"In re Facebook, Inc. Securities Litigation"

I. BACKGROUND

Previous orders have detailed the alleged facts of this case. See 2020 Order, ECF No. 137 at 2-25; In re Facebook, Inc. Sec. Litig., 87 F.4th 934, 941-46 (9th Cir. 2023). The Court offers an abbreviated summary here for ease of reference.

A. Parties

Defendant Facebook was founded by Defendant Mark Zuckerberg, who is the Chief Executive Officer ("CEO") of the company and the Chairman of the Board of Directors. 4AC ¶ 1. Defendant Sheryl Sandberg was the Chief Operating Officer ("COO") of the company and served on the Board of Directors. Id. Defendant David Wehner was the Chief Financial Officer ("CFO") of the company. Id.

B. Facebook's Data Policy, Terms of Service, and Platform Policy

The use and sharing of data on Facebook are governed by agreements between Facebook and its users, including Facebook's Data Policy and Terms of Service. Before 2014, Facebook's policies allowed users to share information about their friends with third-party app developers, but in 2014, Facebook announced that it would no longer allow third parties to collect user friend data. Id. ¶¶ 100, 136. App developers also had to agree to Facebook's Platform Policy, which limited the extent to which developers could collect and use Facebook user data. Id. ¶¶ 149, 558 n.572.

C. Timeline In 2014, a personality quiz app developed by Aleksandr Kogan, a professor at Cambridge University, appeared on Facebook. Id. ¶¶ 97, 106-10. Approximately 270,000 people installed the app and consented to sharing their data, including some information about their Facebook friends, which at that time was permitted under Facebook's policies, subject to the friends' privacy and application settings. Id. ¶¶ 115, 117.

In December 2015, The Guardian reported that Kogan, through his company Global Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 2 of 34

2

Science Research ("GSR"), sold some of the information he collected to the British political consulting firm Cambridge Analytica. Cambridge Analytica then developed psychological profiles of U.S. voters using the data of tens of millions of Facebook users (which had been harvested from Kogan's data) to support Ted Cruz's presidential campaign. Id. ¶¶ 162-63. Facebook privately asked GSR and Cambridge Analytica to delete the data. Id. ¶ 220. They said they had. Id. ¶ 221. This first sale is what the parties have referred to as "initial misuse."

In 2016, Facebook represented in its 2016 Form 10-K filed with the Securities Exchange Commission ("SEC") that third-party misuse of Facebook users' personal data was a purely hypothetical risk. Id. ¶ 442. (Facebook made the same statements in later disclosures.) Id. ¶¶ 443-44. For the purposes of this litigation, these statements have come to be known as the "risk statements."

On March 30, 2017, in response to an article titled "Facebook Failed to Protect 30 Million Users From Having Their Data Harvested by a Trump Campaign Affiliate," Facebook spokesperson Andy Stone made a statement to a reporter from The Intercept saying, "Our investigation to date has not uncovered anything that suggests wrongdoing." Id. ¶¶ 17, 635. This is what the parties refer to as the "investigation statement."

On March 16, 2018, three years after the original Cambridge Analytica story broke, Facebook announced that it had received reports from the media that Cambridge Analytica did not destroy the data and that it was suspending Cambridge Analytica from the platform. Id. ¶ 468. This is what the parties have referred to as "continued misuse."

On March 17, 2018, The New York Times and The Guardian reported that Defendants (1) delayed in addressing the Cambridge Analytica data breach and that (2) the data had not been deleted (as reported by Defendants) and was in fact used in connection with President Donald Trump's campaign. Id. ¶¶ 470-71. Cambridge Analytica had lied in 2016 when it told Facebook Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 3 of 34

3

that it had deleted all user data. Facebook then suspended Cambridge Analytica, its parent company, and certain related employees from the Facebook platform. Id. ¶ 101.

On March 19, 2018, the first trading day after the New York Times and Guardian stories broke, Facebook's common stock dropped nearly 7%. Id. ¶ 480. It dropped an additional 2.5% the next day. Id.

On April 25, 2018, Defendants released a favorable first quarter earnings report, 1Q18. Id. ¶ 501. During the earnings call, Defendant Sandberg assured the market that there would not be a significant impact from the March revelations regarding Cambridge Analytica, stating "we think the investigatory work we're doing into [application programming interfaces] is very important and we don't expect it to have an impact on revenue." Id. ¶ 502. Facebook stock rose more than 9% after the release of the 1Q18 earnings report. Id. ¶ 682.

On June 3, 2018, The New York Times reported that Facebook had continued sharing users' data with certain "whitelisted" third parties without users' consent. Id. ¶ 683.

On July 25, 2018, Facebook announced its second quarter earnings report, 2Q18, which reported lower than expected revenue growth, profitability, and user growth. Id. ¶ 525. The next day, the common stock price dropped nearly 19%. Id. ¶ 531.

Throughout the class period, Facebook allegedly continued to give "whitelisted" parties like Amazon, Google, Samsung, Blackberry, Huawei (a Chinese technology company), and Mail.Ru Group (a Kremlin-connected technology conglomerate) access users' data and users' friends' data, in contravention of user privacy settings. Id. ¶ 24. That is, even if Facebook users selected settings that restricted Facebook from sharing their data, Facebook shared it anyway.

Throughout the class period, Facebook made several statements assuring Facebook users they had control over their information and content on Facebook. See, e.g., id. ¶¶ 420, 464, 465, 608-17, 622. For the purposes of this litigation, these are known as the "user control

Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 4 of 34

4

statements." These include things like "People can control the audience for their posts and the apps that can receive their data," "[e]very person gets to control who gets to see their content," and

"[w]e respected the privacy settings that people had in place." Id. ¶¶ 617, 615, 622.

Throughout the class period, Defendant Zuckerberg sold approximately 30,000 Facebook shares for proceeds of more than $5.2 billion, while Defendant Sandberg sold $389 million in Facebook shares and Defendant Wehner sold $21 million worth in Facebook shares. Id. ¶ 26.

D. Procedural Background

1. District Court

In October 2018, Plaintiffs filed their Consolidated Class Action Complaint. See ECF No.

86. The Court granted Defendants' motion to dismiss after finding that Plaintiffs had failed to plead falsity and scienter. That order did not address reliance or loss causation. ECF No. 118. In November 2019, Plaintiffs filed their Second Amended Complaint. See ECF No. 123. The Court again granted Defendants' motion to dismiss after finding that Plaintiffs failed to plead falsity, scienter, and loss causation. ECF No. 126.

In October 2020, Plaintiffs filed their Third Amended Complaint. Third Amended Complaint ("TAC"), ECF No. 142. After determining that the TAC failed to address the deficiencies of the first two filings, the Court dismissed Plaintiffs' claims without leave to amend. December 2021 Order, ECF No. 168.

2. Ninth Circuit

Plaintiffs appealed. ECF No. 170. In December 2023, the Ninth Circuit issued its opinion. In re Facebook, 87 F.4th 934. The Ninth Circuit affirmed this Court's dismissal based on the Cambridge Analytica investigation statement. Id. at 1057. But the Ninth Circuit reversed dismissal based on two other groups of statements: the risk statements and the user control statements. Id.

Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 5 of 34

5

a. Risk Statements

In 2015, Facebook employees noticed that Cambridge Analytica, a British political consulting firm, was receiving vast amounts of Facebook user data. Id. at 9. Despite this and other ongoing developments, Facebook represented in its 2016 Form 10-K filed with the Securities Exchange Commission ("SEC") that third-party misuse of Facebook users' personal data was a purely hypothetical risk. Id. at 12. Those statements are listed below. See infra Part

I.E.

