Eventbrite (EB) Risk Analysis

We bring together a diverse and vibrant community of millions of people to create and discover live experiences that fuel their passions. The safety and integrity of our marketplace is of primary importance to our business. We maintain policies that outline expectations for users while they engage with our services, whether as creators, consumers or third parties. We prohibit a range of content on our platform, including, but not limited to: sexually explicit content; illegal content or illegal activities; hateful, dangerous or violent content or events; content that contains or promotes misinformation; and events that sell, distribute or transfer weapons and firearms. We seek to enforce these community guidelines in order to uphold the safety and integrity of our marketplace, engender trust in the use of our services, ensure that everyone can gather and celebrate in an environment based in respect and dignity and encourage positive connections among members of our communities. We strive to enforce these policies in a consistent and principled manner that is transparent and explicable to stakeholders. However, even with a principled and objective approach, policy enforcement is a combination of human and technological review and is subject to error. For example, at times creators use or attempt to use our platform for events related to illegal activity and extremist groups. These events may cause negative publicity and harm our reputation and brand. In addition, policy enforcement may be subject to different, inconsistent or conflicting regional consensus or regulatory standards in different jurisdictions, or it could be perceived to be arbitrary, unclear or inconsistent. Shortcomings and errors in our ability to enforce our policies across our marketplace could lead to negative public perception, distrust from our creators and consumers, or lack of confidence in the use of our services, and could negatively impact our reputation and our brand and our business, financial condition and results of operations could be adversely affected. In addition, certain creators or consumers may not agree with our decision to restrict certain creators from using our platform, the removal of certain events or the promotion of certain events on our platform. Some creators may not have, or are perceived not to have, legal and ethical business practices. Furthermore, creators use our platform for events that represent a variety of views, activities and interests, some of which many other creators or consumers do not agree with or find offensive. If our platform is associated with illegal or offensive activity or creators and consumers disagree with our decision to restrict certain creators or events, our reputation and brand may be harmed, our ability to attract and retain creators and consumers may be adversely impacted and our business, financial condition and results of operations could be adversely affected.

We face potential liability and expenses for legal claims relating to the events business, including potential claims related to event injuries or the spread of disease allegedly caused by us, creators, service providers, partners or unrelated third parties. For example, from time to time third parties assert legal claims against us in connection with personal injuries, which may include deaths, related to occurrences at an event. See the risk factor above titled "Factors adversely affecting the live event market could impact our results of operations" for additional information. Even if our personnel are not involved in these occurrences, we may face legal claims and incur substantial expenses to resolve such claims. Further, if we provide resources regarding event safety, or on-site personnel to support ticketing at an event, we may face liability related to our provision of such services, including legal claims against us in connection with personal injuries, which may include deaths or spread of disease. Our liability insurance coverage may not be sufficient to satisfy, or may not cover, any expenses or liabilities that may arise.

In general, under Section 382 of the Internal Revenue Code of 1986, as amended (Code), a corporation that undergoes an "ownership change" (generally, a greater than 50 percentage point change in our equity ownership by certain stockholders or groups of stockholders) is subject to limitations on its ability to utilize its pre-change net operating losses (NOLs) to offset future taxable income. We have undergone ownership changes in the past, which have resulted in limitations on our ability to utilize our NOLs, and future changes in our stock ownership, some of which are outside of our control, could result in an ownership change under Section 382 of the Code. The existing NOLs of some of our subsidiaries may be subject to limitations arising from ownership changes prior to, or in connection with, their acquisition by us. Furthermore, our ability to utilize NOLs of companies that we may acquire in the future may be subject to limitations. There is also a risk that, due to regulatory changes, such as suspensions on the use of NOLs or other unforeseen reasons, our existing NOLs could expire or otherwise be unavailable to offset future income tax liabilities, including for state tax purposes. For these reasons, we may not be able to utilize some portion of our NOLs even if we attain profitability.

