Amicus Curiae Brief — Facebook, Inc., et al., Petitioners v. Amalgamated Bank, et al.

No. 23-980

In the Supreme Court of the United States

FACEBOOK, INC., ET AL., PETITIONERS

v.

AMALGAMATED BANK, ET AL.

ON WRIT OF CERTIORARI

TO THE UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

BRIEF FOR THE UNITED STATES

AS AMICUS CURIAE SUPPORTING RESPONDENTS

MEGAN BARBERO

General Counsel

MICHAEL A. CONLEY

Solicitor

JEFFREY A. BERGER

Assistant General Counsel

EMILY TRUE PARISE

Senior Appellate Counsel

ALLISON BITZ

Attorney

Securities and Exchange

Commission

Washington, D.C. 20549

ELIZABETH B. PRELOGAR

Solicitor General

Counsel of Record

MALCOLM L. STEWART

Deputy Solicitor General

KEVIN J. BARBER

Assistant to the Solicitor

General

Department of Justice

Washington, D.C. 20530-0001

SupremeCtBriefs@usdoj.gov

(202) 514-2217

QUESTION PRESENTED

Whether a company’s risk disclosure in the “Risk

Factors” section of a Form 10-K filing, as required by

Item 105 of the Securities and Exchange Commission’s

Regulation S-K, is false or misleading when it does not

disclose that the warned-of risk has materialized in the

past, even if the past event presents no known risk of

ongoing or future business harm.

(I)

TABLE OF CONTENTS

Page

Interest of the United States....................................................... 1

Statement:

A. Legal background ............................................................. 2

B. Factual background .......................................................... 4

C. Prior proceedings .............................................................. 7

Summary of argument ............................................................... 10

Argument:

Respondents have adequately pleaded that Facebook’s

risk-factor statements were false or misleading ................ 12

A. Risk-factor disclosures can falsely imply that the

warned-of risks have not already materialized:

1. An incomplete risk-factor statement is a

quintessential half-truth .......................................... 13

2. The case law supports respondents’ theory of

falsity .......................................................................... 15

3. Administrative practice supports respondents’

theory of falsity ......................................................... 18

4. Petitioners’ principal authority is an outlier

decision that lacks persuasive force ........................ 19

B. Petitioners’ proposed categorical rule limiting riskfactor fraud claims is unsound ....................................... 20

1. Petitioners’ approach would artificially limit

liability for misleading risk statements .................. 20

2. Petitioners’ reliance on statutory and

regulatory context is misplaced .............................. 23

3. The court of appeals’ decision does not create an

undue risk of overdisclosure or abusive

litigation ..................................................................... 25

C. A risk-factor warning that does not reveal prior

instances where the risk materialized can be

misleading even if consequent harm to the issuer’s

business is not certain or nearly certain to occur ........ 27

D. Respondents have plausibly alleged that Facebook’s

risk-factor statements were false or misleading .......... 29

Conclusion ................................................................................... 33

(III)

IV

TABLE OF AUTHORITIES

Cases:

Page

Alphabet, Inc. Sec. Litig., In re,

1 F.4th 687 (9th Cir. 2021), cert. denied,

142 S. Ct. 1227 (2022) ......................................... 9, 16, 17, 30

Asher v. Baxter Int’l Inc.,

377 F.3d 727 (7th Cir. 2004), cert. denied,

544 U.S. 920 (2005).............................................................. 25

Basic Inc. v. Levinson, 485 U.S. 224 (1988) ...... 15, 22, 23, 28

Berson v. Applied Signal Tech., Inc.,

527 F.3d 982 (9th Cir. 2008) ..................................... 9, 15, 29

Bondali v. Yum! Brands, Inc.,

620 Fed. Appx. 483 (6th Cir. 2015) ........................ 19, 20, 26

Chiarella v. United States, 445 U.S. 222 (1980) ................... 3

Cora Pub, Inc. v. Continental Cas. Co.,

619 F.2d 482 (5th Cir. 1980) ............................................... 17

Dolphin & Bradbury, Inc. v. SEC,

512 F.3d 634 (D.C. Cir. 2008) ............................................. 17

Dura Pharm., Inc. v. Broudo, 544 U.S. 336 (2005) .............. 4

Field v. Mans, 157 F.3d 35 (1st Cir. 1998) .......................... 17

Harman Int’l Indus., Inc. Sec. Litig., In re,

791 F.3d 90 (D.C. Cir. 2015), cert. denied,

577 U.S. 1139 (2016)............................................................ 25

Karth v. Keryx Biopharmaceuticals, Inc.,

6 F.4th 123 (1st Cir. 2021) .................................................. 17

Macquarie Infrastructure Corp.

v. Moab Partners, L.P., 601 U.S. 257 (2024) .... 2, 13, 21, 24

Matrixx Initiatives, Inc. v. Siracusano,

563 U.S. 27 (2011) ............................................. 15, 22, 26, 28

Omnicare, Inc. v. Laborers Dist. Council Constr.

Indus. Pension Fund,

575 U.S. 175 (2015)............................. 2, 11, 13, 21, 22, 25, 26

V

Cases—Continued:

Page

Provenz v. Miller,

102 F.3d 1478 (9th Cir. 1996), cert. denied,

522 U.S. 808 (1997).............................................................. 33

Rombach v. Chang, 355 F.3d 164 (2d Cir. 2004) ................. 17

Rubinstein v. Collins, 20 F.3d 160 (5th Cir. 1994) ....... 14, 16

SEC v. Fundpack, Inc.,

No. 79-859, 1979 WL 1238 (D.D.C. Aug. 16, 1979) .......... 19

SEC v. Tecumseh Holdings Corp.,

765 F. Supp. 2d 340 (S.D.N.Y. 2011) ................................. 18

SEC v. True N. Fin. Corp.,

909 F. Supp. 2d 1073 (D. Minn. 2012) ............................... 18

SEC v. Zandford, 535 U.S. 813 (2002) ................................... 3

Siracusano v. Matrixx Initiatives, Inc.,

585 F.3d 1167 (9th Cir. 2009), aff ’d,

563 U.S. 27 (2011) ......................................................... 15, 28

Stoneridge Inv. Partners, LLC

v. Scientific-Atlanta, Inc., 552 U.S. 148 (2008) ................. 4

Universal Health Servs., Inc. v. United States

ex rel. Escobar, 579 U.S. 176 (2016) .................................. 13

Westinghouse Sec. Litig., In re,

90 F.3d 696 (3d Cir. 1996) ............................................ 16, 30

Williams v. Globus Med., Inc.,

869 F.3d 235 (3d Cir. 2017) ................................................ 17

Statutes and regulations:

Private Securities Litigation Reform Act of 1995,

Pub. L. No. 104-67, 109 Stat. 737 ...................................... 24

Securities Act of 1933,

ch. 38, 48 Stat. 74 (15 U.S.C. 77a et seq.) ............................ 2

§ 11, 48 Stat. 82-83 ........................................................... 22

§ 11(a), 48 Stat. 82 ........................................................... 21

15 U.S.C. 77d...................................................................... 2

15 U.S.C. 77e ...................................................................... 2

VI

Statutes and regulations—Continued:

Page

15 U.S.C. 77k(a) ............................................................... 21

Securities Exchange Act of 1934,

ch. 404, 48 Stat. 881 (15 U.S.C. 78a et seq.) ........................ 2

§ 10(b), 48 Stat. 891 ................................................... 3, 4, 7

15 U.S.C. 78j(b).................................................................. 3

15 U.S.C. 78l....................................................................... 2

15 U.S.C. 78m (2018 & Supp. IV 2022) ............................ 2

15 U.S.C. 78u-5 ................................................................ 24

15 U.S.C. 78u-5(c)(1)(A)(i) .............................................. 25

17 C.F.R.:

Pt. 229 ................................................................................. 2

