FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

IN RE ALPHABET, INC. SECURITIES

LITIGATION,

STATE OF RHODE ISLAND, Office of

the Rhode Island Treasurer on behalf

of the Employees’ Retirement

System of Rhode Island; Lead

Plaintiff, Individually and On Behalf

of All Others Similarly Situated,

Plaintiff-Appellant,

v.

ALPHABET, INC.; LAWRENCE E.

PAGE; SUNDAR PICHAI; RUTH M.

PORAT; GOOGLE LLC; KEITH P.

ENRIGHT; JOHN KENT WALKER, JR.,

Defendants-Appellees.

No. 20-15638

D.C. No.

4:18-cv-06245-

JSW

OPINION

Appeal from the United States District Court

for the Northern District of California

Jeffrey S. White, District Judge, Presiding

Argued and Submitted February 4, 2021

San Francisco, California

Filed June 16, 2021
2 IN RE ALPHABET, INC. SECURITIES LITIGATION

Before: Sidney R. Thomas, Chief Judge, and Sandra S.

Ikuta and Jacqueline H. Nguyen, Circuit Judges.

Opinion by Judge Ikuta

SUMMARY*

Securities Fraud

The panel affirmed in part and reversed in part the district

court’s dismissal of a securities fraud action for failure to

state a claim, vacated the district court’s judgment, and

remanded for further proceedings.

The State of Rhode Island filed a private securities fraud

action under §§ 10(b) and 20(a) of the Securities Exchange

Act of 1934 and SEC Rule 10b-5 against Google LLC, its

holding company Alphabet, Inc., and individual defendants. 

The consolidated amended complaint alleged that defendants

omitted to disclose security problems with the Google+ social

network. The complaint referred to the cybersecurity

problems as the “Three-Year Bug” and the “Privacy Bug.” 

The district court granted defendants’ motion to dismiss on

the grounds that Rhode Island failed to adequately allege a

materially misleading misrepresentation or omission and that

Rhode Island failed to adequately allege scienter.

The panel held that the complaint adequately alleged that

two statements made by Alphabet in its quarterly reports filed

* This summary constitutes no part of the opinion of the court. It has

been prepared by court staff for the convenience of the reader.
IN RE ALPHABET, INC. SECURITIES LITIGATION 3

with the SEC on Form 10-Q omitted material facts necessary

to make the statements not misleading. Applying an

objective materiality standard to the 10-Qs, the panel held

that Rhode Island’s complaint plausibly alleged the

materiality of the costs and consequences associated with the

Privacy Bug, and its public disclosure, and how Alphabet’s

decision to omit information about the Privacy Bug in its 10-

Qs significantly altered the total mix of information available

for decisionmaking by a reasonable investor.

The panel next addressed whether the complaint

adequately alleged scienter for the materially misleading

omissions from the 10-Q statements. The panel held that the

complaint was required to plausibly allege, with the

particularity required by the Private Securities Litigation

Reform Act, that the maker of the statements knew about the

security vulnerabilities and intentionally or recklessly did not

disclose them. The panel concluded that the complaint’s

specific allegations, taken as a whole, raised a strong

inference that defendant Lawrence Page, and therefore

Alphabet, knew about the Three-Year Bug, the Privacy Bug,

and a Privacy Bug Memo, and that Alphabet intentionally did

not disclose this information in its 10-Q statements.

The panel further held that Rhode Island adequately

alleged falsity, materiality, and scienter for the 10-Q

statements. The panel therefore reversed the district court’s

holdings to the contrary. The panel also reversed the district

court’s dismissal of the complaint’s § 20(a) control-person

claims based on the 10-Q statements.

As to ten additional statements identified in the

complaint, the panel concluded that the complaint did not

plausibly allege that these remaining statements were
4 IN RE ALPHABET, INC. SECURITIES LITIGATION

misleading material misrepresentations. The panel therefore

affirmed the district court’s dismissal of claims based on

these statements.

Rhode Island argued on appeal that the district court erred

in dismissing its “scheme liability claim” under Rule 10b-5(a)

and (c) when it dismissed the complaint in its entirety without

addressing those claims. The panel held that because

Alphabet’s motion to dismiss did not target Rhode Island’s

Rule 10b-5(a) and (c) claims, Rhode Island did not waive

those claims by failing to address them in opposition to the

motion to dismiss. Reversing, the panel held that the district

court erred in sua sponte dismissing the Rule 10b-5(a) and (c)

claims when Alphabet had not targeted them in its motion to

dismiss.

COUNSEL

Jason A. Forge (argued), Michael Albert, J. Marco Janoski

Gray, and Ting H. Liu, Robbins Geller Rudman & Dowd

LLP, San Diego, California, for Plaintiff-Appellant.

Ignacio E. Salceda (argued), Benjamin M. Crosson, Cheryl

W. Foung, Stephen B. Strain, and Emily Peterson, Wilson

Sonsini Goodrich & Rosati, Palo Alto, California; Gideon A.

Schor, Wilson Sonsini Goodrich & Rosati, New York, New

York; for Defendants-Appellees.
IN RE ALPHABET, INC. SECURITIES LITIGATION 5

OPINION

IKUTA, Circuit Judge:

In March 2018, amid the furor caused by news that

Cambridge Analytica improperly harvested user data from

Facebook’s social network, Google discovered that a security

glitch in its Google+ social network had left the private data

of some hundreds of thousands of users (according to

Google’s estimate) exposed to third-party developers for

three years and that Google+ was plagued by multiple other

security vulnerabilities. Warned by its legal and policy staff

that disclosure of these issues would result in immediate

regulatory and governmental scrutiny, Google and its holding

company, Alphabet, chose to conceal this discovery, made

generic statements about how cybersecurity risks could affect

their business, and stated that there had been no material

changes to Alphabet’s risk factors since 2017. This appeal

raises the question whether, for purposes of a private

securities fraud action, the complaint adequately alleged that

Google, Alphabet, and individual defendants made materially

misleading statements by omitting to disclose these security

problems and that the defendants did so with sufficient

scienter, meaning with an intent to deceive, manipulate, or

defraud.

I

A

At the motion to dismiss stage, we start with the facts

plausibly alleged in the complaint, documents incorporated

into the complaint by reference, and matters of which a court

may take judicial notice. See Ashcroft v. Iqbal, 556 U.S. 662,
6 IN RE ALPHABET, INC. SECURITIES LITIGATION

678–79 (2009); Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551

U.S. 308, 322 (2007). The story begins in the 1990s when

Lawrence Page and Sergey Brin, then students at Stanford

University, developed Google, a web-based search engine. 

Over the next two decades, Google rapidly expanded beyond

its search engine services into a range of other internet-related

services and products, including advertising technology,

cloud computing, and hardware.

Since its initial public offering prospectus in 2004 and

throughout Google’s continued rise, Google and its

executives publicly recognized the importance of user privacy

and user trust to Google’s business. Google executives

expressed their understanding that Google’s “success is

largely dependent on maintaining consumers’ trust” so that

“users will continue to entrust Google with their private data,

which Google can then monetize.” As one media outlet put

it, “Google has a strong incentive to position itself as a

trustworthy guardian of personal information because, like

Facebook, its financial success hinges on its success to learn

about the interests, habits and location[s] of its users in order

to sell targeted ads.” Google and its executives repeatedly

emphasized that maintaining users’ trust is essential and that

a significant security failure “would be devastating.” 

