In re Facebook, Inc. Sec. Litig.

405 F.Supp.3d 809

IN RE FACEBOOK, INC. SECURITIES LITIGATION

Case No. 5:18-cv-01725-EJD

United States District Court, N.D. California, San Jose Division.

Signed September 25, 2019

ORDER GRANTING DEFENDANTS' MOTION TO DISMISS CONSOLIDATED CLASS ACTION COMPLAINT

Re: Dkt. No. 93

EDWARD J. DAVILA, United States District Judge

This lawsuit stems from the revelation that Cambridge Analytica acquired the private Facebook data of millions of users and that, upon learning of this leak, Facebook allegedly attempted to suppress evidence of the breach contrary to its stated privacy policy.

Plaintiffs are persons who purchased shares of Facebook common stock between February 3, 2017 and July 25, 2018 (the "Class Period"), who believe that Mark Zuckerberg, Sheryl K. Sandberg, and David M. Wehner, collectively Defendants, made materially false and misleading statements and omissions in connection with the purchase and sale of Facebook stock. See Consolidated Complaint ("Compl.") ¶ 1, Dkt. 86. They allege that Defendants violated Section 10(b), 20(a), and 20A of the Securities Exchange Act of 1934 (the "Exchange Act") and Rule 10b-5 promulgated thereunder because Defendants made guarantees that the Cambridge Analytica, and related data-privacy scandals, would not impact Facebook stock while knowing this to be false. Specifically, Plaintiffs focus on Defendants' statements and omissions "concerning Facebook's privacy and data protection practices" and their impact on Facebook's stock price during two time periods: March and July 2018.

Defendants have filed a motion to dismiss the lawsuit arguing that Plaintiffs have not, and cannot, meet Rule 9(b)'s heightened pleading requirements for securities fraud and instead allege "an overarching hindsight theory." Motion to Dismiss ("Mot.") at 2, Dkt. 93. Defendants make four main arguments all centered around Plaintiffs' inability to meet the elements of securities fraud. First, Defendants argue Plaintiffs have not pled an actionable misstatement or omission because they have not identified any false statements. Defendants argue the 36 "actionable" statements or omissions Plaintiffs raise are, in fact, neither actionable nor fraudulent because Plaintiffs make no attempt to plead that Defendants lied or mislead investors. As explained infra Section III.C.1.a., as to all the allegations, only Statement 22 is actionable.

Second, Defendants argue Plaintiffs have not pled a strong inference of scienter because Plaintiffs do not (1) relate the alleged misstatements to any conduct establishing scienter or (2) show facts that the Defendants knew the challenged statements were false. Further, Defendants contend that Plaintiffs offer only conclusions without alleging any specific facts to support these conclusions. As explained infra Section III.C.2. the one actionable Statement, Statement 22 lacks scienter because Plaintiffs do not allege with sufficient particularity that Defendant Sandberg made the statement knowing it was false.

Third, Defendants contend that Plaintiffs fail to plead loss causation since Defendants had already warned investors of a potential stock decline and cannot trace any corrective disclosure to the stock price's drop. Finally, Defendants argue that Plaintiffs cannot show reliance based on a "fraud-on-the market" theory because the Cambridge Analytica scandal was already known a year before the start of the putative class action and so the market already reacted to the data breach. The Court does not reach these arguments because it GRANTS the Motion to Dismiss on alternative grounds.

Accordingly, the Plaintiffs do not adequately plead a securities fraud violation. Here, it is Plaintiffs' burden to point to plausible and particular facts tending to show fraudulent behavior by Defendants. Without such a showing, Plaintiffs cannot survive the higher evidentiary pleading standard enumerated in Rule 9 of the Federal Rules of Civil Procedure. See Fed. R. Civ. Pro. 9(b). Thus, for the reasons below, Defendants' Motion to Dismiss is GRANTED .

I. BACKGROUND

A. Factual Background¹

Facebook was founded by Mark Zuckerberg who is now the Chief Executive Officer ("CEO") of the company. Compl. ¶ 28. Sheryl Sandberg is the Chief Organization Officer ("COO") and David Wehner is the Chief Financial Officer ("CFO") of Facebook. Id. ¶¶ 30–31. Facebook is a social-media networking website that allows users to create profiles and share information about themselves to their "community." Id. ¶ 37. The platform also enables third-party developers' applications or websites ("apps") to access users' information. Id. ¶¶ 45–46. Importantly before 2015, a user could consent to an app developer gaining access to their personal data and the personal data of his or her friends (referred to herein as "third-party consent"). Id. ¶ 46.