Statements are false or misleading if they "directly contradict what the defendant knew at that time," Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1008 (9th Cir. 2018), or "create an impression of a state of affairs that differs in a material way from the one that actually exists,"

Brody v. Transitional Hosps. Corp., 280 F.3d 997, 1006 (9th Cir. 2002). The Ninth Circuit held that Plaintiffs allegations "more than support the claim that Facebook was aware of Cambridge Analytica's misconduct before February 2017, so Facebook's statements 'directly contradict[ed]' what the company knew when it filed its 2016 10-K with the SEC." In re Facebook, 87 F.4th at 949 (citing Glazer II, 63 F.4th at 764). As a result, Plaintiffs have already satisfied falsity as to these claims. Id. at 952.

The Ninth Circuit remanded for consideration of whether Plaintiffs can satisfy the other elements of the claims with respect to these statements. Id.

b. User Control Statements

Throughout the class period, Facebook made several statements about users' control of their personal data. One subset of statements claimed that Facebook's priorities of transparency and user control aligned with the European Union's General Data Protection Regulation ("GDPR") framework; the Ninth Circuit affirmed this Court in finding Plaintiffs had not sufficiently pled a violation of Section 10(b) and Rule 10b-5 for those statements. In re Facebook, Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 6 of 34

6

87 F.4th at 954. A second subset of statements assured Facebook users they had control over their information and content on Facebook. Those statements are listed below. See infra Part I.E. On March 16, 2018, however, Facebook revealed that Cambridge Analytica had misused users' data, and Facebook's stock dropped. Id. at 961. On June 3, 2018, The New York Times reported that Facebook had continued sharing users' data with certain "whitelisted" third parties without users' consent. Id. at 962. The following month, Facebook's stock dropped again. Id. The Ninth Circuit held that the Cambridge Analytica revelation caused the March 2018 price drop and that Plaintiffs had adequately pleaded loss causation: statements about user control made before March 16, 2018, could be pegged to the March 2018 price drop. Id. at 955. The Ninth Circuit also found that the Cambridge Analytica and whitelisting revelations caused the July 2018 price drop and that Plaintiffs had adequately pleaded loss causation: statements about user control made before June 3, 2018, could be pegged to the July price drop. Id. at 957.

3. Remand

Defendants filed a petition for a writ of certiorari in the Supreme Court of the United States. ECF No. 177. The Supreme Court granted certiorari and heard oral argument but ultimately dismissed the writ as improvidently granted. ECF Nos. 178, 179. As a result, the Ninth Circuit's opinion was not disturbed.

On May 20, 2025, Lead Plaintiffs filed their motion for leave to amend. ECF No. 217. In their motion, Lead Plaintiffs indicated that they sought to amend their complaint to include new facts learned through discovery. Id. Defendants did not oppose, and the Court granted leave to amend. ECF No. 224. In the meantime, the Court decided not to lift the automatic discovery stay put in place by the Private Securities Litigation Reform Act ("PSLRA"). ECF No. 235. Plaintiffs then filed their amended complaint.

Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 7 of 34

7

E. Alleged Misstatements/Omissions

On remand, the following statements¹remain at issue in the case:

User Control Statements Statement 1:"You own all of the content and information you post on Facebook, and you can control how it is shared through your privacy and application settings.'" 4AC ¶ 608 (stated in Facebook's Statement of Rights and Responsibilities).

Statement 2: "[W]hen you share on Facebook you need to know No one is going to get your data that shouldn't have it. That we're not going to make money in ways that you would feel uncomfortable with off your data. And that you're controlling who you share with. . . . Privacy for us is making sure that you feel secure, sharing on Facebook." Id. ¶ 609 (stated by Defendant Sandberg during 2017 Axios interview).

Statement 7: "In 2014, after hearing feedback from the Facebook community, we made an update to ensure that each person decides what information they want to share about themselves, including their friend list. This is just one of the many ways we give people the tools to control their experience. Before you decide to use an app, you can review the permissions the developer is requesting and choose which information to share. You can manage or revoke those permissions at any time." 4AC ¶ 610 (stated by Defendant Facebook in 2018 post after 2018 Cambridge Analytica scandal).

Statement 8: "[T]he main principles are, you have control over everything you put on the service, and most of the content Facebook knows about you it [sic] because you chose to share that content with your friends and put it on your profile." 4AC ¶ 611 (stated by Defendant Zuckerberg during 2018 phone conference).

Statement 9: "You've been hearing a lot about Facebook lately and how your data is being used. While this information can sometimes be confusing and technical, it's important to know that you are in control of your Facebook, what you see, what you share, and what people see about you."

4AC ¶ 612 (stated by Defendant Facebook in April 2018 post)

Statement 10: "We already show people what apps their accounts are connected to and allow them to control what data they've permitted those apps to use." 4AC ¶ 613 (stated by Defendant Facebook in June 2018 to U.S. House of Representatives).

Statement 11: "Privacy is at the core of everything we do, and our approach to privacy starts with

8

our commitment to transparency and control. [. . .] Our approach to control is based on the belief that people should be able to choose who can see what they share and how their data shapes their experience on Facebook. People can control the audience for their posts and the apps that can receive their data. 4AC ¶ 614 (stated by Defendant Facebook in June 2018 to U.S. House of Representatives).

Statement 12: "This is the most important principle for Facebook: Every piece of content that you share on Facebook, you own and you have complete control over who sees it and — and how you share it, and you can remove it at any time. That's why every day, about 100 billion times a day, people come to one of our services and either post a photo or send a message to someone, because

they know that they have that control and that who they say it's going to go to is going to be who sees the content. And I think that that control is something that's important that I think should apply to — to every service." 4AC ¶ 615(a) (stated by Defendant Zuckerberg in April 2018 to Joint Commerce & Judiciary Committees of U.S. Senate).

Statement 13: "That's what the [Facebook] service is, right? It's that you can connect with the people that you want, and you can share whatever content matters to you, whether that's photos or links or posts, and you get control over it." 4AC ¶ 615(b) (stated by Defendant Zuckerberg in April 2018 to Joint Commerce & Judiciary Committees of U.S. Senate).

Statement 14: "The two broad categories that I think about are content that a person is [sic] chosen to share and that they have complete control over, they get to control when they put into the service, when they take it down, who sees it. And then the other category are data that are connected to making the ads relevant. You have complete control over both." 4AC ¶ 615(c) (stated by Defendant Zuckerberg in April 2018 to Joint Commerce & Judiciary Committees of U.S. Senate).

Statement 15: "Every person gets to control who gets to see their content." 4AC ¶ 615(d) (stated by Defendant Zuckerberg in April 2018 to Joint Commerce & Judiciary Committees of U.S. Senate).

Statement 16: "But, Senator, the — your point about surveillance, I think that there's a very important distinction to draw here, which is that when — when organizations do surveillance[,] people don't have control over that. But on Facebook, everything that you share there[,] you have control over." 4AC ¶ 615(e) (stated by Defendant Zuckerberg in April 2018 to Joint Commerce & Judiciary Committees of U.S. Senate).

Statement 17: "[O]n Facebook, you have control over your information." 4AC ¶ 616(a) (stated by Defendant Zuckerberg in April 2018 to U.S. House of Representatives' Energy and Commerce Committee).

Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 9 of 34

9

Statement 18: "[E]very single time that you share something on Facebook or one of our services, right there is a control in line, where you control who — who you want to share with." 4AC ¶ 616(b) (stated by Defendant Zuckerberg in April 2018 to U.S. House of Representatives' Energy and Commerce Committee).

Statement 19: "Congresswoman, giving people control of their information and how they want to set their privacy is foundational to the whole service [on Facebook]. It's not just a — kind of an add-on feature, something we have to . . . comply with. . . . all the data that you put in, all the content that you share on Facebook is yours. You control how it's used." 4AC ¶ 616(c) (stated by Defendant Zuckerberg in April 2018 to U.S. House of Representatives' Energy and Commerce Committee).

