1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 1 of 16 ERIN E. SCHNEIDER (Cal. Bar No. 216114) TRACY L. DAVIS (Cal. Bar No. 184129) davistl@sec.gov ROBERT L. TASHJIAN (Cal. Bar No. 191007) tashj ianr@sec . gov MATTHEW G. MEYERHOFER (Cal. Bar No. 268559) meyerhoferm@sec . gov Attorneys for Plaintiff SECURITIES AND EXCHANGE COMMISSION 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 (415) 705-2500 UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SECURITIES AND EXCHANGE COMMISSION, Case No. Plaintiff, vs. COMPLAINT FACEBOOK, INC. Defendant. Plaintiff Securities and Exchange Commission (the “Commission”) alleges: SUMMARY OF THE ACTION 1 . For more than two years, Facebook made misleading statements in its required public filings about the misuse of its users’ data. From 2016 until mid-March 2018, Facebook presented the risk of misuse of its users’ data as merely hypothetical. In fact, Facebook had already become aware by December 2015 that a researcher had improperly sold information related to tens of millions of Facebook users to data analytics firm Cambridge Analytica. 2. Since its initial public offering in 2012, Facebook has warned investors that one of the material risks to its business was the fact that independent developers who create applications for its platform might misuse personal data obtained from Facebook users. Complaint Securities and Exchange Commission SEC v. Facebook, Inc. - 1 - 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 2 of 16 3. In June 2014, an academic researcher and Cambridge Analytica entered into an agreement, through affiliated companies, whereby Cambridge Analytica would pay for the researcher to collect data on Facebook users. At Cambridge Analytical expense, the researcher developed a personality survey that obtained data from U.S. Facebook users, including their names, birthdates, gender, location, and their affinities, or “page likes.” From the summer of 2014 through the spring of 2015, the researcher transferred data relating to approximately 30 million Facebook users in the United States to Cambridge Analytica. 4. Facebook learned about the collaboration between the researcher and Cambridge Analytica when it investigated a report published in the British press in December 2015. Within days of the press report, both the researcher and Cambridge Analytica privately confirmed to Facebook that the researcher had transferred personality profiles based on Facebook user data to Cambridge Analytica. Facebook determined that the transfer violated its policy that prohibits developers, like the researcher, from selling or transferring its users’ data, and told the researcher and Cambridge Analytica to delete the data. 5 . In June 20 1 6, the researcher told Facebook that, in addition to transferring Cambridge Analytica personality profiles for approximately 30 million of its users, he had also, for those same users, sold Cambridge a substantial quantity of the underlying Facebook data from which he had derived those profiles. 6. In its quarterly and annual reports filed between January 28, 2016 and March 16, 2018 (the “relevant period”), Facebook did not disclose that a researcher had, in violation of the company’s policies, transferred data relating to approximately 30 million Facebook users to Cambridge Analytica. Instead, Facebook misleadingly presented the potential for misuse of user data as merely a hypothetical investment risk. Moreover, when asked by reporters in 2017 about its investigation into the Cambridge Analytica matter, Facebook falsely claimed the company found no evidence of wrongdoing, thereby reinforcing the misleading statements in its periodic filings. Complaint SEC v. Facebook, Inc. -2- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 3 of 16 7. Facebook did not disclose that a researcher had improperly transferred data for millions of Facebook users to Cambridge Analytica until March 16, 2018, when the company — for the first time — publicly acknowledged on its website that it had learned of the violation of its policy in 2015. The price of Facebook shares declined substantially following the company’s disclosure. 8. Based on the foregoing conduct, and the conduct described below, Facebook violated Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933 (“Securities Act”) and Section 13(a) of the Securities Exchange Act of 1934 (“Exchange Act”) and Rules 12b-20, 13a- 1, 13a- 13, and 13a- 15(a) thereunder. JURISDICTION AND VENUE 9. The Commission brings this action pursuant to Sections 20(b), 20(d), and 22(a) of the Securities Act [15 U.S.C. §§ 77t(b), 77t(d), and 77v(a)] and Sections 21(d), 21(e), and 27 of the Exchange Act [15 U.S.C. §§ 78u(d), 78u(e), and 78aa]. 