On November 6, 2024, the Supreme Court will hear argument in Facebook, Inc. v. Amalgamated Bank, a securities class action that will ask the nation’s high court to consider whether public companies’ mandated risk factor disclosures can be materially false or misleading—and thus potentially violate the federal securities laws—when they present the risk as a hypothetical future risk while failing to mention that the risk has already materialized.  An amicus brief filed by a group of institutional investors that collectively manage over $5 trillion of equity investments described what is at stake in the Facebook case in “real world” terms:

Suppose you’re about to rent a car to go on a road trip.  You ask the person working behind the rental car counter what risks he thinks you might face on the trip.  (An unlikely conversation, perhaps, but bear with us).  Suppose he says, “well, if the tire gets punctured, you could get stranded for a few days.”  You would understand him to be conveying that you could puncture a tire and this could delay you.  The possibility of puncturing a tire is a risk, but not one that would stop you from renting the car.  But what the rental car agent doesn’t tell you is that he knows the tire has been punctured and that the company has been unable to effectively patch it. Well, that’s a different prospect altogether.  Instead of two potentials adding up to a certain level of overall risk (maybe there’s a puncture, and maybe it strands you), the puncture has happened, it was not fixed, and the only real question is how bad the fallout is going to be.  The actual risk of a puncture is far from the hypothetical risk the rental car agent disclosed—because it already happened—resulting in a far greater likelihood of being stranded.  And knowing the actual facts would have changed your decision to rent that car.¹

The key takeaway from this limited example is that risk disclosures can be misleading if they fail to disclose risks that have already materialized but the extent of the resulting harm has not.  Put differently, investors (and the United States government) have a vital interest in safeguarding investments when companies that disclose risk factors opt to mislead investors about the most significant threats a company faces—risks framed only as hypothetical possibilities when, in reality, they have already happened, but the harm from them has not yet been realized or disclosed.

Factual and Procedural Background

In December 2015, British newspaper The Guardian reported that a data analytics company called Cambridge Analytica was using a database created from “unwitting” Facebook users’ data to assist in Senator Ted Cruz’s presidential primary campaign.²  The Cruz campaign and Cambridge Analytica denied misusing or misappropriating data.  Facebook did not confirm any misappropriation or misuse in the article, stating only that the company was “carefully investigating” the situation and that it would take “swift action” if there was any such misuse.³  Unknown to the public, Facebook representatives internally confirmed users’ data had been improperly collected in violation of Facebook’s policies, and demanded that Cambridge Analytica delete the information immediately.⁴  As alleged, Cambridge Analytica did not delete the data, telling Facebook it had but pointedly refusing to confirm in writing to Facebook that the data had been destroyed.⁵  Despite its internal findings and uncertain communications with Cambridge Analytica, Facebook represented to the investing public that its ongoing investigation showed “no misconduct had been discovered.”⁶   At the same time it made these representations, Facebook warned investors in its SEC Form 10-K that “[a]ny failure to prevent or mitigate . . . improper access to or disclosure of our data or user data . . . could result in the loss or misuse of such data, which could harm our business and reputation and diminish our competitive position.”⁷  In other words, Facebook told the investing public that third-party misuse of Facebook users’ personal data was a purely hypothetical risk that could harm the company if it materialized.⁸

In March 2018, the truth about Cambridge Analytica’s misappropriation and misuse of Facebook users’ data was exposed when Facebook published a preemptive article on its investor relations website admitting that it had known of the misappropriation of user data since 2015.  Within one week, Facebook’s stock price plummeted, causing a more than $100 billion loss in market capitalization.⁹  

Shortly after this disclosure, government officials in the United States and Europe called for investigations and Facebook shareholders (Plaintiffs) brought suit against Facebook and certain of its executives (Defendants).¹⁰  Plaintiffs primarily alleged violations of Section 10(b) of the Exchange Act and U.S. Securities and Exchange Commission (SEC) Rule 10b-5, promulgated thereunder, against Facebook and its executives for false and misleading statements about the risk of data misuse.  Among the alleged false and misleading statements in both the private and public enforcement actions were the risk factor disclosures—required disclosures contained in the Item 105 section of a 10-K report—concerning the risks of third-party misuse of personal user data.  While Facebook characterized the possibility of data misuse as a hypothetical risk that could harm the company’s reputation and stock price, the Company knew that users’ data had in fact already been misused by a third party.¹¹

By July 2019, Facebook had settled with the Federal Trade Commission (FTC) and SEC and agreed to pay more than $5 billion in civil penalties for misleading users and investors about the privacy and security of its platform.¹²

Plaintiffs' Allegations of Securities Fraud Initially Dismissed by the District Court

The district court dismissed Plaintiffs’ claims, concluding in relevant part that Facebook’s risk factor disclosure warning investors about the negative impact that could result from “improper use of disclosure of user data” was not misleading because, by the time Facebook revealed these risks, Cambridge Analytica’s improper harvesting of user data was public knowledge.¹³  This holding centered around Defendants’ fact-based argument that the article in The Guardian had already alerted readers that Cambridge Analytica collected data from Facebook users.

