State of Rhode Island v. Alphabet, Inc.

                 FOR PUBLICATION

  UNITED STATES COURT OF APPEALS
       FOR THE NINTH CIRCUIT


IN RE ALPHABET, INC. SECURITIES           No. 20-15638
LITIGATION,
                                             D.C. No.
                                          4:18-cv-06245-
STATE OF RHODE ISLAND, Office of               JSW
the Rhode Island Treasurer on behalf
of the Employees’ Retirement
System of Rhode Island; Lead                OPINION
Plaintiff, Individually and On Behalf
of All Others Similarly Situated,
                   Plaintiff-Appellant,

                  v.

ALPHABET, INC.; LAWRENCE E.
PAGE; SUNDAR PICHAI; RUTH M.
PORAT; GOOGLE LLC; KEITH P.
ENRIGHT; JOHN KENT WALKER, JR.,
            Defendants-Appellees.


      Appeal from the United States District Court
         for the Northern District of California
       Jeffrey S. White, District Judge, Presiding

         Argued and Submitted February 4, 2021
               San Francisco, California

                   Filed June 16, 2021
2       IN RE ALPHABET, INC. SECURITIES LITIGATION

    Before: Sidney R. Thomas, Chief Judge, and Sandra S.
       Ikuta and Jacqueline H. Nguyen, Circuit Judges.

                      Opinion by Judge Ikuta


                            SUMMARY*


                          Securities Fraud

    The panel affirmed in part and reversed in part the district
court’s dismissal of a securities fraud action for failure to
state a claim, vacated the district court’s judgment, and
remanded for further proceedings.

    The State of Rhode Island filed a private securities fraud
action under §§ 10(b) and 20(a) of the Securities Exchange
Act of 1934 and SEC Rule 10b-5 against Google LLC, its
holding company Alphabet, Inc., and individual defendants.
The consolidated amended complaint alleged that defendants
omitted to disclose security problems with the Google+ social
network. The complaint referred to the cybersecurity
problems as the “Three-Year Bug” and the “Privacy Bug.”
The district court granted defendants’ motion to dismiss on
the grounds that Rhode Island failed to adequately allege a
materially misleading misrepresentation or omission and that
Rhode Island failed to adequately allege scienter.

   The panel held that the complaint adequately alleged that
two statements made by Alphabet in its quarterly reports filed

    *
      This summary constitutes no part of the opinion of the court. It has
been prepared by court staff for the convenience of the reader.
       IN RE ALPHABET, INC. SECURITIES LITIGATION             3

with the SEC on Form 10-Q omitted material facts necessary
to make the statements not misleading. Applying an
objective materiality standard to the 10-Qs, the panel held
that Rhode Island’s complaint plausibly alleged the
materiality of the costs and consequences associated with the
Privacy Bug, and its public disclosure, and how Alphabet’s
decision to omit information about the Privacy Bug in its 10-
Qs significantly altered the total mix of information available
for decisionmaking by a reasonable investor.

    The panel next addressed whether the complaint
adequately alleged scienter for the materially misleading
omissions from the 10-Q statements. The panel held that the
complaint was required to plausibly allege, with the
particularity required by the Private Securities Litigation
Reform Act, that the maker of the statements knew about the
security vulnerabilities and intentionally or recklessly did not
disclose them. The panel concluded that the complaint’s
specific allegations, taken as a whole, raised a strong
inference that defendant Lawrence Page, and therefore
Alphabet, knew about the Three-Year Bug, the Privacy Bug,
and a Privacy Bug Memo, and that Alphabet intentionally did
not disclose this information in its 10-Q statements.

    The panel further held that Rhode Island adequately
alleged falsity, materiality, and scienter for the 10-Q
statements. The panel therefore reversed the district court’s
holdings to the contrary. The panel also reversed the district
court’s dismissal of the complaint’s § 20(a) control-person
claims based on the 10-Q statements.

    As to ten additional statements identified in the
complaint, the panel concluded that the complaint did not
plausibly allege that these remaining statements were
4      IN RE ALPHABET, INC. SECURITIES LITIGATION

misleading material misrepresentations. The panel therefore
affirmed the district court’s dismissal of claims based on
these statements.

    Rhode Island argued on appeal that the district court erred
in dismissing its “scheme liability claim” under Rule 10b-5(a)
and (c) when it dismissed the complaint in its entirety without
addressing those claims. The panel held that because
Alphabet’s motion to dismiss did not target Rhode Island’s
Rule 10b-5(a) and (c) claims, Rhode Island did not waive
those claims by failing to address them in opposition to the
motion to dismiss. Reversing, the panel held that the district
court erred in sua sponte dismissing the Rule 10b-5(a) and (c)
claims when Alphabet had not targeted them in its motion to
dismiss.


                         COUNSEL

Jason A. Forge (argued), Michael Albert, J. Marco Janoski
Gray, and Ting H. Liu, Robbins Geller Rudman & Dowd
LLP, San Diego, California, for Plaintiff-Appellant.

Ignacio E. Salceda (argued), Benjamin M. Crosson, Cheryl
W. Foung, Stephen B. Strain, and Emily Peterson, Wilson
Sonsini Goodrich & Rosati, Palo Alto, California; Gideon A.
Schor, Wilson Sonsini Goodrich & Rosati, New York, New
York; for Defendants-Appellees.
       IN RE ALPHABET, INC. SECURITIES LITIGATION           5

                         OPINION

IKUTA, Circuit Judge:

    In March 2018, amid the furor caused by news that
Cambridge Analytica improperly harvested user data from
Facebook’s social network, Google discovered that a security
glitch in its Google+ social network had left the private data
of some hundreds of thousands of users (according to
Google’s estimate) exposed to third-party developers for
three years and that Google+ was plagued by multiple other
security vulnerabilities. Warned by its legal and policy staff
that disclosure of these issues would result in immediate
regulatory and governmental scrutiny, Google and its holding
company, Alphabet, chose to conceal this discovery, made
generic statements about how cybersecurity risks could affect
their business, and stated that there had been no material
changes to Alphabet’s risk factors since 2017. This appeal
raises the question whether, for purposes of a private
securities fraud action, the complaint adequately alleged that
Google, Alphabet, and individual defendants made materially
misleading statements by omitting to disclose these security
problems and that the defendants did so with sufficient
scienter, meaning with an intent to deceive, manipulate, or
defraud.

                              I

                              A

    At the motion to dismiss stage, we start with the facts
plausibly alleged in the complaint, documents incorporated
into the complaint by reference, and matters of which a court
may take judicial notice. See Ashcroft v. Iqbal, 556 U.S. 662,
6      IN RE ALPHABET, INC. SECURITIES LITIGATION

678–79 (2009); Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551
U.S. 308, 322 (2007). The story begins in the 1990s when
Lawrence Page and Sergey Brin, then students at Stanford
University, developed Google, a web-based search engine.
Over the next two decades, Google rapidly expanded beyond
its search engine services into a range of other internet-related
services and products, including advertising technology,
cloud computing, and hardware.

