Plaintiff Securities and Exchange Commission (the “Commission”) alleges:
SUMMARY OF THE ACTION
1. For more than two years, Facebook made misleading statements in its required public filings about the misuse of its users’ data. From 2016 until mid-March 2018, Facebook presented the risk of misuse of its users’ data as merely hypothetical. In fact, Facebook had already become aware by December 2015 that a researcher had improperly sold information related to tens of millions of Facebook users to data analytics firm Cambridge Analytica.
2. Since its initial public offering in 2012, Facebook has warned investors that one of the material risks to its business was the fact that independent developers who create applications for its platform might misuse personal data obtained from Facebook users.
3. In June 2014, an academic researcher and Cambridge Analytica entered into an agreement, through affiliated companies, whereby Cambridge Analytica would pay for the researcher to collect data on Facebook users. At Cambridge Analytica’s expense, the researcher developed a personality survey that obtained data from U.S. Facebook users, including their names, birthdates, gender, location, and their affinities, or “page likes.” From the summer of 2014 through the spring of 2015, the researcher transferred data relating to approximately 30 million Facebook users in the United States to Cambridge Analytica.
4. Facebook learned about the collaboration between the researcher and Cambridge Analytica when it investigated a report published in the British press in December 2015. Within days of the press report, both the researcher and Cambridge Analytica privately confirmed to Facebook that the researcher had transferred personality profiles based on Facebook user data to Cambridge Analytica. Facebook determined that the transfer violated its policy that prohibits developers, like the researcher, from selling or transferring its users’ data, and told the researcher and Cambridge Analytica to delete the data.
5. In June 2016, the researcher told Facebook that, in addition to transferring Cambridge Analytica personality profiles for approximately 30 million of its users, he had also, for those same users, sold Cambridge a substantial quantity of the underlying Facebook data from which he had derived those profiles.
6. In its quarterly and annual reports filed between January 28, 2016 and March 16, 2018 (the “relevant period”), Facebook did not disclose that a researcher had, in violation of the company’s policies, transferred data relating to approximately 30 million Facebook users to Cambridge Analytica. Instead, Facebook misleadingly presented the potential for misuse of user data as merely a hypothetical investment risk. Moreover, when asked by reporters in 2017 about its investigation into the Cambridge Analytica matter, Facebook falsely claimed the company found no evidence of wrongdoing, thereby reinforcing the misleading statements in its periodic filings.
7. Facebook did not disclose that a researcher had improperly transferred data for millions of Facebook users to Cambridge Analytica until March 16, 2018, when the company—for the first time—publicly acknowledged on its website that it had learned of the violation of its policy in 2015. The price of Facebook shares declined substantially following the company’s disclosure.
8. Based on the foregoing conduct, and the conduct described below, Facebook violated Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933 (“Securities Act”) and Section 13(a) of the Securities Exchange Act of 1934 (“Exchange Act”) and Rules 12b-20, 13a-1, 13a-13, and 13a-15(a) thereunder.
SECURITIES AND EXCHANGE COMMISSION,
Plaintiff,
vs.
FACEBOOK, INC.
Defendant. |
