UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT In re: FACEBOOK, INC. No. 22-15077 SECURITIES LITIGATION, ______________________________ D.C. No. 5:18-cv- 01725-EJD AMALGAMATED BANK, Lead Plaintiff; PUBLIC EMPLOYEES’ RETIREMENT SYSTEM OF OPINION MISSISSIPPI; JAMES KACOURIS, individually and on behalf of all others similarly situated,

Plaintiffs-Appellants,

v. FACEBOOK, INC.; MARK ZUCKERBERG; SHERYL SANDBERG; DAVID M. WEHNER,

Defendants-Appellees.

Appeal from the United States District Court for the Northern District of California Edward J. Davila, District Judge, Presiding

Argued and Submitted February 8, 2023 San Francisco, California 2 AMALGAMATED BANK V. FACEBOOK, INC.

Filed October 18, 2023 Before: M. Margaret McKeown, Jay S. Bybee, and Patrick J. Bumatay, Circuit Judges.

Opinion by Judge McKeown; Partial Concurrence and Partial Dissent by Judge Bumatay

SUMMARY *

Securities Exchange Act of 1934

The panel affirmed in part and reversed in part the district court’s judgment dismissing under Fed. R. Civ. P. 12(b)(6) for failure to state a claim a Third Amended Complaint in which purchasers of Facebook common stock between February 3, 2017, and July 25, 2018, (“the shareholders”) allege that Facebook and its executives violated Sections 10(b), 20(a), and 20A of the Securities Exchange Act of 1934 and Rule 10b-5 of the Exchange Act’s implementing regulations by making materially misleading statements and omissions regarding (1) the risk of improper access to Facebook users’ data, (2) Facebook’s internal investigation into British political consulting firm Cambridge Analytica, and (3) the control Facebook users have over their data. In March 2018, news broke that Cambridge Analytica improperly harvested personal data from millions of * This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader. AMALGAMATED BANK V. FACEBOOK, INC. 3

unwitting Facebook users and retained copies of the data beyond Facebook’s control. In the months that followed, the public learned that Facebook had known of Cambridge Analytica’s misconduct for over two years and failed to inform affected users, and that Facebook surreptitiously allowed certain whitelisted third-party apps to access users’ Facebook friend data without the users’ friends’ consent. Facebook and its executives made various statements before and after the news announcements assuring users that they fully controlled their data on Facebook and that no third party would access the data without their consent. In the wake of the Cambridge Analytica and whitelisting scandals, Facebook’s stock price suffered two significant drops totaling more than $200 billion in market capitalization. The panel considered whether, under the heightened standard of the Private Securities Litigation Reform Act, the shareholders (1) adequately pleaded falsity as to the challenged risk statements, (2) adequately pleaded scienter as to the Cambridge Analytica investigation statements, and (3) adequately pleaded loss causation as to the user control statements. First, the panel held that the shareholders adequately pleaded falsity as to the statements warning that misuse of Facebook users’ data could harm Facebook’s business, reputation, and competitive position and the district court erred by dismissing the complaint as to those statements. The panel wrote that, as in In re Alphabet Sec. Litig., 1 F.4th 687 (9th Cir. 2021), the shareholders here adequately pleaded falsity as to statements in a 2016 Form 10-K filing with the SEC in which Facebook represented the risk of third parties improperly a