     Since its initial public offering prospectus in 2004 and
throughout Google’s continued rise, Google and its
executives publicly recognized the importance of user privacy
and user trust to Google’s business. Google executives
expressed their understanding that Google’s “success is
largely dependent on maintaining consumers’ trust” so that
“users will continue to entrust Google with their private data,
which Google can then monetize.” As one media outlet put
it, “Google has a strong incentive to position itself as a
trustworthy guardian of personal information because, like
Facebook, its financial success hinges on its success to learn
about the interests, habits and location[s] of its users in order
to sell targeted ads.” Google and its executives repeatedly
emphasized that maintaining users’ trust is essential and that
a significant security failure “would be devastating.”
Google’s public emphasis on user trust and user privacy
remained central to its business when, in 2011, Google
launched Google+ “in an attempt to make a social media
network to rival that of Facebook and Twitter, and to join all
users of Google services (i.e., Search, Gmail, YouTube,
Maps) into a single online identity.”

    In October 2015, Google restructured itself from Google,
Inc. into Google LLC and created Alphabet, Inc. as its parent
company, which is “essentially a holding company” whose
       IN RE ALPHABET, INC. SECURITIES LITIGATION           7

“lifeblood is Google.” Page, who had been the CEO of
Google, became the CEO of Alphabet. Sundar Pichai, a
longtime Google senior executive, replaced Page as the CEO
of Google. Page and Pichai both sat on Alphabet’s Board of
Directors and served on the board’s three-person Executive
Committee. Pichai directly reported to Page and maintained
regular contact with him; Pichai was also directly accountable
to Page. Pichai also participated in Alphabet’s public
earnings calls. Page received weekly reports of Google’s
operating results and continued to make “key operating
decisions” at Google.

   Google’s corporate restructuring did not change the
central importance of privacy and security. Google and
Alphabet consistently indicated that Google’s foremost
competitive advantage against other companies was its
sophistication in security. Thus, according to Alphabet’s
Chief Financial Officer in February 2018, security is “clearly
what we’ve built Google on.”

    While highlighting expertise in security and data privacy,
Google and Alphabet also acknowledged the substantial
impact that a cybersecurity failure would have on their
business. According to Alphabet’s 2017 Annual Report on
Form 10-K filed with the Securities and Exchange
Commission (SEC), “[c]oncerns about our practices with
regard to the collection, use, disclosure, or security of
personal information or other privacy related matters, even if
unfounded, could damage our reputation and adversely affect
our operating results.” Alphabet warned that “[i]f our
security measures are breached resulting in the improper use
and disclosure of user data” then Alphabet’s “products and
services may be perceived as not being secure, users and
customers may curtail or stop using our products and
8      IN RE ALPHABET, INC. SECURITIES LITIGATION

services, and we may incur significant legal and financial
exposure.” As Pichai explained in January 2018, “users use
Google because they trust us and it is something easy to lose
if you are not good stewards of it. So we work hard to earn
the trust every day.”

                              B

    “By the spring of 2018, the trustworthiness of technology
and those who control it were under unprecedented scrutiny.”
According to the complaint, a trigger for this scrutiny was the
publication of reports that a research firm, Cambridge
Analytica, “improperly harvested data from Facebook users’
profiles” to be used for political advertising. The immediate
effects of this reporting were “devastating to Facebook and its
investors,” including a 13% decline in Facebook’s stock
price, which amounted to a loss of approximately $75 billion
of market capitalization.

    This scandal quickly led to congressional hearings into
Facebook’s leak of user information to a third-party data
collector. Facebook was not the only target of scrutiny, as the
Senate Judiciary Committee, chaired by Senator Grassley,
requested that Google and Twitter testify at these hearings
about their data privacy and security practices. In a letter to
Pichai, Senator Grassley outlined the committee’s
“significant concerns regarding the data security practices of
large social media platforms and their interactions with third
party developers and other commercial[] users of such data.”
According to Senator Grassley, Pichai declined to testify after
“asserting that the problems surrounding Facebook and
Cambridge Analytica did not involve Google.”
       IN RE ALPHABET, INC. SECURITIES LITIGATION            9

    At around the same time, in May 2018, the European
Union implemented the General Data Protection Regulation
(GDPR), a new framework for regulating data privacy
protections in all member states. Among other things, the
GDPR required prompt disclosure of personal data breaches,
not later than 72 hours after learning of the breach. On its
website, Google reaffirmed its commitment to complying
with the GDPR across all its services and reaffirmed
Google’s aim “always to keep data private and safe.”

                              C

    While external scrutiny of data privacy and security grew
in March and April 2018, internal Google investigators had
discovered a software glitch in the Google+ social network
that had existed since 2015 (referred to in the complaint as
the “Three-Year Bug”). Because of a bug in an application
programming interface for Google+, third-party developers
could collect certain users’ profile data even if those users
had relied on Google’s privacy settings to designate such data
as nonpublic. The exposed private profile data included
email addresses, birth dates, gender, profile photos, places
lived, occupations, and relationship status.

    Not only did Google’s security protocols fail to detect the
problem for three years, but Google also had a limited set of
activity logs that could review only the two most recent
weeks of user data access. Due to this record-keeping
limitation, Google “had no way of determining how many
third-parties had misused its users’ personal private data.”
And Google “could only estimate that it exposed to third-
parties the personal private data of hundreds of thousands of
users” based on “less than 2% of the Three-Year Bug’s
lifespan.” Despite the efforts of “over 100 of Google’s best
10     IN RE ALPHABET, INC. SECURITIES LITIGATION

and brightest,” Google “could not confirm the damage from
[the bug] or determine the number of other bugs.” At the
same time, this investigation into the Three-Year Bug
detected other shortcomings in Google’s security systems,
including “previously unknown, or unappreciated, security
vulnerabilities that made additional data exposures virtually
inevitable.” The complaint refers collectively to the Three-
Year Bug and these additional vulnerabilities as the “Privacy
Bug.”

    Around April 2018, Google’s legal and policy staff
prepared a memo detailing the Three-Year Bug and the
additional vulnerabilities (referred to in the complaint as the
“Privacy Bug Memo”). According to the complaint, the
Privacy Bug Memo warned that the disclosure of these
security issues “would likely trigger ‘immediate regulatory
interest’ and result in defendants ‘coming into the spotlight
alongside or even instead of Facebook despite having stayed
under the radar throughout the Cambridge Analytica
scandal.’” The memo warned that “disclosure ‘almost
guarantees Sundar [Pichai] will testify before Congress.’”

    According to the complaint, Pichai and other senior
Google executives received and read the memo in early April
2018. The complaint alleges that key officers and directors,
including Page and Pichai, chose a strategy of nondisclosure.
Pichai approved a plan to conceal the existence of the Three-
Year Bug and other security vulnerabilities described in the
Privacy Bug Memo “to avoid any additional regulatory
scrutiny, including having to testify before Congress.”
Further, despite Google+ having 395 million monthly active
users, more than either Twitter or Snapchat, Pichai and Page
approved a plan to shut down the Google+ consumer
platform.
       IN RE ALPHABET, INC. SECURITIES LITIGATION           11

                              D

    Despite the information in the Privacy Bug Memo,
Alphabet and Google continued to give the public the same
assurances about security and privacy as before. In
particular, on April 23, 2018, Alphabet filed its quarterly
report on Form 10-Q for the period ending March 31, 2018.
The 10-Q incorporated the risk disclosures from Alphabet’s
2017 10-K and made no disclosure about the Privacy Bug. It
stated:

       Our operations and financial results are
       subject to various risks and uncertainties,
       including those described in Part I, Item 1A,
       “Risk Factors” in our Annual Report on Form
       10-K for the year ended December 31, 2017,
       which could adversely affect our business,
       financial condition, results of operations, cash
       flows, and the trading price of our common
       and capital stock. There have been no
       material changes to our risk factors since our
       Annual Report on Form 10-K for the year
       ended December 31, 2017.