Google’s public emphasis on user trust and user privacy

remained central to its business when, in 2011, Google

launched Google+ “in an attempt to make a social media

network to rival that of Facebook and Twitter, and to join all

users of Google services (i.e., Search, Gmail, YouTube,

Maps) into a single online identity.”

In October 2015, Google restructured itself from Google,

Inc. into Google LLC and created Alphabet, Inc. as its parent

company, which is “essentially a holding company” whose
IN RE ALPHABET, INC. SECURITIES LITIGATION 7

“lifeblood is Google.” Page, who had been the CEO of

Google, became the CEO of Alphabet. Sundar Pichai, a

longtime Google senior executive, replaced Page as the CEO

of Google. Page and Pichai both sat on Alphabet’s Board of

Directors and served on the board’s three-person Executive

Committee. Pichai directly reported to Page and maintained

regular contact with him; Pichai was also directly accountable

to Page. Pichai also participated in Alphabet’s public

earnings calls. Page received weekly reports of Google’s

operating results and continued to make “key operating

decisions” at Google.

Google’s corporate restructuring did not change the

central importance of privacy and security. Google and

Alphabet consistently indicated that Google’s foremost

competitive advantage against other companies was its

sophistication in security. Thus, according to Alphabet’s

Chief Financial Officer in February 2018, security is “clearly

what we’ve built Google on.”

While highlighting expertise in security and data privacy,

Google and Alphabet also acknowledged the substantial

impact that a cybersecurity failure would have on their

business. According to Alphabet’s 2017 Annual Report on

Form 10-K filed with the Securities and Exchange

Commission (SEC), “[c]oncerns about our practices with

regard to the collection, use, disclosure, or security of

personal information or other privacy related matters, even if

unfounded, could damage our reputation and adversely affect

our operating results.” Alphabet warned that “[i]f our

security measures are breached resulting in the improper use

and disclosure of user data” then Alphabet’s “products and

services may be perceived as not being secure, users and

customers may curtail or stop using our products and
8 IN RE ALPHABET, INC. SECURITIES LITIGATION

services, and we may incur significant legal and financial

exposure.” As Pichai explained in January 2018, “users use

Google because they trust us and it is something easy to lose

if you are not good stewards of it. So we work hard to earn

the trust every day.”

B

“By the spring of 2018, the trustworthiness of technology

and those who control it were under unprecedented scrutiny.” 

According to the complaint, a trigger for this scrutiny was the

publication of reports that a research firm, Cambridge

Analytica, “improperly harvested data from Facebook users’

profiles” to be used for political advertising. The immediate

effects of this reporting were “devastating to Facebook and its

investors,” including a 13% decline in Facebook’s stock

price, which amounted to a loss of approximately $75 billion

of market capitalization.

This scandal quickly led to congressional hearings into

Facebook’s leak of user information to a third-party data

collector. Facebook was not the only target of scrutiny, as the

Senate Judiciary Committee, chaired by Senator Grassley,

requested that Google and Twitter testify at these hearings

about their data privacy and security practices. In a letter to

Pichai, Senator Grassley outlined the committee’s

“significant concerns regarding the data security practices of

large social media platforms and their interactions with third

party developers and other commercial[] users of such data.” 

According to Senator Grassley, Pichai declined to testify after

“asserting that the problems surrounding Facebook and

Cambridge Analytica did not involve Google.”
IN RE ALPHABET, INC. SECURITIES LITIGATION 9

At around the same time, in May 2018, the European

Union implemented the General Data Protection Regulation

(GDPR), a new framework for regulating data privacy

protections in all member states. Among other things, the

GDPR required prompt disclosure of personal data breaches,

not later than 72 hours after learning of the breach. On its

website, Google reaffirmed its commitment to complying

with the GDPR across all its services and reaffirmed

Google’s aim “always to keep data private and safe.”

C

While external scrutiny of data privacy and security grew

in March and April 2018, internal Google investigators had

discovered a software glitch in the Google+ social network

that had existed since 2015 (referred to in the complaint as

the “Three-Year Bug”). Because of a bug in an application

programming interface for Google+, third-party developers

could collect certain users’ profile data even if those users

had relied on Google’s privacy settings to designate such data

as nonpublic. The exposed private profile data included

email addresses, birth dates, gender, profile photos, places

lived, occupations, and relationship status.

Not only did Google’s security protocols fail to detect the

problem for three years, but Google also had a limited set of

activity logs that could review only the two most recent

weeks of user data access. Due to this record-keeping

limitation, Google “had no way of determining how many

third-parties had misused its users’ personal private data.” 

And Google “could only estimate that it exposed to thirdparties the personal private data of hundreds of thousands of

users” based on “less than 2% of the Three-Year Bug’s

lifespan.” Despite the efforts of “over 100 of Google’s best
10 IN RE ALPHABET, INC. SECURITIES LITIGATION

and brightest,” Google “could not confirm the damage from

[the bug] or determine the number of other bugs.” At the

same time, this investigation into the Three-Year Bug

detected other shortcomings in Google’s security systems,

including “previously unknown, or unappreciated, security

vulnerabilities that made additional data exposures virtually

inevitable.” The complaint refers collectively to the ThreeYear Bug and these additional vulnerabilities as the “Privacy

Bug.”

Around April 2018, Google’s legal and policy staff

prepared a memo detailing the Three-Year Bug and the

additional vulnerabilities (referred to in the complaint as the

“Privacy Bug Memo”). According to the complaint, the

Privacy Bug Memo warned that the disclosure of these

security issues “would likely trigger ‘immediate regulatory

interest’ and result in defendants ‘coming into the spotlight

alongside or even instead of Facebook despite having stayed

under the radar throughout the Cambridge Analytica

scandal.’” The memo warned that “disclosure ‘almost

guarantees Sundar [Pichai] will testify before Congress.’”

According to the complaint, Pichai and other senior

Google executives received and read the memo in early April

2018. The complaint alleges that key officers and directors,

including Page and Pichai, chose a strategy of nondisclosure. 

Pichai approved a plan to conceal the existence of the ThreeYear Bug and other security vulnerabilities described in the

Privacy Bug Memo “to avoid any additional regulatory

scrutiny, including having to testify before Congress.” 

Further, despite Google+ having 395 million monthly active

users, more than either Twitter or Snapchat, Pichai and Page

approved a plan to shut down the Google+ consumer

platform.
IN RE ALPHABET, INC. SECURITIES LITIGATION 11

D

Despite the information in the Privacy Bug Memo,

Alphabet and Google continued to give the public the same

assurances about security and privacy as before. In

particular, on April 23, 2018, Alphabet filed its quarterly

report on Form 10-Q for the period ending March 31, 2018. 

The 10-Q incorporated the risk disclosures from Alphabet’s

2017 10-K and made no disclosure about the Privacy Bug. It

stated:

Our operations and financial results are

subject to various risks and uncertainties,

including those described in Part I, Item 1A,

“Risk Factors” in our Annual Report on Form

10-K for the year ended December 31, 2017,

which could adversely affect our business,

financial condition, results of operations, cash

flows, and the trading price of our common

and capital stock. There have been no

material changes to our risk factors since our

Annual Report on Form 10-K for the year

ended December 31, 2017.