As an online platform, we rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. Despite the implementation of security measures, we and our third-party providers are vulnerable to power outages, telecommunications failures, interruptions or shutdowns of our platform and catastrophic events, as well as cybersecurity risks that threaten the confidentiality, integrity and availability of our and third party providers' information systems, technology, and confidential information (including information about our creators, consumers, employees and others, intellectual property and proprietary information such as trade secrets) through diverse attack vectors, including computer viruses, bugs or other vulnerabilities in software that is integrated into our (or our providers') systems and products, break-ins, intentional or accidental actions or inaction by employees or others with authorized access to our or our providers' networks, social engineering/phishing attacks, denial-of-service attacks, malicious or destructive code, malware, ransomware attacks, and other cyber attacks, data breaches and cybersecurity incidents. Cyber attacks and security incidents (including through security breaches, computer malware and computer hacking attacks) upon information systems are accelerating on a global basis in their frequency, magnitude, levels of persistence, intensity and sophistication, and threat actors are using rapidly changing techniques and tools – including AI – that circumvent security controls, evade detection and remove forensic evidence, and are being conducted by diverse threat actors, including sophisticated and organized groups, state-sponsored organizations and individuals with a wide range of motives and expertise. A successful cyber attack or cybersecurity incident could occur and persist for an extended period of time before being detected. As we continue to grow our business, expand to new geographical locations, and gain greater public visibility, we will continue to face a higher risk of being targeted by cyber attacks. As a result of our (and some of our providers') transition to a primarily remote workforce, we face increased cybersecurity risks due to our reliance on Internet technology and the number of our employees who are working remotely, which may create additional opportunities for threat actors to exploit vulnerabilities. Additionally, any current or future integration of AI in our or any of our providers' operations, products or services is expected to pose new or unknown cybersecurity risks and challenges. Moreover, we have acquired and may continue to acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to significant cybersecurity, operational and financial risks. We have experienced in the past, and could experience in the future, credential stuffing attacks in which malicious third parties used or attempted to use credentials compromised in data breaches suffered by other companies to access accounts on our platform. These credential stuffing attacks have in the past, and may in the future,result in the unauthorized takeover of a customer's account and the illegal abuse of account privileges to misdirect funds to bank accounts owned or controlled by such criminal actors, which may subject us to liability for illegal transactions. It is possible that such incidents of account takeover fraud could increase in the future. The misuse of our products or services for illegal or improper purposes could subject us to claims, individual and class action lawsuits, and government and regulatory investigations, prosecutions, enforcement actions, inquiries, or requests that could result in liability and reputational harm for us. While we employ security measures intended to prevent, detect, and mitigate potential for harm to our users from the theft of or misuse of credentials on our network, these security measures may not be effective in every instance and may require significant costs. Furthermore, the prevalent use of mobile devices increases the risk of cybersecurity incidents. Misplaced, stolen or compromised mobile devices used at events for ticket scanning, or otherwise, could lead to unauthorized access to the device and data stored on or accessible through such device. We have in the past experienced breaches of our security measures, and our platform and systems are at risk for future breaches and incidents, including as a result of third-party action or employee, service provider, partner or contractor error or malfeasance. In the future, our financial performance may be impacted further if we face additional costs and expenses from customer compensation and retention incentives, creator loss, regulatory inquiries, litigation and further remediation and upgrades to our security infrastructure. Although we have insurance coverage, our policy may not cover all financial expenses related to cybersecurity incidents, and there is no guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all. In addition, our platform involves the storage and transmission of personal information of our creators and consumers in our facilities and on our third-party equipment, computer systems, hardware, software, technology infrastructure and online sites and networks. Cybersecurity incidents expose us to legal claims or proceedings (such as class actions), remediation costs, increased costs for security measures, loss of revenue, damage to our reputation, customer loss and potential liability. Information and corporate information systems and security measures may be breached or adversely impacted due to the actions of outside parties, employee error or misconduct, malfeasance, a combination of these or otherwise, and, as a result, an unauthorized party may obtain access to our information systems and confidential information, including