## Facts

- Investors brought a putative class action under Exchange Act §§ 10(b) and 20(a) and Rule 10b-5 against Alphabet, Google, and certain executives based on alleged misstatements and omissions about Google+ security vulnerabilities.
- Google allegedly discovered in March 2018 that a software flaw had exposed private Google+ user data to third-party developers for an extended period and that Google+ had additional security vulnerabilities.
- Internal personnel allegedly warned that disclosure could trigger regulatory scrutiny and other adverse consequences, and defendants allegedly chose not to publicly disclose the vulnerabilities at that time.
- Alphabet’s 2017 Form 10-K described privacy and cybersecurity as risks that could harm the company if breaches occurred.
- Alphabet’s 2018 Forms 10-Q incorporated the 2017 risk factors and stated there had been “no material changes” to those risk factors.
- Plaintiffs alleged these “no material changes” statements were misleading because the cybersecurity and privacy risk had already materialized and was known to senior management.
- After public reporting disclosed the Google+ vulnerabilities in connection with Google+’s shutdown, Alphabet’s stock price allegedly declined.
- The district court dismissed under Rule 12(b)(6) for failure to plead actionable misstatements/omissions and scienter under the PSLRA.

## Issues

1. Whether the complaint plausibly alleged that Alphabet’s 10-Q statements that there were “no material changes” to risk factors were materially misleading because they omitted known, realized Google+ security vulnerabilities and likely consequences.
2. Whether the complaint pled a strong inference of scienter under the PSLRA as to the maker(s) of the challenged 10-Q statements.
3. Whether other challenged statements about privacy and security were actionable misrepresentations or non-actionable generalized statements.
4. Whether a viable primary violation supported reinstatement of § 20(a) control-person claims.

## Decision

- The Ninth Circuit affirmed in part and reversed in part, vacated the judgment, and remanded.
- The court held the complaint adequately alleged that two “no material changes” statements in Alphabet’s Forms 10-Q omitted material facts necessary to make the statements not misleading.
- The court held the complaint adequately alleged scienter as to those omissions, particularly as to Lawrence Page and, by attribution, Alphabet.
- The court affirmed dismissal of other challenged statements characterized as generic, aspirational, or too vague to be materially misleading.
- Because a primary § 10(b)/Rule 10b-5 claim survived as to the 10-Q omissions, the court reinstated related § 20(a) claims tied to those disclosures.

## Legal Principles

- A securities-fraud omission is actionable when, in context, omitted facts are necessary to make an affirmative statement not misleading, assessed by whether disclosure would significantly alter the “total mix” of information for a reasonable investor.
- Risk disclosures can be misleading when they describe harms as potential (“could” occur) while the complaint plausibly alleges the risk has already materialized and management knows it.
- Under the PSLRA, scienter must be pled with particularized facts supporting a strong inference that the statement’s maker acted with intent to deceive or deliberate recklessness.
- Generalized, aspirational statements about a company’s commitment to privacy or security, or other vague assurances, are typically not actionable absent concrete, objectively verifiable contradiction.
- A § 20(a) control-person claim generally requires a viable underlying Exchange Act violation and plausible allegations of control over the primary violator.

## Conclusion

The Ninth Circuit allowed claims to proceed based on Alphabet’s 10-Q statements reporting “no material changes” to risk factors where plaintiffs plausibly alleged known Google+ vulnerabilities made those statements misleading and pled scienter with particularity, while leaving in place dismissal of generalized privacy and security statements.


In re Alphabet, Inc. Sec. Litig., 1 F.4th 687 (9th Cir. 2021)