(emphasis added). Nor did Alphabet make any disclosure
during an earnings call on the same day. Months later, in July
2018, Alphabet filed its Form 10-Q for the period ending
June 30, 2018. This filing included a risk disclosure
substantially identical to the one in the April 2018 filing; it
likewise incorporated the 2017 Form 10-K risk factors and
affirmed that no material changes occurred. Nor did
12       IN RE ALPHABET, INC. SECURITIES LITIGATION

Alphabet make any disclosure of the problems during its July
2018 earnings call.1

     The complaint identifies statements made by Alphabet,
Google, and their employees between April and October 2018
that continued to reference user security and data privacy
while making the same omission regarding any Google+
problems. According to the complaint, Alphabet thought that
this “decision to buy time” would reduce the detrimental
effects of eventual disclosure by avoiding disclosure at a time
when Facebook was facing regulatory scrutiny, public
criticism, and loss of consumer confidence as a result of the
Cambridge Analytica scandal.

                                   E

    Six months after this decision to buy time, the Wall Street
Journal exposed Google’s discovery of Google+’s security
vulnerabilities and its decision to conceal those
vulnerabilities. In October 2018, the Wall Street Journal
published a lengthy story on the events surrounding the
Privacy Bug Memo. See Douglas MacMillan & Robert
McMillan, Google Exposed User Data, Feared
Repercussions of Disclosing to Public, Wall Street J. (Oct. 8,
2018). The story reported that “Google exposed the private
data of hundreds of thousands of users of the Google+ social
network and then opted not to disclose the issue this past
spring, in part because of fears that doing so would draw
regulatory scrutiny and cause reputational damage.” It


     1
       The complaint alleges that Page signed the 10-Qs and signed
certifications, under SEC rules promulgated after the Sarbanes-Oxley Act,
that vouched for the accuracy of the 10-Qs and the adequacy of controls
for identifying cybersecurity risks.
       IN RE ALPHABET, INC. SECURITIES LITIGATION              13

walked the reader through the discovery of the privacy bug,
explained how Google made “concerted efforts to avoid
public scrutiny of how it handles user information,
particularly at a time when regulators and consumer privacy
groups are leading a charge to hold tech giants accountable
for the vast power they wield over the personal data of
billions of people,” and reported that Pichai had been briefed
on the plan not to notify users.

   The day the news broke, Google published a blog post
acknowledging the “significant challenges” regarding data
security identified in the Wall Street Journal article. It finally
admitted to exposing the private data of hundreds of
thousands of users and announced it was shutting down the
Google+ social network for consumers.

    Condemnation from lawmakers soon followed. Two days
after the Wall Street Journal article, Democratic senators
wrote to demand an investigation by the Federal Trade
Commission. This letter noted that, due to the limitations of
Google’s internal logs, “we may never know the full extent
of the damage caused by the failure to provide adequate
controls and protection to users.” The letter likewise noted
that the “awareness and approval by Google management to
not disclose represents a culture of concealment and opacity
set from the top of the company.” Republican senators also
wrote a letter to Pichai that questioned Google’s decision “to
withhold information about a relevant vulnerability for fear
of public scrutiny” at the same time that Facebook was being
questioned regarding the Cambridge Analytica scandal. In a
second letter to Pichai, Senator Grassley complained that
Google had assured him in April 2018 that it maintained
robust protection for user data, despite Pichai’s awareness
that Google+ “had an almost identical feature to Facebook,
14       IN RE ALPHABET, INC. SECURITIES LITIGATION

which allowed third party developers to access information
from users.”

    Markets reacted to the news. Alphabet’s publicly traded
share price fell after the Wall Street Journal article.
According to the complaint, Alphabet’s share price fell
$11.91 on October 8, $10.75 on October 9, and $53.01 on
October 10. Financial news reports called Google’s decision
not to disclose the security breach a “cover-up” and predicted
forthcoming regulatory scrutiny.

    Just weeks later, in December 2018, Google disclosed the
discovery of another Google+ bug that had exposed user data
from 52.5 million accounts. Google also announced it was
accelerating the shutdown of the consumer Google+ platform
to occur four months earlier than planned.

                                 F

    Three days after the Wall Street Journal article, Rhode
Island filed a securities fraud action, as did other plaintiffs.2
After the cases were consolidated, Rhode Island was
designated the lead plaintiff. It filed a consolidated amended
complaint in April 2019, which now serves as the operative
complaint. The complaint names Alphabet, Google, Page,
Pichai, and two other Google senior executives as defendants
(we refer to the defendants collectively as Alphabet, where




     2
      Rhode Island refers to the State of Rhode Island, Office of the
Rhode Island Treasurer on behalf of the Employees’ Retirement System
of Rhode Island.
        IN RE ALPHABET, INC. SECURITIES LITIGATION                 15

appropriate, and otherwise by name).3 The complaint alleges
primary violations of Section 10(b) of the Securities
Exchange Act of 1934, 15 U.S.C. § 78j(b), and SEC Rule
10b-5, 17 C.F.R. § 240.10b-5, for securities fraud, as well as
violations of Section 20(a) of the Exchange Act, 15 U.S.C.
§ 78t(a), which imposes joint and several liability on persons
in control of “any person liable under any provision” of
securities law.

    Alphabet moved to dismiss the complaint for failure to
state a claim. The district court granted the motion after
determining that the complaint failed to allege any material
misrepresentation or omission and failed to allege scienter
sufficiently. Further, the court held that because the
Section 10(b) claim failed, the Section 20(a) claim for
controlling-person liability “necessarily fails.”

    Although the district court granted leave to amend, Rhode
Island notified the district court that it did not intend to
amend, and the district court entered judgment. Rhode Island
now appeals from that final judgment.

                                  II

    We have jurisdiction under 28 U.S.C. § 1291. We review
the district court’s dismissal of Rhode Island’s complaint for
failure to state a claim de novo. In re NVIDIA Corp. Sec.


    3
      The other two individual defendants are Keith P. Enright, who
served as Google’s Legal Director of Privacy from 2016 until September
2018 when he became Google’s Chief Privacy Officer, and John Kent
Walker, Jr., who served as Google’s Vice President and General Counsel
from 2016 through August 2018 before becoming Senior Vice President
for Global Affairs.
16     IN RE ALPHABET, INC. SECURITIES LITIGATION

Litig., 768 F.3d 1046, 1051 (9th Cir. 2014). “To survive a
motion to dismiss, a complaint must contain sufficient factual
matter, accepted as true, to ‘state a claim to relief that is
plausible on its face.’” Iqbal, 556 U.S. at 678 (quoting Bell
Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “When
there are well-pleaded factual allegations, a court should
assume their veracity and then determine whether they
plausibly give rise to an entitlement to relief.” Id. at 679. As
the Supreme Court has explained, “[d]etermining whether a
complaint states a plausible claim for relief” is “a
context-specific task that requires the reviewing court to draw
on its judicial experience and common sense.” Id. In the
process, we may “disregard ‘[t]hreadbare recitals of the
elements of a cause of action, supported by mere conclusory
statements.’” Telesaurus VPC, LLC v. Power, 623 F.3d 998,
1003 (9th Cir. 2010) (quoting Iqbal, 556 U.S. at 678).

