only five months later—that Cambridge Analytica had received much more information from Facebook than just the personality score data and that Cambridge Analytica was still using a model based on the data in violation of Facebook’s policies. The shareholders further allege that when Facebook found out, it tried to require Cambridge Analytica’s CEO to certify that all data harvested from the personality quiz was deleted, but the AMALGAMATED BANK V. FACEBOOK, INC. 39

CEO refused to do so. Thus, the shareholders pleaded with particularity that Facebook knew Cambridge Analytica did not delete all the data it had improperly accessed. We agree with the dissent that “a supposed bad actor violating Facebook’s privacy controls to improperly access user data doesn’t make the company’s statements about its policies misleading.” But labeling Cambridge Analytica as a “bad actor” is not the issue. It was not Cambridge Analytica’s deception that made Facebook’s user control statements misleading. Rather, it was that Facebook knew Cambridge Analytica retained access to improperly collected user data after Cambridge Analytica certified that it had deleted the personality score data, and Facebook nonetheless falsely represented to users that they had control over their data on the platform. The shareholders adequately pleaded loss causation as to the stock price drops that occurred after the Cambridge Analytica revelation in March and July 2018. Accordingly, we reverse the district court’s dismissal of Facebook’s statements regarding data control that predated the June 3, 2018, whitelisting revelation. III. CONCLUSION We affirm in part and reverse in part as to dismissal based on the risk statements and user control statements, and we affirm as to dismissal based on the Cambridge Analytica investigation statements. Specifically, we affirm the dismissal of the statements in ¶¶ 503–05, 530, 533, and 537– 38 of the Third Amended Complaint, reverse the district court’s dismissal of the statements in ¶¶ 501–02, 507–14, 519, and 525, and remand for further proceedings. Each party shall bear its own costs. AFFIRMED IN PART, REVERSED IN PART, AND REMANDED IN PART. 40 AMALGAMATED BANK V. FACEBOOK, INC.

BUMATAY, J., concurring in part and dissenting in part:

At issue here are three general categories of alleged false statements: (1) statements about Facebook’s risk factors, (2) statements about Facebook’s investigation of Cambridge Analytica, and (3) statements about Facebook users’ control over their data. I join the majority in holding that the plaintiff Shareholders failed to sufficiently allege a falsity in the second category—Facebook’s Cambridge Analytica investigation statements. I also join the majority in holding that Shareholders did allege a falsity and loss from the third category of user control statements—but only as those statements relate to Facebook’s practice of “whitelisting.” So I disagree with the majority on two fundamental points. First, Shareholders failed to sufficiently allege that Facebook’s risk factor statements in its public filings were fraudulent. Second, Shareholders didn’t show that Facebook’s user control statements were false based on the Cambridge Analytica revelations. I briefly set out my disagreement below. I. Risk Factor Statements Federal securities law creates no “affirmative duty to disclose any and all material information.” Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27, 44 (2011). Rather, companies must disclose information “only when necessary ‘to make . . . statements made, in light of the circumstances under which they were made, not misleading.’” Id. (quoting 17 CFR § 240.10b–5(b)). Thus, companies “can control what they have to disclose . . . by controlling what they say to the market.” Id. at 45. AMALGAMATED BANK V. FACEBOOK, INC. 41

Indeed, companies have no “obligation to offer an instantaneous update of every internal” or “fleeting” development. Weston Fam. P’ship LLLP v. Twitter, Inc., 29 F.4th 611, 620 (9th Cir. 2022). Instead, a “company must disclose a negative internal development only if its omission would make other statements materially misleading.” Id. Put differently, statements and omissions are actionable only if they “directly contradict what the defendant knew at that time,” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1008 (9th Cir. 2018), or “create an impression of a state of affairs that differs in a material way from the one that actually exists,” Brody v. Transitional Hosps. Corp., 280 F.3d 997, 1006 (9th Cir. 2002). In assessing this question, we look to the “total mix” of information available to the reasonable investor and whether the alleged misstatement “significantly altered” the decision-making of the reasonable investor. Retail Wholesale & Dep’t Store Union Loc. 338 Ret. Fund v. Hewlett-Packard Co., 845 F.3d 1268, 1274 (9th Cir. 2017) (simplified); see also In re Syntex Corp. Sec. Litig., 95 F.3d 922, 929 (9th Cir. 1996) (requiring evaluation of the “statement in full and in context at the time it was made”). Shareholders’ allegations stem from Facebook’s 2016 SEC Form 10-K “Risk Factors” statements, dated February 3, 2017. Facebook made these statements in the context of the following bolded headline:

• “Security breaches and improper access to or disclosure of our data or user data, or other hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business.” 42 AMALGAMATED BANK V. FACEBOOK, INC.

Under that header, Facebook gave these warnings:

• “Any failure to prevent or mitigate security breaches and improper access to or disclosure of our data or user data could result in the loss or misuse of such data, which could harm our business and reputation and diminish our competitive position.” • “We provide limited information to . . . third parties based on the scope of services provided to us. However, if these third parties or developers fail to adopt or adhere to adequate data security practices . . . our data or our users’ data may be improperly accessed, used, or disclosed.”

Shareholders argue—and the majority agrees—that all three of these statements are misleading because, by February 2017, Facebook already knew that Cambridge Analytica had gained improper access to the data of tens of millions of Facebook users. According to the majority, this means that the statements directly contradicted what the company knew when it filed its 10-K. There’s a problem with this analysis. Even if Facebook knew about the full extent of the so-called Cambridge Analytica scandal at this point, none of this makes the risk factor statements false. Recall the facts of the scandal. In 2015, Facebook became aware that Cambridge Analytica— through a consulting academic—had developed a personality quiz that harvested data from more than thirty million Facebook users, often without the users’ consent. AMALGAMATED BANK V. FACEBOOK, INC. 43

This quiz gave Cambridge Analytica access to Facebook users’ name, gender, location, birthdate, “likes,” and “friends,” which made it possible to develop an algorithm to sort Facebook users according to personality traits. Cambridge Analytica then allegedly used that algorithm to help political campaigns. Regardless of the severity of Cambridge Analytica’s alleged misconduct, a careful reading of the 10-K statements shows that these risk factor statements warn about harm to Facebook’s “business” and “reputation” that “could” materialize based on improper access to Facebook users’ data—not about the occurrence or non-occurrence of data breaches. How do we know that? Well, the statements say so. The first and second statements expressly advise that improper breaches “could harm” Facebook’s “business” and “reputation.” And although the third statement does not expressly mention business and reputational harm, we know that is its focus for two reasons. First, Facebook reported the statement under the bolded section about breaches and improper actions “could harm [Facebook’s] reputation and adversely affect our business.” Second, the very next sentence places that statement into more context: “Affected users or government authorities could initiate legal or regulatory actions against us in connection with any security breaches or improper disclosure of data, which could cause us to incur significant expense and liability or result in orders or consent decrees forcing us to modify our business practices.” Taken together, Facebook’s risk factor statements warn about harm to its “reputation” and “business” that may come to light if the public or the government learns about improper 44 AMALGAMATED BANK V. FACEBOOK, INC.

access to its data. These statements do not represent that Facebook was free from significant breaches at the time of the filing. And if a reasonable investor thought so based on Facebook’s 10-K statements, that “reasonable” investor wasn’t acting so reasonably. Indeed, within the same section, Facebook warned that “computer malware, viruses, social engineering (predominantly spear phishing attacks), and general hacking have become more prevalent in our industry, have occurred on our systems in the past, and will occur on our systems in the future.” Facebook expressly advised that it experienced previous attempts to swipe its data and that it would continue to face such threats. Beyond Facebook’s own statements, much about the Cambridge Analytica scandal was already public. In a December 2015 article, The Guardian reported that Cambridge Analytica had harvested data from “tens of millions” of Facebook users “without their permission.” 1 These are the same facts Shareholders use to claim Facebook deceived the public with more than two years later. So, on their face, none of the 10-K risk factor statements are false or misleading. The statements advise that improper access to data could harm Facebook’s reputation and business. And Shareholders have not sufficiently alleged that Facebook knew its reputation and business were already harmed at the time of the filing of the 10-K. Nor do they allege that Facebook was aware of government entities or users launching regulatory or legal actions based on the Cambridge Analytica scandal in February 2017.