information relating to our creators and consumers. Additionally, outside parties may attempt to fraudulently induce employees, creators or consumers to disclose sensitive information in order to gain access to creator or consumer data. We will continuously examine and modify our security controls and business policies to address the use of new devices and technologies, and the increasing focus by consumers and regulators on controlling and protecting personal data. We may need to expend significant resources to protect against and remedy any potential cybersecurity incidents and their consequences, including making notifications to governmental authorities and affected individuals. For example, laws in the EU and UK and all 50 U.S. states require businesses to provide notice to individuals whose personal information has been disclosed as a result of certain data security breaches. Any cybersecurity incident or adverse impact to the availability, integrity or confidentiality of our platform or information systems, the systems or networks of our third-party service providers or partners, or any unauthorized access to information we or our providers and partners process or maintain, could harm our business, financial condition and results of operations. As any investigation of a cybersecurity incident is inherently unpredictable, the extent of a particular cybersecurity incident and the path of investigating, remediating or recovering from the incident may not be immediately clear. It may take a significant amount of time and resources before an investigation can be completed and full and reliable information about the incident is known. While an investigation is ongoing, we may not necessarily know the extent of the harm or how best to remediate or recover from the incident, certain vulnerabilities could remain and errors or actions could be repeated or compounded before they are discovered and remediated, and communication to the public, regulators, creators, consumers and other stakeholders may be delayed, inaccurate or incomplete, any or all of which could further increase the costs and consequences of a cybersecurity incident. Additionally, applicable rules requirements regarding how to respond, required notices to users, and reporting obligations to creators, consumers, regulators and others vary by jurisdiction. While we have a cybersecurity risk management program and have implemented security policies and controls intended to protect our information systems, infrastructure and confidential information, there can be no assurance that such measures or our third-party service providers' and partners' security measures will successfully anticipate new or existing techniques used by threat actors, protect our systems and information, prevent service interruptions, software or hardware vulnerabilities or other security incidents. Further, if our employees or employees of our third-party service providers fail to comply with our internal security policies and practices, or fully implement our cybersecurity risk management program, our information systems and creator, consumer, employee and other confidential information stored thereon may be improperly accessed, used, disclosed or processed. Although it is difficult to determine what harm may directly result from any specific interruption or incident, any actual or perceived failure to maintain performance, reliability, security and availability of our network infrastructure, or of any third-party networks or systems used or supplied by our third-party service providers or partners, to the satisfaction of creators and consumers may harm our reputation and our ability to retain existing creators and consumers and attract new creators and consumers. Examples of situations which have in the past and may in the future lead to unauthorized access to or an adverse impact on the availability, integrity or confidentiality of our information systems or information include, but are not limited to the following: - employees inadvertently sending financial information of one creator, consumer or employee to another creator, consumer or employee;- employee malfeasance;- creators' failure to properly password protect their leased ticket scanning and site operations devices leaving the data available to anyone using the device;- a device stolen from an event and data access, alteration or acquisition occurring prior to our remote wiping of the data;- an employee losing their computer or mobile device or otherwise, allowing for access to our email and/or administrative access, including access to guest lists to events;- external breaches leading to the circulation of "dark web" lists of user name and password combinations openly vulnerable to attack without immediate detection;- a hack of one of our databases;- account takeovers;- a hack of a third-party service provider's or partner's database; and - unauthorized access to our offices or other properties. If an actual or perceived breach of our security or other cybersecurity incident occurs, the market perception of the effectiveness of our cybersecurity risk management program and measures could be harmed, and we could lose existing or future creators and consumers, face lawsuits (including class actions), regulatory investigations and enforcement actions, other legal or regulatory proceedings, damage to our reputation, suffer financial exposure due to such events or in connection with regulatory fines and penalties, incident response, remediation or system restoration efforts, investigation costs, changes or augmentation of our security measures, the expense of taking additional protection measures and future compliance costs. Any or all of the foregoing could materially adversely affect our business, financial condition and results of operations.