10. This Court has jurisdiction over this action pursuant to Sections 20(b), 20(d)(1) and 22(a) of the Securities Act [15 U.S.C. §§ 77t(b), 77t(d)(l), and 77v(a)] and Sections 21(d), 21(e) and 27 of the Exchange Act [15 U.S.C. §§ 78u(d), 78u(e) and 78aa]. 1 1 . Defendant, directly or indirectly, made use of the means and instrumentalities of interstate commerce or of the mails in connection with the acts, transactions, practices, and courses of business alleged in this complaint. 12. Venue is proper in this District pursuant to Section 22(a) of the Securities Act [15 U.S.C. § 77v(a)] and Section 27(a) of the Exchange Act [15 U.S.C. § 78aa(a)]. Acts, transactions, practices, and courses of business that form the basis for the violations alleged in this complaint occurred in this District. Facebook employees who participated in the events alleged in this complaint worked in the company’s headquarters, which is located in Menlo Park, California. In addition, the relevant offers and sales of Facebook securities took place in this District. Complaint SEC v. Facebook, Inc. -3- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 4 of 16 13. Under Rule 3-2(d) of the Civil Local Rules, this civil action should be assigned to the San Francisco Division because a substantial part of the events or omissions which give rise to the claims alleged herein occurred in San Mateo County. DEFENDANT 14. Facebook, Inc., a Delaware corporation based in Menlo Park, California, is an Internet platform that allows its users to share photos and other digital content with their “friends” on-line. Since its initial public offering in 2012, Facebook’s Class A common stock has been registered under Section 12(b) of the Exchange Act and trades on the Nasdaq Global Select Market. RELEVANT ENTITY 15. Cambridge Analytica (“Cambridge”) was a data analytics and advertising firm affiliated with an entity in the United Kingdom known as the SCL Group. The firm and its affiliated entities filed for bankruptcy protection in the United States and the United Kingdom in 2018. These organizations are collectively referred to as “Cambridge.” FACTUAL ALLEGATIONS Overview of Facebook’s Business 16. Facebook derives substantially all of its revenue from advertising aimed at its users. More than 2.3 billion people used the company’s Facebook service on a monthly basis in the first quarter of 2019, and more than 2.7 billion people regularly used its broader family of services, which include Facebook, Instagram, and other services. The company generated more than $55.8 billion in revenue in its 2018 fiscal year and had a market capitalization of more than $500 billion as of March 31, 2019. 17. Since it filed for its initial public offering in 2012, Facebook has acknowledged in its periodic filings with the Commission that the size of its user base and level of its user engagement are critical to its financial success. Facebook has recognized that its users’ willingness to engage with its services depends in part on users believing they have control over the way their data is shared. The “Risk Factor” disclosures in Facebook’s periodic filings warned Complaint SEC v. Facebook, Inc. -4- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 5 of 16 investors that concerns relating to data privacy and sharing could result in Facebook failing to retain or add users or in users decreasing their level of engagement, which could significantly harm its business, revenue, and financial results. 18. One of the ways Facebook engages users is to allow unaffiliated software developers to create applications (or “apps”) that can access information that users share on Facebook. Facebook originally permitted developers to gather information from many app users’ friends in addition to the app user. Facebook deactivated this pennission in April 2014 but developers of existing apps were allowed to continue to collect data relating to an app user’s friends until April 2015. 19. Developers who create Facebook apps must consent to Facebook’s “Platfonn Policy,” a set of rules governing what developers are allowed to do with the apps they create and the data that they gather. Since at least 2012, the Platfonn Policy has prohibited developers from selling user data or transfening user data to anyone who intends to profit from the data. The Platform Policy is maintained and updated by Facebook’s policy group, which works with others in the company to establish rules that govern, among other things, user privacy. Facebook also established a “Developer Operations” group within the company to prevent and address violations of the Platform Policy. The Sale of Facebook Data to Cambridge Analytica 20. In November 2013, an academic researcher in the United Kingdom created a Facebook app in connection with his studies. In doing so, he agreed to abide by Facebook’s Platfonn Policy. Initially, the researcher used the app only for his own research. 