1 See Harry Davies, Ted Cruz Using Firm that Harvested Data on Millions of Unwitting Facebook Users, The Guardian (Dec. 11, 2015), https://www.theguardian.com/us-news/2015/dec/11/senator-ted-cruz- president-campaign-facebook-user-data. AMALGAMATED BANK V. FACEBOOK, INC. 45

While acknowledging these shortcomings in the Shareholders’ complaint, the majority takes the surprisingly broad view that it’s irrelevant that “Facebook did not know whether its reputation was . . . harmed” at the time of the 10- K filing. Maj. Op. 24. The majority instead asserts that it’s enough that a breach had occurred, never mind whether the breach led to a discernible effect on Facebook’s reputation or business at the time. Id. The majority goes so far as to say that a fraud occurs even if the harm caused by the breach was completely “unknown” to Facebook. Id. But if it was “unknown” whether the breach led to reputational or business harm, it’s hard to see how the risk factor statements were untrue. Stating that harm could result from a breach is not falsified by some “unknown” possibility of harm from a breach. In other words, Facebook’s risk factor statements could not “directly contradict what the defendant knew at that time” if any harm was unknown to Facebook at the time. Khoja, 899 F.3d at 1008. 2 And In re Alphabet, Inc. Securities Litigation, 1 F.4th 687 (9th Cir. 2021), doesn’t transform every risk statement into a false or misleading statement if a risk later comes to fruition. Nor does it create a new requirement that a

2 Given the majority’s analysis of these statements, it’s difficult to see how Shareholders can ever satisfy the scienter requirement. Indeed, “[a] complaint will survive . . . only if a reasonable person would deem the inference of scienter cogent and at least as compelling as any opposing inference one could draw from the facts alleged.” Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 324 (2007). Such a strong inference requires an “intent to deceive, manipulate, or defraud,” or “deliberate recklessness”—which is “an extreme departure from the standards of ordinary care.” Schueneman v. Arena Pharmaceuticals, Inc., 840 F.3d 698, 705 (9th Cir. 2016). If the harm from Cambridge Analytica’s breach was unknown at the time of the filing of the 10-K, it’s doubtful this standard can be met. 46 AMALGAMATED BANK V. FACEBOOK, INC.

company disclose every bad thing that ever happened to it. In that case, Alphabet stated in two quarterly disclosure forms that certain risks “could adversely affect our business, financial condition, [and] results of operations,” but that “[t]here have been no material changes to our risk factors since our [last] Annual Report on Form 10-K.” 1 F.4th at 696 (simplified). What Alphabet didn’t disclose is that, before the reports came out, its internal Google investigators had discovered a software glitch in one of its programs that allowed third parties to collect users’ private data. Id. at 695. Google’s legal and policy staff quickly recognized the problem and warned in an internal memorandum that these security issues would likely trigger an immediate regulatory response and cause its senior executives to testify before Congress. Id. at 696. When news inevitably broke six months later, Alphabet’s shares plummeted in value and, sure enough, there were calls for government investigation. Id. at 697. We concluded that “[r]isk disclosures that speak entirely of as-yet-unrealized risks and contingencies and do not alert the reader that some of these risks may already have come to fruition can mislead reasonable investors.” Id. at 703 (simplified). In Alphabet’s case, the “warning in each [quarterly report] of risks that ‘could’ or ‘may’ occur [was] misleading to a reasonable investor [because] Alphabet knew that those risks had materialized.” Id. at 704. Contrary to the majority’s assertion, this case is nothing like Alphabet. In Alphabet, the company knew a risk had come to fruition—set out as clear as day in an internal company memo—that a data bug would cause it greater regulatory scrutiny. Id. at 696. Rather than disclose its assessment, Alphabet chose to bury it and even stated that no material changes existed in its risk factors. Id. at 696–97, 703. Here, Facebook might have known of breaches of its AMALGAMATED BANK V. FACEBOOK, INC. 47

