The 9th US Circuit Court of Appeals in San Francisco said the lawsuit raised a “strong inference” that Alphabet’s then-chief executive Larry Page and his successor, Sundar Pichai, knew about the bugs and an internal memo on security issues but intentionally concealed the information from investors.
Alphabet and its lawyers did not immediately respond to requests for comment on the 3-0 decision.
The lawsuit, led by the state of Rhode Island, followed an October 2018 Wall Street Journal article that said Google concealed the exposure of private data for nearly 500,000 Google+ users because it feared regulatory scrutiny and reputational harm.
Alphabet’s share price fell more than six percent over the following three days, reducing the Mountain View, California-based company’s market value by more than US$50 billion.
Google ultimately admitted it had discovered the data exposure in March 2018, though there was no evidence of misuse, and decided to shut down the consumer version of Google+.
Its failure to disclose the vulnerabilities sooner drew bipartisan condemnation from Congress.
In Wednesday’s decision, Circuit Judge Sandra Ikuta accepted the shareholders’ argument that Alphabet stayed silent to “buy time,” and avoid the spotlight that Facebook was then under because Britain’s Cambridge Analytica had harvested data from tens of millions of its users.
“As it turned out, Alphabet successfully bought itself about six months of time,” Ikuta wrote.
“The competing inference that Alphabet knew of this information but was merely negligent in not disclosing it is not plausible.”
The case was returned to US District Judge Jeffrey White in San Francisco, who had dismissed it in February 2020.
“We are grateful to have the opportunity to sit down with Mr. Pichai, Mr. Page and others to get the bottom of what they did,” the plaintiffs’ lawyer Jason Forge said in an interview.