    A complaint is plausible on its face “when the plaintiff
pleads factual content that allows the court to draw the
reasonable inference that the defendant is liable for the
misconduct alleged.” Iqbal, 556 U.S. at 678. The
misconduct alleged here includes claims under two statutory
sections: primary liability under Section 10(b) of the
Exchange Act and controlling-person liability under
Section 20(a) of the Exchange Act.

    Section 10(b) of the Exchange Act prohibits using or
employing, “in connection with the purchase or sale of any
security . . . [,] any manipulative or deceptive device or
contrivance in contravention of such rules and regulations as
the [SEC] may prescribe as necessary or appropriate in the
public interest or for the protection of investors.” 15 U.S.C.
§ 78j(b). To implement Section 10(b), the SEC prescribed
Rule 10b-5, which makes it unlawful
       IN RE ALPHABET, INC. SECURITIES LITIGATION          17

       (a) To employ any device, scheme, or artifice
       to defraud,

       (b) To make any untrue statement of a
       material fact or to omit to state a material fact
       necessary in order to make the statements
       made, in the light of the circumstances under
       which they were made, not misleading, or

       (c) To engage in any act, practice, or course of
       business which operates or would operate as
       a fraud or deceit upon any person, in
       connection with the purchase or sale of any
       security.

17 C.F.R. § 240.10b-5.

    The Supreme Court has interpreted Section 10(b) and
Rule 10b-5 as providing an implied private cause of action.
Stoneridge Inv. Partners, LLC v. Scientific-Atlanta, 552 U.S.
148, 157 (2008). “In a typical § 10(b) private action” based
on material misrepresentations or omissions, a plaintiff must
prove “(1) a material misrepresentation or omission by the
defendant; (2) scienter; (3) a connection between the
misrepresentation or omission and the purchase or sale of a
security; (4) reliance upon the misrepresentation or omission;
(5) economic loss; and (6) loss causation.” Id.

    Under Section 10(b) and Rule 10b-5(b), “the maker of a
statement is the person or entity with ultimate authority over
the statement, including its content and whether and how to
communicate it.” Janus Cap. Grp., Inc. v. First Derivative
Traders, 564 U.S. 135, 142 (2011). Persons “who do not
‘make’ statements (as Janus defined ‘make’), but who
18     IN RE ALPHABET, INC. SECURITIES LITIGATION

disseminate false or misleading statements to potential
investors with the intent to defraud, can be found to have
violated the other parts of Rule 10b-5, subsections (a) and (c),
as well as related provisions of the securities laws” including
Section 10(b). Lorenzo v. SEC, 139 S. Ct. 1094, 1099,
1100–03 (2019).

    The first two elements of a typical Section 10(b) and Rule
10b-5(b) claim are at issue here. The first element is that a
defendant omitted “to state a material fact necessary in order
to make the statements made . . . not misleading,” 17 C.F.R.
§ 240.10b-5(b). To meet this requirement, the plaintiff must
prove both that the omission is misleading and that it is
material. Id.

     We apply the objective standard of a “reasonable
investor” to determine whether a statement is misleading.
See In re VeriFone Sec. Litig., 11 F.3d 865, 869 (9th Cir.
1993). Section 10(b) and Rule 10b-5(b) “do not create an
affirmative duty to disclose any and all material information”
and instead require disclosure “only when necessary ‘to make
. . . statements made, in light of the circumstances under
which they were made, not misleading.’” Matrixx Initiatives,
Inc. v. Siracusano, 563 U.S. 27, 44 (2011) (quoting 17 C.F.R.
§ 240.10b-5(b)).

    A misleading omission is material if “there is ‘a
substantial likelihood that [it] would have been viewed by the
reasonable investor as having significantly altered the “total
mix” of information made available’ for the purpose of
decisionmaking by stockholders concerning their
investments.” Retail Wholesale & Dep’t Store Union Loc.
338 Ret. Fund v. Hewlett-Packard Co., 845 F.3d 1268, 1274
(9th Cir. 2017) (quoting Basic Inc. v. Levinson, 485 U.S. 224,
       IN RE ALPHABET, INC. SECURITIES LITIGATION           19

231–32 (1988)). The inquiry into materiality is “fact-
specific,” Matrixx Initiatives, 563 U.S. at 43 (quoting Basic,
485 U.S. at 236), and “requires delicate assessments of the
inferences a ‘reasonable shareholder’ would draw from a
given set of facts and the significance of those inferences to
him,” Fecht v. Price Co., 70 F.3d 1078, 1080 (9th Cir. 1995)
(quoting TSC Indus., Inc. v. Northway, Inc., 426 U.S. 438,
450 (1976)). “[T]hese assessments are peculiarly ones for the
trier of fact.” Id. (quoting TSC Indus., 426 U.S. at 450). As
a result, resolving materiality as a matter of law is generally
appropriate “only if the adequacy of the disclosure or the
materiality of the statement is so obvious that reasonable
minds could not differ.” Id. at 1081 (cleaned up); see Khoja
v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1014 (9th Cir.
2018) (same).

    In evaluating whether an omission relating to
cybersecurity is materially misleading, we may consider the
SEC’s interpretive guidance regarding the adequacy of
cybersecurity-related disclosures. See Commission Statement
and Guidance on Public Company Cybersecurity Disclosures,
Securities Act Release No. 33-10459, Exchange Act Release
No. 34-82746, 83 Fed. Reg. 8166-01, 8167 (Feb. 26, 2018)
(“Cybersecurity Disclosures”). Regardless of the degree of
deference such interpretive guidance may merit, see Kisor v.
Wilkie, 139 S. Ct. 2400, 2414–18 (2019), an SEC interpretive
release can “shed further light” on regulatory disclosure
requirements, NVIDIA, 768 F.3d at 1055.                Agency
interpretations, like the SEC interpretive release here, can
provide “the judgments about the way the real world works”
that “are precisely the kind that agencies are better equipped
to make than are courts.” See Pension Benefit Guar. Corp. v.
LTV Corp., 496 U.S. 633, 651 (1990); see also Kisor, 139 S.
Ct. at 2413 (“[W]hen new issues demanding new policy calls
20     IN RE ALPHABET, INC. SECURITIES LITIGATION

come up within that [statutory] scheme, Congress presumably
wants the same agency, rather than any court, to take the
laboring oar.”).

    We have held that            “transparently aspirational”
statements, Hewlett-Packard, 845 F.3d at 1278, as well as
statements of “mere corporate puffery, vague statements of
optimism like ‘good,’ ‘well-regarded,’ or other feel good
monikers,” are generally not actionable as a matter of law,
because “professional investors, and most amateur investors
as well, know how to devalue the optimism of corporate
executives,” Police Ret. Sys. of St. Louis v. Intuitive Surgical,
Inc., 759 F.3d 1051, 1060 (9th Cir. 2014) (quoting In re
Cutera Sec. Litig., 610 F.3d 1103, 1111 (9th Cir. 2010)).
Such statements rise to the level of materially misleading
statements only if they provide “concrete description of the
past and present” that affirmatively create a plausibly
misleading impression of a “state of affairs that differed in a
material way from the one that actually existed.” See In re
Quality Sys., Inc. Sec. Litig. (Quality Systems), 865 F.3d
1130, 1144 (9th Cir. 2017) (cleaned up).