(emphasis added). Nor did Alphabet make any disclosure

during an earnings call on the same day. Months later, in July

2018, Alphabet filed its Form 10-Q for the period ending

June 30, 2018. This filing included a risk disclosure

substantially identical to the one in the April 2018 filing; it

likewise incorporated the 2017 Form 10-K risk factors and

affirmed that no material changes occurred. Nor did
12 IN RE ALPHABET, INC. SECURITIES LITIGATION

Alphabet make any disclosure of the problems during its July

2018 earnings call.1

The complaint identifies statements made by Alphabet,

Google, and their employees between April and October 2018

that continued to reference user security and data privacy

while making the same omission regarding any Google+

problems. According to the complaint, Alphabet thought that

this “decision to buy time” would reduce the detrimental

effects of eventual disclosure by avoiding disclosure at a time

when Facebook was facing regulatory scrutiny, public

criticism, and loss of consumer confidence as a result of the

Cambridge Analytica scandal.

E

Six months after this decision to buy time, the Wall Street

Journal exposed Google’s discovery of Google+’s security

vulnerabilities and its decision to conceal those

vulnerabilities. In October 2018, the Wall Street Journal

published a lengthy story on the events surrounding the

Privacy Bug Memo. See Douglas MacMillan & Robert

McMillan, Google Exposed User Data, Feared

Repercussions of Disclosing to Public, Wall Street J. (Oct. 8,

2018). The story reported that “Google exposed the private

data of hundreds of thousands of users of the Google+ social

network and then opted not to disclose the issue this past

spring, in part because of fears that doing so would draw

regulatory scrutiny and cause reputational damage.” It

1 The complaint alleges that Page signed the 10-Qs and signed

certifications, under SEC rules promulgated after the Sarbanes-Oxley Act,

that vouched for the accuracy of the 10-Qs and the adequacy of controls

for identifying cybersecurity risks.
IN RE ALPHABET, INC. SECURITIES LITIGATION 13

walked the reader through the discovery of the privacy bug,

explained how Google made “concerted efforts to avoid

public scrutiny of how it handles user information,

particularly at a time when regulators and consumer privacy

groups are leading a charge to hold tech giants accountable

for the vast power they wield over the personal data of

billions of people,” and reported that Pichai had been briefed

on the plan not to notify users.

The day the news broke, Google published a blog post

acknowledging the “significant challenges” regarding data

security identified in the Wall Street Journal article. It finally

admitted to exposing the private data of hundreds of

thousands of users and announced it was shutting down the

Google+ social network for consumers.

Condemnation fromlawmakers soon followed. Two days

after the Wall Street Journal article, Democratic senators

wrote to demand an investigation by the Federal Trade

Commission. This letter noted that, due to the limitations of

Google’s internal logs, “we may never know the full extent

of the damage caused by the failure to provide adequate

controls and protection to users.” The letter likewise noted

that the “awareness and approval by Google management to

not disclose represents a culture of concealment and opacity

set from the top of the company.” Republican senators also

wrote a letter to Pichai that questioned Google’s decision “to

withhold information about a relevant vulnerability for fear

of public scrutiny” at the same time that Facebook was being

questioned regarding the Cambridge Analytica scandal. In a

second letter to Pichai, Senator Grassley complained that

Google had assured him in April 2018 that it maintained

robust protection for user data, despite Pichai’s awareness

that Google+ “had an almost identical feature to Facebook,
14 IN RE ALPHABET, INC. SECURITIES LITIGATION

which allowed third party developers to access information

from users.”

Markets reacted to the news. Alphabet’s publicly traded

share price fell after the Wall Street Journal article. 

According to the complaint, Alphabet’s share price fell

$11.91 on October 8, $10.75 on October 9, and $53.01 on

October 10. Financial news reports called Google’s decision

not to disclose the security breach a “cover-up” and predicted

forthcoming regulatory scrutiny.

Just weeks later, in December 2018, Google disclosed the

discovery of another Google+ bug that had exposed user data

from 52.5 million accounts. Google also announced it was

accelerating the shutdown of the consumer Google+ platform

to occur four months earlier than planned.

F

Three days after the Wall Street Journal article, Rhode

Island filed a securities fraud action, as did other plaintiffs.2

After the cases were consolidated, Rhode Island was

designated the lead plaintiff. It filed a consolidated amended

complaint in April 2019, which now serves as the operative

complaint. The complaint names Alphabet, Google, Page,

Pichai, and two other Google senior executives as defendants

(we refer to the defendants collectively as Alphabet, where

2 Rhode Island refers to the State of Rhode Island, Office of the

Rhode Island Treasurer on behalf of the Employees’ Retirement System

of Rhode Island.
IN RE ALPHABET, INC. SECURITIES LITIGATION 15

appropriate, and otherwise by name).3 The complaint alleges

primary violations of Section 10(b) of the Securities

Exchange Act of 1934, 15 U.S.C. § 78j(b), and SEC Rule

10b-5, 17 C.F.R. § 240.10b-5, for securities fraud, as well as

violations of Section 20(a) of the Exchange Act, 15 U.S.C.

§ 78t(a), which imposes joint and several liability on persons

in control of “any person liable under any provision” of

securities law.

Alphabet moved to dismiss the complaint for failure to

state a claim. The district court granted the motion after

determining that the complaint failed to allege any material

misrepresentation or omission and failed to allege scienter

sufficiently. Further, the court held that because the

Section 10(b) claim failed, the Section 20(a) claim for

controlling-person liability “necessarily fails.”

Although the district court granted leave to amend, Rhode

Island notified the district court that it did not intend to

amend, and the district court entered judgment. Rhode Island

now appeals from that final judgment.

II

We have jurisdiction under 28 U.S.C. § 1291. We review

the district court’s dismissal of Rhode Island’s complaint for

failure to state a claim de novo. In re NVIDIA Corp. Sec.

3 The other two individual defendants are Keith P. Enright, who

served as Google’s Legal Director of Privacy from 2016 until September

2018 when he became Google’s Chief Privacy Officer, and John Kent

Walker, Jr., who served as Google’s Vice President and General Counsel

from 2016 through August 2018 before becoming Senior Vice President

for Global Affairs.
16 IN RE ALPHABET, INC. SECURITIES LITIGATION

Litig., 768 F.3d 1046, 1051 (9th Cir. 2014). “To survive a

motion to dismiss, a complaint must contain sufficient factual

matter, accepted as true, to ‘state a claim to relief that is

plausible on its face.’” Iqbal, 556 U.S. at 678 (quoting Bell

Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “When

there are well-pleaded factual allegations, a court should

assume their veracity and then determine whether they

plausibly give rise to an entitlement to relief.” Id. at 679. As

the Supreme Court has explained, “[d]etermining whether a

complaint states a plausible claim for relief” is “a

context-specific task that requires the reviewing court to draw

on its judicial experience and common sense.” Id. In the

process, we may “disregard ‘[t]hreadbare recitals of the

elements of a cause of action, supported by mere conclusory

statements.’” Telesaurus VPC, LLC v. Power, 623 F.3d 998,

1003 (9th Cir. 2010) (quoting Iqbal, 556 U.S. at 678).

A complaint is plausible on its face “when the plaintiff

pleads factual content that allows the court to draw the

reasonable inference that the defendant is liable for the

misconduct alleged.” Iqbal, 556 U.S. at 678. The

misconduct alleged here includes claims under two statutory

sections: primary liability under Section 10(b) of the

Exchange Act and controlling-person liability under

Section 20(a) of the Exchange Act.