There is considerable patent and other intellectual property development activity in our industry. Our success depends on our not infringing or misappropriating upon the intellectual property rights of others. Our competitors, as well as a number of other entities, including non-practicing entities and individuals, may own or claim to own intellectual property rights relating to our industry and may challenge the validity or scope of our intellectual property rights. From time to time, third parties, including our competitors and non-practicing entities, have claimed and may in the future claim that our products or technologies may infringe or misappropriate their intellectual property rights and may assert patent, copyright, trade secret and other claims based on intellectual property rights against us and our creators and vendors. A claim may also be made relating to technology or intellectual property rights that we acquire or license from third parties. If we were subject to a claim of infringement, regardless of the merit of the claim or our defenses, the claim could: - require costly litigation to resolve and the payment of substantial damages;- require significant management time;- cause us to enter into unfavorable royalty or license agreements;- require us to discontinue the sale of solutions through our platform;- require us to indemnify creators or third-party service providers or partners; and/or - require us to expend additional development resources to redesign our platform.

We use open source software in our platform and may use more open source software in the future. The terms of many open source licenses to which we are subject have not been interpreted by U.S. or foreign courts, and there is a risk that open source software licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our provision of our platform. From time to time, companies that use open source software have faced claims challenging the use of open source software or compliance with open source license terms, and we could be subject to such lawsuits. Litigation could be costly for us to defend, harm our business, financial condition and results of operations or require us to devote additional research and development resources to change our platform. In addition, if we were to combine our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release the source code of our proprietary software. If we inappropriately use open source software, we may be required to re-engineer parts of our platform, extract the open source software at issue or take other remedial actions. In addition to risks related to license requirements, use of certain open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide support, warranties, indemnification or other contractual protections on the origin of software equivalent to those provided by third-party commercial software providers. Any of the foregoing could adversely impact the value or enforceability of our intellectual property, and materially adversely affect our business, financial condition and results of operations.

We believe that our corporate culture has been an important contributor to our success, which we believe fosters innovation, teamwork and passion for creators and our transition to a global marketplace. As of December 31, 2024, 66.2% of our development roles were located outside the United States, and nearly all of our customer support and operations roles were transitioned to third-party vendors outside the United States, both of which involve risks related to difficulties in managing and staffing international operations and differences in employee norms. Further, we may face challenges in integrating new employees or any acquired companies into our corporate culture. Any failure to preserve our culture could also negatively affect our ability to retain and recruit personnel, maintain our performance or execute on our business strategy, which may harm our business, results of operations and financial condition. In addition, our remote-first work environment (and remote and hybrid working arrangements at many third-party providers) subjects us to operational challenges and risks. We face increased cybersecurity risks due to our reliance on Internet technology and the number of our employees who are working remotely, which creates challenges associated with managing remote computing assets and may create additional opportunities for threat actors to exploit vulnerabilities present in many non-corporate and home networks. Remote working may also result in other information technology, privacy and fraud risks. Allowing members of our workforce to work remotely may create intellectual property risks if employees create intellectual property on our behalf while residing in a jurisdiction with unenforced or uncertain intellectual property laws. We are also exposed to risks associated with the locations of remote workers, including compliance with local laws and regulations or exposure to compromised Internet infrastructure. Further, if employees fail to inform us of changes in their work location, we may be exposed to additional risks without our knowledge. Our remote-first work environment also presents significant challenges to maintaining compliance with country and state requirements such as employee income tax withholding, the recording of reserves to cover withholding corrections or penalties, remittance and reporting, payroll registration and workers' compensation insurance. Any of these operational challenges or tax implications resulting from our remote-first policy may harm our business, financial condition and results of operations.