The Ninth Circuit Reverses, Finding Facebook’s Risk Statements Were Actionable

In October 2024, the U.S. Court of Appeals for the Ninth Circuit reversed the district court’s holdings and found, inter alia, that (1) the extent of Cambridge Analytica’s misconduct was not yet public when Facebook first filed its Form 10-K; and (2) Facebook’s risk factor statements were indeed misleading since the company “represented the risk of improper access to or disclosure of Facebook user data as purely hypothetical when that exact risk had already transpired.”¹⁴ 

As the Ninth Circuit aptly explained, “[o]ur case law does not require harm to have materialized for a statement to be materially misleading.”¹⁵  Instead, “[b]ecause Facebook presented the prospect of a breach as purely hypothetical when it had already occurred, such a statement could be misleading even if the magnitude of the ensuing harm was still unknown.”¹⁶  In other words, the Ninth Circuit held that it was “the fact of the breach itself, rather than the anticipation of reputational or financial harm” that “caused [the] anticipatory statements to be materially misleading.”¹⁷

Facebook Petitions for Certiorari

In March 2024, Defendants filed a petition for a writ of certiorari that presented the following question: “Are risk disclosures false or misleading when they do not disclose that a risk has materialized in the past, even if that past event presents no known risk of ongoing future business harm?”¹⁸  Plaintiffs opposed certiorari, arguing among other things, that the question itself posed no actual dispute because the Ninth Circuit did not hold that companies must disclose a past event that presents no risk of ongoing or future business harm and, further, because there is no circuit conflict to be resolved.¹⁹

The Supreme Court Grants Certiorari and the Parties File Merits Briefs Joined by Amici

In June 2024, the Supreme Court granted Defendants’ petition for certiorari.²⁰

In their merits brief, Defendants slightly reworded the question presented, which now reads: “[w]hether a risk disclosure in the ‘Risk Factors’ section of an SEC Form 10-K filing, as required by Item 105 of SEC Regulation S-K, is false or misleading when it does not disclose that the warned-of risk has materialized in the past, even if the past event presents no known risk of ongoing or future business harm.”

Defendants lodged several arguments in an effort to reverse the Ninth Circuit, including that “typical” risk factor disclosures are inherently forward-looking, and that “no reasonable investor” reading Facebook’s risk factor disclosures in the context in which they were made would assume that [Facebook] meant to assert that it had never experienced improper access to or disclosure of its data, or that such previous misuse could not harm the company’s business or reputation in the future.²¹  In so doing, Defendants ask the Supreme Court to broadly hold that “[n]o reasonable investor would interpret a typical risk disclosure under Item 105 as implicitly suggesting that the specified triggering event had never previously occurred and that no such previous occurrence presented a risk of harm to the company.”²²  Simply put, defendants are asking the Supreme Court to conclude that “no reasonable investor would have been misled by [Facebook’s] risk disclosures merely because they did not disclose Cambridge Analytica’s previous misuse of Facebook user data.”²³  

The Facebook plaintiffs strongly defended both the sufficiency of their well pled allegations as well as the legal sufficiency of similar types of risk factor disclosure allegations.  Plaintiffs are supported by five amicus briefs, including one filed on behalf of the United States.

Plaintiffs first argue that there is, at essence, no dispute if Defendants’ question presented is taken at face value (and not as Defendants interpret and expand it in their merits briefing), arguing that neither Plaintiffs nor the Ninth Circuit dispute that “[i]f a past event presents no risk of ongoing or future harm to the business, and, as a result, is immaterial to investors, failing to disclose that immaterial event does not make a risk disclosure misleading.”²⁴

Plaintiffs contend that Facebook itself conceded that there is judicial consensus surrounding the concept that presenting a materialized risk as a hypothetical prospect can be misleading.²⁵ Indeed, the Supreme Court recently confirmed the basic principle that, in an action alleging Section 10(b) claims, while there is no private right of action for a “pure omission” of information required by an SEC disclosure rule, issuers must tell the “whole truth” when they do speak.²⁶  Accordingly, a disclosure violates this obligation if it “states[s] the truth only so far as it goes, while omitting critical qualifying information.”²⁷  Plaintiffs argue that courts have widely recognized that a statement may be a misleading “half-truth” (if the other required elements of Section 10(b) are satisfied) when it portrays an adverse event as a hypothetical risk even though it has already transpired or is virtually certain to do so soon.²⁸  