Section 229.10............................................................... 2

Section 229.101(a)(1).................................................. 23

Section 229.103(a) ...................................................... 23

Section 229.105 ....................................................... 2, 10

Section 229.105(a) ............................................ 3, 23, 26

Section 229.105(b) .................................................. 3, 26

Section 229.106 ..................................................... 18, 23

Section 229.303(b)(2)(ii)............................................. 23

Pt. 240:

Section 240.10b-5 .......................... 3, 4, 7, 21, 26, 29, 31

Section 240.10b-5(b) ................................. 12, 20-22, 24

Section 240.12b-20 ..................................................... 24

Miscellaneous:

1 Alan R. Bromberg & Lewis D. Lowenfels,

Bromberg and Lowenfels on Securities Fraud

(2d ed., 2024-1 ed. issued in June) ..................................... 25

3 Dan B. Dobbs et al., The Law of Torts (2d ed. 2011) ...... 13

29 Fed. Reg. 2490 (Feb. 15, 1964) .................................... 2, 18

47 Fed. Reg. 11,380 (Mar. 16, 1982) ....................................... 2

VII

Miscellaneous—Continued:

Page

70 Fed. Reg. 44,722 (Aug. 3, 2005) ......................................... 2

83 Fed. Reg. 8166 (Feb. 26, 2018) ........................................ 18

85 Fed. Reg. 63,726 (Oct. 8, 2020) ........................................ 26

88 Fed. Reg. 51,896 (Aug. 4, 2023) ....................................... 18

Restatement (Second) of Contracts (1981) ......................... 13

Restatement (Second) of Torts (1977) ................................. 13

In the Supreme Court of the United States

No. 23-980

FACEBOOK, INC., ET AL., PETITIONERS

v.

AMALGAMATED BANK, ET AL.

ON WRIT OF CERTIORARI

TO THE UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

BRIEF FOR THE UNITED STATES

AS AMICUS CURIAE SUPPORTING RESPONDENTS

INTEREST OF THE UNITED STATES

The United States, through the Department of Justice and the Securities and Exchange Commission (SEC

or Commission), administers and enforces the federal

securities laws, including the laws at issue in this case.

Meritorious private securities actions are an essential

supplement to criminal prosecutions and civil enforcement actions brought by the Department of Justice and

the SEC. In 2019 the SEC brought a civil action against

petitioner Facebook, Inc. that presented similar legal

issues and involved the same underlying events as respondents’ current suit. The United States therefore

has a substantial interest in the Court’s disposition of

this case.

(1)

2

STATEMENT

A. Legal Background

1. Under the Securities Act of 1933 (Securities Act),

ch. 38, 48 Stat. 74 (15 U.S.C. 77a et seq.), a securities

issuer “may offer securities to the public only after filing a registration statement,” unless an exception applies. Omnicare, Inc. v. Laborers Dist. Council Constr.

Indus. Pension Fund, 575 U.S. 175, 178 (2015); see 15

U.S.C. 77d, 77e. The Securities Exchange Act of 1934

(Exchange Act), ch. 404, 48 Stat. 881 (15 U.S.C. 78a et

seq.), requires certain issuers “to file periodic informational statements,” such as the annual Form 10-K and

the quarterly Form 10-Q, with the SEC. Macquarie Infrastructure Corp. v. Moab Partners, L.P., 601 U.S. 257,

260 (2024); see 15 U.S.C. 78l; 15 U.S.C. 78m (2018 &

Supp. IV 2022). The Commission’s Regulation S-K sets

forth required contents of those filings. 17 C.F.R. 229.10;

see 17 C.F.R. Pt. 229.

Issuers’ public filings have long disclosed business

risks. In 1964 the SEC published Securities Act guidance that advised offerors of “speculative” securities to

include in their prospectuses “a carefully organized series of short, concise paragraphs summarizing the principal factors which make the offering speculative.” 29

Fed. Reg. 2490, 2492 (Feb. 15, 1964). In 1982 the Commission formalized this guidance as a regulatory requirement in Item 503 of Regulation S-K. 47 Fed. Reg.

11,380, 11,423 (Mar. 16, 1982). And in 2005 the SEC extended that requirement to certain of the filings required by the Exchange Act, including Form 10-K. 70

Fed. Reg. 44,722, 44,786-44,787, 44,830 (Aug. 3, 2005).

Risk-factor statements are now governed by Item

105 of Regulation S-K, 17 C.F.R. 229.105. The regulation directs filers to provide “a discussion of the material

3

factors that make an investment in the registrant or offering speculative or risky.” 17 C.F.R. 229.105(a). That discussion “must be organized logically with relevant headings” and with “each risk factor * * * set forth under a

subcaption that adequately describes the risk.” Ibid.

Item 105 discourages “[t]he presentation of risks that

could apply generically to any registrant or any offering,” and it requires risk factors to be stated “in plain

English.” 17 C.F.R. 229.105(a) and (b).

2. False statements in SEC filings can expose issuers to liability for securities fraud. Section 10(b) of the

Exchange Act makes it unlawful for any person “[t]o

use or employ, in connection with the purchase or sale

of any security[,] * * * any manipulative or deceptive

device or contrivance in contravention of ” SEC rules.

15 U.S.C. 78j(b). The Commission’s Rule 10b-5 implements Section 10(b) and makes it unlawful for any person, in connection with the purchase or sale of a security, to (a) “employ any device, scheme, or artifice to defraud”; (b) “make any untrue statement of a material

fact or * * * omit to state a material fact necessary in

order to make the statements made, in the light of the

circumstances under which they were made, not misleading”; or (c) “engage in any act, practice, or course

of business which operates or would operate as a fraud

or deceit upon any person.” 17 C.F.R. 240.10b-5. “Section 10(b) is aptly described as a catchall” antifraud provision. Chiarella v. United States, 445 U.S. 222, 234-235

(1980). And “Rule 10b-5 is coextensive with the coverage of § 10(b).” SEC v. Zandford, 535 U.S. 813, 816 n.1

(2002).

The SEC is charged with enforcing Section 10(b) and

Rule 10b-5. Aggrieved private parties may also sue to

enforce those provisions under a private right of action

4

that Congress has “ratified.” Stoneridge Inv. Partners,

LLC v. Scientific-Atlanta, Inc., 552 U.S. 148, 165 (2008).

To prevail under Section 10(b) and Rule 10b-5, the SEC

or a private plaintiff must show (1) a material misrepresentation or omission; (2) made with scienter; (3) in connection with the purchase or sale of a security. Dura

Pharm., Inc. v. Broudo, 544 U.S. 336, 341 (2005). A private plaintiff must additionally prove (4) reliance; (5) economic loss; and (6) loss causation. Id. at 341-342.

B. Factual Background

1. Petitioners are Facebook, Inc. (now known as

Meta Platforms, Inc., Pet. App. 6a n.1), and three of its

executives. A publicly traded company, Facebook runs

an eponymous social-media platform that enables users

to interact with each other (including as “friends”) and

use applications created by third-party developers. Id.

at 8a. According to the operative complaint here, the

company’s business is heavily dependent on the monetization of user data, and thus on users’ willingness to

trust Facebook with that information. J.A. 8-9, 22-27.

In 2015, the newspaper The Guardian reported that

a British political-consulting firm, Cambridge Analytica, “had created a database of information about American voters by harvesting * * * Facebook data” derived

from a personality quiz that an academic at Cambridge

University, Aleksandr Kogan, had developed and uploaded to Facebook. Pet. App. 10a. Approximately

270,000 people took the quiz, but Kogan was able to obtain data pertaining to tens of millions of those users’

friends as well. J.A. 49-50, 621, 632. Facebook responded

to the report by stating through a spokesman that Facebook was “carefully investigating this situation” and

would “take swift action against companies” that “[m]islead[] people or misus[e] their information” in violation

5

of Facebook’s policies, including by “banning those companies from Facebook and requiring them to destroy all

improperly collected data.” J.A. 619.