    The second element of a typical Section 10(b) claim,
scienter, is not set forth in the statute. Rather, the Supreme
Court has determined that “[t]he words ‘manipulative or
deceptive’ used in conjunction with ‘device or contrivance’
strongly suggest that § 10(b) was intended to proscribe
knowing or intentional misconduct.” Ernst & Ernst v.
Hochfelder, 425 U.S. 185, 197 (1976). We have since held
that “a reckless omission of material facts” satisfies the
element of scienter, Hollinger v. Titan Cap. Corp., 914 F.2d
1564, 1568–70 (9th Cir. 1990) (en banc) (quoting Sundstrand
Corp. v. Sun Chem. Corp., 553 F.2d 1033, 1044 (7th Cir.
1977)), provided that such recklessness “reflects some degree
       IN RE ALPHABET, INC. SECURITIES LITIGATION          21

of intentional or conscious misconduct,” In re Silicon
Graphics Inc. Sec. Litig., 183 F.3d 970, 977 (9th Cir. 1999),
abrogated in part on other grounds, S. Ferry LP, No. 2 v.
Killinger (South Ferry), 542 F.3d 776, 783–84 (9th Cir.
2008). We refer to this standard as “deliberate recklessness”
and define it as “‘an extreme departure from the standards of
ordinary care,’ which ‘presents a danger of misleading buyers
or sellers that is either known to the defendant or is so
obvious that the actor must have been aware of it.’” Nguyen
v. Endologix, Inc., 962 F.3d 405, 414 (9th Cir. 2020) (quoting
Schueneman v. Arena Pharm., Inc., 840 F.3d 698, 705 (9th
Cir. 2016)).

    In addition to these substantive elements, a plaintiff
bringing a securities fraud action must also meet the
heightened pleading standards imposed by the Private
Securities Litigation Reform Act (PSLRA) for pleading,
among other things, “[m]isleading statements and omissions”
and “[r]equired state of mind.” 15 U.S.C. § 78u-4(b)(1)–(2).
Under these standards, if the plaintiff alleges that the
defendant “omitted to state a material fact necessary in order
to make the statements made, in the light of the circumstances
in which they were made, not misleading,” then

       the complaint shall specify each statement
       alleged to have been misleading, the reason or
       reasons why the statement is misleading, and,
       if an allegation regarding the statement or
       omission is made on information and belief,
       the complaint shall state with particularity all
       facts on which that belief is formed.

15 U.S.C. § 78u-4(b)(1). Likewise, when a plaintiff must
prove “that the defendant acted with a particular state of
22     IN RE ALPHABET, INC. SECURITIES LITIGATION

mind,” then “the complaint shall, with respect to each act or
omission alleged to violate this chapter, state with
particularity facts giving rise to a strong inference that the
defendant acted with the required state of mind.” 15 U.S.C.
§ 78u-4(b)(2)(A); see also Fed. R. Civ. P. 9(b). For pleading
scienter, we assess “all the allegations holistically” to
determine whether the inference of scienter is “cogent and
compelling.” Tellabs, 551 U.S. at 324, 326. “[M]erely
‘reasonable’ or ‘permissible’” inferences are insufficient. Id.
at 324. As a result, courts must “take into account plausible
opposing inferences” and determine that “a reasonable person
would deem the inference of scienter cogent and at least as
compelling as any opposing inference one could draw from
the facts alleged.” Id. at 323, 324.

    Finally, in addition to alleging violations under Section
10(b), Rhode Island also alleges violations of Section 20(a)
of the Exchange Act, 15 U.S.C. § 78t(a). Section 20(a)
imposes liability on a person who is in control of the person
who is directly responsible for a securities fraud violation:

       Every person who, directly or indirectly,
       controls any person liable under any provision
       of this chapter or of any rule or regulation
       thereunder shall also be liable jointly and
       severally with and to the same extent as such
       controlled person to any person to whom such
       controlled person is liable . . . , unless the
       controlling person acted in good faith and did
       not directly or indirectly induce the act or acts
       constituting the violation or cause of action.

15 U.S.C. § 78t(a). SEC regulations define “control” to mean
“the possession, direct or indirect, of the power to direct or
       IN RE ALPHABET, INC. SECURITIES LITIGATION           23

cause the direction of the management and policies of a
person, whether through the ownership of voting securities,
by contract, or otherwise.” 17 C.F.R. § 230.405. To establish
a cause of action under Section 20(a), “a plaintiff must first
prove a primary violation of underlying federal securities
laws, such as Section 10(b) or Rule 10b-5, and then show that
the defendant exercised actual power over the primary
violator.” NVIDIA, 768 F.3d at 1052. We have held that the
inquiry into actual power or control “is normally an ‘intensely
factual question.’” Zucco Partners, LLC v. Digimarc Corp.,
552 F.3d 981, 990 (9th Cir. 2009) (quoting Paracor Fin., Inc.
v. Gen. Elec. Cap. Corp., 96 F.3d 1151, 1161 (9th Cir.
1996)). Nevertheless, “if a plaintiff fails to adequately plead
a primary violation,” then Section 20(a) claims “may be
dismissed summarily.” Id.

                              III

    The district court granted Alphabet’s motion to dismiss on
the grounds that Rhode Island failed to adequately allege a
materially misleading misrepresentation or omission and that
Rhode Island failed to adequately allege scienter. We
therefore focus on these two bases for the district court’s
decision.

                              A

    The complaint identifies a dozen allegedly misleading
statements, but we begin by considering two statements made
by Alphabet in its quarterly reports filed with the SEC on
Form 10-Q in April 2018 and July 2018. We conclude that
the complaint adequately alleges that these two statements
omitted material facts necessary to make the statements not
misleading.
24     IN RE ALPHABET, INC. SECURITIES LITIGATION

    The April 2018 report for the period ending March 31,
2018, stated that Alphabet’s “operations and financial results
are subject to various risks and uncertainties,” including those
identified in Alphabet’s Annual Report on Form 10-K for the
year ended December 31, 2017, and asserted that “[t]here
have been no material changes to our risk factors since our
Annual Report on Form 10-K for the year ended December
31, 2017.”4 The 2017 10-K had warned, among other things,
that even unfounded concerns about Alphabet’s “practices
with regard to the collection, use, disclosure, or security of
personal information or other privacy related matters” could
damage the company’s “reputation and adversely affect [its]
operating results.” Alphabet’s April and July 2018 10-Qs
make no mention of the Three-Year Bug or other security
vulnerabilities identified in the Privacy Bug Memo.

    Given that the April 10-Q filing was made after the
detection of Google’s cybersecurity issues, after internal
deliberation based on the Privacy Bug Memo, and during the
growing scrutiny following the Cambridge Analytica scandal,
the complaint plausibly alleges that the omission of any
mention of the Three-Year Bug or the other security
vulnerabilities made the statements in each Form 10-Q
materially misleading to a reasonable investor and
significantly altered the total mix of information available to
investors.

   The complaint plausibly alleges that Alphabet’s omission
was material. Among other allegations in the complaint,
Alphabet’s risk disclosures in the 2017 10-K warned of the
harms that could follow from the detection and disclosure of

    4
      Alphabet’s July 2018 Form 10-Q, for the quarter ending June 30,
2018, is substantively identical.
        IN RE ALPHABET, INC. SECURITIES LITIGATION                   25

security vulnerabilities, including public concerns about
privacy and regulatory scrutiny. Public statements by Google
and Alphabet executives similarly demonstrated the
importance of user trust and public perceptions of security
and privacy practices for the products and services central to
Alphabet’s business. The scale of the data-privacy and
security-vulnerability problems identified in the Privacy Bug
Memo further supports the allegations that these problems
were material. Indeed, the Privacy Bug Memo itself warned
of the significant consequences of the problems discovered
and of their disclosure. The market reaction, increased
regulatory and governmental scrutiny, both in the United
States and abroad, and media coverage alleged by the
complaint to have occurred after disclosure all support the
materiality of the misleading omission.

