The justices left in place a lower court's ruling that revived the lawsuit brought over the 2018 incident that the company was slow to disclose, turning away Alphabet's appeal.
The lawsuit, led by the state of Rhode Island, was filed after the Wall Street Journal published an article in October 2018 that said Google concealed the exposure of private data for nearly 500,000 users of Google+ - a social network owned by Google - because it feared regulatory scrutiny and reputational harm.
The lawsuit accused the company of making false or misleading statements in violation of the US Securities Exchange Act.
Google ultimately admitted it had discovered the data exposure in March 2018, though there was no evidence of misuse, and decided to shut down the consumer version of Google+.
US District Judge Jeffrey White in San Francisco dismissed the lawsuit in February 2020, prompting the plaintiffs to appeal.
The San Francisco-based 9th US Circuit Court of Appeals in June 2021 decided that the lawsuit raised a "strong inference" that Alphabet's then-Chief Executive Larry Page and his successor, Sundar Pichai, knew about the problem and an internal memo on security matters but intentionally concealed the information from investors.
The 9th Circuit credited the plaintiff's argument that Alphabet stayed silent to "buy time" and avoid the spotlight that Meta Platform's Facebook was under because of the Cambridge Analytica scandle.