eBay (EBAY) Risk Analysis

Regulators and civil litigants have sought, and will likely continue to seek, to hold us liable when our sellers list or sell products on our platforms that they claim are regulated, unlawful, unsafe or infringing. For example, the Department of Justice ("DOJ") has sought to hold us liable for the third-party sales of products they claim violate federal law. Other third parties, including government regulators and law enforcement officials, have, at times, alleged that our services aid and abet violations of laws regarding the sale of counterfeit items, laws restricting or prohibiting the transferability (and by extension, the resale) of digital goods (e.g., books, music and software), the fencing of stolen goods, recalled item laws, selective distribution channel laws, customs laws, distance selling laws, and the sale of items outside of the U.S. that are regulated by U.S. export controls. Similarly, allegations of infringement of intellectual property rights, including but not limited to counterfeit items, have resulted and may continue to result in threatened and actual litigation, at times, by rights owners. Further, we are also subject to claims by consumers that products they purchased from third-party sellers caused them bodily injury or harmed their property. We believe we are protected from many of these claims because the statutes and common law theories under which they are brought have not been conclusively applied to our business model and/or because we are protected from liability under various laws, including 47 U.S.C. § 230 in the United States, the hosting defense under Art. 6 DSA in the EU and Reg.19 of the Electronic Commerce Regulations 2002 in the United Kingdom. However, this could change as our product and service offerings and our business model continue to evolve over time, and our history and these laws do not guarantee that we cannot experience losses from such claims. For example, pursuant to our 2024 settlement agreement with the DOJ, we paid $59 million and agreed to implement enhanced processes regarding our monitoring of listings that violate our terms of service to fully resolve the DOJ's allegations of noncompliance with the Controlled Substances Act. See "Note 11 - Commitments and Contingencies - Litigation and Other Legal Matters" for more details. Even where we succeed in limiting or avoiding regulatory liability for third party sales, we often face significant additional litigation costs as a result of additional civil litigation from users on our platforms, stockholders and other stakeholders. Laws vary by jurisdiction and the sentiment of regulators around the world changes over time based on factors that we cannot control. We have seen an increase in litigation challenging these protections and in legislative and regulatory proposals to reduce or eliminate many of the protections on which our business has relied. For example, there are several proposals to limit or eliminate 47 U.S.C. § 230 (the Communication Decency Act), which limits liability for third-party content posted on Internet platforms, under consideration in the United States. We have also seen legislative proposals in the U.S. seeking to make online marketplaces contributorily liable for the use of counterfeit marks by third-party sellers. In the UK, the DMCCA expands regulatory oversight authority over consumer protections. The EU has also adopted certain additional regulations relating to the safety and sustainability of products on its markets, which bring new obligations both on us directly and our sellers and vendors. The European Union General Product Safety Regulation imposes additional requirements on our business with regard to removing dangerous products from our marketplaces, enabling the traceability of products, and related matters. At times, we have been subject to inspection and investigation by regulators in certain EU-member states relating to whether products on our platforms meet their and EU labeling, documentation and product safety standards. We expect product safety regulatory efforts and investigations like these to continue in the future, and the outcomes of these efforts and investigations cannot be predicted with certainty. Regardless of any outcome, such efforts and investigations can have a material adverse impact on us because of legal costs, diversion of management resources, public perception, loss of consumers on our platforms and other similar factors. In recent years, the DSA has imposed legal obligations on online marketplaces operating in Europe, requiring them to verify the identity of business sellers and make best efforts to assess proper disclosure by traders of required information, as well as information on the safety and authenticity of products posted by third-party merchants. The DSA also enforces new content moderation obligations, notice obligations, advertising restrictions and other requirements on digital platforms that created additional operational burdens and compliance costs for us. We have received a request for information from a regulator in Germany for suspected potential non-compliance with provisions of the DSA. We cannot be sure whether this investigation will lead to any action or penalties, including fines or reputational damage. In any event, such investigation could divert management time and company resources. For online platforms like ours, noncompliance with the DSA could result in fines of up to 6% of annual global revenues, which would have an adverse effect on our business. Similarly, in the United Kingdom, the OSA created requirements around monitoring and handling harmful content and required us to expend resources to comply with the new regulations. Regulators around the world shift their focus from time to time, and we cannot control or always anticipate whether their latest area of focus will impact our marketplace platforms or a specific aspect thereof. Recently, regulators in certain EU-member countries have increased their activity challenging certain fast-fashion marketplaces. Certain EU-member countries have also enacted anti-waste regulations that create direct obligations on sellers and impose compliance verification obligations on us. These regulations vary by EU-member country, creating additional operational burdens and compliance costs on our sellers and us. Adverse changes in laws and regulations that protect us from liability for third-party sales, or adverse interpretations of or litigation involving such laws and regulations, could subject us to substantial civil or criminal damages, limit the items we could allow on our Marketplace platforms, require us to modify our business model, and impose substantial additional compliance costs and operational constraints on our business. Any one of these outcomes could reduce the attractiveness of our Marketplace platforms to consumers, reduce our profits or otherwise harm our business and results of operations.