Facebook determined that its users’ information had

indeed been obtained by Cambridge Analytica in violation of Facebook’s policies. Pet. App. 11a-12a. Soon after the Guardian article appeared, a Facebook executive told Cambridge Analytica that Kogan’s data had

been “improperly derived from * * * the Facebook

Platform, and then transferred to Cambridge Analytica

in violation of our terms.” J.A. 87. She directed the firm

to delete the data. Ibid. But Facebook did not make

those findings public. Although company policy provided that “Facebook would notify users” when their accounts were compromised, “a decision [was] made” not

to do so in this instance. J.A. 195, 308. Facebook also

repeatedly told the media that its “investigation into

Cambridge Analytica had not yet uncovered any misconduct related to the firm’s work” on certain political

campaigns, and the company “assured Facebook users

that ‘no one is going to get your data that shouldn’t have

it.’ ” Pet. App. 13a; see id. at 26a; J.A. 7-8. The operative complaint in this case alleged that Facebook did not

ban Cambridge Analytica from its platform even after

being given reason to believe that the firm had not deleted the misappropriated data. J.A. 96-100, 179-180.

2. At approximately the same time, petitioners submitted SEC filings that addressed the risks that improper disclosure of user data could entail. In the riskfactors section of its Form 10-K for fiscal year 2016

(filed in February 2017), Facebook included the heading, “Security breaches and improper access to or disclosure of our data or user data, or other hacking and

phishing attacks on our systems, could harm our repu-

6

tation and adversely affect our business.” J.A. 439 (emphasis omitted). That Form 10-K elaborated on those

risks, noting that “[a]ny failure to prevent or mitigate

security breaches and improper access to or disclosure

of our data or user data could result in the loss or misuse

of such data, which could harm our business and reputation and diminish our competitive position.” Ibid.

Facebook also stated that, “if * * * third parties or

[app] developers fail to adopt or adhere to adequate

data security practices, or in the event of a breach of

their networks, our data or our users’ data may be improperly accessed, used, or disclosed.” J.A. 440. Facebook included nearly identical warnings in subsequent 10-K and 10-Q filings. J.A. 192-193.

3. In March 2018, “The New York Times and The

Guardian contacted Facebook for comment on joint articles the outlets planned to publish about Cambridge

Analytica’s misuse of Facebook users’ data.” Pet. App.

14a. Facebook then “announced on its investor relations website that it was suspending Cambridge Analytica for violating its policies by sharing Facebook users’

data without the users’ consent and for failing to delete

the improperly collected data.” Ibid. On March 17, 2018,

The Guardian published its story under the headline,

“Revealed: 50 million Facebook profiles harvested for

Cambridge Analytica in major data breach.” J.A. 634

(emphasis omitted). The coverage prompted a series of

government investigations and a social-media campaign

urging Facebook users to delete their accounts. See

J.A. 208-212. Facebook’s leadership apologized for failing to inform users that their accounts had been compromised and for otherwise mishandling the Cambridge

Analytica matter. J.A. 195; see J.A. 213-218.

7

On March 19, 2018, the first trading day after the

news broke, the price of Facebook’s common stock fell

almost 7 percent; within a week, it had fallen nearly 18

percent. Pet. App. 15a; J.A. 14.

C. Prior Proceedings

1. Respondents filed this suit against petitioners on

behalf of a putative class of Facebook shareholders.

Their third amended complaint alleged “that Facebook,

through the executive defendants or a company spokesperson, made several false or materially misleading

statements between February 3, 2017, and July 25,

2018,” in violation of Section 10(b) of the Exchange Act

and Rule 10b-5, among other provisions. Pet. App. 17a18a. The relevant statements included those on the

Form 10-K discussed above, see J.A. 192-194, 281-282,

as well as certain “statements regarding Facebook’s investigation into Cambridge Analytica’s 2015 misconduct” and “statements regarding the control Facebook

users have over their data on the platform.” Pet. App.

18a. Respondents alleged, among other things, that petitioners’ risk-factor statements were misleading because they presented the risks of misappropriation of

user data as “merely hypothetical,” even though petitioners knew that Cambridge Analytica and others already had “improperly gained access to user data and

used it in ways not consented to or authorized by those

users.” J.A. 9 (emphasis omitted); see J.A. 282-285.

In 2019, the SEC brought its own enforcement action

against Facebook in federal district court. J.A. 642-660.

Like respondents, the Commission alleged that “Facebook’s Risk Factor disclosures misleadingly suggested

that the company faced merely the risk” of misuse of

user data. J.A. 653. “This hypothetical phrasing,” the

Commission alleged, “created the false impression that

8

Facebook had not suffered a significant episode of misuse of user data by a developer.” J.A. 653-654. Facebook settled the case, agreeing to pay a civil penalty of

$100 million. J.A. 661-662. At the same time, the Federal Trade Commission imposed a $5 billion penalty on

Facebook for deceiving users about the privacy of their

data. Pet. App. 8a-9a.

2. Petitioners moved to dismiss respondents’ complaint, and the district court granted their motion. Pet.

App. 109a-224a. Most relevant here, the court found

that respondents had “failed to plead falsity” with respect to the risk-factor statements. Id. at 191a. The

court noted that most of those statements had warned

of “reputation, business, or competitive” risks, but that

respondents had not alleged that “the Cambridge Analytica scandal was harming Facebook’s reputation, business, or competitive position” at the time Facebook made

the statements. Id. at 189a. Although one of the statements had referenced the risk of “improper use or disclosure of user data,” the court found that Facebook’s

failure to disclose Cambridge Analytica’s actual misuse

of consumer data did not render Facebook’s Form 10-K

misleading. The court determined that, by virtue of the

2015 Guardian article, Cambridge Analytica’s misuse

“was already public knowledge” when the risk-factor

statement was made. Id. at 189a-190a. The district

court also dismissed respondents’ other claims for failure to plead falsity, scienter, and loss causation. See id.

at 110a, 114a.

3. The court of appeals affirmed in part and reversed in part. Pet. App. 1a-53a.

a. The panel majority largely reversed the dismissal

of the risk-factor claims, holding that respondents had

adequately pleaded falsity as to most of those state-

9

ments. Pet. App. 21a-29a; see id. at 29a (affirming district court’s dismissal as to risk-factor statements unrelated to misuse of user data). The panel applied Ninth

Circuit precedent holding that “[r]isk disclosures that

‘speak entirely of as-yet-unrealized risks and contingencies’ and do not ‘alert the reader that some of these

risks may already have come to fruition’ can mislead

reasonable investors.” In re Alphabet, Inc. Sec. Litig.,

1 F.4th 687, 703 (2021) (quoting Berson v. Applied Signal Tech., Inc., 527 F.3d 982, 986 (9th Cir. 2008)) (brackets omitted), cert. denied, 142 S. Ct. 1227 (2022); see

Pet. App. 22a-26a. The majority rejected petitioners’

contention that the 2015 Guardian article had already

made Cambridge Analytica’s data misuse public, noting

that Facebook had merely told the newspaper it was

“carefully investigating” the matter. Pet. App. 26a. The

majority found it irrelevant that the risk statements

had acknowledged that Facebook had previously been

the target of cyberattacks, hacking, and phishing, see

J.A. 439, since the data misuse at issue here did not involve those kinds of security breaches. See Pet. App.

27a-28a.

The court of appeals affirmed the district court’s dismissal, for lack of scienter, of respondents’ claims based

on statements that Facebook had made to journalists

about its Cambridge Analytica investigation. Pet. App.

