UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT In re: FACEBOOK, INC. No. 22-15077 SECURITIES LITIGATION, ______________________________ D.C. No. 5:18-cv- 01725-EJD AMALGAMATED BANK, Lead Plaintiff; PUBLIC EMPLOYEES’ RETIREMENT SYSTEM OF ORDER AND MISSISSIPPI; JAMES KACOURIS, AMENDED individually and on behalf of all others OPINION similarly situated,

Plaintiffs-Appellants,

v. FACEBOOK, INC.; MARK ZUCKERBERG; SHERYL SANDBERG; DAVID M. WEHNER,

Defendants-Appellees.

Appeal from the United States District Court for the Northern District of California Edward J. Davila, District Judge, Presiding

Argued and Submitted February 8, 2023 San Francisco, California 2 AMALGAMATED BANK V. FACEBOOK, INC.

Filed October 18, 2023 Amended December 4, 2023 Before: M. Margaret McKeown, Jay S. Bybee, and Patrick J. Bumatay, Circuit Judges.

Opinion by Judge McKeown; Partial Concurrence and Partial Dissent by Judge Bumatay

SUMMARY *

Securities Fraud

The panel filed (1) an order denying a petition for panel rehearing and a petition for rehearing en banc; and (2) an amended opinion affirming in part and reversing in part the district court’s dismissal of a securities fraud action against Facebook, Inc., and three of its executives, and remanding for further proceedings. Cambridge Analytica improperly harvested personal data from millions of unwitting Facebook users and retained copies of the data beyond Facebook’s control. Facebook had known of Cambridge Analytica’s misconduct for over two years and failed to inform affected users, and Facebook surreptitiously allowed certain whitelisted third-party apps to access users’ Facebook friend data without the users’ friends’ consent.

* This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader. AMALGAMATED BANK V. FACEBOOK, INC. 3

Facebook shareholders filed suit, alleging that the defendants violated Sections 10(b), 20(a), and 20A of the Securities Exchange Act of 1934 and Rule 10b-5 by making materially misleading statements and omissions regarding the risk of improper access to Facebook users’ data, Facebook’s internal investigation into Cambridge Analytica, and the control Facebook users had over their data. The panel held that, under the heightened standard of the Private Securities Litigation Reform Act, the shareholders adequately pleaded falsity as to the some of the challenged risk statements. The panel followed In re Alphabet Sec. Litig., 1 F.4th 687 (9th Cir. 2021), which held that falsity allegations were sufficient to survive a motion to dismiss when the complaint plausibly alleged that a company’s SEC filings warned that risks “could” occur when, in fact, those risks had already materialized. The panel concluded that the shareholders adequately pleaded falsity as to the statements warning that misuse of Facebook users’ data could harm Facebook’s business, reputation, and competitive position, and the district court erred by dismissing the complaint as to those statements. The panel concluded, however, that the district court correctly dismissed the challenged statements regarding the risk of security breaches and the risk of the public not perceiving Facebook’s products to be “useful, reliable, and trustworthy.” The panel left to the district court on remand whether the shareholders could satisfy the other elements of the claims with respect to risk statements. The panel held that the shareholders did not adequately plead facts giving rise to a strong inference of scienter as to the Cambridge Analytica investigation sta