21. In January 2014, Cambridge approached the researcher about a possible business relationship. Cambridge was exploring a new model of election campaigning by targeting advertising based on voters’ personalities, and both Cambridge and the researcher were familiar with an academic study that correlated an individual’s personality with Facebook “likes.” 22. Pursuant to a June 2014 agreement between Cambridge and the researcher, the researcher would collect data from the users of his Facebook app and their friends, use that Complaint SEC v. Facebook, Inc. -5- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 6 of 16 information to create personality “scores” for both app users and their friends, and then match these personality scores to individuals in Cambridge’s U.S. voter database. Cambridge would provide the researcher with funding to help recruit users to download and use the researcher’s app. 23. The researcher configured his app to deliver a standard academic personality survey to app users. In addition to the survey results, the app obtained the name, birthdate, gender, location, and Facebook page likes both for the app users and the app users’ friends. 1 24. In the summer and early fall of 2014, a business entity created and controlled by the researcher retained a surveying firm to recruit and pay approximately 270,000 Facebook users to download the researcher’s app and take the personality survey. This enabled the researcher to collect Facebook user data from both the 270,000 app users and many app users’ friends, which collectively amounted to tens of millions of Facebook users. From the survey responses, the researcher created personality scores for all 270,000 app users. Then, by analyzing the correlations between survey responses and page likes, the researcher derived “predicted” personality scores for the survey-takers’ tens of millions of friends. The researcher matched the personality scores against Cambridge’s database of American voters in 1 1 states, and transferred this matched data back to Cambridge, in violation of the Platfonn Policy. Cambridge used the scores to target advertisements in connection with its political consultancy services. Cambridge paid the researcher’s business entity for the costs associated with the work done by the surveying firm. 25. In January 2015, the researcher and Cambridge signed a follow-on agreement. Pursuant to the agreement, Cambridge paid the researcher’s business entity £200,000 GBP, and the researcher, in violation of the Platfonn Policy, gave Cambridge the previously-collected 1 On Facebook, “pages” are profiles that businesses or other organizations create in order to have a presence on Facebook. Organizations use Facebook pages to share information about products, services, and events. Individuals register their affinity to a particular organization by “liking” the organization’s Facebook page. “Page likes,” accordingly, represent a set of affinities connecting particular individuals to particular organizations. Complaint SEC v. Facebook, Inc. -6- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 7 of 16 names, birthdays, gender, location, personality scores, and an agreed-upon number of page likes for approximately 30 million Facebook users in all 50 states. By the end of May 2015, the researcher had transferred this information to Cambridge. 26. The researcher also entered into a separate agreement with another entity, “Company A.” Pursuant to that agreement, the researcher provided Facebook demographic data and all page likes relating to approximately 30 million U.S. Facebook users to Company A in the fall of 2014. Facebook’s Investigation into Cambridge Analytical Use of Facebook Data 27. On December 11, 2015, the British newspaper The Guardian published an article about the researcher and Cambridge reporting that the researcher had obtained Facebook data from tens of millions of Facebook users and used this data to create personality profiles for Cambridge’s use in American elections. 28. The newspaper contacted Facebook before publishing its report and shared the allegations they intended to publish. Facebook provided the following quote attributable to a company spokesperson: “We are carefully investigating this situation. To be clear, misleading people or misusing their information is a direct violation of our policies and we will take swift action against companies that do, including banning those companies from Facebook and requiring them to destroy all improperly collected data.” The Guardian included the company’s statement in the article published on December 1 1, 2015. 