29a-32a. And while the court affirmed the dismissal of

claims related to some of Facebook’s “statements about

users’ control over their personal data,” id. at 32a, it reversed as to other such statements, including statements related to Facebook’s practice of allowing certain

“whitelisted” third-party apps to collect users’ data

without their consent, id. at 9a, 38a; see id. at 32a-40a.

10

b. Judge Bumatay concurred in part and dissented

in part. Pet. App. 41a-53a. He agreed with the majority

that the district court had erred in dismissing certain of

respondents’ claims arising from Facebook’s assurances

that users maintained control over their own data. See

id. at 41a, 48a-51a. He would have affirmed the district

court’s dismissal of the risk-factor claims, however. See

id. at 41a-48a. Judge Bumatay would have held that,

even if Facebook knew of “potentially serious breaches”

of user-data protections when the company made the

risk-factor statements, those statements were not false

or misleading because respondents had not alleged that

“Facebook knew that those breaches would lead to immediate harm to its business or reputation.” Id. at 48a.

SUMMARY OF ARGUMENT

A. Petitioners principally contend that, when a company’s statement of “risk factors” under Item 105 of

Regulation S-K, 17 C.F.R. 229.105, describes a particular risk as hypothetical, that statement cannot be rendered false or misleading by the fact that the risk had

already materialized when the statement was made.

That proposed rule defies both common sense and the

great weight of judicial authority. In the securities context as elsewhere, a forward-looking statement of risk

can be misleading insofar as it implies that the relevant

risk has not already come to fruition. The antifraud

provisions of the securities laws prohibit half-truths,

not just flat-out lies, and there is no exception to that

principle for risk-factor statements.

B. In urging this Court to adopt their proposed categorical rule, petitioners assert (Br. 21-22, 24) that no

reasonable investor would understand a risk disclosure

to say anything about past events or present conditions.

But just as a statement of opinion can imply a proposi-

11

tion of fact, see Omnicare, Inc. v. Laborers Dist. Council Constr. Indus. Pension Fund, 575 U.S. 175, 188 (2015),

a prospective statement of risk can implicitly represent

that a specified adverse event has not already occurred.

Whether a particular risk-factor statement carries that

implication depends on the facts and context. Because

a risk statement does not always carry such an implication, petitioners are wrong to assert (Br. 32) that the

Ninth Circuit’s approach would compel issuers to disclose “every instance of the [risk-]triggering event having occurred in the past.”

C. Some courts have suggested that risk-factor

statements are misleading only if they omit “previous

occurrences of the triggering event” that the company

knows “are almost certain to cause the warned-of harm

to the company’s business.” Pet. Br. 39. Petitioners view

that “virtual certainty” rule as inappropriate but still

preferable to the court of appeals’ approach. Ibid. (citation omitted). This Court should reject the virtualcertainty rule. Among other things, that rule would

artificially raise the bar in the risk-factor context for

establishing the element of materiality, which does

not require that a misrepresentation involve near-certain

harm to the issuer’s business.

D. Respondents have adequately pleaded that the

risk-factor disclosures in petitioners’ SEC filings were

false or misleading. The relevant statements characterized the misuse of user data as a future risk that could

hypothetically harm Facebook’s business, even though

the company had recently suffered a major episode of

such misuse. Petitioners’ contrary arguments reflect a

misunderstanding of the Ninth Circuit’s opinion and an

insufficient appreciation of the likelihood that the investing public was misled.

12

ARGUMENT

RESPONDENTS HAVE ADEQUATELY PLEADED THAT

FACEBOOK’S RISK-FACTOR STATEMENTS WERE FALSE

OR MISLEADING

This Court granted the petition for a writ of certiorari limited to the question whether “risk disclosures

[are] false or misleading when they do not disclose that a

risk has materialized in the past, even if that past event

presents no known risk of ongoing or future business

harm.” Pet. i. As respondents explain, the nondisclosure of an event that has no “ongoing or future” implications for the business does not render a risk statement materially misleading, and the Ninth Circuit did

not hold that Rule 10b-5(b) liability can be premised on

such an omission. Resp. Br. 1, 12-13 (citation omitted).

The court instead held that respondents have plausibly

alleged that false or misleading statements appeared in

Facebook’s Item 105 disclosures, insofar as Facebook’s

risk-factor statements depicted the risk of user-data

misuse as hypothetical when a plainly important episode of such misuse had recently occurred.

In challenging the court of appeals’ actual holding,

petitioners make broader arguments that extend beyond their question presented. Petitioners contend (Br.

21, 41) that, as a categorical matter, risk-factor disclosures “do not make any implied assertion about previous events and the present risk of harm they created,”

or at least can be deemed false or misleading only if the

undisclosed past event “was virtually certain to cause

business harm” when the risk-factor statement was

made. Both of those contentions are inconsistent with

basic principles of securities law and therefore should

be rejected.

13

A. Risk-Factor Disclosures Can Falsely Imply That The

Warned-Of Risks Have Not Already Materialized

1. An incomplete risk-factor statement is a quintessential half-truth

Consistent with the common law of fraud, the antifraud provisions of the securities laws prohibit not just

outright lies but also half-truths—“representations that

state the truth only so far as it goes, while omitting critical qualifying information.” Macquarie Infrastructure

Corp. v. Moab Partners, L.P., 601 U.S. 257, 263 (2024)

(quoting Universal Health Servs., Inc. v. United States

ex rel. Escobar, 579 U.S. 176, 188 (2016)). (For instance,

a child would tell a half-truth if he told his parents that

he “had dessert” after eating an entire cake. Id. at 264.)

The standard used to determine whether a particular

statement is misleading is an objective one that “depends on the perspective of a reasonable investor” and

is informed by the common law. Omnicare, Inc. v. Laborers Dist. Council Constr. Indus. Pension Fund, 575

U.S. 175, 186-187 (2015); see id. at 191 & n.9.

Petitioners primarily contend (Pet. 19-25) that no

reasonable investor would interpret a typical risk disclosure under Item 105 of Regulation S-K as implying

that the warned-of risk has not already materialized.

That argument is inconsistent with both law and common sense. In law as in life, “[a] statement about the

future may imply a representation concerning an existing or past fact.” Restatement (Second) of Torts § 525

cmt. e (1977); accord 3 Dan B. Dobbs et al., The Law of

Torts § 678, at 692 (2d ed. 2011); see Restatement (Second) of Contracts § 159 cmt. c (1981) (“[A] promise or a

prediction of future events may by implication involve

an assertion that facts exist from which the promised or

predicted consequences will follow, which may be a mis-

14

representation as to those facts.”). Thus, if a realtor

tells the prospective buyer of a house that “a rise in

crime could reduce the value of the property,” and a

wave of burglaries has recently hit the neighborhood, a

reasonable person would deem the realtor’s statement

to be misleading. Similarly, the statement “I could lose

my job if I’m ever arrested” would be misleading if the

speaker had actually been arrested the previous week.

“To warn that the untoward may occur when the event

is contingent is prudent; to caution that it is only possible for the unfavorable events to happen when they

have already occurred is deceit.” Rubinstein v. Collins,

20 F.3d 160, 171 (5th Cir. 1994) (citation omitted).

This does not mean that a statement about the potential consequences of hypothetical future events is always misleading if it does not reference a past instance

when such an event occurred. The statement “Next

month’s outdoor concert will be canceled if it rains on

the scheduled day” would not be rendered misleading

by the speaker’s failure to disclose that it had rained the

previous day. Statements about the potential effects of

future rainfall cannot reasonably be understood to imply the non-occurrence of past rain, and the previous

day’s rainfall would have no bearing on the likelihood

that a concert scheduled for the following month would

ultimately be canceled.