Plaintiffs also pushed back on the argument that statements in a company’s Item 105 section of a Form 10-K are solely forward-looking and cannot be interpreted to include information about past events.  They explained that this conflicts with common sense, the common law, longstanding consensus in lower courts, the text of the regulation, and regulatory guidance.²⁹  Notably, Defendants’ interpretation of Item 105 is irreconcilable with the SEC’s interpretation and application of the rule the agency itself wrote.³⁰  Plaintiffs highlight the fact that because Facebook (like other companies) commonly discusses past events in its own risk factors, reasonable investors were unlikely to view such disclosures as purely forward looking, as defendants urge.³¹

Plaintiffs also caution of the dangers to investors should the Supreme Court adopt a categorical brightline rule regarding when a class of statements can be materially misleading.  For example, if Item 105 disclosures are deemed to be categorically forward-looking, companies could claim a nearly complete defense of safe-harbor protection for all risk factor statements even if they fall outside of the statutory definition of “forward-looking statements.”³²

Plaintiffs are joined by five groups of amici, all of whom discredit Defendants’ argument that risk factor disclosures can never be misleading when they fail to disclose prior events.

Notable among these amici is the presence of the United States, arguing on behalf of the interests of the DOJ and the SEC, the latter of which “brought a civil action against [Facebook] that presented similar legal issues and involved the same underlying events as respondents’ current suit.”³³  The U.S. argues that Facebook’s position is inconsistent with basic securities law and common sense,³⁴ including the universally accepted principles that “[t]he antifraud provisions of the securities laws prohibit half-truths, not just flat-out lies, and there is no exception to that principle for risk-factor statements.”³⁵  Indeed, a ruling in Facebook’s favor could strip the SEC and DOJ of enforcement power over risk factor disclosures, as well as the enforcement rights afforded to “[m]eritorious private securities actions [that] are an essential supplement to criminal prosecutions and civil enforcement actions brought by the Department of Justice and the SEC.”³⁶

Other amici rely in great part on their industry expertise to further protest Defendants’ position. For example, a group of distinguished Financial Economists explain that Defendants’ arguments—that risk disclosures imply nothing about a company’s past experiences—“do not make economic sense”³⁷ because reasonable market participants interpret risks to be referencing uncertain harms, not harms that have already happened.³⁸  Additionally, a group of Securities Law Scholars characterize  Defendants’ proposal for a brightline rule—that would designate risk disclosures as inherently forward-looking and thus never misleading³⁹ —as one that has already been rejected by the Supreme Court because whether something is materially misleading is an inherently fact-intensive inquiry.⁴⁰  Further, a collection of Technology Industry Policy Advocates and Investors chime in with more critiques, arguing Defendants’ policy argument suggesting adoption of Plaintiffs’ position will lead to “overdisclosure” in public filings is particularly unconvincing where (1) the SEC has long advocated for honest disclosures of already-transpired events and (2) Defendants offered no proof that this well-established rule, adopted by many circuits, has ever resulted in the claimed overdisclosures.⁴¹

Finally, in a brief filed by Institutional Investors and authored with the support of four Labaton Keller Sucharow attorneys,⁴² amici point to the legislative history of the securities laws,⁴³ Supreme Court precedent,⁴⁴ and academic research⁴⁵ to highlight the importance of honest and complete risk factor disclosures, which reduce uncertainty about how risky an investment is, minimize the likelihood of stock price crashes, and produce a stable market for everyone.⁴⁶  The Institutional Investors argue “Facebook is fighting a strawman”⁴⁷ in claiming that risk factor disclosures are limited only to referencing future risks.  They expose the complication in Defendants’ position in plain terms: “You can’t say ‘if X happens, Y harm might occur’ when the truth is that ‘because X already happened, Y harm might occur.’”⁴⁸  After all, explain the Institutional Investors, “that is why life insurance companies ask about smoking history, not whether you plan to start smoking.”⁴⁹

Looking Ahead

The parties, joined by the United States who will argue in favor of Plaintiffs, are scheduled to appear for oral argument on Wednesday, November 6, 2024.  If the Supreme Court adopts Defendants’ position as it is articulated in their briefing, companies that deceive the investing public could insulate themselves from liability by characterizing their misleading statements as inherently forward-looking risk disclosures.  Such a holding could have sweeping ramifications for securities fraud actions and threaten the health of our well-functioning capital markets.  

‍