29. The day the Guardian article was published, a Facebook employee with responsibility for interpreting and administering the company’s Platfonn Policy contacted both the researcher and Cambridge. Within days, both the researcher and Cambridge confirmed to Facebook that the researcher had used a Facebook app to collect user data and then used that data to create personality scores, which were then transferred to Cambridge. 30. The Facebook employee concluded that the researcher’s transfer of personality scores derived from Facebook user data to Cambridge violated the company’s Platform Policy. This conclusion was shared with others in Facebook’s communications, legal, operations, policy, Complaint SEC v. Facebook, Inc. -7- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 8 of 16 privacy, and research groups. The employee told the researcher and Cambridge to delete the personality scores and told the researcher to delete all of the Facebook data that his app had collected, and Cambridge subsequently told Facebook that it had deleted the data received from the researcher. 3 1 . Six months later, in June 2016, Facebook and the researcher signed a settlement agreement. In a certification attached to that agreement, the researcher reported — contrary to his and Cambridge’s representations in December 2015 — that, in addition to the personality scores, he had also transferred actual U.S. Facebook user data, including names, birthdays, location, and certain page likes, to Cambridge. He also represented that he deleted all the Facebook data his app had collected. 32. Almost a year later, in April 2017, Cambridge provided Facebook with a similar certification reporting that Cambridge had received from the researcher underlying raw Facebook user data in addition to the personality scores, as well as that it had deleted that data. 33. All told, more than 30 Facebook employees in different corporate groups including senior managers in Facebook’s communications, legal, operations, policy, and privacy groups, learned that the researcher had transferred information to Cambridge in violation of Facebook’s Platfonn Policy. However, as discussed more fully below, Facebook had no specific policies or procedures in place to assess or analyze this information for the purposes of making accurate disclosures in Facebook’s periodic filings. Red Flags Raised About Cambridge Analytica ’s Other Potential Misuse of User Data 34. At the time of the December 2015 Guardian article, Facebook was already familiar with Cambridge and had suspicions that Cambridge had misused user data. In September 2015, employees in Facebook’s political advertising group requested an investigation into possible “scraping” — the automated and unauthorized aggregation of Facebook user data — by Cambridge. After the Guardian article was published in December 2015, these employees reiterated their concern about scraping. The political advertising employees recognized Cambridge as a well-known firm within the political advertising space and a client of Facebook’s Complaint SEC v. Facebook, Inc. Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 9 of 16 advertising business, and had described it as a “sketchy (to say the least) data modeling company that has penetrated our market deeply.” 35. Throughout 2016, red flags were raised to Facebook suggesting that Cambridge was potentially misusing Facebook user data. Following the Guardian article, several Facebook employees became aware of media reports on Cambridge’s use of personality profiles to target advertising in the summer and fall of 2016. Facebook lawyers and employees in the company’s political advertising group saw and discussed an October 27, 2016, article in The Washington Post reporting that Cambridge combined psychological tests with “likes” on “social-media sites.” Employees responsible for coordinating Facebook’s response to the Guardian article also circulated a link to a video of a marketing presentation by Cambridge’s chief executive officer about the firm’s ability to target voters based on personality. As an additional indication to Facebook that Cambridge might have been misusing Facebook user data, some employees on Facebook’s political advertising team knew from August 2016 through November 2016 that Cambridge named Facebook and Instagram advertising audiences by personality trait for certain clients that included advocacy groups, a commercial enterprise, and a political action committee. 