Our platform enables the sale and distribution of event tickets through select third-party platforms, such as Meta, Bandsintown and TikTok. Creators are able to publicize their events and sell tickets through these third-party platforms, and these distribution partnerships enable consumers to discover Eventbrite events on other platforms where they spend time. This dynamic enables creators to reach more consumers and makes our platform more appealing to creators looking to grow their audiences. These third-party distribution partners have in the past, and may in the future, terminate their relationship with us, fail to maintain integrations, limit certain integration functionality, change their treatment of our services, restrict access to their platform by creators or consumers, or change their algorithms or consumer experience at any time, thereby impacting the business performance of Eventbrite and its creators. For example, in late 2023, Meta discontinued its Facebook native ticketing product. This means that consumers are no longer able to buy tickets to Eventbrite events directly on Facebook, rather they can continue buying Eventbrite tickets through a clickout experience. If any such third-party services become incompatible with our platform or the use of our platform and solutions on such third-party platforms are restricted in the future, our business may be harmed. In addition, to the extent that Google, or other leading large technology companies that have a significant presence in our key markets disintermediate ticketing or event management providers, whether by offering their own comprehensive event-focused or shopping capabilities, or by referring leads to suppliers, other favored partners or themselves directly, there could be harm to our business, financial condition and results of operations. Further, our partners, some of whom are large technology companies, may be subject to federal regulation in the United States, which may restrict consumer access to our integrations and harm our business. TikTok, for example, was banned in the United States and reinstated shortly thereafter in January 2025. While there is reprieve for the moment, TikTok may continue to be subject to federal scrutiny.

Maintaining and promoting awareness of our marketplace and services is important to our ability to attract and retain creators and consumers. One of the key parts of our strategy is to build a consumer brand that brings consumers to Eventbrite and create more habitual consumers by positioning ourselves as the destination to help people disrupt their old routine and make life more eventful. As we focus on engaging consumers to scale our platform, we plan to continue to increase our marketing spend to help drive consumer demand. We may also need to increase our marketing spend in response to increased spend on marketing from our competitors. We invest in brand and performance advertising through various channels, including search engine optimization (SEO), search engine marketing, affiliate marketing and display marketing, as well as social media, email marketing and digital video advertising. Prominently displaying listings in response to key search terms is a critical factor for attracting creators and consumers to our platform, and we face increased costs for relevant keywords, including our brand name, due to competitive bidding. Search engines frequently change the algorithms that determine the ranking and display of results of a user's search, alter analytics or SEO data available to us or make other changes to the way results are displayed, which can negatively affect the placement of links to our platform and reduce the number of visits or otherwise negatively impact our marketing efforts. In addition, search engines, social networks and other third parties typically require compliance with their policies and procedures, which may be subject to change or new interpretation with limited ability to negotiate, which could negatively impact our marketing capabilities (including marketing services for creators). Further, the growing use of online ad-blocking software and technological changes to browsers and mobile operating systems that, for example, limit access to usage information for platforms like Eventbrite, impact the effectiveness of, or our visibility and insights into, our marketing efforts. As a result, we may fail to bring more consumers, or fail to increase the frequency of visits to our platform. In addition, ongoing legal and regulatory changes in the data privacy sphere in U.S. states and countries throughout the world – and the interpretation of these laws by major search, social and operating system providers – may impact the scope and effectiveness of marketing and advertising services generally, including those used on our platforms. Certain laws require us and our marketing partners to provide consumers the ability to opt-out of this collection of processing of their information for online advertising, and some providers of consumer devices, mobile or desktop operating systems and web browsers have implemented, or have announced plans to implement, ways to block tracking technologies. These developments could result in online tracking methods and our marketing efforts becoming significantly less effective. Similarly, our vendors, particularly those providing advertising and analytics products and services have, and may continue to, modify their products and services based on legal and technical changes relating to privacy in ways that could reduce the efficiency of our marketing efforts and our access to data about use of our platforms. Any reduction in our ability to make effective use of such technologies could harm our ability to personalize the experience of consumers, increase our costs, and limit our ability to attract and retain creators and consumers on cost-effective terms. As a result, our business, financial condition and results of operations could be adversely affected. In addition to the marketing strategies described above, we also engage with celebrities and influencers and partner with aligned brands as part of our marketing efforts, and our perceived affiliation with these individuals and brands could cause us brand or reputational damage in the event they undertake actions inconsistent with our brand and values or otherwise fall in public perception.