"In re Facebook, Inc. Securities Litigation", No. 5:2018cv01725 - Document 118 (N.D. Cal. 2019)

Court Description: Order Granting Defendants' Motion to Dismiss Consolidated Class Action Complaint 93 . Signed by Judge Edward J. Davila on September 25, 2019.Plaintiff may file an amended complaint on or before 10/26/2019.(ejdlc2S, COURT STAFF) (Filed on 9/25/2019)

Download PDF
"In re Facebook, Inc. Securities Litigation" Doc. 118 1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION 7 8 9 IN RE FACEBOOK, INC. SECURITIES LITIGATION 10 United States District Court Northern District of California 11 ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS CONSOLIDATED CLASS ACTION COMPLAINT Re: Dkt. No. 93 12 13 Case No. 5:18-cv-01725-EJD This lawsuit stems from the revelation that Cambridge Analytica acquired the private 14 Facebook data of millions of users and that, upon learning of this leak, Facebook allegedly 15 attempted to suppress evidence of the breach contrary to its stated privacy policy. 16 Plaintiffs are persons who purchased shares of Facebook common stock between February 17 3, 2017 and July 25, 2018 (the “Class Period”), who believe that Mark Zuckerberg, Sheryl K. 18 Sandberg, and David M. Wehner, collectively Defendants, made materially false and misleading 19 statements and omissions in connection with the purchase and sale of Facebook stock. See 20 Consolidated Complaint (“Compl.”) ¶ 1, Dkt. 86. They allege that Defendants violated Section 21 10(b), 20(a), and 20A of the Securities Exchange Act of 1934 (the “Exchange Act”) and Rule 10b- 22 5 promulgated thereunder because Defendants made guarantees that the Cambridge Analytica, and 23 related data-privacy scandals, would not impact Facebook stock while knowing this to be false. 24 Specifically, Plaintiffs focus on Defendants’ statements and omissions “concerning Facebook’s 25 privacy and data protection practices” and their impact on Facebook’s stock price during two time 26 periods: March and July 2018. 27 28 Defendants have filed a motion to dismiss the lawsuit arguing that Plaintiffs have not, and Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 1 Dockets.Justia.com 1 cannot, meet Rule 9(b)’s heightened pleading requirements for securities fraud and instead allege 2 “an overarching hindsight theory.” Motion to Dismiss (“Mot.”) at 2, Dkt. 93. Defendants make 3 four main arguments all centered around Plaintiffs’ inability to meet the elements of securities 4 fraud. First, Defendants argue Plaintiffs have not pled an actionable misstatement or omission 5 because they have not identified any false statements. Defendants argue the 36 “actionable” 6 statements or omissions Plaintiffs raise are, in fact, neither actionable nor fraudulent because 7 Plaintiffs make no attempt to plead that Defendants lied or mislead investors. As explained infra 8 Section III.C.1.a., as to all the allegations, only Statement 22 is actionable. United States District Court Northern District of California 9 Second, Defendants argue Plaintiffs have not pled a strong inference of scienter because 10 Plaintiffs do not (1) relate the alleged misstatements to any conduct establishing scienter or (2) 11 show facts that the Defendants knew the challenged statements were false. Further, Defendants 12 contend that Plaintiffs offer only conclusions without alleging any specific facts to support these 13 conclusions. As explained infra Section III.C.2. the one actionable Statement, Statement 22 lacks 14 scienter because Plaintiffs do not allege with sufficient particularity that Defendant Sandberg 15 made the statement knowing it was false. 16 Third, Defendants contend that Plaintiffs fail to plead loss causation since Defendants had 17 already warned investors of a potential stock decline and cannot trace any corrective disclosure to 18 the stock price’s drop. Finally, Defendants argue that Plaintiffs cannot show reliance based on a 19 “fraud-on-the market” theory because the Cambridge Analytica scandal was already known a year 20 before the start of the putative class action and so the market already reacted to the data breach. 21 The Court does not reach these arguments because it GRANTS the Motion to Dismiss on 22 alternative grounds. 23 Accordingly, the Plaintiffs do not adequately plead a securities fraud violation. Here, it is 24 Plaintiffs’ burden to point to plausible and particular facts tending to show fraudulent behavior by 25 Defendants. Without such a showing, Plaintiffs cannot survive the higher evidentiary pleading 26 standard enumerated in Rule 9 of the Federal Rules of Civil Procedure. See Fed. R. Civ. Pro. 9(b). 27 Thus, for the reasons below, Defendants’ Motion to Dismiss is GRANTED. 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 2 I. United States District Court Northern District of California 1 BACKGROUND 2 A. Factual Background1 3 Facebook was founded by Mark Zuckerberg who is now the Chief Executive Officer 4 (“CEO”) of the company. Compl. ¶ 28. Sheryl Sandberg is the Chief Organization Officer 5 (“COO”) and David Wehner is the Chief Financial Officer (“CFO”) of Facebook. Id. ¶¶ 30–31. 6 Facebook is a social-media networking website that allows users to create profiles and share 7 information about themselves to their “community.” Id. ¶ 37. The platform also enables third- 8 party developers’ applications or websites (“apps”) to access users’ information. Id. ¶¶ 45–46. 9 Importantly before 2015, a user could consent to an app developer gaining access to their personal 10 data and the personal data of his or her friends (referred to herein as “third-party consent”). Id. 11 ¶ 46. 1. Relevant Agreements 12 Facebook-User Agreements. The use and sharing of data on Facebook are governed by an 13 14 agreement between Facebook and users, including Facebook’s Data Policy (also referred to as the 15 “Data Use Policy” and the “Privacy Policy”), Ex. 24 &35, and the Terms of Service (formerly 16 “Statement of Rights and Responsibilities”), Compl. ¶ 4, 60, 200, 232. These agreements explain 17 how users can control the use of their data. Id. ¶ 301(b). Before 2015, Facebook’s policies allowed users to share information about their friends 18 19 with third-party app developers, i.e. “third-party consent.” Id. ¶¶ 46, 82. Defendants subsequently 20 announced that they would overhaul Facebook’s privacy practices to better protect user data and 21 would tell people if their data was shared with Cambridge Analytica. Id. ¶ 18. Specifically, in 22 23 24 25 26 27 28 1 At points, Plaintiffs’ consolidated class action complaint can be difficult to understand—it is hard to grasp exactly what Plaintiffs allege Defendants’ misstatements and omissions were and how they constitute a securities violation. See Irving Firemen’s Relief & Ret. Fund v. Uber Techs., 2018 WL 4181954, at *6 (N.D. Cal. Aug. 31, 2018) (noting that courts in this district have rejected the “laborious deconstruction and reconstruction of a great web of scattered, vague, redundant, and often irrelevant allegations” in securities fraud cases). Often, the Complaint simply reposts entire news articles, multiple times, without explaining to this Court why Defendants’ statements therein constitute actionable fraud. See Compl. ¶¶ 230, 237, 242, 251, 261(b), 276. If Plaintiffs amend their complaint, this Court requests they make it clear what the alleged misstatement or omission is and why it meets the standards of securities fraud. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 3 1 2014, Facebook stated that changes would “dramatically limit the Facebook information apps 2 could access,” and “turn[ed] off users’ ability to provide access to their friend’s personal data.” 3 Id. ¶¶ 79, 251, 266(b), 280. However, in April 2018, it was revealed that Defendants still 4 permitted third parties to access user data, known as “whitelisting.” Id. ¶¶ 19, 140. 5 Facebook-App Developer Agreements. Third-party app developers must agree to 6 Facebook’s Platform Policies before offering apps on Facebook. ¶¶ 176, 301. This limits the use 7 and collection of user data and requires developers to explain what type of information they will 8 collect and how it will be used. Id. The policy prohibits developers from selling, licensing, or 9 purchasing user data and from transferring data to advertisers or data brokers. Id. ¶ 301(c). 10 United States District Court Northern District of California 11 2. Relevant Events Allegedly Showing Material Misstatements or Omissions Aleksandr Kogan and Cambridge Analytica. In 2013, Kogan, a professor and data 12 researcher at Cambridge University, developed an app called “thisisyourdigitallife.” Id. ¶ 80–81. 13 This app was a personality quiz; users were told that the results would be used only for academic 14 purposes. Id. ¶ 81. Around 270,000 people installed the app and consented to the sharing of their 15 data. Id. ¶¶ 81–82. Due to Facebook’s privacy policies, app developers were able to access data 16 about “thisisyourdigitallife” user’s Facebook friends. Id. 17 The December 2015 The Guardian Article and Defendants’ Response. In December 18 2015, The Guardian reported that Kogan, through his company Global Science Research (“GSR”), 19 sold information collected through the “thisisyourdigitallife” app to Cambridge Analytica, 20 violating Facebook’s policies. Id. ¶¶ 7, 150, 232, 280. This article indicated that Cambridge 21 Analytica developed voter profiles using the data of tens of millions of Facebook users, which 22 were then used for political purposes. Id. ¶¶ 80–81. Once news of the data leak broke, 23 Defendants sent Cambridge Analytica a letter asking it to delete the data and provide confirmation 24 of deletion. Id. ¶¶ 9, 90, 92, 96, 98, 150–51, 176. Defendants made no efforts to verify 25 Cambridge Analytica’s assurances that the data was deleted, investigate the extent of the use or 26 distribution of data, or verify that the data had been deleted. Id. ¶ 9. 27 28 Reemergence of the Cambridge Analytica Story in 2018. On March 17, 2018, three years Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 4 1 after the original Cambridge Analytica story broke, The New York Times and The Guardian 2 reported that Defendants delayed acting to address the Cambridge Analytica data breach and that 3 data had not been deleted but was used in connection with President Donald Trump’s campaign. 4 Id. ¶¶ 150, 153–54. These reports allegedly contradicted Defendants’ representations of data 5 protection, specifically the fact that user data could still be accessed by developers without user’s 6 knowledge or consent, i.e., whitelisting. Id. ¶ 14, 19. Facebook did, however, immediately 7 suspend Cambridge Analytica, its parent company, and Cambridge Analytica employees from the 8 Facebook platform. Id. ¶ 150. United States District Court Northern District of California 9 In response to the stories, Facebook’s common stock dropped nearly 7% on Monday, 10 March 19, 2018, the first trading day after the news broke. Id. By March 27, 2018, the stock was 11 trading as low as $152/share, a drop of nearly 18% in value from its price before the stories broke. 12 Id. ¶ 15. The Securities and Exchange Commission (“SEC”) began investigating “whether 13 Facebook adequately warned investors that developers and other third parties may have obtained 14 users’ data without their permission or in violation of Facebook policies.” Id. ¶ 16. 15 Facebook’s First Quarter 2018 Earnings Report (“1Q18”) and the GDPR. On April 25, 16 2018, Defendants released a favorable first quarter earnings report, 1Q18, which showed that user 17 growth was unaffected by the continued Cambridge Analytica scandal. Id. ¶ 21. The report had 18 quarterly revenue, earnings, and daily and monthly active user growth exceeding analyst 19 expectations. Id. ¶¶ 21, 186, 188, 190, 270–71. Although a “handful” of advertisers had “paused 20 spend” with Facebook after the Cambridge Analytica news, Defendants reported that this did not 21 appear to reflect a “meaningful trend.” Id. ¶ 274. Defendants also told investors that it anticipated 22 expenses to increase year-over-year by “50% [to] 60%,” because of the “significant investments 23 [Facebook was] making in areas like safety and security” and due to increased hiring. Id. ¶ 275. 24 The stock price climbed more than 9% following the release of this report. Id. ¶ 21. By July, 25 Facebook’s stock price was trading well above $200 per share. Id. 26 27 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 5 The new European privacy legislation, the General Data Protection Regulation2 (the 1 2 “GDPR”), became effective the month after 1Q18 was released. Defendants addressed the 3 possible impact of this legislation during the investor call. Id. ¶ 276. Defendants claimed that 4 compliance with the GDPR would not be an issue because Facebook was almost compliant. Id. 5 ¶ 20. On this call, however, Defendants noted that it was “early and difficult to know . . . in 6 advance” the business implications of the GDPR and anticipated that Facebook’s European daily 7 and monthly user base could “be flat to slightly down.” Lutz Ex. 11, at 8, 23, Dkt. 95. Defendants 8 noted that there was potential for impact and that they would monitor it closely. Id. Facebook’s Second Quarter 2018 Earnings Report (“2Q18”). The stock price increase United States District Court Northern District of California 9 10 ended on July 25, 2018 when Defendants released 2Q18, which showed a decline in total 11 revenues. Id. ¶ 21. There, Defendants reported a significant decline in user-metrics in Europe, 12 zero user growth in the United States, decelerating worldwide growth of active users, lower than 13 expected revenue and earnings, and ballooning expenses affecting profitability. Id. As a result, 14 the common stock price dropped nearly 19% on July 26, 2018, resulting in a single-day loss of 15 approximately $100 billion in market capitalization. Id. ¶ 23. By July 30, 2018, the price of stock 16 had fallen by 21%, shedding around $112 billion in market capitalization. Id. Defendants attributed the user growth slowdown to the effects of the “GDPR rollout, 17 18 consistent with the outlook we gave on the Q1 call,” but noted that the “vast majority of people 19 [had continued] opting in to . . . third-party data use.” Lutz Ex. 12 at 7, 18. Defendants maintain 20 that this is consistent with their premonition during the Q1 call that there would be a “decline” in 21 European users. Motion to Dismiss at 9, Dkt. 93. Defendants’ Sale of Facebook Stock. During the Class Period, Defendant Zuckerberg 22 23 sold approximately 30,000 Facebook shares for proceeds of more than $5.3 billion, while 24 25 26 27 28 2 The GDPR applies to all companies processing personal data of European Union citizens, regardless of the company’s location. See GDPR Key Changes, EU GDPR.ORG, https://eugdpr.org/the-regulation/ (last visited Sept. 16, 2019). Violations can result in severe penalties. Id. The main component of the GDPR that affects Defendants is the requirement that users provide intelligent consent for use of their data, i.e., an “opt-in” regime. Id. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 6 1 Sandberg sold $389 million worth and Wehner $21 million worth during the same period. Compl. 2 ¶ 13. These included large sales during the first quarter of 2018—more than triple what 3 Defendants sold in the last quarter of 2017—before the 2Q18 report was released. Id. 3. Alleged Misstatements/Omissions 4 Plaintiffs allege Defendants made a total of 36 materially misleading statements or United States District Court Northern District of California 5 6 omissions in press releases, SEC filings, earnings calls, and public remarks at conferences. The 7 Court has arranged these statements chronologically and by source and bolded/italicized the 8 relevant part of the statement. 9 December 20153 Statements to The Guardian 10 Statement 1 11 “[M]isleading people or misusing their information is a direct violation of our policies and we will take swift action against companies that do . . . .” 12 13 Statement 2 14 “[I]ncluding banning those companies from Facebook and requiring them to destroy all improperly collected data.” 15 September 29, 2016 Facebook Privacy Policy 16 Statement 3 17 18 “We use the information we have to help verify accounts and activity, and to promote safety and security on and off of our Services, such as by investigating suspicious activity or violations of our terms or policies.” 19 Statement 4 20 “We work hard to protect your account using teams of engineers, automated systems, and advanced technology such as encryption and machine learning.” 21 22 Statement 5 23 “These partners must adhere to strict confidentiality obligations in a way that is consistent with this Data Policy and the agreements we enter into with them.” 24 Statement 6 25 26 27 28 3 These are within the Class Period as Plaintiffs allege that Defendants repeated these statements in 2017. See Pl. Opp. at 7; Compl. ¶¶ 228 (noting that a Facebook representative made this statement on or around June 8, 2017, i.e., within the Class Period). Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 7 3 “Don’t sell, license or purchase any data obtained from us or our services. . . . Don’t transfer any data that you receive from us (including anonymous, aggregate or derived data) to any ad network, data broker or other advertising or monetization-related service. . . . Enforcement is both automated and manual, and can include disabling your app, restricting you and your app’s access to platform functionality, requiring that you delete data, terminating our agreements with you or any other action that we deem appropriate.” 4 Statement 7 5 6 “We notify our users with context around the status of their account and actionable recommendations if we assess they are at increased risk of future account compromise by sophisticated actors or when we have confirmed their accounts have been compromised.” 7 Statement 8 8 “You own all of the content and information you post on Facebook, and you can control how it is shared through your privacy and application settings. In addition . . . [w]hen you use an application, the application may ask for your permission to access your content and information as well as content and information that others have shared with you. We require applications to respect your privacy, and your agreement with that application will control how the application can use, store, and transfer that content and information. (To learn more about Platform, including how you can control what information other people may share with applications, read our Data Policy and Platform Page.).” 1 2 9 10 United States District Court Northern District of California 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 February 3, 2017 Facebook’s 10-K Report: Data Breaches Statement 9 “Security breaches and improper access to or disclosure of our data or user data, or other hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business.” Statement 10 “. . . . Any failure to prevent or mitigate security breaches and improper access to or disclosure of our data or user data could result in the loss or misuse of such data, which could harm our business and reputation and diminish our competitive position. In addition, computer malware, viruses, social engineering (predominantly spear phishing attacks), and general hacking have become more prevalent in our industry, have occurred on our systems in the past, and will occur on our systems in the future. As a result of our prominence, we believe that we are a particularly attractive target for such breaches and attacks. Such attacks may cause interruptions to the services we provide, degrade the user experience, cause users to lose confidence and trust in our products, or result in financial harm to us. Our efforts to protect our company data or the information we receive may also be unsuccessful due to software bugs or other technical malfunctions; employee, contractor, or vendor error or malfeasance; government surveillance; or other threats that evolve. In addition, third parties may attempt to fraudulently induce employees or users to disclose information in order to gain access to our data or our users’ data.” Statement 11 “Although we have developed systems and processes that are designed to protect our data and user data, to prevent data loss, and to prevent or detect security breaches, we cannot assure you that such measures will provide absolute security.” Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 8 1 4 “In addition, some of our developers or other partners, such as those that help us measure the effectiveness of ads, may receive or store information provided by us or by our users through mobile or web applications integrated with Facebook. We provide limited information to such third parties based on the scope of services provided to us. However, if these third parties or developers fail to adopt or adhere to adequate data security practices, or in the event of a breach of their networks, our data or our users’ data may be improperly accessed, used, or disclosed. 5 Statement 13 6 8 “Affected users or government authorities could initiate legal or regulatory actions against us in connection with any security breaches or improper disclosure of data, which could cause us to incur significant expense and liability or result in orders or consent decrees forcing us to modify our business practices. Any of these events could have a material and adverse effect on our business, reputation, or financial results.” 9 February 3, 2017 Facebook’s 10-K Report: Risks Related to Business and Industry 2 3 7 United States District Court Northern District of California Statement 12 10 Statement 14 11 “If we fail to retain existing users or add new users, or if our users decrease their level of engagement with our products, our revenue, financial results, and business may be significantly harmed. 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 The size of our user base and our users' level of engagement are critical to our success. . . . If people do not perceive our products to be useful, reliable, and trustworthy, we may not be able to attract or retain users or otherwise maintain or increase the frequency and duration of their engagement. . . . ” Statement 15 “Any number of factors could potentially negatively affect user retention, growth, and engagement, including if: .... there are decreases in user sentiment about the quality or usefulness of our products or concerns related to privacy and sharing, safety, security, or other factors;” Statement 16 “[T]echnical or other problems prevent us from delivering our products in a rapid and reliable manner or otherwise affect the user experience, such as security breaches or failure to prevent or limit spam or similar content;” Statement 17 “[W]e, developers whose products are integrated with our products, or other partners and companies in our industry are the subject of adverse media reports or other negative publicity.” 27 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 9 1 February 3, 2017 Facebook’s 10-K Report: Unfavorable Media and Regulatory Investigations 2 Statement 18 3 4 Statement 19 5 “We have been subject to regulatory investigations and settlements, and we expect to continue to be subject to such proceedings and other inquiries in the future, which could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business.” 6 7 8 April 27, 2017 White Paper 9 Statement 20 10 11 United States District Court Northern District of California “Unfavorable media coverage could negatively affect our business.” “Targeted data collection and theft can affect all types of victims . . . . [t]ypical methods include phishing with malware to infect a person’s computer and credential theft to gain access to their online accounts. . . . 12 .... 13 .... 14 .... 15 Here are some of the steps we are taking: 16 .... 17 18 19 20 21 22 23 24 25 26 27 28 Notifications to specific people if they have been targeted by sophisticated attackers, with custom recommendations depending on the threat model;” Statement 21 “Proactive notifications to people who have yet to be targeted, but whom we believe may be at risk based on the behavior of particular malicious actors;” October 12, 2017 Sandberg’s Axios Interview Statement 22 “[W]hen you share on Facebook, you need to know that no one’s going to steal our data. No one is going to get your data that shouldn’t have it . . . you are controlling who you share with.” Statement 23 “Europe[] has passed a single privacy law and we are adhering to that. . . . privacy is something we take really seriously.” Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 10 1 November 1, 2017 3Q17 Earnings Call 2 Statement 24 3 4 “On GDPR, the Facebook family of apps already applies the core principles of the framework because we built our services around transparency and control, and we’re building on this to ensure that we comply in May of next year.” 5 March 16, 2018 “Suspending Cambridge Analytica & SCL Group From Facebook” Post 6 Statement 25 7 8 “We are committed to vigorously enforcing our policies to protect people’s information. We will take whatever steps are required to see that this happens. We will take legal action if necessary to hold them responsible and accountable for any unlawful behavior.” 9 Statement 26 United States District Court Northern District of California 10 11 “In 2014, after hearing feedback from the Facebook community, we made an update to ensure that each person decides what information they want to share about themselves, including their friend list.” 12 Statement 27 13 15 “This is just one of the many ways we give people the tools to control their experience. Before you decide to use an app, you can review the permissions the developer is requesting and choose which information to share. You can manage or revoke those permissions at any time. On an ongoing basis, we also do a variety of manual and automated checks to ensure compliance with our policies and a positive experience for users. 16 Statement 28 17 “These include steps such as random audits of existing apps along with the regular and proactive monitoring of the fastest growing apps. We enforce our policies in a variety of ways from working with developers to fix the problem, to suspending developers from our platform, to pursuing litigation.” 14 18 19 20 March 17, 2018 Addendum to Earlier Statements About Cambridge Analytica Event 21 Statement 29 22 “The claim that this is a data breach is completely false. Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, . . . .” 23 24 25 26 Statement 30 “[E]veryone involved gave their consent. People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked.” 27 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 11 1 2 3 4 5 6 7 8 9 10 April 4, 2018 Defendant Zuckerberg’s Telephonic Phone Conference Statement 31 “You asked about the FTC consent order. We’ve worked hard to make sure that we comply with it. I think the reality here is that we need to take a broader view of our responsibility, rather than just the legal responsibility. We’re focused on doing the right thing and making sure people’s information is protected, and we’re doing investigations. Statement 32 “For Facebook specifically, one of the things we need to do and that I hope that more people look at are just the privacy controls that you have. I think, especially leading up to the GDPR event, a lot of people are asking us, “Okay, are you going to implement all those things?” And my answer is that we’ve had almost all of what’s in there implemented for years, around the world, not just in Europe. So, to me, the fact that a lot of people might not be aware of that is an issue, and I think we could do a better job of putting these tools in front of people and not just offering them, and I would encourage people to use them and make sure that they’re Comfortable with how their information is used on our services and others.” United States District Court Northern District of California 11 12 13 14 April 25, 2018 Defendant Zuckerberg’s Personal Facebook Update Statement 33 “Despite facing important challenges, our community continues to grow. More than 2.2 billion people now use Facebook every month and more than 1.4 billion people use it daily.” 15 16 17 18 19 20 21 22 23 24 25 April 25, 2018 1Q18 Earnings Call Statement 34 “We made a number of changes and are still making changes to prioritize meaningful interactions between people over passive consumption of content. . . . We’ve been rolling out new changes . . . . that [have] increased—or we’ve observed increases in some types of sharing and interaction between people based on that. We’ve also observed some continued declines as we’ve done this . . . . Overall, I’d say these changes are doing what we expected that they would do and helping people to connect more and have more meaningful interactions. . . . We think that this is going in the direction of building a strong community and a stronger business over the long term and we’re optimistic about what we’re seeing here.” Statement 35 “[W]e do not anticipate [that new European privacy regulations] will significantly impact advertising revenues.” 26 27 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 12 1 2 3 United States District Court Northern District of California 4 Statement 36 “So on GDPR. . . . I don’t know that we really see a doomsday scenario here. I think what we think is that depending on how people react to the controls and the ad settings, there could be some limitations on data usage. We believe that those will be relatively minor.” 