36. Despite Facebook’s suspicions about Cambridge and the red flags raised after the Guardian article, Facebook did not consider how this information should have informed the risk disclosures in its periodic filings about the possible misuse of user data. Facebook’s Misleading Public Filings 37. Since the time of its initial public offering in 20 12, Facebook has warned investors about the potential for misuse of its users’ data by developers and the possible consequent financial effect on the company’s business. For example, in the Risk Factor disclosures in its Fonn 10-Q filed on October 30, 2014, Facebook cautioned that “Improper access to or disclosure of user information, or violation of our terms of service or policies, could harm our reputation and adversely affect our business.” In the same Form 10-Q, the company advised that if developers “fail to comply with our terms and policies . . . our users’ data may be Complaint SEC v. Facebook, Inc. -9- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 10 of 16 improperly accessed or disclosed.” This, the company acknowledged, “could have a material and adverse effect on our business, reputation, or financial results.” 38. Facebook modified this language beginning in January 2015 and continued to warn investors about the possibility that third parties might improperly access or misuse its users’ data. For example, in its Form 10-K filed on January 28, 2016, only weeks after it had confirmed that the researcher had improperly transferred personality scores derived from Facebook user data to Cambridge in violation of its Platform Policy, Facebook cautioned that “Any failure to prevent or mitigate security breaches and improper access to or disclosure of our data or user data could result in the loss or misuse of such data, which could harm our business and reputation and diminish our competitive position.” The company further asserted that if “developers fail to adopt or adhere to adequate data security practices . . . our data or our users’ data may be improperly accessed, used, or disclosed.”2 39. During the relevant period, Facebook’s Risk Factor disclosures misleadingly suggested that the company faced merely the risk of such misuse and any harm to its business that might flow from such an incident. This hypothetical phrasing, repeated in each of its periodic filings during the relevant period, created the false impression that Facebook had not suffered a significant episode of misuse of user data by a developer. 40. The company’s processes and procedures around the drafting of its periodic reports on Forms 10-K and 10-Q, including but not limited to its Risk Factor disclosures, failed to bring the researcher’s sale of data from tens of millions of Facebook users to Cambridge to the attention of the individuals with primary responsibility for drafting and approving those reports. Although protecting user data is critical to Facebook’s business, and Facebook had identified the potential for improper access to and misuse of user data as a significant risk, Facebook did not 2 During the relevant period, Facebook filed three annual reports on Fonn 10-K for the fiscal years ended December 3 1, 2015, December 31, 2016, and December 31, 2017, and six quarterly reports on Form 10-Q for each fiscal quarter in 2016 and 2017. Complaint SEC v. Facebook, Inc. -10- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 11 of 16 maintain disclosure controls and procedures designed to analyze or assess incidents involving misuse of user data for potential disclosure in the company’s periodic filings. 4 1 . During the relevant period, Facebook identified trends and events for possible disclosure through a series of quarterly meetings to prepare for the company’s earnings announcements. This process relied on the employees and managers who attended these meetings to identify issues that might need to be disclosed. Although several employees in Facebook’s legal, policy, and communications groups who attended these meetings during the relevant period were aware of the researcher’s improper transfer of data to Cambridge, that incident was never discussed. Facebook also did not share information regarding the incident with its independent auditors and outside disclosure counsel in order to assess the company’s disclosure obligations. 