In the securities context, whether a given statement

about the likely consequences of potential future events

is a material misrepresentation depends on whether a

reasonable investor (a) would construe the statement as

an implicit representation that such events have not already occurred, and (b) would view the undisclosed occurrence as significant to an appraisal of the company’s

business prospects. Those are “inherently fact-specific,”

15

context-dependent inquiries. Basic Inc. v. Levinson, 485

U.S. 224, 236 (1988). In at least some circumstances,

however, it is plainly misleading to characterize an adverse event that has already materialized as a merely

hypothetical future risk.

2. The case law supports respondents’ theory of falsity

Courts have repeatedly applied the principle described above in adjudicating claims of securities fraud.

Siracusano v. Matrixx Initiatives, Inc., 585 F.3d 1167

(9th Cir. 2009), aff ’d, 563 U.S. 27 (2011), for example,

involved a pharmaceutical company’s nondisclosure of

adverse information regarding one of its products. See

id. at 1172. In the risk-factors section of its Form 10-Q,

the company warned that product-liability claims could

negatively affect the company’s “ ‘product branding and

goodwill,’ ” but the filing did not reveal that the company

had already been sued about the product and additional

litigation was likely. Ibid. Citing the same circuit precedent it invoked here, the Ninth Circuit concluded that

the company’s statement was misleading because it

spoke of “the risks of product liability claims in the abstract, with no indication that the risk ‘may already

have come to fruition.’ ” Id. at 1181 (quoting Berson v.

Applied Signal Tech., Inc., 527 F.3d 982, 986 (9th Cir.

2008)); see Pet. App. 25a. This Court then granted certiorari to consider whether the nondisclosure of adverse

drug events could be materially misleading if “a statistically significant number of adverse events” had not occurred. Matrixx Initiatives, Inc. v. Siracusano, 563

U.S. 27, 30 (2011). The Court “conclude[d] that the materiality of adverse event reports cannot be reduced to

a bright-line rule,” ibid., and it affirmed the Ninth Circuit’s judgment, id. at 31.

16

In In re Westinghouse Securities Litigation, 90 F.3d

696 (3d Cir. 1996) (Alito, J.), shareholders alleged that

a registration statement was misleading because it

warned that the adequacy of the issuer’s loss reserves

depended on economic conditions, when the issuer already “knew that the reserves were and would remain

inadequate, even without any future or prolonged economic downturn.” Id. at 709. The court of appeals reversed the dismissal of the plaintiffs’ claim, observing

that “a reasonable investor would be very interested in

knowing, not merely that future economic developments might cause further losses, but that * * * current reserves were known to be insufficient under current economic conditions.” Ibid.; see id. at 710 (citing

Rubinstein, supra).

The Ninth Circuit more recently applied the same logic

in In re Alphabet, Inc. Securities Litigation, 1 F.4th 687

(2021), cert. denied, 142 S. Ct. 1227 (2022). There, a

Form 10-K filed by Alphabet, Inc., Google’s parent company, warned investors that “[c]oncerns about our practices with regard to the collection, use, disclosure, or security of personal information or other privacy related

matters, even if unfounded, could damage our reputation and adversely affect our operating results.” Id. at

694 (brackets in original). An internal review later “discovered that a security glitch in [the] Google+ social

network had left the private data of some hundreds of

thousands of users * * * exposed to third-party developers,” but Alphabet did not change the risk-factor

statements in its subsequent filings. Id. at 693, 696.

The district court dismissed the plaintiffs’ claims related to those filings, see id. at 698, 702, but the Ninth

Circuit reversed, see id. at 707. The court of appeals

held that “the complaint plausibly alleges that Alpha-

17

bet’s warning in each [filing] of risks that ‘could’ or

‘may’ occur is misleading to a reasonable investor when

Alphabet knew that those risks had materialized.” Id.

at 704; see id. at 703 (citing Berson and Siracusano).

Other courts of appeals have likewise recognized

that forward-looking risk statements can violate the securities laws by creating misleading impressions about

the past or present. See, e.g., Karth v. Keryx Biopharmaceuticals, Inc., 6 F.4th 123, 138 (1st Cir. 2021) (“A

company must * * * disclose a relevant risk if that risk

had already begun to materialize.”); Williams v. Globus

Med., Inc., 869 F.3d 235, 241 (3d Cir. 2017) (“[C]ourts

are skeptical of companies treating as hypothetical in

their disclosures risks that have already materialized.”);

Rombach v. Chang, 355 F.3d 164, 173 (2d Cir. 2004)

(“Cautionary words about future risk cannot insulate

from liability the failure to disclose that the risk has

transpired.”); cf. Dolphin & Bradbury, Inc. v. SEC, 512

F.3d 634, 640 (D.C. Cir. 2008) (explaining that there is

a “critical distinction between disclosing the risk a future event might occur and disclosing actual knowledge

the event will occur”).

Courts have regularly applied similar reasoning outside the securities context as well. See, e.g., Field v.

Mans, 157 F.3d 35, 38, 43 (1st Cir. 1998) (defendant’s

request for permission to sell property falsely implied

that the property had not already been sold); Cora Pub,

Inc. v. Continental Cas. Co., 619 F.2d 482, 487 (5th Cir.

1980) (citing fraud cases where purchasers of insurance

had concealed the fact that the risk to be insured

against “had already occurred, or that forces reasonably certain to cause the risk to occur were underway”).

There is consequently a strong judicial consensus supporting the court of appeals’ reasoning here.

18

3. Administrative practice supports respondents’ theory of falsity

The SEC too has consistently taken the view that

disclosable risk factors can include past and present

business conditions and events, and that nondisclosure

of such information can render risk statements misleading. The Commission’s 1964 guidance discussed above,

see p. 2, supra, listed among potential risk factors that

should be disclosed “an absence of operating history of

the registrant” and “an absence of profitable operations

in recent periods.” 29 Fed. Reg. at 2492. As respondents note (Br. 29 & n.8), the original version of Item 105

took the same approach. More recently, the SEC issued

guidance advising issuers who disclose cybersecurity

risk factors under Item 105 “to disclose previous or ongoing cybersecurity incidents or other past events in order to place discussions of these risks in the appropriate

context,” 83 Fed. Reg. 8166, 8169-8170 (Feb. 26, 2018)—

even before the Commission made this a freestanding

disclosure requirement in the new Item 106, 17 C.F.R.

229.106; see 88 Fed. Reg. 51,896, 51,921 (Aug. 4, 2023)

(noting that the 2018 guidance “remains in place”).

The Commission has likewise consistently enforced

the securities laws on the understanding that risk statements can be false or misleading in the manner respondents allege here. Indeed, the Commission brought and

settled an enforcement action against Facebook that relied on the same theory of falsity that respondents assert.

See pp. 7-8, supra. It has brought similar enforcement

proceedings in numerous other cases spanning decades.

See, e.g., D. Ct. Doc. 1, at 2, 11, SEC v. Mylan N.V., No.

19-cv-2904 (D.D.C. Sept. 27, 2019); SEC v. True N. Fin.

Corp., 909 F. Supp. 2d 1073, 1102 (D. Minn. 2012) (citing, e.g., SEC v. Tecumseh Holdings Corp., 765 F. Supp.

19

2d 340, 352-356 (S.D.N.Y. 2011); SEC v. Fundpack, Inc.,

No. 79-859, 1979 WL 1238, at *4 (D.D.C. Aug. 16, 1979).