     Finally, the SEC’s guidance on when companies should
disclose “cybersecurity incidents” also supports the
conclusion that Alphabet’s omission was material. See
Cybersecurity Disclosures, 83 Fed. Reg. at 8169.5 In
determining disclosure obligations and “[t]he materiality of
cybersecurity risks and incidents,” the SEC advises that
companies should weigh, among other things, “harm to a
company’s reputation, financial performance, and customer
and vendor relationships, as well as the possibility of
litigation or regulatory investigations or actions, including
regulatory actions by state and federal governmental
authorities and non-U.S. authorities.” Id. at 8168–69. Here,


    5
      The SEC defines a “cybersecurity incident” as an “occurrence that
actually or potentially results in adverse consequences to an information
system or the information that the system processes, stores, or transmits
and that may require a response action to mitigate the consequences.”
Cybersecurity Disclosures, 83 Fed. Reg. at 8166 n.3 (cleaned up).
26     IN RE ALPHABET, INC. SECURITIES LITIGATION

the complaint plausibly alleges that these risks of harm
ripened into actual harm when the Privacy Bug was detected
and created the new risk that this discovery would become
public.

     The complaint also plausibly alleges that Alphabet’s
omission was misleading. Risk disclosures that “speak[]
entirely of as-yet-unrealized risks and contingencies” and do
not “alert[] the reader that some of these risks may already
have come to fruition” can mislead reasonable investors. See
Berson v. Applied Signal Tech., Inc., 527 F.3d 982, 985–87
(9th Cir. 2008). In Berson, we held that the company’s
statement of anticipated revenues from its large backlog of
work was misleading because it failed to disclose that a
significant portion of the “backlogged” work was
“substantially delayed and at serious risk of being cancelled
altogether.” Id. at 986. Similarly, we explained that a 10-Q
statement that warned of “the risks of product liability claims
in the abstract” was misleading because it failed to disclose
that the risk had already come to fruition. Siracusano v.
Matrixx Initiatives, Inc., 585 F.3d 1167, 1181 (9th Cir. 2009)
(citing Berson, 527 F.3d at 986), aff’d, 563 U.S. 27 (2011).
Even more recently, we held that a company’s warning in its
Form 10-Q that share prices “might” be affected by
announcements of study results that “may” be inconsistent
with interim study results was misleading because the
company “allegedly knew already that the ‘new data’
revealed exactly that.” Khoja, 899 F.3d at 1015–16; cf.
Wochos v. Tesla, Inc., 985 F.3d 1180, 1195–96 (9th Cir.
2021) (rejecting the argument that a risk disclosure’s
forward-looking statements “constituted misleading
omissions about current or past challenges” because the
disclosure also acknowledged that the company had already
experienced “the sort of ‘challenges’ that it would have to
        IN RE ALPHABET, INC. SECURITIES LITIGATION                    27

overcome in order to achieve its stated objective”).6 As in
these cases, the complaint plausibly alleges that Alphabet’s
warning in each Form 10-Q of risks that “could” or “may”
occur is misleading to a reasonable investor when Alphabet
knew that those risks had materialized.

    Alphabet makes several arguments against this
conclusion. First, Alphabet argues that any omission from
the Form 10-Qs was not misleading because Google had
already remediated the software glitch in Google+ before it
made the 10-Q statements. Because the risks caused by the
software glitch had been remediated, Alphabet argues, Rhode
Island cannot rely on the cases holding that a company’s
warning of future risks is misleading if those risks have
already materialized. This argument fails for several reasons.
Given that Google’s business model is based on trust, the
material implications of a bug that improperly exposed user
data for three years were not eliminated merely by plugging
the hole in Google+’s security. The existence of the software
glitch for a three-year period, which exposed the private
information of hundreds of thousands of Google+ users, and
the fact that Google was unable to determine the scope and
impact of the glitch, indicated that there were significant
problems with Google’s security controls. Google had long
recognized that in an industry based on security and privacy,
the public disclosure of serious failings in this area would
have wide-ranging effects, including erosion of consumer
confidence and increased regulatory scrutiny. Further, the


    6
      In light of our precedent, we decline to follow the Sixth Circuit’s
unpublished decision in Bondali v. Yum! Brands, Inc., which held that a
statement disclosing future harms generally would not mislead a
reasonable investor about the current state of a corporation’s operations.
620 F. App’x 483, 490–91 (6th Cir. 2015).
28       IN RE ALPHABET, INC. SECURITIES LITIGATION

Privacy Bug Memo was not limited to discussing the
discovery of the software glitch that had been remediated
because it highlighted additional security vulnerabilities that
were so significant that they allegedly led to Google’s
decision to shut down the Google+ consumer platform.

    Second, Alphabet contends that the 10-Q omissions were
not material because the software bug did not lead to the
release of sensitive information like financial or medical
information or cause harm to any user and because
Alphabet’s revenue increased from $12 billion to $30 billion
between 2017 and 2018. These arguments fail because a
cybersecurity incident may be material even if it does not
compromise sensitive financial or medical information or
have an immediate financial impact on the company. The
standard is whether there is a “substantial likelihood” that the
information at issue “would have been viewed by the
reasonable investor as having significantly altered the total
mix of information made available for the purpose of
decisionmaking by stockholders concerning their
investments.” Hewlett-Packard, 845 F.3d at 1274 (cleaned
up). Because cybersecurity incidents may cause a range of
substantial costs and harms,7 reasonable investors would
likely find omissions regarding significant cybersecurity
incidents material to their decisionmaking. The likelihood is
particularly substantial here, given the nature of Alphabet’s
business. As the SEC has explained, the materiality of


     7
      See Cybersecurity Disclosures, 83 Fed. Reg. at 8167–69 & n.32
(noting that a cybersecurity incident can cause a company to incur
remediation costs, increased cybersecurity protection costs, lost revenues,
harm to customer retention or attraction, litigation and legal risks,
increased insurance premiums, reputational damage, and damage to stock
price and shareholder value).
       IN RE ALPHABET, INC. SECURITIES LITIGATION            29

compromised information may “depend on the nature of the
company’s business” and “the scope of the compromised
information.” Id. at 8169 n.33. Here, for instance, the
complaint alleges that the Wall Street Journal article resulted
in a swift stock price decline, legislative scrutiny, and public
reaction, all of which support the allegation that the Privacy
Bug was material even absent a release of sensitive
information or revenue decline.

    Applying our objective materiality standard to the 10-Qs
here, Rhode Island’s complaint plausibly alleges the
materiality of the costs and consequences associated with the
Privacy Bug, and its public disclosure, and how Alphabet’s
decision to omit information about the Privacy Bug in its 10-
Qs significantly altered the total mix of information available
for decisionmaking by a reasonable investor.