42. Facebook had no specific mechanism to summarize or report violations of its Platform Policy to employees responsible for ensuring the accuracy of Facebook’s filings with the Commission. For example, the Facebook employees responsible for monitoring violations of the company’s Platform Policy were not provided with the draft disclosures pertaining to the misuse of user data. 43. Asa result, Facebook senior management and relevant legal staff did not assess the scope, business impact, or legal implications of the researcher’s improper transfer of data to Cambridge, including whether or how it should have been disclosed in Facebook’s public filings or whether it rendered, or would render, any statements made by the company in its public filings misleading. 44. Based on the foregoing, Facebook filed materially misleading periodic reports with the Commission. Facebook knew, or should have known, that its Risk Factor disclosures in its annual reports on Fonn 1 0-K for the fiscal years ended December 3 1 , 20 1 5, December 3 1 , 2016, and December 31, 2017, and in its quarterly reports on Form 10-Q filed in 2016 and 2017, as incorporated into its Form S-8 registration statements, were materially misleading. Complaint SEC v. Facebook, Inc. -11- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 12 of 16 45. The Risk Factor disclosures were incorporated by reference into Facebook’s registration statements on Forms S-8 filed with the Commission on May 21, 2012 and February 1, 2013. These statements registered sales of shares of Facebook common stock under the company’s employee and officer equity incentive plans, and incorporated future periodic reports filed with the Commission, including those filed during the relevant period. 46. During the relevant period, Facebook received approximately $29 million in cash proceeds from the exercise of employee stock options. Facebook also granted restricted stock units to more than 17,000 new employees during the relevant period who, in some cases, agreed to accept lower salaries in exchange for additional equity compensation. Facebook’s Statements to the Press Reinforced Its Misleading Filings 47. Beginning in November 2016, reporters asked Facebook about the investigation that the company said it was conducting in the December 2015 Guardian article. These inquiries were referred to Facebook’s communications group, which was aware that the company had confirmed that the researcher had improperly transferred personality profiles based on U.S. user data to Cambridge in violation of Facebook’s policy, and had told both parties to delete the data. 48. The communications group initially responded to the press inquiries indirectly. For example, beginning in February 2017, the communications group pointed reporters to Cambridge’s public statement that it “does not use data from Facebook” and “does not obtain data from Facebook profiles or Facebook likes.” This was misleading because it suggested that Facebook was unaware that Cambridge had improperly obtained Facebook user data. 49. On at least two subsequent occasions in March 2017, Facebook’s communications group provided the following quote to reporters: “Our investigation to date has not uncovered anything that suggests wrongdoing.” This was misleading because Facebook had, in fact, determined that the researcher’s transfer of user data to Cambridge violated the company’s Platfonn Policy. The quote served to reinforce the misleading impression in Facebook’s periodic filings that the company was not aware of any material developer misuse of Complaint SEC v. Facebook, Inc. -12- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 13 of 16 user data. The on-line publication The Intercept included the quote, attributed to a Facebook spokesperson, in an article dated March 30, 2017. Facebook’s Acknowledgement of the Cambridge Analytica Incident 50. In March 20 1 8, The New York Times and Guardian contacted Facebook and informed the company that the publications planned to run stories about the researcher’s improper transfer of data to Cambridge, including that Facebook had told the researcher and Cambridge to delete their Facebook data. Reporters from the Times suggested that Cambridge had not deleted the data, contrary to its representations to Facebook. 5 1 . After the close of market on Friday, March 16, 2018, Facebook preempted the newspapers’ publication by a post on its own online Facebook “newsroom.” The company publicly acknowledged, for the first time, that it had confirmed that the researcher had transferred user data to Cambridge, in violation of its Platform Policy, and that the company had told the researcher and Cambridge to delete the data in December 2015. When the market opened on Monday, March 19, 2018, the price of Facebook’s shares fell five percent, from $185.09 to $172.56, and continued to decline throughout the week, closing at $159.39 per share on March 23, 2018. FIRST CLAIM FOR RELIEF Violations of Sections 17(a)(2) and (3) of the Securities Act 52. The Commission re-alleges and incorporates by reference Paragraph Nos. 1 through 51, above. 