4. Petitioners’ principal authority is an outlier decision that lacks persuasive force

Petitioners rely (Br. 22; Pet. 18-19) on the Sixth Circuit’s unpublished decision in Bondali v. Yum! Brands,

Inc., 620 Fed. Appx. 483 (2015). The issuer there, which

owned two fast-food chains, made risk-factor statements warning that potential “food safety issues” could

adversely affect the company’s profitability, at a time

when the issuer allegedly knew that eight batches of its

chicken located in China already “had tested positive

for drug and antibiotic residues.” Id. at 484-487. In rejecting the plaintiffs’ claim, the court of appeals characterized risk-factor disclosures as “inherently prospective in nature,” such that “a reasonable investor would

be unlikely to infer” from such disclosures “anything regarding the current state of a corporation’s compliance,

safety, or other operations.” Id. at 491.

The court of appeals in Bondali provided no reasoning to support its view that a reasonable investor would

be unlikely to draw such an inference. And immediately

after making the observations just quoted, the Sixth

Circuit noted that “there may be circumstances under

which a risk disclosure might support Section 10(b) liability.” 620 Fed. Appx. at 491. The court concluded that,

“[i]n any event,” the plaintiffs had “not alleged facts

showing any investment risk had already materialized”

by the time the risk disclosures were made, and it suggested that the eight positive test results were too minor in relation to the issuer’s overall business to render

the risk-factor statements misleading. Ibid. Thus, while

Bondali contains language supporting petitioners’ narrow view of risk-factor disclosures as exclusively “pro-

20

spective in nature,” ibid. (emphasis omitted); see Pet.

Br. 4, 15, 17, 27, even the Sixth Circuit did not unequivocally embrace that proposition.

B. Petitioners’ Proposed Categorical Rule Limiting RiskFactor Fraud Claims Is Unsound

Petitioners urge this Court (see Br. 24-25) to reject

the consensus view described above and to adopt a rule

that risk disclosures can be false or misleading under

Rule 10b-5(b) only if they contain embedded false statements of fact or opinion or misstate the degree or nature of future risk. Petitioners are correct that riskfactor statements can be false or misleading in those

circumstances. But petitioners offer no sound basis for

concluding that these are the only ways in which riskfactor statements can mislead investors.

1. Petitioners’ approach would artificially limit liability for misleading risk statements

Petitioners’ proposed bright-line rule would arbitrarily narrow the coverage of Rule 10b-5(b) in risk-factor

cases. Petitioners emphasize (Br. 21-22) that risk statements are “inherently forward-looking and probabilistic” and are directed toward “the possibility of future

harm.” But that is precisely what can make such a

statement misleading. When warned-of risks have already materialized, statements portraying those risks

as merely potential problems can mislead the investing

public.

Petitioners contend that a reasonable investor would

understand a risk-factor statement to convey information only about the future and never about the past.

See, e.g., Br. 40 (“[T]he reasonable investor would understand the company’s statement to mean what it says:

that, if the triggering event were to occur in the future,

21

business harm could result.”); Pet. App. 44a (Bumatay,

J., concurring in part and dissenting in part) (similar).

That contention resembles one this Court rejected in

Omnicare, supra. That case concerned the circumstances

in which statements of opinion can be misleading under

Section 11(a) of the Securities Act, which, like Rule 10b5, prohibits statements that “contain[] an untrue statement of a material fact or omit[] to state a material fact

* * * necessary to make the statements therein not misleading.” 15 U.S.C. 77k(a); see Omnicare, 575 U.S. at

178; 17 C.F.R. 240.10b-5(b).1

The issuer, Omnicare, argued that, because statements

of opinion “convey [no]thing more than the speaker’s own

mindset,” they can be false or misleading only if the

stated opinions are not “sincerely held.” Omnicare, 575

U.S. at 187. The Court disagreed, finding that Omnicare’s approach went “too far, because a reasonable

investor may, depending on the circumstances, understand an opinion statement to convey facts about how

the speaker has formed the opinion.” Id. at 188; see id.

at 198-203 (Scalia, J., concurring in part and concurring

in the judgment) (recognizing that statements of opinion sometimes can imply certain facts about the manner

in which the opinion was formed).

Petitioners’ narrow view of risk-factor statements,

as looking exclusively to the future and never implying

anything about the past or present, see Br. 21-24, is similar to Omnicare’s literalistic view that statements of

opinion describe the speaker’s mindset and nothing

Section 11(a) includes additional language, covering pure omissions of information “required to be stated” in a registration statement, 15 U.S.C. 77k(a), that distinguishes it from Rule 10b-5. See

Macquarie, 601 U.S. at 264-265. But Omnicare did not involve that

clause of Section 11(a). See 575 U.S. at 186 n.3.

1

22

else, see Omnicare, 575 U.S. at 187. In rejecting Omnicare’s proposed limitation on Section 11 liability, the

Court acknowledged that Congress’s decision to include

misleading omissions within the range of conduct that

Section 11 proscribes made that provision “less cut-anddry than a law prohibiting only false factual statements.” Id. at 193. The Court explained, however, that

“Section 11’s omissions clause * * * necessarily brings

the reasonable person into the analysis, and asks what

she would naturally understand a statement to convey

beyond its literal meaning.” Id. at 193-194. Similarly

here, the need for a nuanced, context-specific inquiry

into the inferences that reasonable investors would

draw from a particular risk-factor warning is simply the

logical consequence of Rule 10b-5(b)’s ban on misleading omissions. Like the rule that Omnicare advocated,

petitioners’ proposed rule would “punch a hole” in the

antifraud provisions “for half-truths in the form of ”

risk-factor disclosures. Id. at 193.

This Court’s securities-law decisions have consistently

rejected similar efforts to impose categorical limitations

that are untethered to the expectations of ordinary investors. In Matrixx, for instance, the Court eschewed the

issuer’s proposed “bright-line rule that reports of adverse

events associated with a pharmaceutical company’s products cannot be material absent a sufficient number of

such reports to establish” a statistically significant link

between the product and the adverse events. 563 U.S.

at 39 (footnote omitted); see id. at 39-43. The Court in

Basic likewise rejected the contention that the existence

of merger negotiations will be material to a reasonable

investor only after the negotiators have reached an

agreement in principle. See 485 U.S. at 232-236. The

Court explained that “[a] bright-line rule indeed is eas-

23

ier to follow than a standard that requires the exercise

of judgment in the light of all the circumstances. But

ease of application alone is not an excuse for ignoring

the purposes of the Securities Acts and Congress’ policy

decisions.” Id. at 236. The categorical rule that petitioners propose has no more to recommend it.

2. Petitioners’ reliance on statutory and regulatory

context is misplaced

As explained above, statements of future risk are

characteristically premised upon, and can imply representations about, present or past events. Nothing in the

relevant text of Regulation S-K suggests an intent to

depart from that understanding. Item 105 directs filers

not simply to make predictions about the future, but to

provide “a discussion of the material factors that make

an investment in the registrant or offering speculative

or risky.” 17 C.F.R. 229.105(a) (emphasis added). A

past event like Cambridge Analytica’s misuse of Facebook user data, whose ultimate effects on the company’s

reputation and consequent business success were unknown but potentially substantial when Facebook filed

its Form 10-K, is naturally characterized as such a “material factor[].” See Resp. Br. 27-28 (citation omitted).

Petitioners suggest that other provisions of Regulation S-K, by “requir[ing] companies to provide investors

with specific information about what has happened to

the company in the past and what is happening to the

company in the present,” imply that the SEC did not

“want[] to require” such disclosures under Item 105.

Pet. Br. 23 (citing 17 C.F.R. 229.101(a)(1), 229.103(a),

229.106, 229.303(b)(2)(ii)). That inference conflicts with

long-standing SEC guidance and enforcement practice,

which recognize that disclosing past and present matters in risk-factor statements can be appropriate and

24

sometimes necessary to avoid misleading investors. See

pp. 18-19, supra. Consistent with the text of Rule 10b5(b), moreover, the Commission has made clear that,

even if particular information is not “expressly required

to be included in a statement or report,” it must be included “as may be necessary to make the required statements, in the light of the circumstances under which they

are made[,] not misleading.” 17 C.F.R. 240.12b-20; see

17 C.F.R. 240.10b-5(b). There would be nothing anomalous about disclosing past events in the risk-factors

section of an SEC filing. Indeed, other aspects of Facebook’s risk-factor disclosures in the Form 10-K at issue

here did just that. E.g., J.A. 439 (noting that cyberattacks “have occurred on our systems in the past”).