Section 10(b) of the Exchange Act prohibits using or

employing, “in connection with the purchase or sale of any

security . . . [,] any manipulative or deceptive device or

contrivance in contravention of such rules and regulations as

the [SEC] may prescribe as necessary or appropriate in the

public interest or for the protection of investors.” 15 U.S.C.

§ 78j(b). To implement Section 10(b), the SEC prescribed

Rule 10b-5, which makes it unlawful
IN RE ALPHABET, INC. SECURITIES LITIGATION 17

(a) To employ any device, scheme, or artifice

to defraud,

(b) To make any untrue statement of a

material fact or to omit to state a material fact

necessary in order to make the statements

made, in the light of the circumstances under

which they were made, not misleading, or

(c) To engage in any act, practice, or course of

business which operates or would operate as

a fraud or deceit upon any person, in

connection with the purchase or sale of any

security.

17 C.F.R. § 240.10b-5.

The Supreme Court has interpreted Section 10(b) and

Rule 10b-5 as providing an implied private cause of action. 

Stoneridge Inv. Partners, LLC v. Scientific-Atlanta, 552 U.S.

148, 157 (2008). “In a typical § 10(b) private action” based

on material misrepresentations or omissions, a plaintiff must

prove “(1) a material misrepresentation or omission by the

defendant; (2) scienter; (3) a connection between the

misrepresentation or omission and the purchase or sale of a

security; (4) reliance upon the misrepresentation or omission;

(5) economic loss; and (6) loss causation.” Id.

Under Section 10(b) and Rule 10b-5(b), “the maker of a

statement is the person or entity with ultimate authority over

the statement, including its content and whether and how to

communicate it.” Janus Cap. Grp., Inc. v. First Derivative

Traders, 564 U.S. 135, 142 (2011). Persons “who do not

‘make’ statements (as Janus defined ‘make’), but who
18 IN RE ALPHABET, INC. SECURITIES LITIGATION

disseminate false or misleading statements to potential

investors with the intent to defraud, can be found to have

violated the other parts of Rule 10b-5, subsections (a) and (c),

as well as related provisions of the securities laws” including

Section 10(b). Lorenzo v. SEC, 139 S. Ct. 1094, 1099,

1100–03 (2019).

The first two elements of a typical Section 10(b) and Rule

10b-5(b) claim are at issue here. The first element is that a

defendant omitted “to state a material fact necessary in order

to make the statements made . . . not misleading,” 17 C.F.R.

§ 240.10b-5(b). To meet this requirement, the plaintiff must

prove both that the omission is misleading and that it is

material. Id.

We apply the objective standard of a “reasonable

investor” to determine whether a statement is misleading. 

See In re VeriFone Sec. Litig., 11 F.3d 865, 869 (9th Cir.

1993). Section 10(b) and Rule 10b-5(b) “do not create an

affirmative duty to disclose any and all material information”

and instead require disclosure “only when necessary ‘to make

. . . statements made, in light of the circumstances under

which they were made, not misleading.’” Matrixx Initiatives,

Inc. v. Siracusano, 563 U.S. 27, 44 (2011) (quoting 17 C.F.R.

§ 240.10b-5(b)).

A misleading omission is material if “there is ‘a

substantial likelihood that [it] would have been viewed by the

reasonable investor as having significantly altered the “total

mix” of information made available’ for the purpose of

decisionmaking by stockholders concerning their

investments.” Retail Wholesale & Dep’t Store Union Loc.

338 Ret. Fund v. Hewlett-Packard Co., 845 F.3d 1268, 1274

(9th Cir. 2017) (quoting Basic Inc. v. Levinson, 485 U.S. 224,
IN RE ALPHABET, INC. SECURITIES LITIGATION 19

231–32 (1988)). The inquiry into materiality is “factspecific,” Matrixx Initiatives, 563 U.S. at 43 (quoting Basic,

485 U.S. at 236), and “requires delicate assessments of the

inferences a ‘reasonable shareholder’ would draw from a

given set of facts and the significance of those inferences to

him,” Fecht v. Price Co., 70 F.3d 1078, 1080 (9th Cir. 1995)

(quoting TSC Indus., Inc. v. Northway, Inc., 426 U.S. 438,

450 (1976)). “[T]hese assessments are peculiarly ones for the

trier of fact.” Id. (quoting TSC Indus., 426 U.S. at 450). As

a result, resolving materiality as a matter of law is generally

appropriate “only if the adequacy of the disclosure or the

materiality of the statement is so obvious that reasonable

minds could not differ.” Id. at 1081 (cleaned up); see Khoja

v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1014 (9th Cir.

2018) (same).

In evaluating whether an omission relating to

cybersecurity is materially misleading, we may consider the

SEC’s interpretive guidance regarding the adequacy of

cybersecurity-relateddisclosures. SeeCommission Statement

and Guidance on Public CompanyCybersecurityDisclosures,

Securities Act Release No. 33-10459, Exchange Act Release

No. 34-82746, 83 Fed. Reg. 8166-01, 8167 (Feb. 26, 2018)

(“Cybersecurity Disclosures”). Regardless of the degree of

deference such interpretive guidance may merit, see Kisor v.

Wilkie, 139 S. Ct. 2400, 2414–18 (2019), an SEC interpretive

release can “shed further light” on regulatory disclosure

requirements, NVIDIA, 768 F.3d at 1055. Agency

interpretations, like the SEC interpretive release here, can

provide “the judgments about the way the real world works”

that “are precisely the kind that agencies are better equipped

to make than are courts.” See Pension Benefit Guar. Corp. v.

LTV Corp., 496 U.S. 633, 651 (1990); see also Kisor, 139 S.

Ct. at 2413 (“[W]hen new issues demanding new policy calls
20 IN RE ALPHABET, INC. SECURITIES LITIGATION

come up within that [statutory]scheme, Congress presumably

wants the same agency, rather than any court, to take the

laboring oar.”).

We have held that “transparently aspirational”

statements, Hewlett-Packard, 845 F.3d at 1278, as well as

statements of “mere corporate puffery, vague statements of

optimism like ‘good,’ ‘well-regarded,’ or other feel good

monikers,” are generally not actionable as a matter of law,

because “professional investors, and most amateur investors

as well, know how to devalue the optimism of corporate

executives,” Police Ret. Sys. of St. Louis v. Intuitive Surgical,

Inc., 759 F.3d 1051, 1060 (9th Cir. 2014) (quoting In re

Cutera Sec. Litig., 610 F.3d 1103, 1111 (9th Cir. 2010)). 

Such statements rise to the level of materially misleading

statements only if they provide “concrete description of the

past and present” that affirmatively create a plausibly

misleading impression of a “state of affairs that differed in a

material way from the one that actually existed.” See In re

Quality Sys., Inc. Sec. Litig. (Quality Systems), 865 F.3d

1130, 1144 (9th Cir. 2017) (cleaned up).

The second element of a typical Section 10(b) claim,

scienter, is not set forth in the statute. Rather, the Supreme

Court has determined that “[t]he words ‘manipulative or

deceptive’ used in conjunction with ‘device or contrivance’

strongly suggest that § 10(b) was intended to proscribe

knowing or intentional misconduct.” Ernst & Ernst v.