5 B. Procedural History 6 Following the collapse of Facebook’s stock price, multiple lawsuits were filed against 7 Defendants. One of these—Fan Yuan v. Facebook—was randomly assigned to this Court. See 8 Dkt. 1. This Court consolidated that case with other related ones. See Order Granting 9 Administrative Motion Relating Cases, Dkt. 23. On October 15, 2018, Plaintiffs submitted their 10 consolidated class action amended complaint, which is the subject of the current motion to 11 dismiss. Defendants also request judicial notice regarding facts pertaining to the motion to 12 dismiss. See Request for Judicial Notice re Motion to Dismiss (“Req. Jud. Notice”), Dkt. 94. 13 14 15 II. JUDICIAL NOTICE Defendants ask this Court to take judicial notice of Exhibits 1 through 34 attached to the declaration of Brian M. Lutz (the “Lutz declaration”) and of Exhibits 35 through 37. 16 A. Legal Standard 17 Generally, district courts may not consider material outside the pleadings when assessing 18 the sufficiency of a complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure. Lee v. 19 City of L.A., 250 F.3d 668, 688 (9th Cir. 2001). When matters outside the pleadings are 20 considered, the 12(b)(6) motion converts into a motion for summary judgment. Khoja v. Orexigen 21 Therapeutics, Inc., 899 F.3d 988, 998 (9th Cir. 2018); see also Fed. R. Civ. P. 12(d). This rule 22 does not apply to the incorporation by reference doctrine and judicial notice under Federal Rule of 23 Evidence 201. Khoja, 899 F.3d at 998. These exceptions, however, should not be used to 24 “undermin[e] . . . the usual pleading burden[].” Id. (noting the “concerning pattern” in securities 25 cases where exploiting the exceptions improperly defeats what would otherwise constitute 26 adequately stated claims at the pleading stage). 27 28 Rule 201 permits a court to take judicial notice of an adjudicative fact “not subject to Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 13 1 reasonable dispute,” that is “generally known” or “can be accurately and readily determined from 2 sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). Specifically, a 3 court may take judicial notice: (1) of matters of public record, Khoja, 899 F.3d at 999, (2) that the 4 market was aware of information contained in news articles, Heliotrope Gen., Inc. v. Ford Motor 5 Co., 189 F.3d 971, 981 n.18 (9th Cir. 1999), and (3) publicly accessible websites whose accuracy 6 and authenticity is not subject to dispute, Daniels-Hall v. Nat’l Educ. Ass’n, 629 F.3d 992, 998–99 7 (9th Cir. 2010). A court may further consider facts contained in the noticed materials. Barron v. 8 Reich, 13 F.3d 1370, 1377 (9th Cir. 1994). United States District Court Northern District of California 9 Incorporation by reference treats certain documents as though they are part of the 10 complaint itself. Daniels-Hall, 629 F.3d at 998. These are situations where the complaint 11 “necessarily relies” upon a document or where the complaint alleges the contents of the document 12 and the documents authenticity and relevance is not disputed. Coto Settlement v. Eisenberg, 593 13 F.3d 1031, 1038 (9th Cir. 2010). A defendant may seek to incorporate a document into the 14 complaint “if the plaintiff refers extensively to the document or the document forms the basis of 15 the plaintiff’s claim.” Khoja, 899 F.3d at 1002. 16 17 18 19 20 B. Discussion 1. Unopposed Items: Exhibits 2–5, 11–23, 25–29 Plaintiffs do not object to the judicial notice of these documents for any reason. Pl. Opp. to Jud. Notice at 4. Exhibits 2–6 are Facebook SEC Filings. Judicial notice is GRANTED for these Exhibits 21 because they are public filings made by Facebook with the SEC and thus are matters of public 22 record not subject to reasonable dispute. Fed. R. Evid. 201(b); Khoja, 899 F.3d at 999; see also 23 Waller v. Scout Analytics, Inc., 230 F. Supp. 3d 1085, 1094 n.5 (N.D. Cal. 2017) (taking judicial 24 notice of SEC filings). 25 Exhibits 11 & 12 are Transcripts of the Conference Calls following the release of the 2018 26 quarter earnings reports. Judicial notice is GRANTED because these are relied on extensively by 27 Plaintiffs and are used as evidence to establish a material misstatement or omission. Further, they 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 14 1 are also matters of public record. See In re Energy Recovery Inc. Sec. Litig., 2016 WL 324150, at 2 *3 (N.D. Cal. Jan. 27, 2016) (“[T]ranscripts of conference earning calls are judicially noticeable 3 because they are matters of public record.”). 4 Exhibits 13–23 are news articles used to show that the market was aware of the 5 information contained in the articles. Judicial notice is GRANTED because they are publicly 6 available news articles. See In re Kalobios Pharm., Inc. Sec. Litig., 258 F. Supp. 3d 999, 1003–04 7 (N.D. Cal. 2017) (granting judicial notice of four news articles). Further these articles were 8 reprinted in full or in part in the Complaint and so are also incorporated by reference. United States District Court Northern District of California 9 Exhibit 25 is Facebook’s Data Policy and is used throughout Plaintiffs’ Complaint to show 10 changes that Facebook made to the policy. It is referenced throughout; specifically, ¶¶ 4, 60, 139, 11 200, 301(b), 302(a), 302(b), 302(e). Accordingly, judicial notice is GRANTED. 12 Exhibit 26 is the Facebook White Paper referenced and relied on in paragraphs 5, 120, 13 122, 230, 301, and 302 of the Complaint. Exhibit 27 is a 2018 Facebook press release referenced 14 in paragraph 250. Exhibit 28 is a June 29, 2018 Facebook letter providing answers to written 15 questions from the Energy and Commerce Committee of the U.S. House or Representatives, 16 referenced in paragraph 206 of the Complaint. All these exhibits are referenced in the Complaint 17 and are publicly available documents. Therefore, judicial notice is GRANTED. 18 Exhibit 29 is a Bloomberg stock table showing the historical stock prices of Facebook 19 from January 2, 2018 to December 11, 2018. “Information about the stock price of publicly traded 20 companies [is] the proper subject of judicial notice.” In re Copper Mountain Sec. Litig., 311 F. 21 Supp. 2d 857, 864 (N.D. Cal. 2004). Judicial notice is GRANTED. 22 2. Semi-Opposed Items: Exhibits 1, 6–10 23 Plaintiffs object to judicial notice of Exhibits 1, 6–10. Pl. Opp. to Jud. Notice at 4. They 24 do not object to this Court taking judicial notice of the existence of these documents, only of the 25 facts contained therein. Id. at 1. Plaintiffs contend that Defendants seek to improperly use these 26 27 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 15 1 exhibits to establish a defense to scienter by showing trades were made pursuant to a Rule 10b5-14 2 plan. Id. at 4 (citing Mot. at 24). Exhibit 1 shows Defendant Zuckerberg’s plan to gift substantially all his Facebook stock 3 4 or the proceeds to philanthropy pursuant to a Rule 10b5-1 plan. Exhibit 6 is a Facebook Proxy 5 Statement, which notifies shareholders that directors and officers have adopted Rule 10b5-1 plans. 6 Exhibit 7 is Facebook’s September 4, 2012 Current Report on Form 8-K, which contains the 7 Company’s insider trading policy and notes that Zuckerberg had not yet entered a Rule 10b5-1 8 plan. Exhibits 8–10 are SEC Form 4s which disclose Defendants’ sales of Facebook stock and 9 note that these were made pursuant to a Rule 10b5-1 plan. Defendants clarify in their Reply that they are only asking for judicial notice as to the United States District Court Northern District of California 10 11 “existence of the Individual Defendants’ 10b5-1 plans.” Reply in Support of Request for Judicial 12 Notice (“Reply Jud. Notice”) at 2, Dkt. 104. Courts “may take judicial notice of SEC Forms 4, 13 even when not referenced in the pleading, to prove that stock sales were made pursuant to a Rule 14 10b5-1 trading plan.” City of Royal Oak Ret. Sys. v. Juniper Networks, Inc., 880 F. Supp. 2d 15 1045, 1059 (N.D. Cal. 2012). Exhibits 1 and 6–10 are publicly available documents and it is 16 proper for this Court to take judicial notice of the documents. The Court, however, agrees with 17 Plaintiffs’ contention that judicial notice is confined to recognizing only that a 10b5-1 trading plan 18 existed. See also Patel v. Parnes, 253 F.R.D. 531, 546 (C.D. Cal. 2008) (“It is appropriate for the 19 court to take judicial notice of the content of the SEC Forms 4 and the fact that they were filed 20 with the agency. The truth of the content, and the inferences properly drawn from them, however, 21 is not a proper subject of judicial notice under Rule 201.”). Accordingly, Defendants’ request is 22 GRANTED but is limited to showing only that a Rule 10b5-1 plan existed and that stock sales 23 were made pursuant to that plan, not that this plan confined Defendants’ trading discretion. See 24 Khoja, 899 F.3d at 999 (court cannot take judicial notice of disputed facts in records). 25 26 27 28 4 Rule 10b5-1 permits company insiders to adopt written, pre-arranged trading plans under which specific amounts of stock are sold according to pre-established criteria, thus theoretically liminating an individual’s discretion over trading. See 17 C.F.R. § 240.10b5-1(c). Plaintiffs and Defendants dispute the amount of discretion retained by Defendants. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 16 United States District Court Northern District of California 1 3. Opposed Items: Exhibits 24, 30–34 2 Plaintiffs object to any judicial notice of Exhibits 24, 30–34. Pl. Opp. to Jud. Notice at 7. 3 Exhibit 24 is Facebook’s 2013 Data Policy. The exhibit was obtained using the Internet 4 Archive’s Wayback Machine. See U.S. ex. Rel. v. Newport Sensors, Inc., 2016 WL 8929246, at 5 *3 (N.D. Cal. May 19, 2016) (“A court ‘may take judicial notice on its own,’ and district courts in 6 this circuit have routinely taken judicial notice of content from the Internet Archive's Wayback 7 Machine pursuant to this rule, as we do here.” (citations omitted)). 8 Plaintiffs argue that this Court should not take judicial notice because the facts of the 9 policy are disputed and it is not relied on or referenced throughout. This policy is, however, 10 implicitly referenced throughout; a central theme of the Complaint is that Facebook changed its 11 2013 Data Policy in 2015 to eliminate the provision that allowed third-party consent. See Compl. 12 ¶¶ 79, 131, 176, 183, 203, 238, 251, 258(a), 264, 266(b), 268, 280, 288, & 302; see also Khoja, 13 899 F.3d at 1002 (noting incorporation by reference appropriate where Plaintiff references the 14 document throughout). It would be unfair for Plaintiffs to reference this document to show the 15 change in Facebook’s Data Policy and suppress the actual policy. Plaintiffs repeatedly reference 16 this change, and so their use of the document is more than “the mere mention of [its] existence.” 17 Cf. United States v. Ritchie, 342 F.3d 903, 908–09 (9th Cir. 2003). This Court agrees that 18 Plaintiffs true contention is with the legal effect of the policy, which is outside the inquiry of 19 judicial notice. See Reply Jud. Notice at 5. Because the policy is referenced throughout, the Court 20 GRANTS Defendants’ request. 21 Exhibits 30–33 are stock indices running from January 2, 2018 to December 11, 2018, 22 showing the historical stock prices of different companies; specifically, Ex. 30 is Amazon, Ex. 31 23 is Apple, Ex. 32 is Alphabet, and Ex. 33 is Netflix. Exhibit 34 is the CBOE Volatility Index, a 24 popular measure of the stock market’s expectation of volatility, for the same period. These 25 exhibits were not referenced or relied on through the complaint and so Defendants ask for judicial 26 notice only. Plaintiffs argue that Defendants use these exhibits to support their argument that 27 Plaintiffs’ Complaint should be dismissed because of the “incredible volatility” in the stock 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 17 1 United States District Court Northern District of California 2 market during the Class Period. Pl. Opp. to Jud. Notice at 9. In Khoja, the Ninth Circuit cautioned against the use of judicial notice to allow defendants 3 to “use the doctrine to insert their own version of events into the complaint to defeat otherwise 4 cognizable claims.” 899 F.3d at 1002. While the focus of the discussion was on incorporation-by- 5 reference, this Court finds the logic of Khoja applicable to judicial notice as well. If this Court 6 allows Defendants to submit Exhibits 30–34, it would permit Defendants to “short-circuit the 7 resolution of a well-pleaded claim.” Id. The question at this stage is not are there other 8 explanations for Facebook’s stock price falling but whether Plaintiffs adequately stated a claim for 9 securities fraud. The stock prices of Apple, Google, and Netflix, and the overall volatility of the 10 stock market during the Class Period do not help answer that question and so Defendants’ request 11 for judicial notice of Exhibits 30–34 is DENIED. 12 13 4. Items that Plaintiffs Did Not Receive a Chance to Respond to: Exhibits 35–37 Defendants also ask this Court to take judicial notice of three exhibits used to support its 14 Reply in Support of its Motion to Dismiss. Request for Judicial Notice in Support of Facebook’s 15 Reply in Support of Motion to Dismiss, Dkt. 102, 103. Plaintiffs did not receive an opportunity to 16 respond to this request because procedurally they had no leave to respond to Defendant’s reply. 17 Plaintiffs raised no objection to Defendants request for judicial notice of these three exhibits. 18 Exhibit 35 is a transcript of a March 21, 2018 witness examination of Sandy Parkilas 19 before the Digital, Culture, Media, and Sports Committee of the House of Commons of the United 20 Kingdom. This exhibit is referenced and repeatedly quoted in the Complaint. See ¶¶ 76–78; Coto, 21 593 F.3d at 1038 (noting that incorporation by reference is appropriate when “the contents of the 22 document are alleged in a complaint”). Further, this a matter of public record not subject to 23 reasonable dispute. Fed. R. Evid. 201(b); Khoja, 899 F.3d at 999. Accordingly, Defendants’ 24 request for judicial notice of Exhibit 35 is GRANTED. 25 Exhibit 36 is an excerpt of a Transcript of Proceedings from a February 1, 2019 hearing 26 before Judge Chhabria regarding another data privacy action arising out of the Cambridge 27 Analytica events. Defendants use this to support their theory that users consented to Cambridge 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 18 1 Analytica obtaining their data. See Reply in Support of Motion to Dismiss (“Reply”) at 8, Dkt. 2 101. Publicly available transcripts of court hearings are “not subject to reasonable dispute” and 3 courts routinely take judicial notice of them. See In re: San Jose Airport Hotel, LLC, 2016 WL 4 3357175, at *4 n.1 (N.D. Cal. June 17, 2016) (taking judicial notice of transcripts of hearings 5 before the bankruptcy court); Biggs v. Terhune, 334 F.3d 910, 915 n.3 (9th Cir. 2003) (“Materials 6 from a proceeding in another tribunal are appropriate for judicial notice”), overruled on other 7 grounds by Hayward v. Marshall, 603 F.3d 546 (9th Cir. 2008). 