                               B

    We now consider whether the complaint adequately
alleges scienter for the materially misleading omissions from
the 10-Q statements. Because Rule 10b-5 makes it unlawful
“[t]o make any untrue statement” or to omit material facts
necessary to make “the statements made” not misleading,
17 C.F.R. § 240.10b-5(b) (emphasis added), we must first
determine who was the maker of the statement for purposes
of Section 10(b) and Rule 10b-5(b) and whether the
complaint adequately alleged that the maker omitted material
information knowingly, intentionally, or with deliberate
recklessness. In other words, the complaint must plausibly
allege, with the particularity required by the PSLRA, that the
maker of the statements knew about the security
vulnerabilities and intentionally or recklessly did not disclose
them.
30       IN RE ALPHABET, INC. SECURITIES LITIGATION

    Alphabet is at least one alleged maker of the 10-Q
statements here, because Alphabet has “ultimate authority
over the statement, including its content and whether and how
to communicate it,” Janus, 564 U.S. at 142.8

    Because Alphabet is a corporation, it “‘can only act
through its employees and agents’ and can likewise only have
scienter through them.” In re ChinaCast Educ. Corp. Sec.
Litig., 809 F.3d 471, 475 (9th Cir. 2015) (quoting Suez Equity
Invs., L.P. v. Toronto-Dominion Bank, 250 F.3d 87, 101 (2d
Cir. 2001)). We have explained that the “scienter of the
senior controlling officers of a corporation may be attributed
to the corporation itself to establish liability as a primary
violator of § 10(b) and Rule 10b-5 when those senior officials
were acting within the scope of their apparent authority.” Id.
at 476 (quoting Adams v. Kinder-Morgan, Inc., 340 F.3d
1083, 1106–07 (10th Cir. 2003)).

    The complaint’s specific allegations, taken as a whole,
raise a strong inference that Page, and therefore Alphabet,
knew about the Three-Year Bug, the Privacy Bug, and the
Privacy Bug Memo, and that Alphabet intentionally did not
disclose this information in its 10-Q statements.

    The complaint’s allegations, read as a whole, raise a
strong inference that Alphabet was aware of the information
in the Privacy Bug Memo. In this case, the complaint alleges
that Pichai and other Google senior executives read the
Privacy Bug Memo, and so necessarily knew of the Three-
Year Bug and other security vulnerabilities, before Alphabet


     8
      The complaint does not allege, and Rhode Island does not argue,
that Page is a maker of the 10-Q statements for purposes of Section 10(b)
and Rule 10b-5. We therefore do not address this issue.
      IN RE ALPHABET, INC. SECURITIES LITIGATION          31

made its April 2018 10-Q statement. The complaint alleges
with particularity that the memo informed senior executive
leadership at Google of the scope of the problem, warned of
the consequences of disclosure, and presented Google
leadership with a clear decision on whether to disclose those
problems. See South Ferry, 542 F.3d at 785–86 (describing
“actual access to the disputed information” as supporting a
strong inference of scienter).

    The complaint also raises a strong inference that Pichai
communicated this information to Page, and therefore Page
was also aware of the Three-Year Bug and other security
vulnerabilities before he signed the April 2018 10-Q
statement. Although the complaint does not directly allege
that Page read the Privacy Bug Memo, we may consider a
senior executive’s role in a company to determine whether
there is a cogent and compelling inference that the senior
executive knew of the information at issue. Id. at 785. This
includes consideration of the executive’s access to the
information, and, whether, given the importance of the
information, “it would be ‘absurd’ to suggest that
management was without knowledge of the matter.” Id. at
786 (quoting Berson, 527 F.3d at 988).

    Here, numerous allegations in the complaint raise the
strong inference that Page was vitally concerned with
Google’s operations. See id. at 785–86. Specifically, the
complaint alleges that Alphabet is essentially a holding
company for Google (i.e., Google was the “lifeblood” of
Alphabet). Page, the former CEO of Google, received
weekly reports of Google’s operating results and made “key
operating decisions” at Google. Pichai, as the replacement
CEO of Google, reported directly to Page. Moreover, the
complaint alleges that Pichai and Page together approved a
32     IN RE ALPHABET, INC. SECURITIES LITIGATION

plan in spring 2018 to shut down Google+ because of the
security concerns revealed by the Privacy Bug Memo. Taken
together, these specific allegations raise the strong inference
that Pichai informed Page of any information regarding
Google’s operations that was material and that there was
shared decision-making on key issues. See id. (identifying a
combination of allegations regarding corporate structure,
importance of information, and exposure to factual
information that “may be relevant and help to satisfy the
PSLRA scienter requirement”). The complaint also cogently
alleges that the Three-Year Bug and other security
vulnerabilities that were disclosed in the Privacy Bug Memo
were highly material to Google’s operations, for the reasons
explained above.

    Therefore, considering these allegations together, there is
a strong inference that Page knew of these problems and the
consequences of disclosure when Alphabet made its 10-Q
statements in April and July 2018. The competing
inference—that Pichai concealed “the largest data-security
vulnerability in the history of two Companies whose
existence depends on data security” from the CEO of
Alphabet at a time when social media networks were under
immense regulatory and governmental scrutiny—is not
plausible. Accordingly, we conclude there is a strong
inference that Page had the requisite knowledge, which can
be imputed to Alphabet. ChinaCast, 809 F.3d at 475.

    For the same reasons, there is an equally strong inference
that, armed with this knowledge, Alphabet intentionally did
not disclose the cybersecurity information to the public in
order to avoid or delay the impacts disclosure could have on
regulatory scrutiny, public criticism, and loss of consumer
confidence. The complaint also alleges that Pichai approved
       IN RE ALPHABET, INC. SECURITIES LITIGATION           33

a cover-up to avoid regulatory scrutiny and testimony before
Congress. The complaint alleges that “key officers and
directors,” including Page and Pichai, “had decided to
conceal all of this information from everyone outside the
Companies.” This decision to conceal was calculated to “buy
time” by avoiding putting Google in the spotlight alongside
the Facebook-Cambridge Analytica scandal and at the time of
heightened public and regulatory scrutiny. As it turned out,
Alphabet successfully bought itself about six months of time
between the April 2018 decision not to disclose and the
October 2018 publication of the Wall Street Journal article.
Again, the competing inference that Alphabet knew of this
information but was merely negligent in not disclosing it is
not plausible.

    Finally, Alphabet argues that the complaint does not raise
a strong inference that Alphabet intentionally omitted
material information from its 10-Q statement because the
complaint does not allege that company officials made
suspicious stock sales or include allegations from confidential
witnesses. This argument fails. Although such allegations
may support an inference of scienter, they are not a sine qua
non for raising such an inference. See, e.g., Siracusano,
585 F.3d at 1180–83 (rejecting need for stock sales and
identifying sufficient scienter allegations without witnesses);
No. 84 Employer-Teamster Joint Council Pension Tr. Fund
v. Am. W. Holding Corp., 320 F.3d 920, 944 (9th Cir. 2003)
(“[T]he lack of stock sales by a defendant is not dispositive
as to scienter.”). Allegations of suspicious stock sales or
information from confidential witnesses are not needed
where, as here, other allegations in the complaint raise a
strong inference of scienter. Alphabet also argues that
because Google fixed the Three-Year Bug and no users were
harmed, Alphabet’s failure to disclose does not support a
34     IN RE ALPHABET, INC. SECURITIES LITIGATION

strong inference of scienter. This argument is little more than
a restatement of Alphabet’s contention, which we have
already rejected, that the Three-Year Bug and the Privacy
Bug were not material because they had been remediated.
See supra Part III.A.