Nor is it decisive (contra Pet. Br. 31) that Rule 10b5(b) does not prohibit “pure omissions.” See Macquarie,

601 U.S. at 264. Respondents’ risk-factor claims allege

that affirmative statements in petitioners’ Form 10-K

were rendered misleading by the omission of important

information. See J.A. 192-194. And the Court in Macquarie reaffirmed that Rule 10b-5(b) applies to “misleading half-truths.” 601 U.S. at 266.

Petitioners also suggest (Br. 38) that the court of appeals’ decision conflicts with the safe harbor for forwardlooking statements in the Private Securities Litigation

Reform Act of 1995 (PSLRA), Pub. L. No. 104-67, 109

Stat. 737, see 15 U.S.C. 78u-5, and the closely related

common-law “bespeaks caution” doctrine. Petitioners

have not directly invoked either of those rules, however,

and neither supports their argument here.

Congress enacted the PSLRA’s safe harbor to insulate from suit issuers who “offer forward-looking projections” that do not accurately predict future events, so

long as those projections are “accompanied by meaning-

25

ful cautionary statements.” 15 U.S.C. 78u-5(c)(1)(A)(i);

see Pet. Br. 38. But neither the statutory safe harbor

nor the bespeaks-caution doctrine immunizes forwardlooking statements that leave a false impression as to

past or present conditions. “A warning that identifies a

potential risk, but ‘implies that no such problems were

on the horizon even if a precipice was in sight,’ would

not meet the statutory standard for safe harbor protection.” In re Harman Int’l Indus., Inc. Sec. Litig., 791

F.3d 90, 102 (D.C. Cir. 2015) (quoting Asher v. Baxter

Int’l Inc., 377 F.3d 727, 733 (7th Cir. 2004), cert. denied,

544 U.S. 920 (2005)) (brackets omitted), cert. denied,

577 U.S. 1139 (2016). By the same token, “[t]he ‘bespeaks caution’ doctrine is a protection against violations based on events that occur later. It does not protect against failure to disclose facts existing at the time

the document is written.” 1 Alan R. Bromberg & Lewis

D. Lowenfels, Bromberg and Lowenfels on Securities

Fraud § 5:281(7), at 1170 (2d ed., 2024-1 ed. issued in

June).

3. The court of appeals’ decision does not create an undue risk of overdisclosure or abusive litigation

Petitioners contend that the Ninth Circuit’s approach would require issuers to include in risk-factor

statements “every instance of the triggering event having occurred in the past,” resulting in “bloated risk disclosures,” “ ‘abusive’ ” securities-fraud litigation, and

“staggering” economic consequences. Br. 32, 35, 37 (citation omitted). The issuer in Omnicare raised similar

policy concerns. See Omnicare, 575 U.S. at 193 (noting

Omnicare’s stated concern about “ ‘adverse policy consequences,’ ” including “ ‘unpredictable’ and possibly

‘massive’ liability”) (citations omitted). As in that case,

petitioners’ policy arguments are both more appropri-

26

ately directed to Congress and “overstate[d]” in any

event. Id. at 194; see id. at 193; see also Matrixx, 563

U.S. at 43 (explaining that the Court’s rejection of the

defendant’s proposed bright-line rule “does not mean

that pharmaceutical manufacturers must disclose all reports of adverse events”).

Respondents’ legal theory does not imply that every

risk-factor statement must disclose every prior instance

where the relevant risk has materialized. See Pet. App.

46a-47a (Bumatay, J., concurring in part and dissenting

in part) (observing that a company need not “disclose

every bad thing that ever happened to it”). As noted

above, a plaintiff suing under Rule 10b-5 must show,

among several other elements, “a material misrepresentation or omission by the defendant.” Matrixx, 563

U.S. at 37 (citation omitted). A risk statement that

omits a past instance in which the risk came to fruition

is not always misleading or materially misleading. See

p. 14, supra; cf. Bondali, 620 Fed. Appx. at 491 (concluding that failure to mention a prior occurrence is not

misleading where the past instance is trivial or remote

in time). The determination whether reasonable investors would read a particular risk statement to imply the

non-occurrence of particular past events depends on

context, as is often the case in this area of the law. See

Omnicare, 575 U.S. at 194; Matrixx, 563 U.S. at 44.

Petitioners acknowledge (Br. 35, 37) that their fears

of overdisclosure and “staggering” liability for issuers

have not yet come to pass, even though courts have long

allowed claims like respondents’ to proceed, see pp. 1517, supra. As petitioners note, the SEC has stressed

the importance of brevity in issuers’ disclosures generally and in risk-factor statements in particular. Pet. Br.

32-35 (citing, e.g., 17 C.F.R. 229.105(a) and (b); 85 Fed.

27

Reg. 63,726, 63,744-63,745 (Oct. 8, 2020)). Yet the Commission has also long recognized that risk-factor statements can be misleading in the manner respondents allege. See pp. 18-19, supra.

C. A Risk-Factor Warning That Does Not Reveal Prior Instances Where The Risk Materialized Can Be Misleading Even If Consequent Harm To The Issuer’s Business

Is Not Certain Or Nearly Certain To Occur

Some courts have held or suggested that risk-factor

statements can be unlawfully misleading only if they fail

to reference “previous occurrences of the triggering

event” that the company knows “are almost certain to

cause the warned-of harm to the company’s business.”

Pet. Br. 39 (emphasis added); see id. at 39-41. Petitioners view that “ ‘virtual certainty’ standard” as “flawed”

but still preferable to the approach taken by the court

of appeals. Id. at 39. This Court should not adopt the

“virtual certainty” approach.

Adoption of the “virtual certainty” test would scramble the elements of a securities-fraud claim. A typical

risk-factor statement under Item 105 warns of two

risks: first, that “some triggering event” may occur, and

second, that the event may cause “some consequence—

usually harm to the business.” Pet. Br. 2. Here, for example, petitioners’ Form 10-K identified both a potential triggering event (“improper access to or disclosure

of our data or user data”) and a potential harmful consequence of such an event (“could harm our reputation

and adversely affect our business”). J.A. 439 (emphasis

omitted). Such a statement can mislead when the triggering event has already materialized, even if the followon business harm has not yet come to pass. Thus, in the

hypothetical involving a realtor described above, see

p. 14, supra, the realtor’s statement about a potential

28

spike in crime would be misleading even if only the

crime wave, and not any resulting drop in property values, had already begun to happen. And in Matrixx, the

statement that product-liability claims could “affect

Matrixx’s ‘product branding and goodwill,’ leading to

reduced customer acceptance,” was misleading even

though only the adverse health events and the lawsuits,

and not necessarily the “reduced customer acceptance,”

had begun to materialize when the statement was made.

563 U.S. at 34 (citation omitted); see Siracusano, 585

F.3d at 1172, 1181.