8 United States District Court Northern District of California 9 Defendants, however, misunderstand these cases; in each, the trial court materials being judicially noticed were used to show the trial court did or did not do something. In San Jose 10 Airport Hotel, this Court judicially noticed the bankruptcy court’s docket to show that it never 11 ruled on a motion at issue. 2016 WL 3357175, at *4. Likewise, in Biggs, the Ninth Circuit 12 judicially noticed that the trial court’s transcript undertook the appropriate review of the Parole 13 Board’s hearing. 334 F.3d at 915. In contrast, here, Defendants are neither asking this Court to 14 judicially notice another Court’s ruling (or absence thereof) nor the reasoning used to support a 15 ruling, they are asking this Court to judicially notice another judge’s opining, at a hearing, on the 16 issue of consent. The case law does not support this. Moreover, judicial notice on the issue of 17 user consent is not appropriate because it cannot be “accurately and readily determined” given the 18 fluidity and complexity of this area of the law. See In re Facebook Inc., Consumer Privacy User 19 Profile Litig., 2019 WL 4261048, at *8 (N.D. Cal. Sept. 9, 2019) (collecting cases); Fed. R. Evid. 20 201(b)(2). Accordingly, this request is DENIED. 21 Exhibit 37 is a Facebook blog post entitled “Notifications for targeted attacks” by Alex 22 Stamos. This is a publicly available document and is cited and referenced in Exhibit 26, which 23 Plaintiffs cite in their Complaint. See Diaz v. Intuit, Inc., 2018 WL 2215790, at *3 (N.D. Cal. 24 May 15, 2018) (“Publically accessible websites and news articles are proper subjects of judicial 25 notice.” (citation omitted)). The Court GRANTS this request for judicial notice. 26 27 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 19 1 MOTION TO DISMISS 2 A. Legal Standard 3 To survive a Rule 12(b)(6) motion to dismiss, a complaint must contain sufficient factual 4 matter to “state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 5 (2009); Fed. R. Civ. Pro. 8(a). Threadbare recitals of the elements of a cause of action supported 6 by mere conclusory statements “do not suffice.” Ashcroft, 556 U.S. at 678. 7 Securities fraud cases, however, must meet Rule 8’s plausibility standard, the Private 8 Securities Litigation Reform Act (“PSLRA”), and Rule 9(b)’s higher pleading standard. See 9 Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 319–22 (2007); Zucco Partners, LLC v. 10 United States District Court Northern District of California III. Digimarc, Corp., 552 F.3d 981, 991 (9th Cir. 2009). 11 The PSLRA mandates that securities fraud complaints “‘specify’” each misleading 12 statement, set forth the facts “‘on which [a] belief’” that a statement is misleading was “‘formed,’” 13 and “‘state with particularity facts giving rise to a strong inference that the defendant acted with 14 the required state of mind [scienter].’” Dura Pharm., Inc. v. Broudo, 544 U.S. 336, 345 (2005) 15 (quoting 15 U.S.C. §§ 78u–4(b)(1)–(2)); see also Metzler Inv. GmbH v. Corinthian Colleges, Inc., 16 540 F.3d 1049, 1070 (9th. Cir. 2008) (“The PSLRA has exacting requirements for pleading 17 ‘falsity.’”). Plaintiffs bear the burden of proving that the defendant’s misrepresentations ‘“caused 18 the loss for which the plaintiff seeks to recover.’” Dura Pharm., 544 U.S. at 345–46 (quoting 19 § 78u-4(b)(4)). In determining whether a “strong inference” of scienter has been sufficiently 20 alleged, this Court must not only draw “inferences urged by the plaintiff,” but also engage in a 21 “comparative evaluation,” thus examining and considering “competing inferences [in defendants’ 22 favor] drawn from the facts alleged.” Tellabs, 551 U.S. at 314. Hence, scienter must not only be 23 “plausible or reasonable,” it must also be “cogent and at least as compelling as any opposing 24 inference of nonfraudulent intent.” Id. at 324. 25 26 Rule 9 further requires a plaintiff pleading securities fraud to state, with particularity, the circumstances constituting fraud or mistake. Fed. R. Civ. Pro 9(b). 27 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 20 United States District Court Northern District of California 1 B. Defendants’ Motion to Dismiss 2 To show securities fraud under Section 10(b) and Rule 10b-5, plaintiffs must allege facts 3 sufficient to establish (1) a material misrepresentation or omission; (2) made with scienter, i.e., a 4 wrongful state of mind; (3) a connection between the misrepresentation and the purchase or sale of 5 a security; (4) reliance upon the misrepresentation; (5) economic loss; and (6) loss causation. 6 Loos v. Immersion Corp., 762 F.3d 880 (9th. Cir. 2014), amended (Sept. 11, 2014). “To 7 determine whether a private securities fraud complaint can survive a motion to dismiss for failure 8 to state a claim, the court must determine whether particular facts in the complaint, taken as a 9 whole, raise a strong inference that defendants intentionally or with deliberate recklessness made 10 false or misleading statements to investors.” In re LeapFrog Enter., Inc. Sec. Litig., 527 F. Supp. 11 2d. 1033, 1039–40 (N.D. Cal. 2007). 12 In their Motion to Dismiss, Defendants challenge the sufficiency of Plaintiffs’ Section 10b 13 and Rule 10b-5 claim as to (1) misrepresentation, (2) scienter, (3) reliance, and (4) causation. 14 Regarding misrepresentation, Defendants argue that Plaintiffs’ “scattershot pleading” fails on 15 multiple levels. 16 First, Defendants argue that Plaintiffs fail to allege particularized, contemporaneous facts 17 inconsistent with Defendants’ allegedly false statements, and thus do not meet the PSLRA. Mot. 18 at 10. Defendants also contend that many of the challenged statements are forward-looking 19 statements accompanied by appropriate cautionary language and are thus protected by the 20 PSLRA’s “Safe Harbor” Provision. See Mot. at 11, 14, 19. Finally, Defendants assert that many 21 of the challenged statements (including some of the ones claimed to be forward-looking) are non- 22 actionable expressions of corporate optimism. See id. at 11. 23 Defendants next argue that Plaintiffs fail to plead sufficient facts establishing the requisite 24 inference of scienter because “Plaintiff offer[s] almost nothing but conclusions.” Id. at 20. 25 Defendants then argue that Plaintiffs fail to plead loss causation because there is no pleading of a 26 specific misstatement, as opposed to some other fact, that foreseeably caused Plaintiffs’ loss. Id. 27 at 27. Rather, Defendants contend that the stock fluctuation was due to other forces. Id. 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 21 1 Defendants next contend that Plaintiffs fail to plead reliance based on the fraud-on-the market 2 theory because Plaintiffs already knew of the core information allegedly concealed. Id. at 33. 3 Finally, Defendants argue that because Plaintiffs cannot show a primary Securities Act violation, 4 their Section 20(a) and 20A claims must be dismissed. Id. at 34. 5 6 statement, but that Plaintiffs failed to adequately plead scienter and thus GRANTS Defendants 7 Motion to Dismiss. 8 9 10 United States District Court Northern District of California As discussed in detail below, the Court finds that Statement 22 is the only actionable C. Discussion 1. Misstatement or Omission For a misstatement to be actionable, the statement must be both false and material. See 11 Basic Inc. v. Levinson, 485 U.S. 224, 238 (1988) (“It is not enough that a statement is false or 12 incomplete, if the misrepresented fact is otherwise insignificant.”). To survive a motion to 13 dismiss, a complaint must “specify each statement alleged to have been misleading, [and] the 14 reason or reasons why the statement is misleading.” Metzler Inv. GmbH, 540 F. 3d at 1070 15 (quoting 15 U.S.C. § 78u–4(b)(1)). 16 Statements are misleading only if they “affirmatively create an impression of a state of 17 affairs that differs in a material way from the one that actually exists.” Brody v. Transitional 18 Hosp. Corp., 280 F.3d 997, 1006 (9th Cir. 2002). Rule 10b-5 prohibits “only misleading and 19 untrue statements, not statements that are incomplete.” Id. Silence, absent a duty to disclose, “is 20 not misleading under Rule 10b-5.” Basic, 485 U.S. at 239 n.17. “Often a statement will not 21 mislead even if it is incomplete or does not include all relevant facts.” Brody, 280 F.3d at 1006. 22 Not all material adverse events must be disclosed to investors. See In re Rigel Pharm., Inc. 23 Sec. Litig., 697 F.3d 869, 880 n.8 (9th Cir. 2012) (discussing Matrixx Initiatives, Inc. v. 24 Siracusano, 563 U.S. 27, 38–45 (2011)). Information that a reasonable investor might consider 25 material need not always be disclosed; companies can control “what they have to disclose [per 26 § 10(b)] by controlling what they say to the market.” Matrixx, 563 U.S. at 45. Consequently, 27 omissions are only actionable if a defendant has a duty to disclose information and fails to do so. 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 22 1 Basic, 485 U.S. at 239 n.17. Hence, if the omission does not “make the actual statement[] 2 misleading,” a company need not supplement the statement “even if investors would consider the 3 omitted information significant.” Rigel, 697 F.3d at 880 n.8. 4 5 Wholesale & Dep’t Store Union Local 338 Ret. Fund v. Hewlett-Packard Co., 845 F.3d 1268, 6 1275 (9th Cir. 2017). For example, business puffery or opinion (vague, optimistic statements) is 7 not actionable because it does not “induce the reliance of a reasonable investor.” Or. Pub. Emps. 8 Ret. Fund v. Apollo Grp. Inc., 774 F.3d 598, 606 (9th Cir. 2014). 9 10 United States District Court Northern District of California Finally, an actionable statement must also “be capable of objective verification.” Retail a. Application The alleged material misstatements and omissions can be separated into four categories: 11 first, material misstatements or omissions regarding Facebook’s response to data misuse and 12 privacy violations. For these, Plaintiffs allege actionable misstatements by Defendants because 13 they mislead investors about how Facebook handled privacy violations by falsely stating that 14 victims received notice when their data was compromised, that they would ensure the deletion of 15 any purloined data, and that users could control their data, including where it went and with whom 16 it was shared. Pl. Opp. at 5. Second, Plaintiffs allege that the risk disclosures (Defendants’ 10-K 17 forms) filed with the SEC were materially false and misleading because they failed to disclose the 18 existence and magnitude of the risks created by Facebook’s existing and uncorrected failures to 19 protect user privacy, including the risk presented by the exposed data possessed by Cambridge 20 Analytica and other privacy violations. Id. at 11. Third, Plaintiffs address material misstatements 21 or omissions regarding Defendants’ response to the Cambridge Analytica scandal. Plaintiffs 22 allege that Defendants concealed the full extent that Cambridge Analytica damaged Facebook’s 23 image and thus mislead investors. Id. at 13; Compl. ¶¶ 149–52, 176. Finally, Plaintiffs allege that 24 Defendants materially mislead investors by repeatedly assuring investors that Facebook was 25 GDPR-compliant, when, in fact, it was not. Pl. Opp. at 17; Compl. ¶¶ 234–37. 26 In order to effectively address these categories of statements, the Court sorts the statements 27 into headings based on Defendants arguments for dismissal, i.e., (1) Forward-Looking Statements, 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 23 1 (2) General Statements of Corporate Optimism, and (3) Falsity (including the alleged omissions). 2 To begin, this Court resolves whether Facebook’s Privacy Policy statements are actionable. i. 3 Defendants argue that the Privacy Policy Statements (Statements 3–7) are not actionable 4 United States District Court Northern District of California Use of the Privacy Policy Statements 5 because these statements were not “made in connection with the purchase or sale of Facebook 6 securities.” Mot. at 20. 7 To give rise to a 10b-5 claim, a statement must be made “in a manner reasonably 8 calculated to influence the investing public.” McGann v. Ernst & Young, 102 F.3d 390, 397 (9th 9 Cir. 1996). Plaintiffs first point the Court to Batwin v. Occam Networks, Inc., to show that a 10 “materiality” argument is premature at this stage. 2008 WL 2676364, at *22 (C.D. Cal. July 1, 11 2008). Plaintiffs are correct that materiality arguments often are “inappropriate for resolution on a 12 motion to dismiss.” Id. But the question here is not whether an investor would find the 13 information in the privacy statements material, but if they are the types of documents that a 14 reasonable investor would look at while making purchasing decisions. These questions, while 15 remarkably similar, are distinct. Batwin, thus, is not applicable.5 Defendants cite In re Lifelock, Inc. Securities Litigation, to argue that while Facebook’s 16 17 privacy policies may have some probative value in consumer protection litigation, they have none 18 in a case alleging investor fraud. 690 F. App’x 947, 953–54 (9th Cir. 2017). The Lifelock court, 19 however, specifically distinguished the simple ads at hand, from the “detailed drug advertisements 20 in sophisticated medical journals” considered in In re Carter-Wallace, Inc. Securities Litigation, 21 150 F.3d 153, 154 (2d Cir. 1998). Here, Facebook’s privacy policies are more like the detailed 22 23 24 25 26 27 28 5 For this reason, Plaintiffs use of In re Volkswagen “Clean Diesel” Mktg., Sales Practices, and Prods. Liab., 2017 WL 66281 (N.D. Cal. Jan. 4, 2017) is also misplaced. That case assessed whether stickers were addressed at consumers, rather than the investing public, in a reliance argument. Id. at *22 (“[Defendants’ cases] do not indicate that only market-related documents, such as regulatory filings, public presentations, or press releases, can contain actionable misstatements under Section 10(b); instead, the cases simply identify documents that have previously been found to support a ‘fraud-on-the market’ theory.” (second emphasis added)). For this same reason, Plaintiffs use of Basic, 485 U.S. at 247 n.24, is also misplaced as the Court was specifically discussing when a presumption of reliance applies. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 24 1 drug advertisements of Carter-Wallace and less like the “simple” advertisements discussed in 2 Lifelock. See Pl. Opp. at 20 n.16. As Exhibit 24 and 25 show, Facebook’s data policy is thorough 3 and thus markedly different from the “simple descriptive chart” and “passive ads” at issue in 4 Lifelock. Further, the Second Circuit, who has examined this issue more extensively, has “broadly 5 construed” the phrase “in connection with” to account for Congressional intent. Carter-Wallace, 6 150 F.3d at 156. Accordingly, because this Court cannot say as a matter of law that a reasonable 7 investor would not use the privacy policy when making investment decisions, the privacy policies 8 may be used to show a material misstatement or omission. 