Labor & Employment Law Daily Wrap Up, WHISTLEBLOWERS—N.D. Cal.: Lone plaintiff theory grounded in securities fraud may proceed, (Sep 22, 2026)

By Mark S. Nelson, J.D.

The case may be equally important for the claims it dismissed as for the one claim that survived.

A wide-ranging whistleblower claim stated a single theory on which the case may proceed, specifically, that Meta Platforms, Inc.’s SEC filings misrepresented the company’s FTC-mandated privacy compliance program and its cybersecurity risks, but other related claims failed to satisfy pleading standards and were dismissed. Overall, the complaint still must be amended once again to focus on the lone surviving claim and to remedy other pleading defects, including the failure to provide a short and plain statement of the case and the failure to describe its various claims in numbered paragraphs with carefully circumscribed text (Baig v. Meta Platforms, Inc., No. 25-cv-07604 (N.D. Cal. Sept. 18, 2026)).

Privacy concerns. Attaullah Baig, Meta's former head of security, sued Meta Platforms, Inc. (WhatsApp’s parent), the company's CEO, Mark Zuckerberg, the head of WhatsApp, Will Cathcart, WhatsApp’s head of engineering, Nitin Gupta, and Pinaki Mukerji and Mark Tsimelzon, Baig’s supervisors, under Section 806 of the Sarbanes-Oxley Act (SOX) (18 U.S.C. § 1514A) for retaliation on the ground that the company ignored his warnings about noncompliance with an FTC agreement over privacy concerns at Meta and WhatsApp.

Protected activity: securities filings theory. The key consideration for the one claim that can move forward was whether Baig reasonably believed that Meta and WhatsApp failed to account for certain privacy deficiencies that may have violated the FTC agreement through disclosures made in the company’s SEC filings.

The court explained that a prima facie case requires that: (1) the employee engaged in protected activity, (2) the employer knew or suspected, actually or constructively, that he did, (3) he suffered an unfavorable personnel action, and (4) the circumstances raise an inference that the protected activity was a contributing factor in the unfavorable action.

The court suggested that the standard is relatively flexible and can even include an employee’s reasonable but mistaken views. However, the court later in its opinion clarified: “But the ‘basic elements’ that an employee’s theory must approximate are the core of a fraud—a material misrepresentation or omission, made with knowledge, in connection with the company’s securities—not the elements of a private damages action, such as reliance, economic loss, and loss causation, that an employee reporting ongoing conduct is in no position to assess. That is how the Ninth Circuit applied the standard…”

The court concluded that Baig’s assertions were objectively reasonable. The court cited from Baig’s claims, among other things, that despite claims by Meta of compliance with privacy directives, the company nevertheless had not built key systems, continued to allow access to user data, and that “assessments were being falsified and audits narrowed or blocked so that the Board’s audit committee received a false picture.”

Under these pleadings, the court allowed the securities-based claim to proceed, albeit with some procedural cleanup of the complaint required by the plaintiff.

Other claims dismissed. The case may be equally important for the claims dismissed as for the one claim that survived. The court, for example, dismissed claims asserted by Baig regarding alleged SEC books and records violations and cybersecurity audits, which the court said were non-starters because the types of audits involved were unrelated to financial audits. Said the court: “The reasonable-belief standard forgives an employee’s mistakes about what the law requires; it does not extend the SEC’s accounting rules to records and audits that have nothing to do with accounting.”

Internal controls claims were likewise dismissed because they were both precluded by prior litigation in Baig’s case (Baig I) and they did not concern financial reporting. Related disclosure controls claims failed because they involved allegations by Baig that sounded more in misrepresentation than in disclosure controls compliance. In other words, the court said the disclosure claims were not about what information Meta executives received from whatever sources (i.e., flawed disclosure controls), but what the executives did with that information afterwards.

A claim based on Form 8-K disclosures (or nondisclosures) also failed. For one, the court explained that the belief that a company failed to adequately inform regulators about cybersecurity matters is not equivalent to the failure to disclose them in an SEC filing. Moreover, the court said that Meta’s decision not to voluntarily report an item on Form 8-K is not an objectively reasonable basis for a whistleblower claim.

With respect to Meta CEO Zuckerberg and WhatsApp head Will Cathcart, the court concluded that claims by Baig that they had directed retaliation against Baig were not plausible. Said the court: “The facts the plaintiff offers here—that both received his complaints, that his termination carried litigation exposure, and that he was the head of security of a major product—do not make it plausible that Meta’s chief executive, four levels above the plaintiff, or the head of WhatsApp, three levels above him, personally approved the termination rather than the managers to whom he reported.”

Narrowed case. The court said that repleading of the dismissed claims would be futile. But the remaining claim that may proceed also must be repleaded in order for the plaintiff to file a complaint that complies with the Federal Rules of Civil Procedure. As a result, the court explained that the remaining case consists of a claim against Meta, Nitin Gupta (WhatsApp’s head of engineering), and Pinaki Mukerji and Mark Tsimelzon (Baig’s supervisors), which is focused on the theory that Meta’s SEC filings misrepresented its FTC-mandated privacy program and related cybersecurity risks.

The case is No. 25-cv-07604.

Judge: Beeler, L.

Attorneys: Katherine Wardlaw (Schonbrun Seplow Harris Hoffman & Zeldes, LLP) for Attaullah Baig. Jeffrey A. Sturgeon (Paul Hastings LLP) for Meta Platforms, Inc.

Companies: Meta Platforms, Inc.

Cases: Whistleblowers Retaliation Privacy Procedure CaliforniaNews