Amalgamated Bank v. Facebook, Inc., 87 F.4th 934

Background

In 2015–16 Cambridge Analytica obtained and retained Facebook-derived data on millions of users via a third‑party app; Facebook investigated internally and sought certifications that data were deleted, but allegedly learned by mid‑2016 that misuse persisted.
Facebook filed a 2016 Form 10‑K (filed Feb. 2017) warning generically that improper third‑party access "could" harm its business, reputation, and competitive position.
In March 2018 press reports revealed Cambridge Analytica had retained and used Facebook data; Facebook announced suspension of Cambridge Analytica and stock fell ~18% (≈$100B market cap loss).
On June 3, 2018 the New York Times disclosed Facebook’s "whitelisting" practice giving certain partners deep access to friend data; no immediate stock drop followed that revelation.
On July 25, 2018 Facebook announced weak Q2 results (cited GDPR and privacy efforts), and stock fell ~19%; shareholders sued alleging securities fraud; the district court dismissed the TAC; Ninth Circuit affirmed in part, reversed in part, and remanded.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Falsity of 2016 10‑K risk statements (third‑party misuse)	Facebook represented third‑party misuse risk as hypothetical even though it knew Cambridge Analytica had improperly accessed user data before the 10‑K.	The 10‑K gave generic warnings about potential harm; it did not state Facebook was free from breaches or that reputational/business harm had occurred.	Reversed dismissal: plaintiffs plausibly pleaded falsity as to 10‑K risk statements about third‑party misuse (analogous to In re Alphabet). Other risk statements about security breaches and "useful, reliable, trustworthy" were properly dismissed.
Scienter for March 2017 investigation statements	Spokesperson said the internal probe had not uncovered wrongdoing; plaintiffs contend Facebook knew otherwise.	Plaintiffs fail to allege that the spokesperson actually knew or acted with deliberate recklessness—at most they allege the spokesperson "should have known."	Affirmed dismissal: scienter not adequately pleaded for the Cambridge Analytica investigation statements.
Loss causation for user‑control statements re March 2018 disclosure	Pre‑March assurances that users controlled their data were rendered false by the March 16, 2018 revelations; that disclosure was corrective and caused the March stock drop.	Earlier 2015–16 press and Facebook statements already put the market on notice; claims therefore not corrective.	Reversed dismissal: plaintiffs adequately pleaded that the March 2018 Cambridge Analytica revelation was corrective and caused the March stock decline (loss causation).
Loss causation for user‑control statements re June whitelisting / July earnings	Combined effect of Cambridge Analytica, June whitelisting revelations, and GDPR/earnings caused the July 25 drop.	The July drop was driven by an earnings miss and GDPR effects; June whitelisting alone produced no immediate price reaction.	Reversed in part: plaintiffs adequately pleaded that the Cambridge Analytica and whitelisting revelations (as later reflected in July earnings) contributed to the July drop; standalone June whitelisting claim (without price impact) was not actionable.

Key Cases Cited

In re Alphabet Sec. Litig., 1 F.4th 687 (9th Cir. 2021) (risk‑factor warnings that a risk "could" occur can be misleading when the risk already has materialized).
Glazer Cap. Mgmt., L.P. v. Forescout Techs., Inc., 63 F.4th 747 (9th Cir. 2023) (reciting Section 10(b)/Rule 10b‑5 elements and PSLRA/Rule 9(b) pleading standards).
Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988 (9th Cir. 2018) (statement false when it directly contradicts what the defendant knew at the time).
Brody v. Transitional Hosps. Corp., 280 F.3d 997 (9th Cir. 2002) (misstatements actionable when they create an impression materially different from the actual state of affairs).
Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551 U.S. 308 (2007) (standard for evaluating whether allegations give rise to a ‘‘strong inference’’ of scienter).
Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27 (2011) (no affirmative duty to disclose all material information; disclosure required to avoid making other statements misleading).
Dura Pharm., Inc. v. Broudo, 544 U.S. 336 (2005) (loss causation requires a showing that the share price fell after the truth became known).
In re Gilead Scis. Sec. Litig., 536 F.3d 1049 (9th Cir. 2008) (loss causation may survive dismissal despite a temporal gap between disclosure and price drop when discovery may reveal the causal link).