Statement 20: "Privacy is at the core of everything we do, and our approach to privacy starts with our commitment to transparency and control. [. . .] Our approach to control is based on the belief that people should be able to choose who can see what they share and how their data shapes their experience on Facebook. People can control the audience for their posts and the apps that can receive their data." 4AC ¶ 617 (stated by Defendant Facebook in response to questions from the U.S. Senate).

Statement 21: "We respected the privacy settings that people had in place. Privacy and data protections are fundamental to every decision we make." 4AC ¶ 622 (stated by Defendant Facebook in March 2018 to The Washington Post).

Risk Factor Statements Statement 22: "Security breaches and improper access to or disclosure of our data or user data, or other hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business." 4AC ¶ 628(a) (stated by Defendant Facebook in 2016 Form 10-K).

Statement 23: "Any failure to prevent or mitigate security breaches and improper access to or disclosure of our data or user data could result in the loss or misuse of such data, which could harm our business and reputation and diminish our competitive position." 4AC ¶ 628(b) (stated by Defendant Facebook in 2016 Form 10-K).

Statement 24: "We provide limited information to . . . third parties based on the scope of services provided to us. However, if these third parties or developers fail to adopt or adhere to adequate data security practices . . . our data or our users' data may be improperly accessed, used, or disclosed." 4AC ¶ 628(c) (stated by Defendant Facebook in 2016 Form 10-K). The statements quoted in ¶628, supra, were repeated or incorporated by reference into Facebook's other reports on Forms 10-K and 10-Q that the Company filed with the SEC during the Class Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 10 of 34

10

Period, including its quarterly reports filed on May 4, 2017 (the "1Q17 10-Q"), July 27, 2017 (the

"2Q17 10-Q"), November 2, 2017 (the "3Q17 10-Q"), and its annual report filed on February 1, 2018 (the "2017 Form 10-K"), each of which was signed by Zuckerberg, Sandberg and Wehner, among others, and made available on Facebook's investor relations website.

Investigation Statement Statement 28: "Our investigation to date has not uncovered anything that suggests wrongdoing [with respect to Cambridge Analytica]." 4AC ¶ 635 (stated by Defendant Facebook to The Intercept in March 2017).

II. REQUEST FOR JUDICIAL NOTICE AND INCORPORATION BY REFERENCE

In general, a court may not consider material beyond the pleadings when ruling on a Rule 12(b)(6) motion. Khoja, 899 F.3d at 998. The only exceptions to this rule are documents that are the subject of judicial notice, appended to the complaint, or incorporated by reference. Id. Defendants ask the Court to take judicial notice of Exhibits 1 through 18, which are attached to the Declaration of Brian M. Lutz in Support of Defendants' Motion to Dismiss ("Lutz Decl."). See Request for Judicial Notice in Support of Defendants' Motion to Dismiss Fourth Amended Consolidated Class Action Complaint ("RJN"), ECF No. 238-20. Defendants also ask the Court to incorporate by reference Exhibits 5, 7-9, 11, 14, and 17. Plaintiffs opposed, ("Opp. to RJN"), ECF No. 244, and Defendants replied, ECF No. 249.

A. Judicial Notice

Judicial notice permits courts to consider facts that are not subject to reasonable dispute. Id. at 999 (quoting Fed. R. Evid. 201). A court may also consider matters that are "capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned." Roca v. Wells Fargo Bank, N.A., 2016 WL 368153, at *3 (N.D. Cal. Feb. 1, 2016) (quoting Fed. R. Evid. 201(b)).

Exhibits 1-5, 9, 14, 16, and 17: The Court previously granted requests for judicial notice Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 11 of 34

11

of Exhibits 1-5, 9, 14, 16, and 17. See 2019 Order, ECF No. 118 at 14-15; 2020 Order at 26-28. Judicial notice is GRANTED for these Exhibits for the same reasons outlined in those orders.

Exhibits 7, 8, and 11: These exhibits are news articles. Exhibit 7 is a 2016 Bloomberg article referenced and relied on in the 4AC. 4AC ¶¶ 303, 333, 337. Exhibit 8 is a 2016 Reuters article referenced and relied on in the 4AC. 4AC ¶ 335. And Exhibit 11 is a 2017 Vice article referenced and relied on in the 4AC. 4AC ¶¶ 321, 323, 352, 354, 369. Courts may grant judicial notice of documents that Plaintiffs cite to and quote from in their complaint. See Khoja, 899 F.3d at 1004-05 (affirming finding that online news articles underlying plaintiffs' claims were incorporated into complaint); In re Calpine Corp. Sec. Litig., 288 F. Supp. 2d 1054, 1075 (N.D. Cal. 2003) (taking notice of documents that "Plaintiffs expressly cite and quote from . . . in the [complaint]"). Consequently, the Court GRANTS the request for judicial notice of Exhibits 7, 8, and 11.

Exhibits 6, 10, 12, 13, and 15: These exhibits are also news articles. Exhibit 6 is a 2015 New York Times article, Exhibit 10 is a 2016 Boston Globe article, Exhibit 12 is a 2017 Medium article, Exhibit 13 is a 2017 Guardian article, and Exhibit 15 is a 2017 New York Review of Books article. Plaintiff does not refer to or rely on these documents in the 4AC, but Defendant uses them to show that the market was aware of the information contained in the articles. Mot. at 11-13. These news articles are publicly available, "capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned." Roca v. Wells Fargo Bank, N.A., 2016 WL 368153, at *3 (N.D. Cal. Feb. 1, 2016) (quoting Fed. R. Evid. 201(b)). Thus, the Court

GRANTS the request for judicial notice of Exhibits 6, 10, 12, 13, and 15.

Exhibit 18: This exhibit is a copy of an October 2, 2020, letter from the Information Commissioner's Office of the Parliament of the United Kingdom to Julian Knight, Chair, Digital, Culture and Media and Sport Committee, United Kingdom House of Commons. Defendants argue Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 12 of 34

12

that judicial notice of Exhibit 18 is appropriate because it is a matter of public record, the contents of which are not subject to reasonable dispute. RJN at 5. Plaintiffs oppose, but only on the grounds that Defendants fail to identify the specific fact or facts they ask the Court to notice. Opp. to RJN at 6-7. If the Court does notice the letter, Plaintiffs ask that the Court not notice the truth of any disputed facts, including whether Cambridge Analytica continued misusing Facebook user data in 2016. Id. at 7. Because the letter is a matter of public record, Khoja, 899 F. 3d at 999, the Court GRANTS the request for judicial notice of Exhibit 18. The Court does not, however, take notice of the disputed facts in that letter. Id. ("a court cannot take judicial notice of disputed facts contained in such public records").

B. Incorporation by Reference

Defendants also ask the Court to incorporate by reference Exhibits 5, 7-9, 11, 14, and 17. Incorporation by reference permits courts to treat an extrinsic document as if it were "part of the complaint itself," but only if the complaint "refers extensively to the document or the document forms the basis of the plaintiff's claim." Khoja, 899 F.3d at 1002 (citing United States v. Ritchie,

342 F.3d 903, 908 (9th Cir. 2003)). This "prevents plaintiffs from selecting only portions of documents that support their claims, while omitting portions of those very documents that weaken—or doom—their claims." Id. (citation omitted). Courts may incorporate documents or portions thereof that are not expressly referenced in the complaint if the claims depend on documents' contents. Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005) (affirming incorporation by reference of webpages surrounding photographs to provide crucial context for defamation claims). Once incorporated, the Court may assume the entire document is true for purposes of a motion to dismiss. Ritchie, 342 F.3d at 908.