9 United States District Court Northern District of California 10 ii. Forward-Looking Statements Under the PSLRA “Safe Harbor” Provision, “forward-looking statements are not 11 actionable as a matter of law if they are identified as such and accompanied by “meaningful 12 cautionary statements identifying important facts that could cause actual results to differ materially 13 from those in the forward looking statement.” 15 U.S.C. § 78u-5(c)(1)(A)(i). 14 A forward-looking statement is “any statement regarding (1) financial projections, (2) 15 plans and objectives of management for future operations, (3) future economic performance, or (4) 16 the assumptions ‘underlying or related to’ any of these issues.” No. 84 Emp’r Teamster Joint 17 Council Pension Trust Fund v. Am. W. Holding Corp., 320 F.3d 920, 936 (9th Cir. 2003) (citing 18 15 U.S.C. § 78u5 (i)). “[I]f a forward-looking statement is identified as such and accompanied by 19 meaningful cautionary statements, then the state of mind of the individual making the statement is 20 irrelevant, and the statement is not actionable regardless of the plaintiff's showing of scienter.” In 21 re Cutera Sec. Litig., 610 F.3d 1103, 1112 (9th Cir.2010). 22 Here, Defendants argue that some of the challenged statements were forward-looking 23 statements protected by the PSLRA’s Safe Harbor. This Court holds that Statements 35 and 36 24 are inactionable forward-looking statements. 25 Statement 35 is a statement of anticipation regarding the impact of the GDPR made 26 during an earnings call (“[W]e do not anticipate [GDPR] will significantly impact advertising 27 revenues.”). Compl. ¶ 273. Forward-looking statements made during earnings calls are protected 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 25 United States District Court Northern District of California 1 under the PSLRA safe harbor. In re Mellanox Techs. Ltd. Secs. Litig., 2014 WL 12650991, at *14 2 (N.D. Cal. Mar. 31, 2014). Forward-looking statements are projections of revenues, income, 3 earnings per share, management's plans or objectives for future operations and predictions of 4 future economic performance. 15 U.S.C. § 78u–5(i)(1)(A)–(C). At the start of the call, 5 Defendants stated “[O]ur remarks today will include forward-looking statements. Actual results 6 may differ materially from those contemplated by these forward-looking statements.” Ex. 11 at 1. 7 Because Statement 35 is a statement of anticipation regarding a future economic performance 8 accompanied by meaningful cautionary language, this is an inactionable forward-looking 9 statement. 10 Statement 36 is a statement regarding predictions of the impact of the GDPR on ads, i.e. 11 revenue (“We believe [GDPR impacts on ads] will be relatively minor.”). Compl. ¶ 277. It was 12 made on the same call as Statement 35 and is also a projection of future economic performance 13 with meaningful, cautionary language. Accordingly, Statement 36 is an inactionable forward- 14 looking statement. For these reasons, the Court holds that Plaintiffs failed to plead falsity as required by the 15 16 PSLRA for Statements 35 and 36. Accordingly, this Court GRANTS Defendants’ motion to 17 dismiss as to those statements. iii. 18 General Statements of Corporate Optimism/Puffery In the Ninth Circuit, “vague, generalized assertions of corporate optimism or statements of 19 20 ‘mere puffing’ are not actionable material misrepresentations under federal securities laws” 21 because no reasonable investor would rely on such statements. In re Fusion-io, 2015 WL 661869, 22 at *14 (collecting cases). When valuing corporations, investors do not “rely on vague statements 23 of optimism like ‘good,’ ‘well-regarded,’ or other feel good monikers.” In re Cutera, 610 F.3d at 24 1111. 25 Statements like “[w]e are very pleased with the learning from our pilot launch,” “so far 26 we’re getting really great feedback,” and “we are very pleased with our progress to date,” are 27 inactionable puffery. Wozniak v. Align Tech., Inc., 2012 WL 368366, at *4–5 (N.D. Cal. Feb. 3, 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 26 1 2012). Likewise, “statements projecting ‘excellent results,’ a ‘blowout winner’ product, 2 ‘significant sales gains,’ and ‘10% to 30% growth rate over the next several years’” have been 3 held not actionable as mere puffery. In re Fusion-io, 2015 WL 661869, at *14 (citing In re 4 Cornerstone Propane Partners, L.P. Sec. Litig., 355 F.Supp.2d 1069, 1087 (N.D.Cal.2005)). United States District Court Northern District of California 5 Statement 31 pertains to Defendant Zuckerberg’s conference call statements about the 6 FTC consent order. Compl. ¶ 261(b) (“We’ve worked hard to make sure that we comply with [the 7 FTC order].”). Plaintiffs allege that this was a misstatement because it misleadingly assured 8 investors that the Cambridge Analytica scandal, and any potential resulting regulatory action, was 9 a “non-issue.” Pl. Opp. at 13, 15. Defendants argue, and this Court agrees, that this statement is 10 too vague to be actionable. See, e.g., Lomingkit v. Apollo Educ. Grp. Inc., 2017 WL 633148, at 11 *23 (D. Ariz. Feb. 16, 2017) (“Courts often hold that statements regarding general legal 12 compliance are too vague to be actionable misrepresentations or omissions.”); see also Karam v. 13 Corinthian Colls., Inc., 2012 WL 8499135, at *10 (C.D. Cal. Aug. 20, 2012) (holding statement 14 “[c]ompliance for the organization has really been job one for us” inactionable puffery); In re 15 Gentiva Sec. Litig., 932 F. Supp. 2d 352, 370 (2013) (“The Court finds . . . [statements] that the 16 compliance program was “robust” or “best-of-class” . . . too general to cause reliance by a 17 reasonable investor.”). Because this a statement of general compliance, it is inactionable corporate 18 puffery. 19 Moreover, companies are not required to engage in “self-flagellation” by disclosing 20 unproven allegations. Haberland v. Bulkeley, 896 F. Supp. 2d 410, 426 (E.D.N.C. 2012); In re 21 Paypal Holdings, Inc., 2018 WL 466527, at *3 (N.D. Cal. Jan. 18, 2018) (“Federal securities laws 22 do not impose upon companies a ‘duty to disclose uncharged, unadjudicated wrongdoing.’” (citing 23 City of Pontiac Policemen & Firemen Ret. Sys. v. UBS AG, 752 F.3d 173, 184 (2d Cir. 2014)). At 24 the time this statement was made, the FTC only stated an intent to investigate Facebook, but had 25 not made any formal finding that Facebook violated the decree order. See Compl. ¶ 16 (“On 26 March 26, 2018, the FTC formally announced an investigation into Facebook’s breach of the 27 consent decree . . . .” (emphasis added)). Thus, Defendants had no requirement to elaborate on 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 27 1 United States District Court Northern District of California 2 any potential privacy breaches. Accordingly, Statement 31 is not an actionable misstatement. Statement 33 relates to statements made by Defendant Zuckerberg in an April 2018 3 Facebook post. He wrote that the Facebook community “continues to grow.” Compl. ¶ 271. 4 Plaintiffs argue that because there was a “basis” for doubt about growth, this statement is 5 misleading and conceals user disengagement. The statement, however, is almost identical to 6 statements this district has found to be inactionable puffery. See Cornerstone Propane, 355 F. 7 Supp. 2d at 1087 (statement “10% to 30% growth over the next several years” inactionable 8 puffery); LeapFrog, 527 F. Supp. 2d. at 1050 (vague statements like “[w]e are pleased with our 9 progress” inactionable); City of Royal Oak Ret. Sys. v. Juniper Networks Inc., 880 F. Supp. 2d 10 1045, 1064 (N.D. Cal. 2012) (statements like “our demand indicators are strong, our product 11 portfolio is robust” inactionable corporate optimism). In response, Plaintiffs argue that this 12 statement was deceptive because it misleadingly told investors that the Cambridge Analytica 13 scandal was not affecting Facebook. This rebuttal, however, fails to allege that Facebook was not 14 growing (thus rendering the statement false). Cf. In re Syntex Corp. Sec. Litig., 95 F.3d 922, 931 15 (9th Cir. 1996) (“Everything [was] going fine” actionable only because plaintiff “pled facts 16 showing that the statements were false when made”). Accordingly, because Plaintiffs have not 17 sufficiently pled falsity, this is an inactionable statement of corporate optimism. 18 Statement 34 is a statement of optimism (“[W]e’re optimistic about what we’re seeing 19 here.”). Compl. ¶ 273. The Court agrees with Defendants that this is a general statement of 20 corporate optimism because it is a vague, “run-of-the-mill” statement expressing, quite literally, 21 corporate optimism. Copper Mountain, 311 F. Supp. 2d at 868–69 (“run-of-the-mill” statements 22 like “business remained strong” inactionable corporate optimism). Thus, this statement is not 23 actionable. 24 For these reasons, the Court holds that Plaintiffs failed to plead falsity as required by the 25 PSLRA for Statements 31, 33, and 34. Accordingly, this Court GRANTS Defendants’ motion to 26 dismiss as to those statements. 27 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 28 iv. 1 To assert a claim under the PSLRA, the plaintiff must particularly plead the element of 2 United States District Court Northern District of California Failure to Sufficiently Allege Falsity 3 falsity. Zucco Partners, 552 F.3d at 990–91. “The PSLRA has exacting requirements for 4 pleading ‘falsity.’” Metzler, 540 F.3d at 1070. To satisfy these “exacting requirements” a plaintiff 5 must plead “specific facts indicating why” the statements at issue were false. Id.; Ronconi v. 6 Larkin, 253 F.3d 423, 434 (9th Cir. 2001) (“Plaintiffs’ complaint was required to allege specific 7 facts that show” how statements were false). A plaintiff may rely on contemporaneous statements 8 or conditions to demonstrate why statements were false when made, but such circumstantial 9 evidence must be plead with particularity. In re Stratosphere Corp. Sec. Litig., 1997 WL 581032, 10 at *13 (D. Nev. May 20, 1997) (noting that to plead falsity, plaintiff must provide “evidentiary 11 facts contemporary to the alleged false or misleading statements from which this court can make 12 inferences permissible under Rule 9(b).”). Thus, to be actionable, a statement must be false “at 13 [the] time by the people who made them.” Larkin, 253 F.3d at 430. The fact that a “prediction 14 proves to be wrong in hindsight does not render the statement untrue when made.” In re VeriFone 15 Sec. Litig., 11 F.3d 865, 871 (9th Cir. 1993). 16 Statements 1 and 2 pertain to how Facebook said it generally responds to situations 17 involving data violations; Defendants stated they would take “swift action” against companies that 18 mislead people or misuse their information because this is a “direct violation of [Facebook] 19 policies” and would require such companies to destroy improperly collected data. Compl. ¶¶ 227– 20 28. First, Plaintiffs do not allege that misleading people or misusing their information is allowed 21 under Facebook’s policies, i.e., that it is not a “direct violation” of the policy. Rather, Plaintiffs 22 allege that these statements were misleading because Facebook’s actions in response to the 23 Cambridge Analytica data breach, and other similar privacy violations, were “directly contrary” to 24 these assertions. Id. ¶ 229. Defendants stated they “will” take swift action;6 Plaintiffs must prove contemporaneous 25 26 27 28 6 This Court need not decide whether this statement is forward-looking, without the presence of meaningful cautionary language, as it holds Plaintiffs did not allege falsity with sufficient Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 29 United States District Court Northern District of California 1 falsity, Stratosphere Corp., 1997 WL 581032, at *13, and allege specific facts demonstrating that, 2 when the statements were made, Facebook did not intend to (1) take swift action and/or (2) 3 promptly ban from Facebook companies that violated Facebook’s policies and require those 4 companies to destroy misappropriated data. See In re Fusion-io, Inc. Sec. Litig., 2015 WL 661869 5 (N.D. Cal. Feb. 12, 2015) (requiring plaintiff provide evidentiary facts contemporary to the alleged 6 false statement from which court can make inferences permitted under Rule 9(b)). To show 7 contemporaneous falsity, Plaintiffs argue that when these statements were first made in 2015, 8 Facebook “had not taken any action to enforce its privacy policies until six months after the 9 Cambridge Analytica data breach was publicly reported and more than a year after the Company 10 had learned of it.” Pl. Opp. at 7 (citing Compl. ¶¶ 86, 94–97). But what happened in 2015 is 11 irrelevant, the Class Period starts in February 2017. When these statements were made in 2017, 12 Facebook “did investigate the alleged data misuse, did remove Kogan’s app from Facebook, and 13 did obtain certifications and confirmations that all user data had been destroyed.” Mot. at 11 14 (citing Compl. ¶¶ 9, 90, 92, 96, 98, 150–51, 176). Thus, this Court can infer they did take “swift 15 action.” 16 Plaintiffs next urge this Court to find the statements false because Defendants had not 17 taken any “meaningful steps to ‘require’ Cambridge Analytica to ‘destroy’ the affected data, to 18 investigate the extent of the breach, or even to identify the amount of data affected.” Pl. Opp. at 7 19 (citing Compl. ¶¶ 90–93, 98–99, 104–08). Plaintiffs, however, never allege that Defendants 20 promised to take “meaningful steps.” Further, and more damning, Plaintiffs cannot escape the fact 21 that Defendants did require Kogan to destroy the data, Compl. ¶ 9, and received confirmation from 22 Kogan that this was done, id. ¶ 92. 23 Finally, these statements, by their terms, are outside the scope of the Cambridge Analytica 24 matter and are thus outside the purview of Plaintiffs’ claim. Compare Compl. ¶¶ 227, 228 25 (“Facebook, which told The Guardian in 2015 that it was investigating allegations that the 26 27 28 particularity. See Pl. Opp. 8–9 (citing Fadia v. FireEye, Inc., 2016 WL 6679806, at *11–12 (N.D. Cal. Nov. 14, 2016). Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 30 1 company had improperly obtained data from its users, would not comment on the current status of 2 that investigation.” (emphasis added)), with id. ¶ 225 (“Facebook’s false assurances that it had 3 “take[n] swift action” in response to the Cambridge Analytica data breach . . . remained alive and 4 uncorrected in the market at the outset of the Class Period.”). 5 6 PSLRA for Statements 1 and 2. Accordingly, this Court GRANTS Defendants’ motion to dismiss 7 as to those statements. 