U.S. Supreme Court Changes Its Mind, Will Not Decide Facebook Dispute Concerning Public Companies’ Risk-Factor Disclosures

After hearing argument earlier this month in a widely followed securities law case concerning risk-factor disclosures of public companies, the U.S. Supreme Court last week decided it should not have agreed to hear the case after all. 

As a result, it leaves standing a Ninth Circuit decision allowing plaintiffs to proceed with a complaint based on a company’s risk disclosure that was alleged to be misleading because the future risk it warned of had occurred in the past.

The Court on November 22 issued an order in Facebook, Inc. v. Amalgamated Bank, No. 23-980, stating that the "writ of certiorari is dismissed as improvidently granted.” That’s the language the Court uses when it accepts a case for consideration and then changes its mind about deciding the case. 

That order was surprising.  After argument on November 6, most commentators reporting on the case concluded from the justices’ questions that a majority seemed ready to reverse the Ninth Circuit decision allowing the case to proceed. 

At issue was whether a company’s disclosures of potential future risks can be treated as false or misleading, when they do not reveal that a warned-of risk has materialized in the past, even if that past event presents no known risk to the company’s ongoing or future business.

Both private class action plaintiffs and SEC enforcement attorneys have brought actions contending that risk disclosures are misleading where a company discloses that a certain risk is possible but does not also disclose that such a risk has actually come to pass.   

In the Supreme Court case, plaintiffs sued Facebook (now Meta) (the “Company”) and its executives for risk-factor disclosures regarding data breaches.  The disclosures warned of the risk of security breaches and improper third-party access to user data that “could harm” the Company’s business. Plaintiffs alleged that when it said this, the Company was aware that another firm, Cambridge Analytica, had improperly collected and harvested user data.

The district court found that the plaintiffs had failed to state a securities fraud claim under Section 10(b) of the Securities Exchange Act of 1934.  The Ninth Circuit reversed, holding that the Company’s disclosure could be read as presenting the risk of a data breach as “purely hypothetical when it had already occurred, [and that] such a statement could be misleading [to a reasonable investor] even if the magnitude of the ensuing harm was still unknown.”

There were multiple amicus briefs filed in the case, with business groups supporting the defendants and the U.S. government and pension funds and institutional investors supporting the plaintiffs.

The parties jousted in briefs and at argument over how reasonable investors would interpret risk disclosures. The defendants contended that a reasonable investor would not interpret a forward-looking statement about the existence of a potential risk as “implicitly certifying that the triggering event identified has never occurred in the past and that the company faced no present risk of harm from such an occurrence.”  Plaintiffs, however, echoed the Ninth Circuit’s conclusion that in some circumstances, including the case at hand, describing something as a future risk could mislead an investor into believing that that “something” had not occurred.

Much of the argument before the Court concerned the issue of how to draw categorical rules regarding such disclosures.  It seems possible that after the argument, the justices concluded that such rules may be too difficult to draw, resulting in the decision not to decide the case at all and to leave the matter, for now, to be dealt with by lower courts.