Here, Plaintiffs cite to and quote from these documents throughout their 4AC. See supra Part II.A.; 4AC ¶¶ 5, 162, 186, 196, 409, 449 (referencing Exhibit 5); id. ¶¶ 341, 345 (referencing Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 13 of 34

13

Exhibit 9); id. ¶¶ 17, 407-11, 635 (referencing Exhibit 14); id. ¶¶ 538-39, 543-44 (referencing exhibit 17). As a result, the Court GRANTS the request that Exhibits 5, 7-9, 11, 14, and 17 be incorporated by reference.

III. LEGAL STANDARD

A. Motion to Dismiss

To survive a Rule 12(b)(6) motion to dismiss, a plaintiff must provide "sufficient factual matter . . . 'to state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). When deciding whether to grant the motion, the court must generally accept as true all "well-pleaded factual allegations," id. at 664, and construe the alleged facts and inferences in the light most favorable to the plaintiff, Retail Prop. Trust v. United Bd. of Carpenters & Joiners of Am., 768 F.3d 938, 945 (9th Cir. 2014). The court is not, however, "bound to accept as true a legal conclusion couched as a factual allegation." Iqbal, 556 U.S. at 678.

Section 10(b) of the Exchange Act, 15 U.S.C. § 78j(b), prohibits "manipulative or deceptive" practices in the purchase or sale of a security. See In re Alphabet Sec. Litig., 1 F.4th 687, 699 (9th Cir. 2021). Rule 10b-5 implements Section 10(b). S.E.C. v. Zandford, 535 U.S. 813, 816 n.1 (2002). It prohibits making "any untrue statement of a material fact" or omitting material facts "necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading." Glazer Cap. Mgmt., L.P. v. Forescout Techs., Inc. (Glazer II), 63 F.4th 747, 764 (9th Cir. 2023) (quoting 17 C.F.R. § 240.10b-5(b)). To state a claim under Section 10(b) and Rule 10b-5, "a plaintiff must allege: (1) a material misrepresentation or omission by the defendant ('falsity'); (2) scienter; (3) a connection between the misrepresentation or omission and the purchase or sale of a security; (4) reliance upon the misrepresentation or omission; (5) economic loss; and (6) loss causation." Id. (internal quotation marks omitted) Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 14 of 34

14

(quoting In re NVIDIA Corp. Sec. Litig., 768 F.3d 1046, 1052 (9th Cir. 2014)). Claims under Sections 20(a) and 20A of the Exchange Act "require an independent violation of the Exchange Act." See Johnson v. Aljian, 490 F.3d 778, 781 (9th Cir. 2007). Shareholders must thus successfully plead a Section 10(b) claim to succeed on their claims under Sections 20(a) and 20A.

Securities fraud cases demand a heightened pleading standard. Complaints alleging securities fraud must meet the plausibility standard, the PSLRA, and Federal Rule of Civil Procedure 9(b)'s higher pleading standard. See Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 319-22 (2007); Zucco Partners, LLC v. Digimarc, Corp., 552 F.3d 981, 991 (9th Cir. 2009). The PSLRA mandates that securities fraud complaints (1) specify each misleading statement, (2) set forth the facts on which the belief that a statement was misleading was formed,

(3) and "state with particularity facts giving rise to a strong inference that the defendant acted with the required state of mind [i.e., scienter]." Dura Pharm., Inc. v. Broudo, 544 U.S. 336, 345 (2005) (quoting 15 U.S.C. §§ 78u-4(b)(1)-(2)).

B. Scienter

To survive a motion to dismiss, the 4AC must create a strong inference of scienter. 15 U.S.C. § 78u-4(b)(2) ("[T]he complaint shall ... state with particularity facts giving rise to a strong inference that the defendant acted with the required state of mind."). This means that the

"inference of scienter ... must be cogent and at least as compelling as any opposing inference of nonfraudulent intent." Tellabs, 551 U.S. at 314 (2007). In other words, courts ask: "When the allegations are accepted as true and taken collectively, would a reasonable person deem the inference of scienter at least as strong as any opposing inference?" Webb v. Solarcity Corp., 884 F.3d 844, 850 (9th Cir. 2018). Plaintiffs can meet this standard by alleging facts demonstrating an

"intent to deceive, manipulate, or defraud" or "deliberate recklessness." Id. at 851 (quoting In re Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 15 of 34

15

Quality Sys., 865 F.3d at 1144). "An actor is deliberately reckless if he had reasonable grounds to believe material facts existed that were misstated or omitted, but nonetheless failed to obtain and disclose such facts although he could have done so without extraordinary effort." Reese, 747 F.3d at 569 (quoting In re Oracle Corp. Sec. Litig., 627 F.3d 376, 390 (9th Cir. 2010)).

IV. MOTION TO DISMISS

There are three groups of statements that remain at issue: the user control statements, the investigation statement, and the 10-K risk factor statements. There are two theories of fraud: the alleged whitelisting fraud and the alleged Cambridge Analytica fraud (which itself can be broken into the "initial misuse" theory and the "continued misuse" theory, see supra Part I.C). Finally, there are two stock drops, in March 2018 and July 2018.

Defendants move to dismiss the claim for violation of Section 10(b) of the Securities Exchange Act of 1934 and SEC Rule 10b-5 insofar as it is based on the investigation statement, arguing that statement is barred by the mandate rule. Defendants also move to dismiss the claim insofar as it is based on the Cambridge Analytica theory of fraud. Defendants do not move to dismiss the claim insofar as it is based on the whitelisting theory of fraud, but they argue that theory only supports the user control statements, not the risk statements. Finally, Defendants move to dismiss Plaintiffs' claims for violation for Sections 20(a) and 20A of the Securities Act.

A. Investigation Statement

On March 30, 2017, in response to an article titled "Facebook Failed to Protect 30 Million Users From Having Their Data Harvested by a Trump Campaign Affiliate," a Facebook spokesperson made a statement to a reporter from The Intercept saying, "Our investigation to date has not uncovered anything that suggests wrongdoing." 4AC ¶ 635; see also supra Part I.E. In 2021, this Court found that Plaintiffs failed to establish scienter for this statement: they did not adequately plead that Defendants knew Cambridge Analytica was using the misappropriated data Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 16 of 34

16

after Facebook obtained deletion certifications. 2021 Order at 11-12. The Ninth Circuit reached the same conclusion, Facebook, 87 F.4th at 952-53, and expressly "affirm[ed] the dismissal of the statements in . . . ¶¶ 537-38," id. at 957. Plaintiffs deleted one of those statements from their Fourth Amended Complaint but repleaded the other.²

In moving to dismiss the investigation statement, Defendants argue that its inclusion in the Fourth Amended Complaint "flouts the Ninth Circuit's mandate." Mot. at 16. Defendants argue that "even though 'amendment of pleadings following remand may be permitted,' the mandate rule dictates that 'such amendment cannot be inconsistent with the appellate court's mandate.'"

Mot. at 16 (quoting In re Beverly Hills Bancorp, 752 F.2d 1334, 1337 (9th Cir. 1984)). To support this argument, Defendants analogize to Alaska Dep't of Fish & Game v. Fed. Subsistence Bd., 139 F.4th 773 (9th Cir. 2025). In that case, the district court had allowed the plaintiff to revive a claim on remand even though the Ninth Circuit had affirmed the claim's dismissal. On appeal, the Ninth Circuit instructed the district court to dismiss the claim for lack of jurisdiction. Alaska Dep't of Fish & Game, 139 F.4th at 789.

Plaintiffs resist that analogy. Opp. at 23. They point out that in Alaska Dep't of Fish & Game, the Ninth Circuit had already "expressly held" a claim had been forfeited and "declined to reach the merits" in its prior opinion. Alaska Dep't of Fish & Game, 139 F.4th at 789. Here, however, the Ninth Circuit did reach the merits.

