DiDi Global 740M Settlement Over Alleged IPO Cybersecurity and Data Privacy Misstatements

DiDi Global’s June 2021 IPO came at a time when Chinese regulators were rapidly tightening oversight of platform companies that collect large volumes of personal and location data. Just days after DiDi listed in the U.S., China’s Cyberspace Administration of China (CAC) launched a cybersecurity review and ordered DiDi’s app removed from app stores, a move that rattled markets and raised questions about what the company and its underwriters knew—and disclosed—about regulatory risk tied to data practices and cross-border listings. The securities class action was filed on behalf of investors who bought DiDi American Depositary Shares between June 30, 2021 and July 21, 2021, alleging that DiDi’s IPO registration statement contained materially false or misleading statements and omissions—specifically, that it downplayed or failed to disclose warnings from Chinese authorities and misrepresented compliance with cybersecurity and data protection requirements. The $740 million settlement is significant because it reflects how costly disclosure failures can be when a major regulatory action quickly follows an IPO, and it underscores the role U.S. securities law (including the Securities Act’s rules governing IPO registration statements) plays in policing what issuers and underwriters must tell public investors about known risks. More broadly, the case sits at the intersection of two regulatory worlds: U.S. disclosure obligations for foreign issuers selling shares to American investors, and China’s evolving cybersecurity and data-governance regime—especially CAC’s security reviews for companies handling “important data” or large-scale personal information, alongside laws like China’s Data Security Law and Personal Information Protection Law. It also echoes other investor suits tied to China-based companies whose valuations were hit by abrupt policy or enforcement shifts, reinforcing a wider industry lesson for global tech and mobility firms: data access, storage, and regulatory clearance can be as material to a public offering as revenue growth, and markets may punish companies swiftly when those risks crystallize right after listing.