Hochfelder, 425 U.S. 185, 197 (1976). We have since held

that “a reckless omission of material facts” satisfies the

element of scienter, Hollinger v. Titan Cap. Corp., 914 F.2d

1564, 1568–70 (9th Cir. 1990) (en banc) (quoting Sundstrand

Corp. v. Sun Chem. Corp., 553 F.2d 1033, 1044 (7th Cir.

1977)), provided that such recklessness “reflects some degree
IN RE ALPHABET, INC. SECURITIES LITIGATION 21

of intentional or conscious misconduct,” In re Silicon

Graphics Inc. Sec. Litig., 183 F.3d 970, 977 (9th Cir. 1999),

abrogated in part on other grounds, S. Ferry LP, No. 2 v.

Killinger (South Ferry), 542 F.3d 776, 783–84 (9th Cir.

2008). We refer to this standard as “deliberate recklessness”

and define it as “‘an extreme departure from the standards of

ordinary care,’ which ‘presents a danger of misleading buyers

or sellers that is either known to the defendant or is so

obvious that the actor must have been aware of it.’” Nguyen

v. Endologix, Inc., 962 F.3d 405, 414 (9th Cir. 2020) (quoting

Schueneman v. Arena Pharm., Inc., 840 F.3d 698, 705 (9th

Cir. 2016)).

In addition to these substantive elements, a plaintiff

bringing a securities fraud action must also meet the

heightened pleading standards imposed by the Private

Securities Litigation Reform Act (PSLRA) for pleading,

among other things, “[m]isleading statements and omissions”

and “[r]equired state of mind.” 15 U.S.C. § 78u-4(b)(1)–(2). 

Under these standards, if the plaintiff alleges that the

defendant “omitted to state a material fact necessary in order

to make the statements made, in the light of the circumstances

in which they were made, not misleading,” then

the complaint shall specify each statement

alleged to have been misleading, the reason or

reasons why the statement is misleading, and,

if an allegation regarding the statement or

omission is made on information and belief,

the complaint shall state with particularity all

facts on which that belief is formed.

15 U.S.C. § 78u-4(b)(1). Likewise, when a plaintiff must

prove “that the defendant acted with a particular state of
22 IN RE ALPHABET, INC. SECURITIES LITIGATION

mind,” then “the complaint shall, with respect to each act or

omission alleged to violate this chapter, state with

particularity facts giving rise to a strong inference that the

defendant acted with the required state of mind.” 15 U.S.C.

§ 78u-4(b)(2)(A); see also Fed. R. Civ. P. 9(b). For pleading

scienter, we assess “all the allegations holistically” to

determine whether the inference of scienter is “cogent and

compelling.” Tellabs, 551 U.S. at 324, 326. “[M]erely

‘reasonable’ or ‘permissible’” inferences are insufficient. Id.

at 324. As a result, courts must “take into account plausible

opposing inferences” and determine that “a reasonable person

would deem the inference of scienter cogent and at least as

compelling as any opposing inference one could draw from

the facts alleged.” Id. at 323, 324.

Finally, in addition to alleging violations under Section

10(b), Rhode Island also alleges violations of Section 20(a)

of the Exchange Act, 15 U.S.C. § 78t(a). Section 20(a)

imposes liability on a person who is in control of the person

who is directly responsible for a securities fraud violation:

Every person who, directly or indirectly,

controls any person liable under any provision

of this chapter or of any rule or regulation

thereunder shall also be liable jointly and

severally with and to the same extent as such

controlled person to any person to whom such

controlled person is liable . . . , unless the

controlling person acted in good faith and did

not directly or indirectly induce the act or acts

constituting the violation or cause of action.

15 U.S.C. § 78t(a). SEC regulations define “control” to mean

“the possession, direct or indirect, of the power to direct or
IN RE ALPHABET, INC. SECURITIES LITIGATION 23

cause the direction of the management and policies of a

person, whether through the ownership of voting securities,

by contract, or otherwise.” 17 C.F.R. § 230.405. To establish

a cause of action under Section 20(a), “a plaintiff must first

prove a primary violation of underlying federal securities

laws, such as Section 10(b) or Rule 10b-5, and then show that

the defendant exercised actual power over the primary

violator.” NVIDIA, 768 F.3d at 1052. We have held that the

inquiry into actual power or control “is normally an ‘intensely

factual question.’” Zucco Partners, LLC v. Digimarc Corp.,

552 F.3d 981, 990 (9th Cir. 2009) (quoting Paracor Fin., Inc.

v. Gen. Elec. Cap. Corp., 96 F.3d 1151, 1161 (9th Cir.

1996)). Nevertheless, “if a plaintiff fails to adequately plead

a primary violation,” then Section 20(a) claims “may be

dismissed summarily.” Id.

III

The district court grantedAlphabet’s motion to dismiss on

the grounds that Rhode Island failed to adequately allege a

materially misleading misrepresentation or omission and that

Rhode Island failed to adequately allege scienter. We

therefore focus on these two bases for the district court’s

decision.

A

The complaint identifies a dozen allegedly misleading

statements, but we begin by considering two statements made

by Alphabet in its quarterly reports filed with the SEC on

Form 10-Q in April 2018 and July 2018. We conclude that

the complaint adequately alleges that these two statements

omitted material facts necessary to make the statements not

misleading.
24 IN RE ALPHABET, INC. SECURITIES LITIGATION

The April 2018 report for the period ending March 31,

2018, stated that Alphabet’s “operations and financial results

are subject to variousrisks and uncertainties,” including those

identified in Alphabet’s Annual Report on Form 10-K for the

year ended December 31, 2017, and asserted that “[t]here

have been no material changes to our risk factors since our

Annual Report on Form 10-K for the year ended December

31, 2017.”4 The 2017 10-K had warned, among other things,

that even unfounded concerns about Alphabet’s “practices

with regard to the collection, use, disclosure, or security of

personal information or other privacy related matters” could

damage the company’s “reputation and adversely affect [its]

operating results.” Alphabet’s April and July 2018 10-Qs

make no mention of the Three-Year Bug or other security

vulnerabilities identified in the Privacy Bug Memo.

Given that the April 10-Q filing was made after the

detection of Google’s cybersecurity issues, after internal

deliberation based on the Privacy Bug Memo, and during the

growing scrutiny following the Cambridge Analytica scandal,

the complaint plausibly alleges that the omission of any

mention of the Three-Year Bug or the other security

vulnerabilities made the statements in each Form 10-Q

materially misleading to a reasonable investor and

significantly altered the total mix of information available to

investors.

The complaint plausibly alleges that Alphabet’s omission

was material. Among other allegations in the complaint,

Alphabet’s risk disclosures in the 2017 10-K warned of the

harms that could follow from the detection and disclosure of

4 Alphabet’s July 2018 Form 10-Q, for the quarter ending June 30,

2018, is substantively identical.
IN RE ALPHABET, INC. SECURITIES LITIGATION 25

security vulnerabilities, including public concerns about

privacy and regulatory scrutiny. Public statements by Google

and Alphabet executives similarly demonstrated the

importance of user trust and public perceptions of security

and privacy practices for the products and services central to

Alphabet’s business. The scale of the data-privacy and

security-vulnerability problems identified in the Privacy Bug

Memo further supports the allegations that these problems

were material. Indeed, the Privacy Bug Memo itself warned

of the significant consequences of the problems discovered

and of their disclosure. The market reaction, increased

regulatory and governmental scrutiny, both in the United

States and abroad, and media coverage alleged by the

complaint to have occurred after disclosure all support the

materiality of the misleading omission.