Plaintiffs propose that Bafford v. Admin. Comm. Of Northrop Grumman Pension Plan, 101 F.4th 641 (9th Cir. 2024) should control. In Bafford, the Ninth Circuit found that it would be possible to cure the complaint and directed the district court to permit the plaintiffs to file an amended version. Id. at 649. The Ninth Circuit reasoned that "Absent a mandate which explicitly

17

directs to the contrary, a district court upon remand can permit the plaintiff to file additional pleadings." Id. (citing S.F. Herring Ass'n v. Dep't of the Interior, 946 F.3d 564, 574 (9th Cir. 2019)). Plaintiffs conclude that as long as the Ninth Circuit did not (1) expressly disallow additional pleadings, and (2) find the failure to state a claim was impossible to cure, a plaintiff may amend and replead a dismissed claim on remand. Opp. at 24.

The Court agrees with Defendants. In Bafford, which Plaintiffs argue should control, the district court had dismissed an ERISA claim without prejudice. Bafford v. Northrop Grumman Corp., 994 F.3d 1020, 1030 (9th Cir. 2021). On appeal, the Ninth Circuit affirmed dismissal but explicitly directed the district court to permit an amended complaint. Id. at 1029, 1032. The district court did so, which the Ninth Circuit later found to be proper because in the first appeal, the Ninth Circuit "did not express clear intent to deny amendment" and indeed "direct[ed] the district court to permit" amendment. Bafford, 101 F.4th at 649. Here, there are two key differences. One, in Bafford, the district court dismissed the claim without prejudice; here, dismissal was with prejudice. See 2021 Order at 14 ("The Court . . . has warned Plaintiffs that failure to cure the identified deficiencies would result in dismissal with prejudice.") Two, in Bafford, the Ninth Circuit explicitly directed the district court to permit amendment; here, the Ninth Circuit did not do so. Bafford thus does not help Plaintiffs' case. Moreover, the Ninth Circuit issued clear instructions to this Court regarding further proceedings on the risk factor statements and the user control statements—but did not do so for the investigation statement. Regarding the risk factor statements, the Ninth Circuit stated "we leave to the district court on remand whether the shareholders can satisfy the other elements of the claims" beyond falsity. In re Facebook, 87 F.4th at 952. Regarding the user control statements, the Ninth Circuit instructed that "discovery and further proceedings are necessary to illuminate the issues surrounding loss causation." Id. at 956. But of the investigation statement, the Ninth Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 18 of 34

18

Circuit simply wrote, "We affirm the district court's dismissal of the allegations and agree that the shareholders failed to plead scienter . . ." Id. at 953. Unlike with the risk factor and user control statements, there was no instruction to consider any aspect of the investigation statement on remand.

In sum, this Court dismissed the investigation statement with prejudice. The Ninth Circuit affirmed. And the Ninth Circuit did not instruct this Court to allow further proceedings on the investigation statement, as it did for the user control statements and the risk statements. To allow further litigation on the investigation statement would be "inconsistent with the appellate court's mandate." In re Beverly Hills Bancorp, 752 F.2d at 1337. Defendants' motion to dismiss the claim insofar as it is based on the investigation statement is GRANTED. The "court should grant leave to amend . . . unless it determines that the pleading could not possibly be cured by the allegation of other facts." Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (quotation omitted). No facts could cure this defect, so dismissal is WITHOUT leave to amend.

B. Cambridge Analytica Theory

Next, the Court turns to the Cambridge Analytica theory of fraud. Plaintiffs allege that both the user control statements and the risk factor statements were false because Defendants knew that (1) in 2015, Aleksandr Kogan, through his company GSR, sold user data to Cambridge Analytica, which in turn sold it to Ted Cruz's presidential campaign (the "initial misuse" theory), and (2) Cambridge Analytica did not delete users' data and indeed continued to use it to support Donald Trump's 2016 presidential campaign (the "continued misuse" theory). 4AC ¶¶ 162-63, 220-21, 468. Plaintiffs assert that the March 16, 2018, revelation about Cambridge Analytica's misuse of the data revealed the falsity of the user control and risk factor statements, causing the March 19, 2018, and July 25, 2018, stock drops. Id. ¶¶ 480, 687. The Ninth Circuit found that the March revelation was indeed a corrective disclosure and that Plaintiffs adequately pled loss Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 19 of 34

19

causation as to both stock price drops. Facebook, 87 F.4th at 957. The Ninth Circuit remanded to this Court the question of whether Plaintiffs had adequately pled scienter as to the Cambridge Analytica theory.

To state a claim under Section 10(b) and Rule 10b-5, a complaint must plausibly allege:

"(1) a material misrepresentation or omission by the defendant; (2) scienter; (3) a connection between the misrepresentation or omission and the purchase or sale of a security; (4) reliance upon the misrepresentation or omission; (5) economic loss; and (6) loss causation." Halliburton Co. v. Erica P. John Fund, Inc., 573 U.S. 258, 267 (2014) (citations omitted). A complaint must "satisfy the dual pleading requirements of Federal Rule of Civil Procedure 9(b) and the PSLRA" to state a securities fraud claim. Zucco Partners, 552 F.3d at 990. Federal Rule of Civil Procedure 9(b) requires a plaintiff to "state with particularity the circumstances constituting fraud," and the PSLRA extends this particularity requirement to allegations of scienter. See 15 U.S.C. § 78u- 4(b)(2)(A) ("[T]he complaint shall, with respect to each act or omission alleged . . . state with particularity facts giving rise to a strong inference that the defendant acted with the required state of mind."); see also Kearns v. Ford Motor Co., 567 F.3d 1120, 1124 (9th Cir. 2009) ("Averments of fraud must be accompanied by the who, what, when, where, and how of the misconduct alleged." (citations and quotation marks omitted)).

To support a "strong inference" of scienter under the PSLRA, a complaint must allege that the defendant made false or misleading statements with an "intent to deceive, manipulate, or defraud" or with deliberate recklessness. City of Dearborn Heights Act 345 Police & Fire Ret. Sys. v. Align Tech., Inc., 856 F.3d 605, 619 (9th Cir. 2017) (citation omitted). Deliberate recklessness is an "extreme departure from the standards of ordinary care . . . which presents a danger of misleading buyers or sellers that is either known to the defendant or is so obvious that the actor must have been aware of it." Schueneman v. Arena Pharms., Inc., 840 F.3d 698, 705 Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 20 of 34

20

(9th Cir. 2016). When determining whether Plaintiff has alleged a "strong inference" of scienter, the court must "engage in a comparative evaluation [and] . . . consider, not only inferences urged by the plaintiff . . . but also competing inferences rationally drawn from the facts alleged."

Tellabs, 551 U.S. at 314. A complaint will survive a motion to dismiss "only if a reasonable person would deem the inference of scienter cogent and at least as compelling as any opposing inference one could draw from the facts alleged." Id. at 324.

Defendants move to dismiss, arguing that Plaintiffs have failed to plead scienter for both Cambridge Analytica's initial and continued misuse of the data. The Court addresses initial misuse and continued misuse in turn.