8 9 United States District Court Northern District of California For these reasons, the Court holds that Plaintiffs failed to plead falsity as required by the Statements 3–8 refer to Facebook’s 2016 Privacy Policy (now recorded at Exhibit 25). See Compl. ¶¶ 301–04. Defendants argue that these statements are not actionable because they are 10 not adequately alleged to have been false or misleading. Mot. at 20; see also supra III.C.1.a.i. 11 (holding privacy policy statements actionable). 12 Plaintiffs take issue with the “investigating suspicious activity or violations of our terms or 13 policies” part of Statement 3. Compl. ¶¶ 301(a), 302(a). Plaintiffs argue this statement is false 14 because Defendants “deliberately ignored information brought to its attention about such risks and 15 violations,” like the failure to “fully or promptly” investigate the Cambridge Analytic breach or 16 “thousands of [other] reports of [privacy] violations.” Id. ¶ 302(a). Plaintiffs, however do not: (1) 17 provide this Court with specific occurrences of Defendants ignoring these “thousands of reports” 18 or (2) specifically allege, with evidentiary facts, that Defendants did not investigate suspicious 19 activity. To the contrary, Plaintiffs identify actions Defendants took to respond to data breaches, 20 like Cambridge Analytica, thus showing they did investigate these violations. See, e.g., id. ¶ 99. 21 Plaintiffs instead make conclusions that “Facebook [did not] make any attempt to investigate what 22 data had been compromised or from which users, or how widely it had been distributed beyond 23 Cambridge Analytica.” Id. ¶ 91; cf. id. ¶ 104 (identifying Defendant Zuckerberg’s expression of 24 regret about not doing more to investigate the data breach). Defendants never represented (and 25 Plaintiffs do not allege they did) that “investigate” means a “full or prompt” investigation. 26 Because Plaintiffs have not identified specific occurrences of lack of investigation, they have not 27 adequately alleged that this statement is false. 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 31 United States District Court Northern District of California 1 Regarding Statement 4, Plaintiffs allege that contrary to Defendants’ assertion that they 2 “work hard to protect . . . account[s] using teams of engineer, automated systems, and advanced 3 technology,” the company had “no ability to track user data provided to developers or others, 4 much less the ability to determine whether information had been used or shared beyond the extent 5 authorized by the user, or what user data had been compromised, who had it, or how it was being 6 used.” Id. ¶ 302(b). Specifically, Plaintiffs allege that during the class period, Defendants were 7 still concealing that it was unaware of how much data had been compromised or how many users 8 were affected by the Cambridge Analytica breach. Id. Plaintiffs’ allegation that the statement 9 “working hard to protect accounts” is rendered false by the Cambridge Analytica breach and 10 issues arising from the breach is a stretch. In this statement, Defendants do not profess an ability 11 to track user data or that they can determine third-party data-use. Further, Plaintiffs do not allege 12 contemporaneous facts that Defendants meant Statement 4 as an assurance that they could track 13 data. Accordingly, this Court cannot infer a connection between the data breach and this 14 statement. 15 Regarding Statements 5 and 8, Plaintiffs allege that contrary to Defendants assertion that: 16 (1) Facebook’s vendors, service providers, and other partners must “adhere to strict confidentiality 17 obligations that is consistent with [Facebook’s policies];” (2) Facebook “require[s] applications to 18 respect [user] privacy, and [the user’s] agreement with that application will control who the 19 application can use, store, and transfer that content and information;” and (3) that Facebook 20 “expected app developers and others to protect user’s rights by making it clear what information is 21 being collected and how it is used,” Facebook “repeatedly ignored information brought to its 22 attention about violations of those policies, and repeatedly authorized developers and others to use 23 information in ways that were directly contrary to those policies.” Id. ¶ 302(e). First, Plaintiffs do 24 not allege that Facebook partners do not have to adhere to strict confidentiality obligations. 25 Further, Statement 5, by its terms, only requires developers to adhere to strict confidentiality 26 obligations, it makes no assertion about what Defendants will do with developers who do not 27 adhere to this policy, and thus even if Defendants ignored violations, they never asserted here that 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 32 1 they would affirmatively do something. Finally, Plaintiffs provide no specific evidentiary facts 2 from which the Court can infer falsity, i.e., that at the time the statement was made, developers did 3 not have to adhere to strict confidentiality obligations. Accordingly, Statement 5 is not actionable. United States District Court Northern District of California 4 Regarding Statement 8, at the time of the Cambridge Analytica scandal, Facebook had a 5 different privacy policy. See Ex. 24. This privacy policy did not have any guarantee about 6 requiring apps to respect user privacy. The Cambridge Analytica scandal, thus, is irrelevant to this 7 2015/2016 privacy policy (and this is likely why Plaintiffs did not plead any Cambridge Analytica 8 related issues regarding Statement 8). Moreover, Plaintiffs point this Court toward no specific 9 instances of Facebook “repeatedly ignor[ing] information brought to its attention about violations 10 [of Statement 8]” or “repeatedly authoriz[ing] developers and others to use information in ways 11 that were directly contrary [to Statement 8].” Thus, the Court cannot conclude that Statement 8 is 12 false as Plaintiffs have not met their burden of showing particular, evidentiary facts from which 13 this Court can infer falsity. 14 Further regarding Statement 8, Plaintiffs argue that Defendants falsely stated that “[users] 15 can control” how their information is shared through “privacy and application settings.” Id. 16 ¶ 302(f); Pl. Opp. at 9. Plaintiffs argue this is a false statement because Defendants “knew that 17 Facebook’s privacy policies and settings were deliberately confusing to users,” especially 18 regarding third-party consent. Compl. ¶ 302(f). But Plaintiffs offer no contemporaneous pieces of 19 evidence from which this Court can infer Defendants knew users did not understand the policy. 20 Further, Plaintiffs do not allege that users could not control information-sharing. Therefore, again, 21 the Court cannot conclude that Statement 8 is an actionable false statement. 22 Regarding Statement 6, Plaintiffs allege that contrary to Defendants warning to app 23 developers that Facebook would enforce its privacy policy to prevent app developers from selling 24 or transferring user data, “or from using their customers’ friend data outside of their customer’s 25 use of the app,” Facebook failed to verify that user data compromised in the Cambridge Analytica 26 data breach had been deleted and its enforcement of this policy was “limited, haphazard, and 27 inconsistent.” Id. ¶ 302(c). 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 33 1 2 makes no guarantees about verifying data deletion. Rather, by its terms, it specifies enforcement 3 options like “disabling [an] app, restricting . . . access, requiring that you delete data, [or] 4 terminating our agreements with you.” Cf. id. ¶ 313 (Defendants required Cambridge Analytica to 5 delete the data per the policy); Id. ¶ 137 (“On May 14, 2018, CNN reported that ‘Facebook has 6 suspended 200 apps for possible misuse of user data in the wake of the Cambridge Analytica 7 scandal.’”). Further, Plaintiffs offer no specific facts from which this Court can infer that 8 Defendants’ enforcement was “limited, haphazard, and inconsistent.” Accordingly, the Court 9 cannot conclude that Statement 6 is false as Plaintiffs have not met their burden of showing 10 11 United States District Court Northern District of California The connection between Cambridge Analytica and Statement 6 is tenuous. Statement 6 particular, evidentiary facts from which this Court can infer falsity. Plaintiffs contend that Statement 7 is false because Defendants did not “notify [their] users 12 with context around the status of their account and actionable recommendations” when they 13 “confirmed . . . accounts [were] compromised.” Specifically, Plaintiffs point to the fact that 14 Defendants “failed to notify tens of millions of users whose data had been compromised by the 15 Cambridge Analytica data breach.” Id. ¶ 301(d). Defendants wrote this policy in 2017, an entire 16 year after they thought that Cambridge Analytica had already deleted the data. Id. ¶ 153. 17 Moreover, Plaintiffs have not shown that Defendants did not notify users once they confirmed 18 accounts were compromised. Id. ¶ 93; Id. ¶ 18 (“Facebook, also, for the first time, started to 19 notify data misuse victims and ‘tell people if their information may have been improperly shared 20 with Cambridge Analytica.’”). The notification to users came after Facebook learned that 21 Cambridge Analytica had not actually deleted user data. To discount this, Plaintiffs highlight 22 Defendants admissions of regret to show an inadequate response to the breach, but never show that 23 Defendants knew the accounts were compromised before this policy was enacted or before the 24 2018 articles. See id. ¶ 93. The Court, therefore, cannot conclude that this statement is actionable. 25 For these reasons, the Court holds that Plaintiffs failed to plead falsity as required by the 26 PSLRA for Statements 3–8. Accordingly, this Court GRANTS Defendants’ motion to dismiss as 27 to those statements. 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 34 United States District Court Northern District of California 1 Statements 9–19 refer to Defendants’ 10-K SEC risk disclosure statements. Plaintiffs 2 main contention is that these statements are materially false and misleading because the risks they 3 warned of already had materialized. Pl. Opp. at 11 (citing Compl. ¶¶ 6–13, 290–300). Essentially, 4 they argue that Defendants intentionally omitted information about the “existence and magnitude 5 of the risks” facing Facebook and thus mischaracterized threats facing Facebook as “future risks.” 6 Id. For example, Facebook warned investors, using contingent terms, that “[a]ny failure to prevent 7 or mitigate security breaches and improper access to or disclosure of . . . user data could result in 8 the loss or misuse of such data, which could harm our business and reputation.” Compl. ¶ 291. 9 This, Plaintiffs contend, is a material misstatement because “Defendants knew . . . they had not 10 properly ‘mitigate[d]’ the Cambridge Analytica data violation” by not investigating the full extent 11 of the breach, notifying victims of the breach, and not receiving reliable assurances that the data 12 had been deleted. Pl. Opp. at 11 (citing Compl. ¶¶ 8, 9, 90–93, 94–97, 100, 104–10). And, they 13 allege, because Defendants knew of these risks, it was materially misleading to “warn” investors 14 of “potential risks” to the Company by unaddressed privacy violations without revealing that those 15 exact risk already existed. Id. at 12. 16 For a risk disclosure to be false, Plaintiffs must “allege facts indicating that [the] risk factor 17 was already affecting [Facebook] to the extent that [D]efendants’ statements were false” when 18 made. Lloyd v. CVB Fin. Corp., 2012 WL 12883522, at *19 (C.D. Cal. Jan. 12, 2012) (emphasis 19 added); Baker v. Seaworld Entm’t, Inc., 2016 WL 2993481, at *12 (S.D. Cal. Mar. 31, 2016) 20 (holding that risk disclosure statements not materially false or misleading because 21 “[p]laintiffs . . . fail to plausibly allege Defendants knew that [warned-of risks] were having any 22 impact on attendance”); Williams v. Globus Med. Inc., 869 F.3d 235, 241–43 (3d Cir. 2017) 23 (holding risk disclosures not materially misleading because risks plead by the plaintiffs “had not 24 actually materialized at the time of either the 2013 10-K or the 2014 1Q 10-Q”). Plaintiffs do not 25 allege that the Cambridge Analytica data breach was “already affecting Facebook” at the time 26 these risk disclosures were made. Nor could they; these risk disclosure statements were made on 27 February 3, 2017, Compl. ¶ 291, two years after the first 2015 The Guardian story about 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 35 United States District Court Northern District of California 1 Cambridge Analytica, id. ¶ 7, and a year before the 2018 Cambridge Analytica The Guardian 2 story, id. ¶ 14–15. This chronology undercuts Plaintiffs theory of events, namely that the second 3 story reignited scrutiny and distrust, which caused the stock collapse. Id. ¶ 18–23. Accordingly, 4 Plaintiffs have offered no proof that future risks stated in the risk disclosures had “actually 5 affected” Facebook’s reputation or stock because the risks of negative media attention or 6 regulatory action had not yet materialized. 7 In the alternative, Plaintiffs argue that the statements were false because Defendants knew 8 the statements were incomplete. See Berson v. Applied Signal Tech., 527 F.3d 982, 986 (9th Cir. 9 2008) (holding that the defendant’s may have made a material misstatement when they omitted 10 information of a known-risk). Plaintiffs rely on Sgarlata v. PayPal Holdings, Inc. as support that 11 the risks facing Facebook had materialized. 2018 WL 6592771 (N.D. Cal. Dec. 13, 2018). There, 12 the plaintiffs claimed that the defendants made material misstatements in press releases. Id. at *2. 13 Specifically, the defendants released a statement that they were suspending operations due to the 14 discovery of “securities vulnerabilities.” Id. About a month later, the defendants revealed that 15 over 1.6 million people’s data had been potentially compromised. Id. The plaintiffs had plead, 16 with particularity, that the defendants knew about the data breach when they made the original 17 statement. Id. at *3. This allowed the court to conclude that the plaintiffs’ claims satisfied falsity 18 because the disclosure “could plausibly have created an impression that only a potential 19 vulnerability and not an actual breach had been discovered.”7 Id. at *7; see also Brody, 280 F.3d at 20 1006 (“[An omission] must affirmatively create an impression of a state of affairs that differs in a 21 material way from the one that actually exists.”). In contrast, here, Plaintiffs fail to plead specific facts from which this Court can infer that 22 23 Facebook knew of the risk still posed by the Cambridge Analytica breach and that a materially 24 different “state of affairs” existed. Rather, Plaintiffs indicate that no risk had materialized because 25 26 27 28 7 This further supports Defendants position that the risk, when stated, must have already materialized. In Sgarlata, the defendants knew that the stated “securities vulnerabilities” was actually a massive data breach. Thus, the risk stated already had materialized and so failure to disclose the gravity of this risk was an omission. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 36 1 Defendants had asked and had received certifications from Kogan, Cambridge Analytica, and its 2 affiliates that all Facebook user data had been destroyed and had banned Kogan and his app from 3 Facebook. Compl. ¶¶ 9, 90, 92, 96, 98, 150–51, 176. Plaintiffs do not allege other particular facts 4 from which this Court can infer Defendants knew these risk disclosures were false. See ¶ 78 5 (noting that Facebook did not know of any continued risk because it never audited its developers). 6 Further, Facebook changed its privacy policy and restricted app developers access to data, leading 7 the Court farther from the inference that Defendants knew a Cambridge Analytica-like event was 8 likely to happen again. Id. ¶¶ 98, 251, 258, 266, 280. For this reason, Statements 9, 10, 13–19 are 9 inactionable. Plaintiffs’ opposition points this Court towards Statement 11 to argue its language about United States District Court Northern District of California 10 11 “developing systems and processes designed to protect user data” is false because Defendants 12 allowed third-party consent for years. Opp. at 12. These risk disclosures, however, were made 13 after Facebook updated its privacy policy to no longer allow such consent. Plaintiffs next argue 14 that because Facebook continues to provide device makers access to users’ friends’ data without 15 their explicit consent (“whitelisting”), this disclosure is false.8 Pl. Opp. at 12. Plaintiffs, however, 16 do not allege this whitelisting resulted in “data loss” or a “security breach” thus making the risk 17 disclosure false. Compl. ¶ 291. Further, per Statement 12, Facebook discloses that such data 18 sharing may occur. Finally, Plaintiffs argue Statement 12 is false because it affirmatively reassures users that 19 20 Facebook only gives third parties “limited” data. Id. ¶ 291. Plaintiffs contend that this is false 21 because Facebook “didn’t really care how the data was used” and exposed data to copying “a 22 million times” by hundreds of third parties. Id. ¶ 131–48. Plaintiffs, however, seem to disregard 23 the final part of this statement—“if these third parties . . . fail to adopt or adhere to adequate 24 security practices . . . our data or users’ data may be improperly accessed, used, or disclosed.” 25 Id. ¶ 291. Defendants, thus, make no guarantee that data given to app developers would be 26 27 28 8 The Court does not rule on whether this white-listing violated Facebook’s privacy policies or whether Defendants knew about it. Compl. ¶¶ 140, 183. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 37 1 protected or that they would control app developers use of that data. Plaintiffs essentially only 2 allege that Facebook did not audit developers after learning of a potential data storage problem. 3 Id. ¶ 78. However, Facebook makes no contention that it would control the actions of these third- 4 parties. 5 For these reasons, the Court holds that Plaintiffs failed to plead falsity as required by the 6 PSLRA for Statements 9–19. Accordingly, this Court GRANTS Defendants’ motion to dismiss 7 as to those statements. Statements 20 & 21 refer to the white paper issued by Facebook in April 2017 in which 8 9 10 Defendants stated they would “notify specific people” targeted by sophisticated attackers and “proactively notify people” they believed would be targeted. Id. ¶ 230. Plaintiffs argue that these are false statements because (1) Defendant Zuckerberg admitted United States District Court Northern District of California 11 12 to the U.S. Senate that Facebook made a conscious decision not to inform users whose data had 13 been appropriated by Cambridge Analytica about the data breach, id. ¶¶ 93, 98, 100, (2) failed to 14 either investigate other data-sharing instances with other app developers or notify potential victims 15 of such data-sharing, id. ¶¶ 79, 131–48, and (3) continued to share user data in ways that violated 16 its stated privacy policies by providing “whitelisted” mobile device makers access to users’ friends 17 data without notifying users, id. ¶¶ 138, 140, 183, 209–10. Plaintiffs, however, seem to ignore that these statements refer to “targeted data collection 18 19 and theft.” Ex. 26 at 7 (emphasis added). Specifically, this page advised users about protecting 20 their accounts from data collection by methods like “phishing9 with malware to infect a person’s 21 computer and credential theft to gain access to . . . online accounts.” Id. This Court rejects 22 Plaintiffs’ argument that “phishing with malware” was “merely an example of misconduct that 23 could compromise user data.” Pl. Opp. at 6. The portion of the paper with the “false statements” 24 25 26 27 28 9 Phishing is “a cybercrime in which a target or targets are contacted by email, telephone, or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords.” What Is Phishing?, PHISHING.ORG, https://www.phishing.org/what-is-phishing (last visited Sept. 17, 2019). Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 38 United States District Court Northern District of California 1 expressly confines itself to situations involving “malicious actors,” who use “[t]ypical methods” 2 like phishing. Ex. 26 at 7. Plaintiffs do not allege that Cambridge Analytica and other app 3 developers used methods like “phishing with malware.” Instead, Plaintiffs’ complaint focuses on 4 situations where user data was not obtained by phishing, but rather by app developers who 5 accessed the platform with Facebook’s permission and user consent. Compl. ¶¶ 46, 79, 150, 280. 6 Contrary to Plaintiffs’ contention, Hong is thus directly applicable10 because this portion of the 7 white paper plainly does not bear on the Cambridge Analytica-type privacy issues. See Hong v. 8 Extreme Networks, Inc., 2017 WL 1508991, at *15 (N.D. Cal. Apr. 27, 2017) (holding the 9 plaintiffs’ allegations of falsity insufficient because “the reasons Plaintiffs offer as to why the 10 statements are false or misleading bear no connection to the substance of the statements 11 themselves”). Further, by its very terms, notification was limited to people targeted by “sophisticated 12 13 attackers.” Ex. 26 at 7. This is defined as an “attacker suspected of working on behalf of a nation- 14 state.” Ex. 37 (cited in Ex. 26 at 7 n.5). The additional warning is shown if Facebook “has a 15 strong suspicion that an attack could be government-sponsored.” Id. Plaintiffs do not allege that 16 Cambridge Analytica, or any other app developer, was “suspected of working on behalf of a 17 nation state” or “government sponsored.” Instead, Plaintiffs allege that Cambridge Analytica 18 misappropriated Facebook user data for use in U.S. political campaigns, but not that they were 19 sophisticated attackers who targeted users’ accounts. Cf. Compl. ¶¶ 80–83. Defendants 20 commitment in the white paper to warn users either proactively or post-attack by a sophisticated 21 attacker, thus, has no relation to the allegations of misappropriation by Cambridge Analytica. Finally, Plaintiffs attempt to show falsity by contrasting the white paper statements and 22 23 Defendants’ 2018 statements. In 2018, Defendants are quoted as saying “[they] should have 24 25 26 27 28 10 Plaintiffs’ argument that its interpretation prevails because this is the pleading stage is rejected. Pl. Opp. at 6. While it is true that factual disputes are not resolved at the pleading stage, In re Finisar Corp. Sec. Litig., 2017 WL 1549485, at *5 (N.D. Cal. May 1, 2017), this is not a factual issue as Plaintiff never pleads that the Cambridge Analytica scandal was a “phishing-like” incident. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 39 1 [informed users]” and that they “got [it] wrong” by withholding notice from the Cambridge 2 Analytica victims, Compl. ¶¶ 174–83. The connection, however, fails for two reasons: first, as 3 demonstrated, the white paper has no relation (stated or implied) to the Cambridge Analytica 4 scandal, and so statements made about the Cambridge Analytica or related data scandals are per se 5 unrelated to the white paper’s statements, which focuses on Facebook’s phishing policy. Second, 6 and relatedly, while these statements may demonstrate Defendants’ regret, they do not contradict 7 any alleged earlier statement by Defendants that affected users would be notified about the 8 Cambridge Analytica breach. For these reasons, the Court holds that Plaintiffs failed to plead falsity as required by the United States District Court Northern District of California 9 10 PSLRA for Statements 20 and 21. Accordingly, this Court GRANTS Defendants’ motion to 11 dismiss as to those statements. Statement 2211 is Defendant Sandberg’s 2017 statement that “no one is going to get your 12 13 data that shouldn’t have it” because “you’re controlling who you share with.” Compl. ¶ 234(a). Plaintiffs allege two main theories of misconduct regarding consent: (i) third-party consent 14 15 and (ii) whitelisting. This statement addresses theory (ii), specifically that Defendants were still 16 involved in the harvesting of data by allowing certain whitelisted apps to access data contrary to 17 the Privacy Policy. See Ex. 25. Plaintiffs argue, and this Court agrees, that Plaintiffs have adequately pleaded that users 18 19 could not control their data. See id. ¶¶ 138–40, 207, 209 (discussing how Facebook was 20 overriding user privacy settings to provide data to mobile device makers, depriving users of 21 control); Id. ¶¶ 102–03 (stating that Defendants knew that bad actors were able to access data). 22 These allegations are particular enough to allow the Court to infer contemporaneous falsity—that 23 24 25 26 27 28 11 This Court holds that this is not an inactionable forward-looking statement because “you need to know” refers to current practices, as does “you are controlling.” Mulligan v. Impax Labs., Inc., 36 F. Supp. 3d 942, 963–64 (N.D. Cal. 2014) (holding statements outside the PSLRA's definition of a “forward-looking” statement because contained representations of present or historical fact). This Court also holds that this statement is not corporate puffery because it is not so vague or exaggerated that it is “not capable of objective verification.” In re Cornerstone Propane Partners, 355 F. Supp. 2d 1069, 1087–88 (N.D. Cal. 2005). Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 40 1 is, that user’s privacy choices were being “overridden” at the time this statement was made. Id. 2 ¶¶ 140, 183 (stating that the whitelisting deals started in 2015); see also In re Facebook Inc., 3 Consumer Privacy User Profile Litig., 2019 WL 4261048, at *16 (holding whitelisted theory 4 adequately pleaded because “complaint plausibly alleges that none of the users consented” to this 5 type of sharing). 6 United States District Court Northern District of California 7 For these reasons, the Court holds that Plaintiffs adequately pleaded falsity as required by the PSLRA for Statement 22. 8 Statements 25–28 pertain to the update posted by Defendant Zuckerberg after the 2018 9 The Guardian article. Plaintiffs allege these statements are materially misleading because they 10 were meant to cast doubt on news reports about Facebook’s failure to address data breaches. 11 Plaintiffs allege “Facebook had authorized Kogan . . . to sell user data,” “had taken no action 12 against Kogan,” “waited six months before asking Cambridge Analytica and other entities to 13 certify all data had been destroyed,” and “made no effort . . . to identify what data had been 14 compromised.” Plaintiffs, however, allege no facts from which this Court can infer falsity—they 15 offer no evidence Facebook authorized Kogan to sell data, they indicate that Facebook did take 16 action against Kogan and Cambridge Analytica, and they never plead Facebook made promises to 17 take action within a certain time frame. 18 For these reasons, the Court holds that Plaintiffs failed to plead falsity as required by the 19 PSLRA for Statements 25–28. Accordingly, this Court GRANTS Defendants’ motion to dismiss 20 as to those statements. 21 22 Statements 29 & 30 pertain to the issue of consent, specifically whether users gave thirdparty consent. 23 In a Facebook post, Defendants wrote “[t]he claim that this is a data breach is completely 24 false.” (Statement 29), Compl. ¶ 255. Plaintiffs argue that this statement is materially misleading 25 because (1) this was a huge data breach and (2) it undermined media reports concerning 26 Facebook’s lax privacy policies thus misleadingly reassuring investors that the Cambridge 27 Analytica scandal was behind the Company. Id. ¶ 256–57. First, Plaintiffs state “[i]t was patently 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 41 1 false to claim that the Cambridge Analytica scandal was “not a data breach.” Id. ¶ 256. This, 2 however, overlooks the fact that the post confined its meaning of “data breach” to “systems 3 [being] infiltrated, . . . passwords or sensitive pieces of information [being] stolen or hack[ing].” 4 Id. Plaintiffs do not allege that this definition of a data breach was materially misleading or false 5 or that the Cambridge Analytica scandal fit within this definition of data breach. United States District Court Northern District of California 6 In this same post, Defendants wrote “everyone involved gave their consent. People 7 knowingly provided their information.” (Statement 30), Id. ¶ 255. Plaintiffs argue that this is a 8 false statement because not all 87 million affected users consented to the data-sharing and none 9 consented to the sale of their data for use in political campaigns. Pl. Opp. at 14. First, this 10 statement never contends that people consented to the use of their data in political campaigns. 11 Plaintiffs allege that saying people consented is false because people did not knowingly give 12 consent to the data sharing by noting the number of affected people, that they did not get timely 13 notice, and that the FTC consent order required them to report data violations. 14 Again, Plaintiffs allege three main theories of misconduct regarding consent: (i) third-party 15 consent, (ii) whitelisting, and (iii) sharing of data with third-parties contrary to stated policy. At 16 issue here, is category (i); Statement 30 directly addresses this type of consent. Exhibit 24 shows 17 the privacy policy in place during the creation and implantation of the app “thisisyourdigitallife.” 