data—even potentially serious breaches—when it gave its risk statements, but Shareholders don’t allege that Facebook knew that those breaches would lead to immediate harm to its business or reputation. As the majority concedes, the harm from Cambridge Analytica’s breach of Facebook’s policies was “unknown” at the time of the 10-K filing. See Maj. Op. 24. Nor did Facebook lull investors into complacency by suggesting that nothing had changed on its risks front. These facts make all the difference here. Cf. Weston, 29 F.4th at 621 (dismissing fraud claims alleging that Twitter’s risk warning statement—that its “product and services may contain undetected software errors, which could harm our business and operating results”—was misleading because the risk had materialized by then). Because Facebook did not present false or misleading risk statements, and Alphabet did not modify a common- sense understanding of truthfulness and disclosure, we should have affirmed the dismissal of this claim. II. User Control Statements The next category of alleged falsehoods concerns Facebook’s representations that users control their data and information. During the relevant period for this lawsuit, Facebook and its executives made various statements emphasizing users’ control over the data they shared with Facebook, such as—

• “You own all of the content and information you post on Facebook, and you can control how it is shared through your privacy and application settings.” Facebook’s Statement of Rights and 48 AMALGAMATED BANK V. FACEBOOK, INC.

Responsibilities web page, ~ January 30, 2015 to May 25, 2018. • “[W]hen you share on Facebook you need to know . . . . No one is going to get your data that shouldn’t have it. That we’re not going to make money in ways that you would feel uncomfortable with off your data. And that you’re controlling who you share with . . . . Privacy for us is making sure that you feel secure, sharing on Facebook.” Sheryl Sandberg, Axios interview, October 12, 2017. • “Our apps have long been focused on giving people transparency and control . . . .” Sheryl Sandberg, Facebook Gather Conference, January 23, 2018.

A. Shareholders have adequately shown that these statements were misleading based on the allegation that Facebook “whitelisted” third parties. According to the Shareholders, at the same time these statements were made, Facebook continued to allow certain “whitelisted” third parties, mostly app developers and device manufacturers, to continue to access data against a user’s wishes. Shareholders allege that Facebook overrode user privacy settings to allow these third parties access to the data of, not only the Facebook user, but that of the user’s friends as well. In fact, Facebook paid the Federal Trade Commission $5 billion to settle charges stemming from the “whitelisting” allegations. These facts are enough to plead that the statements were false—the only question is whether the statements caused AMALGAMATED BANK V. FACEBOOK, INC. 49

Shareholders any loss. See Grigsby v. BofI Holding, Inc., 979 F.3d 1198, 1204 (9th Cir. 2020) (explaining that “investors must demonstrate that the defendant’s deceptive conduct caused their claimed economic loss”) (simplified). Facebook’s “whitelisting” program became public on June 3, 2018, when the New York Times reported that Facebook shared users’ and their friends’ data with multiple “whitelisted” companies. When it comes to false statements, a plaintiff can usually show loss causation by pointing to an immediate stock drop after the falsity was uncovered. Id. at 1205 (“A plaintiff can satisfy the loss-causation pleading burden by alleging that a corrective disclosure revealed the truth of a defendant’s misrepresentation and thereby caused the company’s stock price to drop and investors to lose money.”) (simplified). The wrinkle here is that Facebook’s stock didn’t drop immediately after the whitelisting became public. It wasn’t until several weeks later—July 26, 2018, the day after Facebook announced slower growth than expected—that Facebook’s stock dropped by almost 19%. Facebook contends that this temporal gap proves that its misleading user control statements didn’t cause Shareholders any loss. But sometimes it takes time for the full scope of a loss from a misrepresentation to materialize. As In re Gilead Sciences Securities Litigation, 536 F.3d 1049, 1058 (9th Cir. 2008) recognized, a “limited temporal gap between the time a misrepresentation is publicly revealed and the subsequent decline in stock value does not render a plaintiff’s theory of loss causation per se implausible.” Indeed, in that case, three months had passed between the disclosure of Gilead’s alleged deceptive marketing practices and the stock drop after Gilead missed revenue targets. Id. at 1057–58. Despite this gap, we concluded the plaintiffs had plausibly alleged 50 AMALGAMATED BANK V. FACEBOOK, INC.