1. Initial Misuse

Defendants argue that Plaintiffs failed to plead scienter as to initial misuse. Mot. at 12-15. Broadly, they argue that Plaintiffs did not identify a motive explaining why Facebook's senior executives would have wanted to deceive the public. Specifically, Defendants maintain that (1) the truth about the initial misuse was already public, (2) Defendants Zuckerberg and Sandberg's 2018 statements of regret do not show they knew the accounts were compromised before 2018, (3) the Court has already found that statements by an early investor and an early employee are insufficient to show scienter, (4) Individual Defendants' stock sales are inadequate to raise a strong inference of scienter, and (5) Defendants would not have tried to mislead the market in a 10-K or 10-Q. The Court addresses the arguments in that order.

a. Truth on the Market

In 2015, the Guardian published an article titled "Ted Cruz Using Firm that Harvested Data on Millions of Unwitting Facebook Users." 4AC ¶5 n.3. In 2017 and 2018, Facebook's senior executives made statements claiming that users had control over their data. See supra Part I.E. Thus, Defendants contend that the Guardian article had revealed the truth about Cambridge Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 21 of 34

21

Analytica's alleged initial misuse of user data years before Facebook's executives made the user control statements. Mot. at 11-12.

In Opposition, Plaintiffs point out that "[t]he Ninth Circuit repeatedly rejected this exact argument, finding for example that . . . '[b]efore the March 2018 news broke, reasonable investors would not have known that Cambridge Analytica had improperly accessed Facebook users' data.'" Opp. at 10 (quoting Facebook, 87 F.4th at 950, 954). Plaintiffs further argue that motive is not required as a matter of law, but even if it were, their complaint has met that burden. Opp. at 10.

In Reply, Defendants contend that mere knowledge of Cambridge Analytica's initial misuse is not enough: Plaintiffs must plead that Defendants intentionally or consciously misled the market. Reply at 3 (citing In re NVIDIA Corp. Sec. Litig., 768 F.3d 1046, 1053 (9th Cir. 2014)). To support a strong inference of scienter under the PSLRA, a plaintiff must clear two hurdles. First, a plaintiff must allege that a defendant made the false or misleading statements with intent or recklessness. See supra Part IV.A.2 (citing City of Dearborn Heights, 856 F.3d

605). Here, Plaintiffs have done just that. Based on communications among Facebook employees, Plaintiffs credibly allege that Facebook leadership, including Defendants Zuckerberg and Sandberg, knew that Cambridge Analytica possessed over 40 million user profiles. 4AC ¶¶ 171-74, 180-82, 185. Next, Plaintiffs claim that even though Defendants knew about that initial misuse of user data, they nonetheless promised that users had control over their data. See, e.g., id. ¶¶ 420, 464, 465, 608-17, 622. Plaintiffs then infer that Defendants made these statements to bolster trust in the platform: users who trusted the platform posted on it, and their posts allowed Facebook to sell ads. Id. ¶ 18 ("Facebook's ability to generate revenue depended on users' willingness to post—and share—data on which ads were based."). Plaintiffs also infer that Defendants made the user control statements to avoid further scrutiny in the wake of the 2012 Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 22 of 34

22

Federal Trade Commission ("FTC") consent decree, which had ordered Facebook to address privacy risks and protect the privacy and confidentiality of covered information. Id. ¶¶ 62-71. Grounded in specific factual allegations, the Court finds these inferences cogent and compelling. But establishing one cogent inference of scienter is not enough. The second hurdle to clear is that the plaintiff's inference of scienter must be "at least as compelling as any opposing inference one could draw from the facts alleged." Tellabs, 551 U.S. at 324. On this point, Defendants argue that there is a more compelling inference: that the market was already aware of Cambridge Analytica's alleged initial misuse, and thus "it did not cross [Defendants] minds that failing to comment on those reports years later when making statements that were not even about Cambridge Analytica would mislead investors." Mot. at 12.

To support this inference, Defendants point to news articles that Defendants say made the market aware of the nature and extent of the initial misuse. Mot. at 11-12. But most of these articles focus on other topics, mentioning Cambridge Analytica's data collection only in passing. See, e.g. Lutz Decl. Ex 6 (referencing the 2015 Guardian article only in the penultimate paragraph); Lutz Decl. Ex. 7 (focusing primarily on the Trump campaign's Twitter strategy); Lutz Decl. Ex. 8 (focusing on Facebook's removal of a famous Vietnam War photograph); Lutz Decl. Ex. 10 (focusing on the Boston Police Department's purchase of software that rakes social media to uncover security threats). Only a few of the articles directly address the data collection, and in some of those Facebook and Cambridge Analytica denied any relationship with each other. See, e.g. Lutz Decl. Ex. 9 (article in the opinion section of the New York Times on Cambridge Analytica and Facebook); Lutz Decl. Ex. 11 (Vice article directly addressing the data's impact on the 2016 election); Lutz Decl. Ex. 12 (Intercept article explaining the mechanics of data harvesting, in which Facebook claimed they "ha[ve] no relationship with GSR"); Lutz Decl. Ex. 13 (Guardian article on Brexit, in which Cambridge Analytica denied that they used data from Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 23 of 34

23

Facebook). These articles, while informative on background, are inadequate to sustain Defendants

"heavy burden" of proving "that the information that was withheld or misrepresented was transmitted to the public with a degree of intensity and credibility sufficient to effectively counterbalance any misleading impression created by [the defendant's] one-sided representations."

Provenz v. Miller, 102 F.3d 1478, 1492-93 (9th Cir. 1996) (internal quotation marks omitted). Defendants cite to a recent case where the Ninth Circuit found that a plaintiff failed to plead scienter because the defendants "likely did not intend to defraud investors by concealing [information] while simultaneously disclosing that information in myriad contexts. Mot. at 12 (citing Sneed v. Talphera, Inc., 2025 WL 2406424, at *7 (9th Cir. Aug. 20, 2025)). But here, Facebook did not simultaneously disclose the initial misuse in other contexts—news outlets did. Indeed, in response to the 2015 Guardian article—the one that broke the story of the initial misuse—Facebook merely promised that it was "carefully investigating" Cambridge Analytica. 4AC ¶ 167. Thus, the Court echoes the Ninth Circuit in finding that reasonable investors would not have known that Cambridge Analytica had improperly accessed Facebook users' data such that users did not have control over their personal information on the platform. Facebook, 87 F.4th at 954.

To summarize, Plaintiffs would infer that Defendants made the user control statements to shore up trust, encourage users to post, and bolster ad revenue. Defendants argue that the truth was on the market and infer that Defendants simply did not think to mention the misuse of user data. The Court concludes that Plaintiffs' inference is "at least as compelling" as Defendants'. Tellabs, 551 U.S. at 324.

b. Statements of Regret, Investor and Early Employee Communications, and Stock Sales

Having conducted the analysis above, Defendants' next three reasons for dismissal only Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 24 of 34

24

require a brief discussion. First, Defendants argue that Defendants Zuckerberg and Sandberg's 2018 statements of regret, cited in Paragraph 644 of the 4AC, do not show they knew the accounts were compromised before 2018. Mot. at 13-14. But the Court's finding of scienter does not rely on those statements. See supra Part IV.B.1.a. Second, Defendants assert that alleged communications from an early investor and an early employee to Defendants Sandberg and Zuckerberg are insufficient to show scienter. Mot. at 14. As with the statements of regret, however, the Court's analysis does not rely on those communications in finding Plaintiffs have adequately pled scienter. See supra Part IV.B.1.a. Finally, Defendants assert that Individual Defendants' stock sales are inadequate to raise a strong inference of scienter. Mot. at 14-15. But, as discussed above, Plaintiffs have adequately pled a cogent and compelling inference of scienter even without relying on the stock sales. See supra Part IV.B.1.a.

c. Risk Factor Statements

Finally, in moving to dismiss the Cambridge Analytica theory insofar as it underlies the risk factor statements, Defendants offer an additional argument: "it makes no sense that Defendants would try to deceive the public about Cambridge Analytica's years-old data misuse through risk factors buried in a voluminous SEC filing drafted by lawyers and generic statements about how users can control their data." Mot. at 13. As Defendants would have it, if a corporation makes a false statement in a document that is sufficiently long or drafted by lawyers, then it did not intend to deceive the market.