53. By engaging in the conduct described above, Defendant Facebook, directly or indirectly, in the offer or sale of securities, by use of the means or instruments of transportation or communication in interstate commerce or by use of the mails, ( 1 ) obtained money or property by means of untrue statements of material fact or by omitting to state a material fact necessary in order to make the statements made, in light of the circumstances under which they were made, not misleading; and Complaint SEC v. Facebook, Inc. -13- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 14 of 16 (2) engaged in transactions, practices, or courses of business which operated or would operate as a fraud or deceit upon purchasers. 54. By reason of the foregoing, Defendant violated, and unless restrained and enjoined will continue to violate, Section 17(a) (2) and Section 17(a)(3) of the Securities Act [15 U.S.C. §§ 77q(a)(2) and 77q(a)(3)]. SECOND CLAIM FOR RELIEF Violations of Section 13(a) of the Exchange Act and Rules 12b-20, 13a-l and 13a-13 Thereunder 55. The Commission re-alleges and incorporates by reference Paragraph Nos. 1 through 51, above. 56. Defendant has at all relevant times been an issuer that has a class of securities registered pursuant to Section 12 of the Exchange Act [15 U.S.C. § 78/]. 57. As described above, Defendant’s filings with the Commission, including its reports filed on Forms 10-K and Forms 10-Q, reflected misleading statements concerning the improper access to and misuse of its users’ personal information. 58. Based on the conduct alleged above, Defendant violated, and unless restrained and enjoined will continue to violate, Section 13(a) of the Exchange Act [15 U.S.C. § 78m(a)] and Rules 12b-20, 13a-l, and 1 3 a- 1 3 thereunder [17 C.F.R. §§ 240.12b-20, 240.13a-l, and 240. 13a-13], which obligate issuers of securities registered pursuant to Section 12 of the Exchange Act [15 U.S.C. § 78/] to file with the Commission periodic reports with information that is accurate and not misleading. THIRD CLAIM FOR RELIEF Violations of Rule 13 a- 15(a) of the Exchange Act 59. The Commission re-alleges and incorporates by reference Paragraph Nos. 1 through 51, above. 60. Defendant failed to maintain controls and procedures designed to ensure that information required to be disclosed in the reports that it files or submits pursuant to the Complaint SEC v. Facebook, Inc. -14- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 15 of 16 Exchange Act is recorded, processed, summarized, and reported, within the time periods specified in the Commission’s rules and forms. 61 . Defendant also failed to maintain controls and procedures designed to ensure that information required to be disclosed in the reports that it files or submits pursuant to the Exchange Act is accumulated and communicated to its management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure. 62. By reason of the foregoing, Defendant violated Rule 13a-15(a) of the Exchange Act [17 C.F.R. § 240. 13 a- 15(a)]. PRAYER FOR RELIEF WHEREFORE, the Commission respectfully requests that this Court: I. Permanently enjoin Defendant Facebook from directly or indirectly violating Sections 17(a)(2) and 17(a)(3) of the Securities Act [15 U.S.C. §§ 77q(a)(2) and 77q(a)(3)], and Section 13(a) of the Exchange Act [15 U.S.C. § 78m(a)], and Rules 12b-20, 13a- 1 , 13a-13, and 13a-15(a) [17 C.F.R. §§ 240.12b-20, 240.13a-l, 240.13a-13, and 240.13a-15(a)] thereunder. II. Issue an order requiring Defendant Facebook to pay a civil monetary penalty pursuant to Section 20(d) of the Securities Act [15 U.S.C. § 77t(d)] and Section 21(d) of the Exchange Act [15 U.S.C. § 78u(d)(3)]. III. Retain jurisdiction of this action in accordance with the principles of equity and the Federal Rules of Civil Procedure in order to implement and carry out the terms of all orders and decrees that may be entered, or to entertain any suitable application or motion for additional relief within the jurisdiction of this Court. Complaint SEC v. Facebook, Inc. -15- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:19-cv-04241 Document 1 Filed 07/24/19 Page 16 of 16 IV. Grant such other and further relief as this Court may determine to be just and necessary. Dated: July 19, 2019 Respectfully submitted, /s/ Matthew G. Meverhofer _ Matthew G. Meyerhofer Attorney for Plaintiff SECURITIES AND EXCHANGE COMMISSION Complaint SEC v. Facebook, Inc. -16- Securities and Exchange Commission 44 Montgomery Street, Suite 2800 San Francisco, CA 94104 II (415) 705-2500