that the less-than-expected revenue was caused by lower end-user demand, which, in turn, was caused by disclosing the company’s deceptive marketing. Id. at 1058. Thus, an “immediate market reaction” is not necessary when the market might “fail[] to appreciate [the] significance” of a disclosure right away. Id. at 1057–58. So, we shouldn’t be too quick to dismiss a claim based on a delay in the manifestation of loss. In my view, it’s plausible that the whitelisting revelation made on June 18 caused user engagement and advertising revenue to diminish, which contributed to the lower earnings announced on July 25 and the immediate stock drop. Facebook counters that the European Union’s new privacy regulations—not the whitelisting revelation—caused the lower July 25 earnings. That might be right. But, at the very least, Shareholders deserve some discovery to prove their theory of loss causation. B. But the analysis of the user control statement must be different when it comes to the Cambridge Analytica scandal. Shareholders allege—and the majority agrees—that new revelations about Cambridge Analytica from March 2018 also proved Facebook’s user control statements were false. As a reminder, in late 2015, Facebook discovered that Cambridge Analytica obtained personality score data harvested from Facebook data and demanded that Cambridge Analytica delete all such data. In response, Cambridge Analytica certified to Facebook that it would delete the data. On March 16, 2018, Facebook announced that it had received reports from the media that Cambridge Analytica did not destroy the data and that it was suspending Cambridge Analytica from the platform. News reports then AMALGAMATED BANK V. FACEBOOK, INC. 51

confirmed that Cambridge Analytica continued to possess and use harvested data from Facebook. Within a week of these disclosures, Facebook’s shares dropped nearly 18%. Shareholders contend that these revelations prove the falsity of Facebook’s user control statements. These Cambridge Analytica disclosures did not make the user control statements materially false. To prevail, Shareholders must show that the Facebook user control statements “affirmatively create[d] an impression of a state of affairs that differ[ed] in a material way from the one that actually exist[ed.]” Brody, 280 F.3d at 1006. But Cambridge Analytica’s lies to Facebook and its continued violation of Facebook’s privacy policies do not mean that Facebook’s privacy protections do not actually exist. Aside from the whitelisting issue described above, Facebook seemingly described its privacy policies accurately. Cambridge Analytica’s violation of those policies doesn’t falsify them. Imagine a bank. Say that the bank announces a range of security measures to protect its customers’ money. Then consider if a bank robber defeats those measures, breaks in, and ultimately steals a bag of cash. Would anyone say that the bank lied about its security measures? Clearly, no. Here, a supposed bad actor violating Facebook’s privacy controls to improperly access user data doesn’t make the company’s statements about its policies misleading. What makes our ruling all the more odd is that much of the Cambridge Analytica scandal was already public by the time of the user control statements. The first article about it dropped in 2015. So it’s hard to see how this new “revelation” added to the “total mix” of information available to Shareholders or “significantly altered” their 52 AMALGAMATED BANK V. FACEBOOK, INC.

decision-making. See Retail Wholesale & Dep’t Store Union Loc. 338 Ret. Fund, 845 F.3d at 1274. We thus should have limited Facebook’s liability for the user control statements to the “whitelisting” allegations. III. For these reasons, I respectfully dissent from Part II.A of the majority opinion, from Part II.C as it relates to Cambridge Analytica, and from Part III.