Finally, the SEC’s guidance on when companies should

disclose “cybersecurity incidents” also supports the

conclusion that Alphabet’s omission was material. See

Cybersecurity Disclosures, 83 Fed. Reg. at 8169.5In

determining disclosure obligations and “[t]he materiality of

cybersecurity risks and incidents,” the SEC advises that

companies should weigh, among other things, “harm to a

company’s reputation, financial performance, and customer

and vendor relationships, as well as the possibility of

litigation or regulatory investigations or actions, including

regulatory actions by state and federal governmental

authorities and non-U.S. authorities.” Id. at 8168–69. Here,

5

 The SEC defines a “cybersecurity incident” as an “occurrence that

actually or potentially results in adverse consequences to an information

system or the information that the system processes, stores, or transmits

and that may require a response action to mitigate the consequences.” 

Cybersecurity Disclosures, 83 Fed. Reg. at 8166 n.3 (cleaned up).
26 IN RE ALPHABET, INC. SECURITIES LITIGATION

the complaint plausibly alleges that these risks of harm

ripened into actual harm when the Privacy Bug was detected

and created the new risk that this discovery would become

public.

The complaint also plausibly alleges that Alphabet’s

omission was misleading. Risk disclosures that “speak[]

entirely of as-yet-unrealized risks and contingencies” and do

not “alert[] the reader that some of these risks may already

have come to fruition” can mislead reasonable investors. See

Berson v. Applied Signal Tech., Inc., 527 F.3d 982, 985–87

(9th Cir. 2008). In Berson, we held that the company’s

statement of anticipated revenues from its large backlog of

work was misleading because it failed to disclose that a

significant portion of the “backlogged” work was

“substantially delayed and at serious risk of being cancelled

altogether.” Id. at 986. Similarly, we explained that a 10-Q

statement that warned of “the risks of product liability claims

in the abstract” was misleading because it failed to disclose

that the risk had already come to fruition. Siracusano v.

Matrixx Initiatives, Inc., 585 F.3d 1167, 1181 (9th Cir. 2009)

(citing Berson, 527 F.3d at 986), aff’d, 563 U.S. 27 (2011). 

Even more recently, we held that a company’s warning in its

Form 10-Q that share prices “might” be affected by

announcements of study results that “may” be inconsistent

with interim study results was misleading because the

company “allegedly knew already that the ‘new data’

revealed exactly that.” Khoja, 899 F.3d at 1015–16; cf.

Wochos v. Tesla, Inc., 985 F.3d 1180, 1195–96 (9th Cir.

2021) (rejecting the argument that a risk disclosure’s

forward-looking statements “constituted misleading

omissions about current or past challenges” because the

disclosure also acknowledged that the company had already

experienced “the sort of ‘challenges’ that it would have to
IN RE ALPHABET, INC. SECURITIES LITIGATION 27

overcome in order to achieve its stated objective”).6 As in

these cases, the complaint plausibly alleges that Alphabet’s

warning in each Form 10-Q of risks that “could” or “may”

occur is misleading to a reasonable investor when Alphabet

knew that those risks had materialized.

Alphabet makes several arguments against this

conclusion. First, Alphabet argues that any omission from

the Form 10-Qs was not misleading because Google had

already remediated the software glitch in Google+ before it

made the 10-Q statements. Because the risks caused by the

software glitch had been remediated, Alphabet argues, Rhode

Island cannot rely on the cases holding that a company’s

warning of future risks is misleading if those risks have

already materialized. This argument fails for several reasons. 

Given that Google’s business model is based on trust, the

material implications of a bug that improperly exposed user

data for three years were not eliminated merely by plugging

the hole in Google+’s security. The existence of the software

glitch for a three-year period, which exposed the private

information of hundreds of thousands of Google+ users, and

the fact that Google was unable to determine the scope and

impact of the glitch, indicated that there were significant

problems with Google’s security controls. Google had long

recognized that in an industry based on security and privacy,

the public disclosure of serious failings in this area would

have wide-ranging effects, including erosion of consumer

confidence and increased regulatory scrutiny. Further, the

6

In light of our precedent, we decline to follow the Sixth Circuit’s

unpublished decision in Bondali v. Yum! Brands, Inc., which held that a

statement disclosing future harms generally would not mislead a

reasonable investor about the current state of a corporation’s operations. 

620 F. App’x 483, 490–91 (6th Cir. 2015).
28 IN RE ALPHABET, INC. SECURITIES LITIGATION

Privacy Bug Memo was not limited to discussing the

discovery of the software glitch that had been remediated

because it highlighted additional security vulnerabilities that

were so significant that they allegedly led to Google’s

decision to shut down the Google+ consumer platform.

Second, Alphabet contends that the 10-Q omissions were

not material because the software bug did not lead to the

release of sensitive information like financial or medical

information or cause harm to any user and because

Alphabet’s revenue increased from $12 billion to $30 billion

between 2017 and 2018. These arguments fail because a

cybersecurity incident may be material even if it does not

compromise sensitive financial or medical information or

have an immediate financial impact on the company. The

standard is whether there is a “substantial likelihood” that the

information at issue “would have been viewed by the

reasonable investor as having significantly altered the total

mix of information made available for the purpose of

decisionmaking by stockholders concerning their

investments.” Hewlett-Packard, 845 F.3d at 1274 (cleaned

up). Because cybersecurity incidents may cause a range of

substantial costs and harms,7

reasonable investors would

likely find omissions regarding significant cybersecurity

incidents material to their decisionmaking. The likelihood is

particularly substantial here, given the nature of Alphabet’s

business. As the SEC has explained, the materiality of

7

See Cybersecurity Disclosures, 83 Fed. Reg. at 8167–69 & n.32

(noting that a cybersecurity incident can cause a company to incur

remediation costs, increased cybersecurity protection costs, lost revenues,

harm to customer retention or attraction, litigation and legal risks,

increased insurance premiums, reputational damage, and damage to stock

price and shareholder value).
IN RE ALPHABET, INC. SECURITIES LITIGATION 29

compromised information may “depend on the nature of the

company’s business” and “the scope of the compromised

information.” Id. at 8169 n.33. Here, for instance, the

complaint alleges that the Wall Street Journal article resulted

in a swift stock price decline, legislative scrutiny, and public

reaction, all of which support the allegation that the Privacy

Bug was material even absent a release of sensitive

information or revenue decline.

Applying our objective materiality standard to the 10-Qs

here, Rhode Island’s complaint plausibly alleges the

materiality of the costs and consequences associated with the

Privacy Bug, and its public disclosure, and how Alphabet’s

decision to omit information about the Privacy Bug in its 10-

Qs significantly altered the total mix of information available

for decisionmaking by a reasonable investor.