That argument is unavailing for two reasons. First, the case Defendants cite to support this notion is inapposite. In Espy v. J2 Global, Inc., 99 F.4th 527, 540 (9th Cir. 2024), the defendant corporation omitted information from a press release and a proxy statement. Id. The court found that "the omitted information and the context of the disclosure do not compel a strong inference of scienter." Id. at 540. In other words, the court found that nature of the information omitted— Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 25 of 34

25

which was minor compared to what was disclosed—was just as important as the context of the disclosure. Id. at 537 ("It is more plausible that the details of the VDW acquisition were equally unimportant to the press release as the details of the eight other acquisitions announced in that same disclosure."). Here, Plaintiffs have pled misstatements, not omissions, and Defendants do not argue that those misstatements somehow paled in comparison to truthful information. Moreover, Facebook made the allegedly false statements not in a press release or a proxy statement, as was the case in Espy, but in its 10-Ks and 10-Qs. Espy thus does not support Defendants' argument.

This leads to the second reason Defendants' inference fails to convince the Court. 10-Ks and 10-Qs can be long and complex, and so Defendants infer Facebook would not have used them to deceive the market. But the very purpose of 10-Ks and 10-Qs is to inform the market; thus, a corporation that makes false statements in those forms would misinform the market. Consequently, the more "cogent and compelling" inference, Tellabs, 551 U.S. at 310, is that Facebook made the allegedly false statements in the 10-Ks and 10-Qs with the "intent to deceive"

the market or with "deliberate recklessness." Webb, 884 F.3d at 851. ***

For the foregoing reasons, the Court finds that Plaintiffs' claim may proceed insofar as it is based on the initial misuse portion of the Cambridge Analytica theory of fraud. This finding applies to both the user control statements and the risk factor statements.

2. Continued Misuse

Defendants contend that Plaintiffs failed to plead scienter as to the continued misuse of user data, as well. Mot. at 18. Defendants move to dismiss on three grounds: that Plaintiffs waived these claims, that these claims go beyond the Ninth Circuit's mandate, and that Plaintiffs failed to plead scienter. The Court addresses the related issues of waiver and mandate, and, Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 26 of 34

26

finding them dispositive, does not address scienter. The Court rejected the continued misuse theory in its 2020 and 2021 orders, finding that Plaintiffs failed to plead adequate facts showing that Defendants knew or should have known that Cambridge Analytica had not deleted the misappropriated data. 2020 Order at 34-35; 2021 Order at 7-12.

In moving to dismiss, Defendants argue that when Plaintiffs failed to raise continued misuse on appeal, Plaintiffs explicitly waived the continued misuse theory. Mot. at 18. And they argue that Plaintiffs' waiver of the continued misuse theory puts that theory beyond the scope of the Ninth Circuit's mandate to this Court. Id. at 20-21.

The mandate rule forecloses relitigation of claims and issues that a plaintiff waived or forfeited on appeal. Although the Ninth Circuit has not yet ruled on this issue, it has recognized that the other federal courts of appeals "have consistently held that the scope of remand is limited when an issue on appeal is waived or forfeited." Alaska Dep't of Fish & Game, 139 F.4th at 788 (citation modified) (collecting cases). The Supreme Court has come to the same conclusion, holding that plaintiffs could not revive on remand an argument that was not pressed on appeal. Bondi v. VanDerStok, 604 U.S. 458, 467 n.2 (2025) ("Nor, on remand, may the parties seek to inject arguments about the proper test that they did not pursue here."). These decisions on waiver and mandate are coextensive with the law of the case doctrine, which "generally preclude[s]" a court "from reconsidering an issue previously decided by the same court, or a higher court in the identical case." United States v. Lummi Indian Tribe, 235 F.3d 443, 452 (9th Cir. 2000). The issue here, then, is whether Plaintiffs waived or forfeited their argument about continued misuse with respect to the user control statements. In the 2021 Order that Plaintiffs ultimately appealed, this Court held that "Plaintiffs have failed to establish that Defendants knew that Cambridge Analytica was using the misappropriated data after Facebook obtained deletion Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 27 of 34

27

certifications." 2021 Order at 12. In their briefing for the Ninth Circuit, Plaintiffs explicitly waived review of that finding insofar as it applied to Executive Defendants' scienter of the investigation statement and the risk statements. In re Facebook Inc. Sec. Litig., No. 22-15077 (9th Cir. Oct. 12, 2022), Plaintiffs' Opening Brief ("Pls'. Opening Br."), ECF No. 14 at 64 n. 7; In re Facebook Inc. Sec. Litig., No. 22-15077 (9th Cir. Oct. 12, 2022), Plaintiffs' Reply Brief ("Pls'. Reply Br."), ECF No. 38 at 3 n.1. Plaintiffs did not, however, explicitly waive review of the Order insofar as it applied to the user control statements—they never said they were waiving the argument.

But even though Plaintiffs did not expressly waive their argument about the user control statements and continued misuse, the Court finds they did forfeit it. Plaintiffs did not explicitly appeal review of the Order insofar as it applied to continued misuse and the user control statements. They argue that they "pressed continuing misuse facts," Opp. at 14, but they only seem to have done so insofar as those facts applied to the spokesperson's scienter in making the investigation statement. Pls.' Opening Br. at 70-75. ("For the reasons already discussed, if Facebook's spokesperson had inquired into the findings of the internal investigation, it is implausible that he did not discover that there was at least some evidence of wrongdoing."). Moreover, it does not appear the Ninth Circuit thought Plaintiffs had appealed the finding of no scienter as to continued misuse and the user control statements. The order credits some of the underlying facts, but it did so most prominently in a section that analyzes loss causation, not scienter. See, e.g., Facebook, 87 F.4th at 957 ("Facebook knew Cambridge Analytica did not delete all the data it had improperly accessed.").

Plaintiffs insist that even if they waived or forfeited the continued misuse theory, they may nonetheless amend their claim to reallege that theory with newly-revealed facts. Opp. at 16. But the examples they cite are inapposite. In Google, Inc. v. Affinity Engines, Inc., 2005 WL 200788 Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 28 of 34

28

(N.D. Cal. Aug. 12, 2005), the plaintiff alleged a claim in the original complaint but dropped the claim from the amended complaint. The Court denied the defendant's motion to dismiss with prejudice because the plaintiff omitted the claim voluntarily. Id. at *7. But Google provides a helpful clarification of the rule at hand: "claims in an original complaint that were not dismissed but rather voluntarily amended" could be realleged. Id. (emphasis added). In Google, the plaintiff voluntarily amended the pleading. Here, the situation is different: Plaintiffs are trying to revive a theory that was dismissed with prejudice, and which they forfeited on appeal. In Comm. Concerning Cmty. Imp. v. City of Modesto, No. CV-F-04-6121 LJO DLB, 2011 WL 9653 (E.D. Cal. Jan. 3, 2011), the court dismissed a claim from the original complaint. After three more motions to dismiss, the case went up on appeal to the Ninth Circuit, which revived the claim. Id. at *1. On remand, the district court allowed the plaintiff to add a defendant to the previously dismissed claim, finding that its earlier dismissal had precluded the plaintiffs from adding the defendant earlier. Id. at *3. Here, on the other hand, nothing precluded Plaintiffs from pursuing their continued misuse theory: they merely needed to appeal that element of this Court's 2021 Order to the Ninth Circuit. When they did not, they forfeited the ability to continue to pursue that rejected theory on remand.