    Rhode Island adequately alleged falsity, materiality, and
scienter for the April 2018 and July 2018 10-Q statements.
We therefore reverse the district court’s holdings to the
contrary. The defendants’ motion to dismiss did not
challenge the remaining elements of the Section 10(b) and
Rule 10b-5(b) statement liability claims for these or other
statements, so we do not address the elements of connection
to the sale of a security, reliance, economic loss, or loss
causation.

    Because we reverse the district court’s dismissal of
Rhode Island’s claims related to Alphabet’s 10-Q statements,
we also reverse its dismissal of the complaint’s Section 20(a)
claims based on those statements, which allege that Pichai
and Page were controlling persons of Alphabet under Section
20(a). The district court dismissed these claims solely on the
ground that Rhode Island failed to state a claim for a primary
violation of Section 10(b) and Rule 10b-5. We remand to the
district court to reconsider Pichai and Page’s liability under
Section 20(a) in light of our holding today.

                              C

    We now consider the ten remaining statements identified
in the complaint.

    First, the complaint identifies statements made in two
earnings calls in April and July 2018 by Ellen West,
        IN RE ALPHABET, INC. SECURITIES LITIGATION                    35

Alphabet’s Head of Investor Relations. According to the
complaint, after noting that “[s]ome of the statements that we
make today may be considered forward looking” and that
“[t]hese statements involve a number of risks and
uncertainties that could cause actual results to differ
materially,” West stated: “For more information, please refer
to the risk factors discussed in our Form 10-K for 2017 filed
with the SEC.”9 These statements alone did not plausibly
give a reasonable investor the “impression of a state of affairs
that differs in a material way from the one that actually
exists,” Hewlett-Packard, 845 F.3d at 1275 (quoting Berson,
527 F.3d at 985), because, unlike the 2018 10-Q statements,
West’s statement did not include the express assurance that
there had been “no material changes” to Alphabet’s risk
factors since the 2017 10-K filing.

    Second, the complaint identifies statements made by
Pichai, three senior Google executives, and an Alphabet
proxy statement. These statements emphasize Google’s and
Alphabet’s commitment to user privacy, data security, and
regulatory compliance and discuss Google and Alphabet’s
ongoing efforts to secure user data and work on GDPR
compliance. For instance, the complaint alleges that, on the
April 2018 earnings call for Alphabet, Pichai assured the
public and investors that Google “started working on GDPR
compliance over 18 months ago and ha[d] been very, very
engaged on it” and that Google has a “very robust and strong
privacy program.” Similarly, in an April 2018 letter to
Senator Grassley, a senior Google executive stated that
“Google has a longstanding commitment to ensuring both that
our users share their data only with developers they can trust,

     9
       The complaint alleges that West’s statements on the April 2018 and
July 2018 earnings calls were substantively identical.
36    IN RE ALPHABET, INC. SECURITIES LITIGATION

and that they understand how developers will use that data”
and that Google was “committed to protecting our users’ data
and prohibit[s] developers from requesting access to
information they do not need.” Google executives elsewhere
touted Alphabet as “one of the leading companies when it
comes to privacy and security of user data,” explained that
Alphabet was taking “great pains to make sure that people
have great control and notice over their data,” and affirmed
that the “foundation of [Google’s] business is the trust of
people that use our services.”

    While these statements are relevant and were made while
Google and Alphabet allegedly chose a strategy of
concealment over disclosure, these statements do not rise to
the level of “concrete description of the past and present”
that affirmatively create a misleading impression of a “state
of affairs that differed in a material way from the one that
actually existed.” Quality Systems, 865 F.3d at 1144 (cleaned
up). They instead amount to vague and generalized corporate
commitments, aspirations, or puffery that cannot support
statement liability under Section 10(b) and Rule 10b-5(b).
See Hewlett-Packard, 845 F.3d at 1278; Intuitive Surgical,
759 F.3d at 1060.

    Finally, the complaint alleges that Page and Pichai
decided not to testify before the United States Senate
Intelligence Committee in September 2018 alongside
Facebook and Twitter, which left “an empty chair for
Google.” An empty chair is neither a statement of material
fact nor the misleading omission of a material fact. See
17 C.F.R. § 240.10b-5(b); see also Hewlett-Packard,
845 F.3d at 1278.
       IN RE ALPHABET, INC. SECURITIES LITIGATION            37

    Because the complaint does not plausibly allege that these
remaining statements are misleading material
misrepresentations or omissions, we affirm the district court’s
dismissal of the Section 10(b) and Rule 10b-5(b) statement
liability claims based on these statements. We also affirm the
district court’s dismissal of the Section 20(a) controlling-
person claims for these statements.

                              IV

     Finally, Rhode Island argues on appeal that the district
court erred in dismissing its claims under Rule 10b-5(a) and
(c) (referred to in the complaint as a “scheme liability claim”)
when it dismissed the complaint in its entirety without
addressing those claims. In its complaint, Rhode Island
alleged that the defendants “disseminated or approved the
statements” alleged to be materially misleading and “engaged
and participated in a continuous course of conduct to conceal
the truth and/or adverse material information about
Alphabet’s business and operations.”

    Alphabet argues that Rhode Island waived these claims
because it failed to raise them to the district court in
opposition to Alphabet’s motion to dismiss. Alphabet also
contends that the complaint’s claims under Rule 10b-5(a) and
(c) are duplicative of the claims under Rule 10b-5(b) seeking
to hold the defendants liable for misleading statements. Both
arguments fail.

    First, because Alphabet’s motion to dismiss did not target
Rhode Island’s Rule 10b-5(a) and (c) claims, Rhode Island
did not waive those claims by failing to address them in
opposition to the motion to dismiss. A party’s failure to
oppose an argument that was not made does not constitute a
38         IN RE ALPHABET, INC. SECURITIES LITIGATION

waiver. Second, Alphabet’s argument that Rule 10b-5(a) and
(c) claims cannot overlap with Rule 10b-5(b) statement
liability claims is foreclosed by Lorenzo, which rejected the
petitioner’s argument that Rule 10b-5(a) and (c) “concern
‘scheme liability claims’ and are violated only when conduct
other than misstatements is involved.”           139 S. Ct.
at 1101–02.10 Rather, Lorenzo explained that “considerable
overlap” exists among the subsections of Rule 10b-5 and held
that disseminating false statements “ran afoul of subsections
(a) and (c).” Id. at 1102.

    Because the district court erred in sua sponte dismissing
Rhode Island’s claims under Rule 10b-5(a) and (c) when
Alphabet had not targeted those claims in its motion to
dismiss, we reverse dismissal of the claims under
Section 10(b) and Rule 10b-5(a) and (c) against all
defendants and remand to the district court. See Golden Gate
Hotel Ass’n v. City & County of San Francisco, 18 F.3d 1482,
1487 (9th Cir. 1994); see also Reed v. Lieurance, 863 F.3d
1196, 1207–08 (9th Cir. 2017) (reversing sua sponte
dismissal). We also reverse the dismissal of Rhode Island’s
claims under Section 20(a) to the extent those claims depend
on claims alleging violations of Rule 10b-5(a) and (c).

  REVERSED IN PART, AFFIRMED IN PART,
JUDGMENT VACATED, REMANDED FOR FURTHER
PROCEEDINGS.11



     10
      In reaching this holding, Lorenzo abrogated our contrary holding in
WPP Luxembourg Gamma Three Sarl v. Spot Runner, Inc., 655 F.3d
1039, 1057–58 (9th Cir. 2011). See Lorenzo, 139 S. Ct. at 1100.
     11
          Each party will bear its own costs on appeal.