B

We now consider whether the complaint adequately

alleges scienter for the materially misleading omissions from

the 10-Q statements. Because Rule 10b-5 makes it unlawful

“[t]o make any untrue statement” or to omit material facts

necessary to make “the statements made” not misleading,

17 C.F.R. § 240.10b-5(b) (emphasis added), we must first

determine who was the maker of the statement for purposes

of Section 10(b) and Rule 10b-5(b) and whether the

complaint adequately alleged that the maker omitted material

information knowingly, intentionally, or with deliberate

recklessness. In other words, the complaint must plausibly

allege, with the particularity required by the PSLRA, that the

maker of the statements knew about the security

vulnerabilities and intentionally or recklessly did not disclose

them.
30 IN RE ALPHABET, INC. SECURITIES LITIGATION

Alphabet is at least one alleged maker of the 10-Q

statements here, because Alphabet has “ultimate authority

over the statement, including its content and whether and how

to communicate it,” Janus, 564 U.S. at 142.8

Because Alphabet is a corporation, it “‘can only act

through its employees and agents’ and can likewise only have

scienter through them.” In re ChinaCast Educ. Corp. Sec.

Litig., 809 F.3d 471, 475 (9th Cir. 2015) (quoting Suez Equity

Invs., L.P. v. Toronto-Dominion Bank, 250 F.3d 87, 101 (2d

Cir. 2001)). We have explained that the “scienter of the

senior controlling officers of a corporation may be attributed

to the corporation itself to establish liability as a primary

violator of § 10(b) and Rule 10b-5 when those senior officials

were acting within the scope of their apparent authority.” Id.

at 476 (quoting Adams v. Kinder-Morgan, Inc., 340 F.3d

1083, 1106–07 (10th Cir. 2003)).

The complaint’s specific allegations, taken as a whole,

raise a strong inference that Page, and therefore Alphabet,

knew about the Three-Year Bug, the Privacy Bug, and the

Privacy Bug Memo, and that Alphabet intentionally did not

disclose this information in its 10-Q statements.

The complaint’s allegations, read as a whole, raise a

strong inference that Alphabet was aware of the information

in the Privacy Bug Memo. In this case, the complaint alleges

that Pichai and other Google senior executives read the

Privacy Bug Memo, and so necessarily knew of the ThreeYear Bug and other security vulnerabilities, before Alphabet

8 The complaint does not allege, and Rhode Island does not argue,

that Page is a maker of the 10-Q statements for purposes of Section 10(b)

and Rule 10b-5. We therefore do not address this issue.
IN RE ALPHABET, INC. SECURITIES LITIGATION 31

made its April 2018 10-Q statement. The complaint alleges

with particularity that the memo informed senior executive

leadership at Google of the scope of the problem, warned of

the consequences of disclosure, and presented Google

leadership with a clear decision on whether to disclose those

problems. See South Ferry, 542 F.3d at 785–86 (describing

“actual access to the disputed information” as supporting a

strong inference of scienter).

The complaint also raises a strong inference that Pichai

communicated this information to Page, and therefore Page

was also aware of the Three-Year Bug and other security

vulnerabilities before he signed the April 2018 10-Q

statement. Although the complaint does not directly allege

that Page read the Privacy Bug Memo, we may consider a

senior executive’s role in a company to determine whether

there is a cogent and compelling inference that the senior

executive knew of the information at issue. Id. at 785. This

includes consideration of the executive’s access to the

information, and, whether, given the importance of the

information, “it would be ‘absurd’ to suggest that

management was without knowledge of the matter.” Id. at

786 (quoting Berson, 527 F.3d at 988).

Here, numerous allegations in the complaint raise the

strong inference that Page was vitally concerned with

Google’s operations. See id. at 785–86. Specifically, the

complaint alleges that Alphabet is essentially a holding

company for Google (i.e., Google was the “lifeblood” of

Alphabet). Page, the former CEO of Google, received

weekly reports of Google’s operating results and made “key

operating decisions” at Google. Pichai, as the replacement

CEO of Google, reported directly to Page. Moreover, the

complaint alleges that Pichai and Page together approved a
32 IN RE ALPHABET, INC. SECURITIES LITIGATION

plan in spring 2018 to shut down Google+ because of the

security concerns revealed by the Privacy Bug Memo. Taken

together, these specific allegations raise the strong inference

that Pichai informed Page of any information regarding

Google’s operations that was material and that there was

shared decision-making on key issues. See id. (identifying a

combination of allegations regarding corporate structure,

importance of information, and exposure to factual

information that “may be relevant and help to satisfy the

PSLRA scienter requirement”). The complaint also cogently

alleges that the Three-Year Bug and other security

vulnerabilities that were disclosed in the Privacy Bug Memo

were highly material to Google’s operations, for the reasons

explained above.

Therefore, considering these allegations together, there is

a strong inference that Page knew of these problems and the

consequences of disclosure when Alphabet made its 10-Q

statements in April and July 2018. The competing

inference—that Pichai concealed “the largest data-security

vulnerability in the history of two Companies whose

existence depends on data security” from the CEO of

Alphabet at a time when social media networks were under

immense regulatory and governmental scrutiny—is not

plausible. Accordingly, we conclude there is a strong

inference that Page had the requisite knowledge, which can

be imputed to Alphabet. ChinaCast, 809 F.3d at 475.

For the same reasons, there is an equally strong inference

that, armed with this knowledge, Alphabet intentionally did

not disclose the cybersecurity information to the public in

order to avoid or delay the impacts disclosure could have on

regulatory scrutiny, public criticism, and loss of consumer

confidence. The complaint also alleges that Pichai approved
IN RE ALPHABET, INC. SECURITIES LITIGATION 33

a cover-up to avoid regulatory scrutiny and testimony before

Congress. The complaint alleges that “key officers and

directors,” including Page and Pichai, “had decided to

conceal all of this information from everyone outside the

Companies.” This decision to conceal was calculated to “buy

time” by avoiding putting Google in the spotlight alongside

the Facebook-Cambridge Analytica scandal and at the time of

heightened public and regulatory scrutiny. As it turned out,

Alphabet successfully bought itself about six months of time

between the April 2018 decision not to disclose and the

October 2018 publication of the Wall Street Journal article. 

Again, the competing inference that Alphabet knew of this

information but was merely negligent in not disclosing it is

not plausible.

Finally, Alphabet argues that the complaint does not raise

a strong inference that Alphabet intentionally omitted

material information from its 10-Q statement because the

complaint does not allege that company officials made

suspicious stock sales or include allegations fromconfidential

witnesses. This argument fails. Although such allegations

may support an inference of scienter, they are not a sine qua

non for raising such an inference. See, e.g., Siracusano,

585 F.3d at 1180–83 (rejecting need for stock sales and

identifying sufficient scienter allegations without witnesses);

No. 84 Employer-Teamster Joint Council Pension Tr. Fund

v. Am. W. Holding Corp., 320 F.3d 920, 944 (9th Cir. 2003)

(“[T]he lack of stock sales by a defendant is not dispositive

as to scienter.”). Allegations of suspicious stock sales or

information from confidential witnesses are not needed

where, as here, other allegations in the complaint raise a

strong inference of scienter. Alphabet also argues that

because Google fixed the Three-Year Bug and no users were

harmed, Alphabet’s failure to disclose does not support a
34 IN RE ALPHABET, INC. SECURITIES LITIGATION

strong inference of scienter. This argument is little more than

a restatement of Alphabet’s contention, which we have

already rejected, that the Three-Year Bug and the Privacy

Bug were not material because they had been remediated. 

See supra Part III.A.

Rhode Island adequately alleged falsity, materiality, and

scienter for the April 2018 and July 2018 10-Q statements. 

