Facebook had over 2.2 billion users as of the end of 2017. The complaint for this securities class action claims that Facebook did not protect these users’ privacy according to its own policies, violating the Securities Exchange Act of 1934 and making it possible for companies to lift data for their own purposes.
The class for this action is all persons who acquired common shares of Facebook between February 3, 2017 and March 19, 2018.
Facebook runs a social networking website that allows users to share news, photos, links, and videos with their families, friends, and coworkers. Facebook users purportedly can share or restrict information according to their own criteria.
On February 2, 2017, Facebook filed its Form 10-K annual report for 2016. The complaint quotes it as saying, among other things, “Security breaches and improper access to or disclosure of our data or user data, or other hacking or phishing attacks on our systems, could harm our reputation and adversely affect our business.” It also talked about “the loss or misuse of such data” and the possibility that “[a]ffected users or government authorities could initiate legal or regulatory actions against us…”
Similar statements were made in the company’s Form 10-Q filed on May 4, 2017. However, less than two weeks later, on May 16, Reuters reported that French privacy regulator CNIL had fined Facebook 150,00 euros for “failing to prevent its users’ data being accessed by advertisers.” The article also noted that the fine was “part of a wider European investigation also being carried out in Belgium, the Netherlands, Spain and Germany into some of Facebook’s practices.”
Yet the company repeated its statements about data security in later filings, and on a conference call, Mark Zuckerberg indicated that the company was increasing security: “We now have around 14,000 people working across community ops, online ops, and our security efforts. That’s almost double where we were a year ago.”
The company’s Data Use Policy also claimed “we don’t share information we receive about you with others unless we have … received your permission; … [and] given you notice…”
On March 17, 2018, the New York Times published an article entitled “How Trump Consultants Exploited the Facebook Data of Millions,” in which it revealed that Cambridge Analytica consultants had obtained the data of 50 million people from Facebook for its own political uses, without permission or proper disclosures.
On March 19, Bloomberg reported that the US Federal Trade Commission was investigating whether Facebook had violated the terms of a 2011 consent decree about the sharing of users’ data. The UK’s Parliament also summoned Zuckerberg to give evidence about the Cambridge Analytica matter.
At each of these revelations, the company’s stock price fell.