18 This policy stated “Just like when you share information by email or elsewhere on the web, 19 information you share on Facebook can be re-shared. This means that if you share something on 20 Facebook, anyone who can see it can share it with others, including the games, applications, and 21 websites they use.” Ex. 24 at 4 (emphasis added). The policy also told users they could decline to 22 allow this third-party consent but would have to actively opt-out, otherwise their data could be 23 shared. Id.; see also In re Facebook Inc., Consumer Privacy User Profile Litig., 2019 WL 24 4261048, at *14 (“Thus, contrary to the plaintiffs' argument, the language of these disclosures 25 cannot be interpreted as misleading users into believing that they merely needed to adjust their 26 privacy settings to ‘friends only’ to protect their sensitive information from being disseminated to 27 app developers. Users were told that they needed to adjust their application settings too.”). 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 42 While Facebook’s updated Privacy Policy restricts friends’ ability to share data with third- 1 2 party app developers, Ex. 25, Plaintiffs have provided no factual basis that the statement 3 “everyone involved gave their consent” was false when made because they have not shown that 4 users did not consent. In re Fusion-io, 2015 WL 661869, at *16 (“To satisfy these ‘exacting 5 requirements,’ a plaintiff must plead ‘specific facts indicating why’ the statements at issue were 6 false.”). For these reasons, the Court holds that Plaintiffs failed to plead falsity as required by the 7 8 PSLRA for Statements 29 & 30. Accordingly, this Court GRANTS Defendants’ motion to 9 dismiss as to those statements. Statements 23, 24, and 3212 are used by Plaintiffs to show that Defendants “misleadingly 10 United States District Court Northern District of California 11 downplayed” the impact of the effect of the looming GDPR on business. Statements 23, 24, and 32 are about the GDPR; Plaintiffs argue that Defendants falsely 12 13 assured investors that Facebook was already “already adhering to or prepared to meet” the 14 regulations, when they were not meeting the requirements. Compl. ¶¶ 233–37, 261, 276–77, 283. 15 Defendants, however, never asserted that Facebook was fully compliant with the GDPR, only that 16 “Europe . . . passed a single privacy law and [Facebook is] adhering to that.” Id. ¶ 201 (Statement 17 23). In other words, this expresses an intention to adhere to this privacy law, the statement is not a 18 profession of being fully compliant. Facebook maintained only that it “applies the core principles 19 [of the GDPR] . . . and we’re building on this to ensure that we comply in May of next year.” Id. 20 (emphasis added) (Statement 24); see also id. ¶ 202 (“[W]e’ve had almost all of what’s in [the 21 GDPR] implemented for years . . . .”) (emphasis added) (Statement 32). The statements show that 22 Facebook knew it was not fully GDPR complaint, but that it intended to keep working to become 23 24 25 26 27 28 12 Plaintiffs did not respond to Defendants’ argument that the Daily Active User (“DAU”) and Monthly Active User (“MAU”) statements are not misleading. The Court agrees with Defendants’ arguments, Mot. at 17, that simply using a new methodology to count accounts is not misleading. See Ironworkers Local 580—Joint Funds v. Linn Energy, LLC, 29 F. Supp. 3d 400, 426 (S.D.N.Y. 2014) (rejecting as misguided the claim that changing a formula for calculating financial metrics amounted to “some sort of admission that statements made in prior reporting periods were false or materially misleading”). Accordingly, the DAU and MAU figures used were not misleading. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 43 United States District Court Northern District of California 1 GDPR compliant. To rebut this, Plaintiffs argue that the costs associated with GDPR 2 implementation, specifically user growth and revenue costs, show that Facebook was not actually 3 anywhere near being GDPR compliant. Pl. Opp. at 18. Defendants, however, specifically warned 4 investors in April 2018 that implementation of the GDPR would impact advertising revenues and 5 user growth by stating they expected “full-year 2018 total expenses [to] grow 50-60%” due to 6 “significant investments we’re making in areas like safety and security.” Compl. ¶ 277, Ex. 11 at 7 8; see also Turocy v. El Pollo Loco Holdings, Inc., 2016 WL 4056209, at *8–10 (C.D. Cal. July 8 25, 2016) (holding not misleading statement where “allegedly omitted facts rendering the 9 statement false were actually disclosed”). 10 Further, Plaintiffs never identify a single provision of the GDPR that Facebook had not 11 implemented at the time the challenged statements were made. Reply at 11. Instead, Plaintiffs 12 rely on a fraud by hindsight pleading—they allege that GDPR compliance statements must have 13 been false because user growth declined slightly once GDRP had been fully implemented. This is 14 not permitted under PSRLA’s strict pleading standards. See City of Roseville Emps. Ret. Sys. v. 15 Sterling Fin. Corp., 963 F. Supp. 2d 1092, 1109 (E.D. Wash. 2013) (“Without evidence of 16 contemporaneous falsity, an allegation of a misleading representation, which entirely rests on later 17 contradictory statements, constitutes an impermissible attempt to plead fraud by hindsight.”). 18 Accordingly, these statements are not actionable. For these reasons, the Court holds that Plaintiffs failed to plead falsity as required by the 19 20 PSLRA for Statements 25–28. Accordingly, this Court GRANTS Defendants’ motion to dismiss 21 as to those statements. 2. Scienter 22 Having determined that Statement 2213 is actionable, the next issue is whether Plaintiffs 23 24 adequately pleaded a strong inference of scienter. 25 26 27 28 13 This section does not address Defendants or Plaintiffs argument regarding inference of scienter based on “data being important to Facebook’s user model” because Statement 22 is actionable due to whitelisting, not the Cambridge Analytica breach. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 44 United States District Court Northern District of California 1 Scienter is required under the PSLRA and plaintiffs must plead “with particularity facts 2 giving rise to a strong inference that the defendant acted with the requisite state of mind” 3 regarding “each act or omission alleged.” 15 U.S.C. 78u-4(b)(2)(A). It can be established by 4 intent, knowledge, or certain levels of recklessness. Verifone, 704 F.3d at 702. Recklessness must 5 be deliberate. Schueneman v. Arena Pharma., Inc., 840 F.3d 698, 705 (9th Cir. 2016) 6 (“[S]cienter—a mental state that not only covers ‘intent to deceive, manipulate, or defraud,’ but 7 also ‘deliberate recklessness.’” (citations omitted)). Deliberate recklessness is an “extreme 8 departure from the standards of ordinary care . . . which presents a danger of misleading buyers or 9 sellers that is either known to the defendant or is so obvious that the actor must have been aware of 10 it.” Id. Thus, recklessness only satisfies scienter under § 10(b) to the extent it reflects some 11 degree of intentional or conscious misconduct. In re NVIDIA Corp. Sec. Litig., 768 F.3d 1046, 12 1053 (9th Cir. 2014). 13 A “strong inference” of scienter exists “only if a reasonable person would deem the 14 inference of scienter cogent and at least as compelling as any opposing inference one could draw 15 from the facts alleged.” Tellabs, 551 U.S. at 324. In reviewing a complaint under this standard, 16 the court must consider “all reasonable inferences to be drawn from the allegations, including 17 inferences unfavorable to the plaintiffs.” Metzler, 540 F.3d at 1061. To plead a strong inference 18 of scienter, plaintiffs must plead particularized facts demonstrating that the individual defendants 19 knew the supposedly false statements challenged by the plaintiffs were false or misleading when 20 made or had access to information demonstrating that the individual defendants were deliberately 21 reckless in allowing the false statements to be made. See id. at 1068. 22 Plaintiffs allege Defendant Sandberg falsely claimed, “[N]o one is going to steal your 23 data.” Compl. ¶ 234(a). This Court held above that Plaintiffs adequately alleged that this is a 24 materially misleading statement considering “whitelisting.” To establish scienter, Plaintiffs rely 25 on Sandberg’s statements of regret, “witness accounts,” “widespread privacy misconduct,” and 26 27 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 45 1 “the FTC Consent Decree.”14 The witness accounts do not establish scienter because none of the witnesses establish that United States District Court Northern District of California 2 3 Sandberg intentionally or recklessly lied when she claimed users controlled their data. First, 4 Plaintiffs argue that in 2016, Roger McNamee raised “red flags” about Facebook’s “systemic 5 problem of data misuse.” Pl. Opp. at 23. McNamee discussed with Defendants a “systemic 6 problem with algorithms and the business model of Facebook that allow bad actors to cause harm 7 to innocent users of Facebook.” Ex. 15 at 3. This could establish knowledge that Sandberg knew, 8 in 2017 when she made Statement 22, that people’s data could be vulnerable. Plaintiffs, however, 9 do not allege, nor can this Court infer, that when Sandberg made this statement, a year after 10 McNamee “raised red flags,” that these processes were still allowing bad actors to cause harm to 11 innocent users. The stronger inference is that Facebook had addressed these problems since 12 Sandberg addressed security improvements following the Russian interference in the Axios 13 Interview (the interview in which Statement 22 was made). 14 Similarly, Plaintiffs use the fact that Sandy Parakilas warned the “top five executives” at 15 Facebook about “privacy vulnerabilities” at Facebook. But, this was five years before the Class 16 Period began, Reply at 14, and thus suffers the same problem as McNamee’s statement. Likewise, 17 Christopher Wylie’s testimony that “Facebook was first notified of [Cambridge Analytica’s] 18 harvesting scheme in 2015,” Compl. ¶ 86(f), has little import considering she said “going to get” 19 your data, therefore rendering the Cambridge Analytica breach irrelevant. Next, Plaintiffs argue that widespread privacy misconduct at Facebook confirms scienter. 20 21 Plaintiffs point to the New York Times article discussing “whitelisting” and that “the Company had 22 struck agreements allowing phone and other device makers access to vast amounts of its users’ 23 personal information.” Compl. ¶ 138. They argue that this alone is enough to establish scienter. 24 But, none of the cases Plaintiffs cite support this conclusion. See In re Countrywide Fin. Corp. 25 26 27 28 14 The Court does not address the arguments regarding the stock sales as those relate to scienter regarding the 1Q18 and 2Q18 disclosures. The chart in the Complaint does not even include the range during which Sandberg made the Axios statement. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 46 1 Sec. Litig., 588 F. Supp. 2d 1132, 1190 (C.D. Cal. 2008) (holding complaint persuasively alleges 2 that “systematic changes in Countrywide came from the top down and pervaded virtually every 3 office” because directors and officers allegedly were regularly provided “detailed exception 4 statistics”). Here, in contrast to Countrywide, Plaintiffs do not allege that Sandberg knew about 5 whitelisting or was provided detailed information about it. It is not enough that Facebook’s 6 business model depends on users freely sharing their information and thus incentivizes misuse of 7 data. See, e.g., Compl. ¶ 302(f); Metzler, 540 F.3d at 1068 (“As this court has noted on more than 8 one occasion, corporate management's general awareness of the day-to-day workings of the 9 company's business does not establish scienter—at least absent some additional allegation of 10 specific information conveyed to management and related to the fraud.”). Third, Plaintiffs point to the FTC Decree to establish scienter because it put “Facebook on United States District Court Northern District of California 11 12 notice” that “its representations concerning its privacy practice needed to be completely accurate.” 13 Pl. Opp. at 26. Plaintiffs use In re Enron Corp. Sec., Deriv. & ERISA Litig., 235 F. Supp. 2d 549 14 (S.D. Tex. 2002) to support this. However, there, the court mentioned the SEC Consent Decree in 15 conjunction with many other factors; this combination gave rise to a strong inference of scienter. 16 Id. at 706. The SEC Consent Decree alone was not enough to infer scienter and, likewise here, the 17 FTC Consent Decree alone is insufficient to infer scienter as Plaintiffs have provided no 18 particularized facts from which this Court can infer Sandberg consciously lied. For these reasons, the Court finds that Plaintiffs fail to plead scienter as to Statement 22 as 19 20 required by the PSLRA and so this Court GRANTS Defendants’ motion to dismiss as to 21 Statement 22.15 Plaintiffs also bring claims for violations of Sections 20(a) and (A) of the Exchange Act. 22 23 Both these claims, however, depend on a primary violation of Section 10(b) or Rule 10b-5. Lipton 24 v. Pathogenesis Corp., 284 F.3d 1027, 1035 n.15 (9th Cir. 2002) (“[T]o prevail on their claims for 25 violations of § 20(a) and § 20A, plaintiffs must first allege a violation of § 10(b) or Rule 10b 5.”). 26 27 28 15 Because it is unnecessary, this Court does not address causation or reliance. Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 47 1 Because the Court determines Plaintiffs’ claim under Section 10(b) and Rule 10b-5 fail, 2 Defendants motion to dismiss these claims is also GRANTED. United States District Court Northern District of California 3 IV. LEAVE TO AMEND 4 When dismissing a complaint for failure to state a claim, a court should grant leave to 5 amend “unless it determines that the pleading could not possibly be cured by the allegation of 6 other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000). Although the Court has 7 determined that Plaintiffs fail to state a claim, it is possible Plaintiffs can cure their allegations by 8 alleging, among other things, more particular facts as to why statements by the Individual 9 Defendants were false when made. Accordingly, because Plaintiffs may salvage their Complaint, 10 the Court finds amendment would not be futile. Plaintiffs' claims are therefore dismissed with 11 leave to amend. 12 13 V. CONCLUSION Defendants’ motion to dismiss Plaintiffs' Complaint in its entirety is GRANTED with 14 leave to amend. Should Plaintiffs choose to file an amended complaint, they must do so by 15 October 26, 2019. Failure to do so, or failure to cure the deficiencies addressed in this Order, will 16 result in dismissal of Plaintiffs' claims with prejudice. Plaintiffs may not add new claims or 17 parties without leave of the Court or stipulation by the parties pursuant to Federal Rule of Civil 18 Procedure 15. 19 20 21 22 IT IS SO ORDERED. Dated: September 25, 2019 ______________________________________ EDWARD J. DAVILA United States District Judge 23 24 25 26 27 28 Case No.: 5:18-cv-01725-EJD ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS 48

Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.