The misleading character of such statements does

not depend on whether the undisclosed triggering

event—here, Cambridge Analytica’s misuse of Facebook user data—was “almost certain” to produce business harm at the time the statements were made. The

antifraud provisions at issue address the relative importance of an issuer’s misrepresentation or omission

principally by requiring it to be “material.” Matrixx,

563 U.S. at 37 (citation omitted). This Court has long

held that, “to fulfill the materiality requirement,” “ ‘there

must be a substantial likelihood that the disclosure of

the omitted fact would have been viewed by the reasonable investor as having significantly altered the “total

mix” of information made available.’ ” Basic, 485 U.S.

at 231-232 (citation omitted). There is no sound reason

to think that a reasonable investor would care about

only those potential business harms that are nearly certain to occur. See, e.g., Matrixx, 563 U.S. at 44 (reports

of adverse drug events can be material even absent “statistical significance”). If adopted in risk-factor cases, the

“virtual certainty” test would effectively replace the established materiality standard with a substantially

more demanding requirement.

29

D. Respondents Have Plausibly Alleged That Facebook’s

Risk-Factor Statements Were False Or Misleading

Respondents have adequately pleaded that the relevant risk-factor statements in Facebook’s 2016 Form

10-K and subsequent filings were false or misleading.

1. Respondents have plausibly alleged that petitioners “represented the risk of improper access to or disclosure of Facebook user data as purely hypothetical

when that exact risk had already transpired.” Pet. App.

24a. The risk-factor statements at issue are reasonably

read as describing events like Cambridge Analytica’s

improper receipt and use of Facebook users’ data as hypothetical risks rather than risks that had previously

materialized. For example, petitioners described how

“any” failure to prevent improper access to user data

“could” result in the misuse of such data, and how such

misuse could occur “if ” third parties or app developers

failed to follow data-security practices. J.A. 439-440.

Those statements could plausibly be thought to have

created the inaccurate impression that a “significant episode of improper access to or disclosure of user data by

a developer,” like Cambridge Analytica’s misuse of the

user data it had obtained, J.A. 283, had not recently occurred. See, e.g., Berson, 527 F.3d at 986 (holding that

plaintiffs had adequately pleaded securities-law violations where language in the defendant’s SEC filings

“speaks entirely of as-yet-unrealized risks and contingencies” and does not “alert[] the reader that some of

these risks may already have come to fruition”).

For the reasons set forth above, that theory of Rule

10b-5 liability is well grounded in precedent and the expectations of ordinary investors. A “reasonable investor would be very interested in knowing, not merely

that future” misuses of user data could harm petition-

30

ers’ business, “but that” a major instance of such misuse

had already materialized. Westinghouse, 90 F.3d at

709. A reasonable investor would view that information

as significant both because of the magnitude of Cambridge Analytica’s own misconduct, and because Facebook’s failure to prevent that misconduct might cause

Facebook users to view their own privacy on the platform as more vulnerable going forward. See Resp. Br.

28. Indeed, respondents’ allegations would be sufficient

even under the virtual-certainty standard described

above. See pp. 27-28, supra. Those allegations support

the inference that such an important event implicating

users’ data was bound to harm Facebook’s business,

which significantly depends on users’ confidence in the

privacy of their data. See, e.g., J.A. 8-9, 16-17, 22-27.

The Ninth Circuit rightly noted the striking parallels

between this case and Alphabet, supra. The plaintiffs

there plausibly alleged that Alphabet had misled investors by warning of data-security risks that could arise

and harm its business, at a time when Alphabet already

“knew that those risks had materialized,” 1 F.4th at 704,

primarily in the form of a major security glitch or “Privacy Bug,” id. at 695-696. Dissenting in relevant part

below, Judge Bumatay asserted that the ultimate business harm at issue in Alphabet, “greater regulatory

scrutiny,” had already “come to fruition” when the allegedly misleading statements were made. Pet. App.

47a. But the Alphabet plaintiffs alleged that the defendant’s executives had “chose[n] a strategy of nondisclosure” in order to avoid such scrutiny. 1 F.4th at 696.

As the panel majority below explained, Alphabet’s SEC

filings were misleading because the “privacy bug itself[]

had materialized” when those filings were submitted,

even though “Alphabet’s identified harm of damage to

31

its business, financial condition, results of operations,

and more had not yet materialized at the time of the filings.” Pet. App. 25a (internal quotation marks omitted).

That reasoning is equally applicable here.

2. Petitioners describe the court of appeals as holding that a risk statement is misleading even if an undisclosed past event poses no “risk of ongoing or future

business harm.” Pet. Br. I; see id. at 33. That characterization reflects a misreading of the court’s opinion.

In observing that “it is ‘the fact of the [triggering event]

itself, rather than the anticipation of reputation or financial harm,’ that renders a risk disclosure misleading,” id. at 33 (quoting Pet. App. 25a) (brackets in petitioners’ brief), the court was explaining that (contrary

to Judge Bumatay’s view) such a statement’s misleading character does not depend on whether the ultimate

business harm has already occurred when the statement

is made. See Pet. App. 24a-25a (“Because Facebook presented the prospect of a breach as purely hypothetical

when it had already occurred, such a statement could be

misleading even if the magnitude of the ensuing harm

was still unknown.”).

Because the undisclosed events here were plainly important, the court of appeals had no occasion to address

the proper treatment of risk-factor statements that fail

to disclose insignificant past events. Holding that such

omissions cannot give rise to Rule 10b-5 liability therefore would provide no ground for reversal here. Presumably that is why petitioners’ primary argument for

reversal is the broader claim that risk statements categorically imply nothing about the past and can be misleading under the securities laws only if their explicit

content is false. As discussed, that argument is mistaken. See pp. 13-27, supra.

32

3. Petitioners also contend (Br. 27-28) that the particular omissions alleged in this case could not have misled investors because Facebook’s other risk-factor

statements mentioned past occurrences of hacking and

other cyberattacks, and because the 2015 Guardian article had already reported on Cambridge Analytica’s

misuse of customer data. See Pet. Br. 27-28; see also

Pet. App. 45a (Bumatay, J., concurring in part and dissenting in part). Those arguments lack merit.

The data misuse at issue here was not a cyberattack.

Indeed, Facebook itself stated after the Cambridge Analytica news broke in March 2018 that “[t]he claim that

this is a data breach is completely false.” J.A. 631; see

Pet. App. 26a-27a. The fact that Facebook’s risk statements explicitly acknowledged past hacking and other

cyberattacks simply exacerbated the misleading nature

of describing misuse of customer data as only a future

risk, see J.A. 439.

As for the 2015 Guardian article, Facebook responded to the article by depicting the Cambridge Analytica matter as something to be investigated. See Pet.

App. 26a. Facebook’s subsequent conduct—such as its

failure to notify users that their data had been compromised, which the company later admitted was error—

tended to signal that nothing improper had happened.

See p. 5, supra. And the court of appeals’ decision was

premised on that court’s understanding that “the extent

of Cambridge Analytica’s misconduct was not yet public

when Facebook filed its 2016 Form 10-K.” Pet. App.

26a. The March 2018 media coverage of Cambridge Analytica, and the ways in which government agencies and

the public responded to that news, further suggest that

the earlier article had not fully apprised the public of

the firm’s misuse of consumer data. Respondents have

33

plausibly alleged that the reporting in 2015 did not

transmit the truth “to the public with a degree of intensity and credibility sufficient to” preclude investors from

being misled by petitioners’ subsequent risk-factor

statements. Ibid. (quoting Provenz v. Miller, 102 F.3d

1478, 1493 (9th Cir. 1996), cert. denied, 522 U.S. 808

(1997)).

CONCLUSION

The judgment of the court of appeals should be

affirmed.

Respectfully submitted.

MEGAN BARBERO

General Counsel

MICHAEL A. CONLEY

Solicitor

JEFFREY A. BERGER

Assistant General Counsel

EMILY TRUE PARISE

Senior Appellate Counsel

ALLISON BITZ

Attorney

Securities and Exchange

Commission

OCTOBER 2024

ELIZABETH B. PRELOGAR

Solicitor General

MALCOLM L. STEWART

Deputy Solicitor General

KEVIN J. BARBER

Assistant to the Solicitor

General