1. Relevant Agreements

Facebook-User Agreements. The use and sharing of data on Facebook are governed by an agreement between Facebook and users, including Facebook's Data Policy (also referred to as the "Data Use Policy" and the "Privacy Policy"), Ex. 24 & 35, and the Terms of Service (formerly "Statement of Rights and Responsibilities"), Compl. ¶ 4, 60, 200, 232. These agreements explain how users can control the use of their data. Id. ¶ 301(b).

Before 2015, Facebook's policies allowed users to share information about their friends with third-party app developers, i.e. "third-party consent." Id. ¶¶ 46, 82. Defendants subsequently announced that they would overhaul Facebook's privacy practices to better protect user data and would tell people if their data was shared with Cambridge Analytica. Id. ¶ 18. Specifically, in 2014, Facebook stated that changes would "dramatically limit the Facebook information apps could access," and "turn[ed] off users' ability to provide access to their friend's personal data." Id. ¶¶ 79, 251, 266(b), 280. However, in April 2018, it was revealed that Defendants still permitted third parties to access user data, known as "whitelisting." Id. ¶¶ 19, 140.

Facebook-App Developer Agreements. Third-party app developers must agree to Facebook's Platform Policies before offering apps on Facebook. ¶¶ 176, 301. This limits the use and collection of user data and requires developers to explain what type of information they will collect and how it will be used. Id. The policy prohibits developers from selling, licensing, or purchasing user data and from transferring data to advertisers or data brokers. Id. ¶ 301(c).

2. Relevant Events Allegedly Showing Material Misstatements or Omissions

Aleksandr Kogan and Cambridge Analytica. In 2013, Kogan, a professor and data researcher at Cambridge University, developed an app called "thisisyourdigitallife." Id. ¶ 80–81. This app was a personality quiz; users were told that the results would be used only for academic purposes. Id. ¶ 81. Around 270,000 people installed the app and consented to the sharing of their data. Id. ¶¶ 81–82. Due to Facebook's privacy policies, app developers were able to access data about "thisisyourdigitallife" user's Facebook friends. Id.

The December 2015 The Guardian Article and Defendants' Response. In December 2015, The Guardian reported that Kogan, through his company Global Science Research ("GSR"), sold information collected through the "thisisyourdigitallife" app to Cambridge Analytica, violating Facebook's policies. Id. ¶¶ 7, 150, 232, 280. This article indicated that Cambridge Analytica developed voter profiles using the data of tens of millions of Facebook users, which were then used for political purposes. Id. ¶¶ 80–81. Once news of the data leak broke, Defendants sent Cambridge Analytica a letter asking it to delete the data and provide confirmation of deletion. Id. ¶¶ 9, 90, 92, 96, 98, 150–51, 176. Defendants made no efforts to verify Cambridge Analytica's assurances that the data was deleted, investigate the extent of the use or distribution of data, or verify that the data had been deleted. Id. ¶ 9.

Reemergence of the Cambridge Analytica Story in 2018. On March 17, 2018, three years after the original Cambridge Analytica story broke, The New York Times and The Guardian reported that Defendants delayed acting to address the Cambridge Analytica data breach and that data had not been deleted but was used in connection with President Donald Trump's campaign. Id. ¶¶ 150, 153–54. These reports allegedly contradicted Defendants' representations of data protection, specifically the fact that user data could still be accessed by developers without user's knowledge or consent, i.e. , whitelisting. Id. ¶ 14, 19. Facebook did, however, immediately suspend Cambridge Analytica, its parent company, and Cambridge Analytica employees from the Facebook platform. Id. ¶ 150.

In response to the stories, Facebook's common stock dropped nearly 7% on Monday, March 19, 2018, the first trading day after the news broke. Id. By March 27, 2018, the stock was trading as low as $152/share, a drop of nearly 18% in value from its price before the stories broke. Id. ¶ 15. The Securities and Exchange Commission ("SEC") began investigating "whether Facebook adequately warned investors that developers and other third parties may have obtained users' data without their permission or in violation of Facebook policies." Id. ¶ 16.

Facebook's First Quarter 2018 Earnings Report ("1Q18") and the GDPR. On April 25, 2018, Defendants released a favorable first quarter earnings report, 1Q18, which showed that user growth was unaffected by the continued Cambridge Analytica scandal. Id. ¶ 21. The report had quarterly revenue, earnings, and daily and monthly active user growth exceeding analyst expectations. Id. ¶¶ 21, 186, 188, 190, 270–71. Although a "handful" of advertisers had "paused spend" with Facebook after the Cambridge Analytica news, Defendants reported that this did not appear to reflect a "meaningful trend." Id. ¶ 274. Defendants also told investors that it anticipated expenses to increase year-over-year by "50% [to] 60%,"...