In 2021, this Court found that Plaintiffs failed to plead that Defendants knew or should have known about the continued misuse of Facebook users' data. 2021 Order at 7-12. Plaintiffs did not appeal that finding to the Ninth Circuit. As a result, they forfeited the continued misuse theory. They may not now revive that argument on remand. Accordingly, the Court's earlier finding Plaintiffs failed to plead scienter as to continued misuse stands as the law of the case. Insofar as Plaintiffs' claim is based on the continued misuse sub-theory of the Cambridge Analytica theory of fraud, it is DISMISSED WITHOUT LEAVE TO AMEND. Lopez, 203 F.3d at 1127.

Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 29 of 34

29

C. Whitelisting Theory

Finally, the Court turns to the whitelisting theory of fraud. Plaintiffs allege that the user control statements and the risk factor statements were false because Defendants exempted a wide array of "whitelisted" app developers and corporations from Facebook's general prohibition on third-party access to user friend data in exchange for advertising revenues and other business benefits. 4AC ¶ 24. They allege that the June 3, 2018, New York Times article revealing these whitelisting practices contributed to the July 25, 2018, stock drop. 4AC ¶¶ 683, 687.

1. User Control Statements

Defendants do not challenge that the user control statements were allegedly false or misleading in light of Defendants' failure to disclose Facebook's practice of whitelisting. Mot. at 25 ("What should remain in this case, therefore, is Plaintiffs' whitelisting theory: that the user control statements allegedly were false or misleading in light of the failure to disclose whitelisting, and that the revelation of whitelisting in June 2018 allegedly caused the July 2018 stock drop."). Insofar as Plaintiffs' Section 10(b) and Rule 10b-5 claim is based on those grounds, it may proceed.

2. Risk Factor Statements

Defendants do argue, however, that the whitelisting theory of fraud does not apply to the risk factor statements, pointing to this Court's 2020 Order and the Ninth Circuit's holding. Mot. at 24-25 (citing 2020 Order at 40; Facebook 87 F.4th at 948). According to Defendants, "the parties have litigated this case all the way to the Supreme Court on Plaintiffs' theory that the risk factor statements were knowingly false because of Cambridge Analytica's initial misuse, not whitelisting" and "[i]t is far too late to put a new face on that claim." Reply at 14. Plaintiffs oppose this characterization of the litigation. In the TAC and 4AC, Plaintiffs allege that the risk factor statements were false because, among other reasons, Defendants Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 30 of 34

30

"continued to improperly provide access to that data to numerous third parties, including . . . 'whitelisted' third parties'" and were "overriding user privacy settings to provide third parties with improper access to user friends' data throughout the Class Period." TAC ¶ 527(f)-(g); 4AC ¶ 630(f)-(g). Plaintiffs maintain that when the Court found scienter as to the whitelisting theory of fraud, that finding applied to both the user control statements and the risk factor statements. Opp. at 14.

In 2020, this Court found that Plaintiffs pled "sufficient facts showing that Defendants knew that Facebook had little control over the deletion of misappropriated data and that the risk of a Cambridge Analytica type scandal could again occur due to its whitelisting practices." 2020 Order at 61. But the Court had already found that Plaintiffs failed to plead falsity as to the risk statements, id. at 40-42, so that finding was with respect to the user control statements alone. Plaintiffs appealed to the Ninth Circuit, but the record there does not tell a clear story. In their opening brief, Plaintiffs wrote that one of the issues presented was "Whether the district court properly dismissed Plaintiffs' claims regarding Defendants' risk statements for failure to adequately plead falsity." Pls'. Opening Br. at 1. But in the body of the brief, Plaintiffs only argued that the risk factor statements were false because "Facebook's internal investigation had determined that Cambridge Analytica had already accessed and misused" user data. Pls'. Opening Br. at 34. That brief did not argue that the risk factor statements were false because of the practice of whitelisting. See id. at 33-43. Naturally, then, Defendants did not address whitelisting with respect to the risk factor statements, either. Appellees' Answering Brief ("Answering Br."), ECF No. 26 at 22-36; In re Facebook Inc. Sec. Litig., No. 22-15077 (9th Cir. Oct. 12, 2022). When the Ninth Circuit then analyzed the risk factor statements, it, too, focused exclusively on the Cambridge Analytica theory of fraud. Facebook, 87 F.4th at 948-52. The Ninth Circuit found that shareholders pled allegations that "if true, more than support the claim that Facebook was Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 31 of 34

31

aware of Cambridge Analytica's misconduct before February 2017, so Facebook's statements about risk management 'directly contradict[ed]' what the company knew when it filed its 2016 10- K." Id. at 949. That is, the Ninth Circuit found the user control statements were false because of Facebook's practice of whitelisting, but it did not consider whether the risk statements were false because of whitelisting.

The Court finds that when Plaintiffs failed to include their theory that the risk factor statements were false because of Facebook's whitelisting practices in their appeal, they forfeited that argument. As the Court discussed above, see supra Part IV.B.2., "the scope of remand is limited when an issue on appeal is waived or forfeited." Alaska Dep't of Fish & Game, 139 F.4th at 788. Here, the Court had previously found Plaintiffs failed to plead falsity as to the risk factor statements. 2020 Order at 40-42. When Plaintiffs appealed that conclusion, they argued that the risk factor statements were false because of the Cambridge Analytica theory of fraud, not because of the whitelisting theory. Consequently, Defendants and the Ninth Circuit also focused exclusively on whether the risk factor statements were false because of the Cambridge Analytica data breach, never reaching the question—not presented or argued by Plaintiffs—of whether the statements were false because of the practice of whitelisting.

For the foregoing reasons, and in an effort to "maintain consistency and avoid reconsideration of matters once decided during the course of a single continuing lawsuit," the Court holds that the risk factor statements may not proceed insofar as they are based on the whitelisting theory. Ingle v. Cir. City, 408 F.3d 592, 594 (9th Cir. 2005) (quoting 18B Wright, Miller & Cooper, Federal Practice and Procedure: Jurisdiction 2d § 4478, at 637-38 (2002)). This dismissal is WITHOUT LEAVE TO AMEND. Lopez, 203 F.3d at 1127.

D. Sections 20(a) and 20A of the Securities Exchange Act

Plaintiffs also assert claims for violations of Sections 20(a) and 20A of the Securities Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 32 of 34

32

Exchange Act, which require a primary Securities Exchange Act violation. 4AC ¶¶ 714-22. Plaintiffs have adequately pleaded a Section 10(b) and Rule 10b-5 violation. Defendants say they

"seek dismissal" of the fraud claim because "Plaintiffs fail to plead violations of Sections 10(b), 20(a), or 20A," but their motion focuses entirely on Section 10(b)—there is nothing else on 20(a) or 20A. Mot. at 1. Because Plaintiff has stated a claim for a primary Securities Exchange Act violation, and because Defendants do not provide any other reason why the 20(a) and 20A claims should be dismissed, these claims may proceed.

V. CONCLUSION

For the foregoing reasons, the Court ORDERS as follows:

1. Count I (for violation of Section 10(b) of the Securities Exchange Act and SEC Rule 10b-5) is DISMISSED insofar as it is based on the investigation statement.

2. Count I is DISMISSED insofar as it is based on the continued misuse sub-theory of the Cambridge Analytica theory of fraud.

3. Count I is DISMISSED insofar as it is based on the risk factor statements and the whitelisting theory of fraud.

4. Count I may PROCEED insofar as it is based on the initial misuse sub-theory of the Cambridge Analytica theory of fraud.

5. Count I may PROCEED insofar as it is based on the user control statements and the whitelisting theory of fraud.

6. Counts II and III (for violations of Sections 20(a) and 20A of the Securities Exchange Act) may PROCEED.

All dismissals are WITHOUT LEAVE TO AMEND.

Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 33 of 34

33

IT IS SO ORDERED.

Dated: February 27, 2026

EDWARD J. DAVILA

United States District Judge Case 5:18-cv-01725-EJD Document 258 Filed 02/27/26 Page 34 of 34

34