The determination of our worldwide provision for income taxes and other tax liabilities requires estimation and significant judgment, and from time to time there can be transactions and calculations where the ultimate tax determination is uncertain. Like many other multinational corporations, we are subject to tax in the United States and multiple foreign jurisdictions and have structured our operations to reduce our effective tax rate. Our determination of our tax liability is always subject to audit and review by applicable domestic and foreign tax authorities, and we are currently undergoing a number of investigations, audits and reviews by taxing authorities throughout the world, including with respect to our business structure. Any adverse outcome of any such audit or review could harm our business, and the ultimate tax outcome may differ from the amounts recorded on our financial statements and may materially affect our financial results in the period or periods for which such determination is made. While we have established reserves based on assumptions and estimates that we believe are reasonable to cover such eventualities, these reserves may prove to be insufficient. In addition, our future income taxes could be adversely affected by a shift in our jurisdictional earnings mix, by changes in the valuation of our deferred tax assets and liabilities, changes in the valuation of our investments, as a result of gains on our foreign exchange risk management program, or changes in tax laws, regulations, or accounting principles, as well as certain discrete items.

We are subject to complex laws that frequently change relating to data protection, privacy, cybersecurity and the collection, use, sharing, retention, deletion, security, transfer and other handling of personal data all around the world. These laws may differ, and be interpreted and applied inconsistently, from country to country. In many cases, these laws apply not only to user data, employee data and third-party transactions, but also to transfers of information between us, our subsidiaries, and other parties with which we have commercial relations. These laws, and regulatory scrutiny in these areas, may continue to expand around the globe in ways we cannot predict and that may materially harm our business. Compliance with these laws may restrict our ability to provide certain services to our customers. For example, the General Data Protection Regulation (the "GDPR") applies broadly to personal data collected as a result of our business in the EU, and imposes significant compliance obligations regarding the handling of personal data. Additionally, we must comply with EU data protection standards with respect to our handling of user and employee personal data. Regulators have broad enforcement authority, and if we fail to comply with the GDPR (or if regulators assert that we have), we may be subject to material regulatory enforcement actions, which could require us to modify or suspend critical business activities or result in substantial monetary penalties, private lawsuits, and reputational damage. For example, we have seen legal challenges and regulatory scrutiny of cross-border data transfers from the EU and other jurisdictions, as well as emergency restrictions in the U.S. relating to certain transfers of personal data of U.S. citizens, which may materially affect our ability to transfer data across borders, throughout our organization or with third parties, which could materially harm our business. In the U.S., numerous states have adopted generally applicable and comprehensive consumer privacy laws and we expect this trend to continue. These state laws provide privacy rights for residents of these states and impose corresponding obligations on organizations doing business in these states. These laws require us to make disclosures about our data collection, use and sharing practices, and they create user rights, such as the right to access, delete and correct personal data. As states adopt privacy laws, we face a greater variety in privacy requirements, increasing the complexity of the regulatory environment. Compliance with the GDPR, U.S. state laws, and other current and future applicable U.S. and international privacy, data protection, cybersecurity, and other data-related laws is expensive and resource intensive. Any violation (or perceived violation) of these laws could expose us to significant damage awards, fines and reputational damage, any of which could materially harm our business. Because of the enormous number of emails, texts and other communications we send to our users, communications laws that provide a specified monetary damage award or fine for each violation could result in particularly large awards or fines. In addition, our success depends in part on our ability to collect and use data relating to merchants, consumers, and other individuals. Legislative proposals and existing laws and regulations have been increasingly focused on the use of tracking technologies, such as "cookies," electronic communications and marketing. For example, in the European Economic Area and the U.K., regulators are increasingly focusing on compliance with requirements related to the targeted advertising ecosystem. European regulators have issued significant fines in certain circumstances where they alleged that appropriate consent was not obtained in connection with targeted advertising activities. If the use of tracking technologies is further restricted, regulated, or otherwise blocked, the amount or accuracy of user information we collect would decrease, which could make it more difficult for us to attract and retain customers. Government regulators globally are also imposing new data reporting requirements on platforms for user tax compliance. These laws (e.g., the Directive on Administrative Cooperating Council Directive (EU) 2021/514 ("DAC 7") in the EU and the Digital Sales Reporting Legislation ("DSR") in the United Kingdom) may make users more reluctant to use our services due to increased sensitivity around personal data collection and reporting (e.g., the requirement to report Chinese sellers' identity and income information to the competent China tax authority in accordance with the Regulations on Internet Platform Companies' Submission of Tax-related Information), even when mandated by applicable laws and regulations. Generally, our sellers demand that our services help them comply with complex regulatory requirements. Training our sellers and providing them with the platform tools and features they need to comply with complex regulations requires substantial time and investment. We have driven consumers away from our platforms in the past where we failed to provide adequate compliance training and platform features. Our business could be harmed if we make similar failures in the future as a result of new and changing regulations.