We therefore reverse the district court’s holdings to the

contrary. The defendants’ motion to dismiss did not

challenge the remaining elements of the Section 10(b) and

Rule 10b-5(b) statement liability claims for these or other

statements, so we do not address the elements of connection

to the sale of a security, reliance, economic loss, or loss

causation.

Because we reverse the district court’s dismissal of 

Rhode Island’s claims related to Alphabet’s 10-Q statements,

we also reverse its dismissal of the complaint’s Section 20(a)

claims based on those statements, which allege that Pichai

and Page were controlling persons of Alphabet under Section

20(a). The district court dismissed these claims solely on the

ground that Rhode Island failed to state a claim for a primary

violation of Section 10(b) and Rule 10b-5. We remand to the

district court to reconsider Pichai and Page’s liability under

Section 20(a) in light of our holding today.

C

We now consider the ten remaining statements identified

in the complaint.

First, the complaint identifies statements made in two

earnings calls in April and July 2018 by Ellen West,
IN RE ALPHABET, INC. SECURITIES LITIGATION 35

Alphabet’s Head of Investor Relations. According to the

complaint, after noting that “[s]ome of the statements that we

make today may be considered forward looking” and that

“[t]hese statements involve a number of risks and

uncertainties that could cause actual results to differ

materially,” West stated: “For more information, please refer

to the risk factors discussed in our Form 10-K for 2017 filed

with the SEC.”9 These statements alone did not plausibly

give a reasonable investor the “impression of a state of affairs

that differs in a material way from the one that actually

exists,” Hewlett-Packard, 845 F.3d at 1275 (quoting Berson,

527 F.3d at 985), because, unlike the 2018 10-Q statements,

West’s statement did not include the express assurance that

there had been “no material changes” to Alphabet’s risk

factors since the 2017 10-K filing.

Second, the complaint identifies statements made by

Pichai, three senior Google executives, and an Alphabet

proxy statement. These statements emphasize Google’s and

Alphabet’s commitment to user privacy, data security, and

regulatory compliance and discuss Google and Alphabet’s

ongoing efforts to secure user data and work on GDPR

compliance. For instance, the complaint alleges that, on the

April 2018 earnings call for Alphabet, Pichai assured the

public and investors that Google “started working on GDPR

compliance over 18 months ago and ha[d] been very, very

engaged on it” and that Google has a “very robust and strong

privacy program.” Similarly, in an April 2018 letter to

Senator Grassley, a senior Google executive stated that

“Google has a longstanding commitment to ensuring both that

our users share their data only with developers they can trust,

9 The complaint alleges that West’s statements on the April 2018 and

July 2018 earnings calls were substantively identical.
36 IN RE ALPHABET, INC. SECURITIES LITIGATION

and that they understand how developers will use that data”

and that Google was “committed to protecting our users’ data

and prohibit[s] developers from requesting access to

information they do not need.” Google executives elsewhere

touted Alphabet as “one of the leading companies when it

comes to privacy and security of user data,” explained that

Alphabet was taking “great pains to make sure that people

have great control and notice over their data,” and affirmed

that the “foundation of [Google’s] business is the trust of

people that use our services.”

While these statements are relevant and were made while

Google and Alphabet allegedly chose a strategy of

concealment over disclosure, these statements do not rise to

the level of “concrete description of the past and present”

that affirmatively create a misleading impression of a “state

of affairs that differed in a material way from the one that

actually existed.” Quality Systems, 865 F.3d at 1144 (cleaned

up). They instead amount to vague and generalized corporate

commitments, aspirations, or puffery that cannot support

statement liability under Section 10(b) and Rule 10b-5(b). 

See Hewlett-Packard, 845 F.3d at 1278; Intuitive Surgical,

759 F.3d at 1060.

Finally, the complaint alleges that Page and Pichai

decided not to testify before the United States Senate

Intelligence Committee in September 2018 alongside

Facebook and Twitter, which left “an empty chair for

Google.” An empty chair is neither a statement of material

fact nor the misleading omission of a material fact. See

17 C.F.R. § 240.10b-5(b); see also Hewlett-Packard,

845 F.3d at 1278.
IN RE ALPHABET, INC. SECURITIES LITIGATION 37

Because the complaint does not plausibly allege that these

remaining statements are misleading material

misrepresentations or omissions, we affirmthe district court’s

dismissal of the Section 10(b) and Rule 10b-5(b) statement

liability claims based on these statements. We also affirm the

district court’s dismissal of the Section 20(a) controllingperson claims for these statements.

IV

Finally, Rhode Island argues on appeal that the district

court erred in dismissing its claims under Rule 10b-5(a) and

(c) (referred to in the complaint as a “scheme liability claim”)

when it dismissed the complaint in its entirety without

addressing those claims. In its complaint, Rhode Island

alleged that the defendants “disseminated or approved the

statements” alleged to be materially misleading and “engaged

and participated in a continuous course of conduct to conceal

the truth and/or adverse material information about

Alphabet’s business and operations.”

Alphabet argues that Rhode Island waived these claims

because it failed to raise them to the district court in

opposition to Alphabet’s motion to dismiss. Alphabet also

contends that the complaint’s claims under Rule 10b-5(a) and

(c) are duplicative of the claims under Rule 10b-5(b) seeking

to hold the defendants liable for misleading statements. Both

arguments fail.

First, because Alphabet’s motion to dismiss did not target

Rhode Island’s Rule 10b-5(a) and (c) claims, Rhode Island

did not waive those claims by failing to address them in

opposition to the motion to dismiss. A party’s failure to

oppose an argument that was not made does not constitute a
38 IN RE ALPHABET, INC. SECURITIES LITIGATION

waiver. Second, Alphabet’s argument that Rule 10b-5(a) and

(c) claims cannot overlap with Rule 10b-5(b) statement

liability claims is foreclosed by Lorenzo, which rejected the

petitioner’s argument that Rule 10b-5(a) and (c) “concern

‘scheme liability claims’ and are violated only when conduct

other than misstatements is involved.” 139 S. Ct.

at 1101–02.10 Rather, Lorenzo explained that “considerable

overlap” exists among the subsections of Rule 10b-5 and held

that disseminating false statements “ran afoul of subsections

(a) and (c).” Id. at 1102.

Because the district court erred in sua sponte dismissing

Rhode Island’s claims under Rule 10b-5(a) and (c) when

Alphabet had not targeted those claims in its motion to

dismiss, we reverse dismissal of the claims under

Section 10(b) and Rule 10b-5(a) and (c) against all

defendants and remand to the district court. See Golden Gate

Hotel Ass’n v. City & County of San Francisco, 18 F.3d 1482,

1487 (9th Cir. 1994); see also Reed v. Lieurance, 863 F.3d

1196, 1207–08 (9th Cir. 2017) (reversing sua sponte

dismissal). We also reverse the dismissal of Rhode Island’s

claims under Section 20(a) to the extent those claims depend

on claims alleging violations of Rule 10b-5(a) and (c).

REVERSED IN PART, AFFIRMED IN PART,

JUDGMENTVACATED,REMANDEDFORFURTHER

PROCEEDINGS.11

10 In reaching this holding, Lorenzo abrogated our contrary holding in

WPP Luxembourg Gamma Three Sarl v. Spot Runner, Inc., 655 F.3d

1039, 1057–58 (9th Cir. 2011). See Lorenzo, 139 S. Ct. at 1100.

11 Each party will bear its own costs on appeal.