Etsy (ETSY) Risk Analysis

We are subject to a variety of laws and regulations in the United States and around the world, including those relating to traditional businesses, such as employment laws, accessibility requirements, taxation, trade, product liability, marketing, intellectual property, and consumer protection laws, and laws and regulations focused on e-commerce and online marketplaces, such as those governing online payments, privacy, anti-spam, data security and protection, online platforms, content moderation, online child safety, social media regulation, marketplace seller regulation, AI, automated decision-making, and machine learning. Additional examples include data localization requirements, limitations on marketplace scope or ownership, intermediary liability protections, regulation of online speech and content moderation, packaging and recycling requirements, seller certification and representative requirements, know-your-customer/business regulations, and rules related to security, privacy, or national security, which may regulate us, our users, or our vendors. In light of our international operations, we need to comply with various laws associated with doing business outside of the United States, including anti-money laundering, sanctions, anti-corruption, and export control laws. In some cases, privacy, data security, consumer protection, e-commerce, and other laws and regulations differ significantly across jurisdictions, and in some countries, such laws are more actively enforced. In addition, regulations, laws, policies, and international accords relating to environmental and social matters, including sustainability, due diligence, climate change, human capital, forced labor, and diversity, have been enacted or are being developed and formalized in Europe, the United States (both at the federal level and on a state-by-state basis), and elsewhere, some of which include specific disclosure requirements, target-driven frameworks, and/or due diligence obligations to which we may be subject. These laws and regulations are continuously evolving, and compliance is costly and can require changes to our business practices and significant management time and effort. Additionally, it is not always clear how existing laws apply to online marketplaces as many of these laws do not address the unique issues raised by online marketplaces or e-commerce. Some jurisdictions attempt to extend domestic laws and regulations globally, including to Etsy or our subsidiaries, and may subject us to inconsistent obligations across jurisdictions. In addition, outside of the United States, governments of one or more countries have in the past, do, and may continue to seek to censor content available on our platforms (including at times lawful content) or require Etsy to block or remove such content, and/or to block access to our platforms. Compliance is often complex, resource intensive, and/or operationally challenging. In addition, applicable laws may conflict with each other, and by complying with the laws or regulations of one jurisdiction, we may find that we are violating the laws or regulations of another jurisdiction. Despite our efforts, we may have not always fully complied and may not be able to fully or timely comply with all applicable laws in all jurisdictions where we operate, particularly where the applicable regulatory regimes are new or have not been broadly interpreted. If we become liable under laws or regulations applicable to us, we could be required to pay significant fines and penalties, our reputation may be harmed, and we may be forced to change the way we operate. That could require us, for example, to incur significant expenses, discontinue certain services, or limit, change, or discontinue our services in particular jurisdictions, any of which could negatively affect our business. In addition, if we are blocked or restricted from operating in one or more countries, our ability to attract and retain sellers and buyers may be adversely affected and we may not be able to operate our business as we anticipate. Additionally, if third parties with whom we work violate applicable laws or our policies, those violations could also result in liabilities for us and could harm our business. Our ability to rely on insurance, contracts, indemnification, and other remedies to limit these liabilities may be insufficient or unavailable in some cases. Furthermore, the circumstances in which we may be held liable for the acts, omissions, or responsibilities of our sellers or other third parties is uncertain, complex, and evolving. Upcoming and proposed regulations may require marketplaces like ours to comply with specific obligations, beyond what marketplaces have traditionally been required to do, to avoid liability. With an increasing number of such laws being proposed and passed, the resulting compliance costs and potential liability risk could negatively impact our business.

We are regularly involved in litigation, arbitration, disputes, and regulatory matters, including those related to intellectual property, consumer protection, product liability, product safety, regulatory compliance, security and privacy, and/or commercial matters, either individually or, where available, on a class-action basis. We have been, are, and may in the future be subject to heightened regulatory scrutiny, inquiries, or investigations, including with respect to our sellers, vendors or third parties, relating to both specific inquiries as well as broad, industry-wide concerns, such as antitrust, product liability, and privacy, that could lead to legal liability, increased expenses, injunctive relief, or reputational damage. Under certain circumstances, we have contractual and other legal obligations to indemnify and to incur legal expenses on behalf of current and former directors, officers, employees, underwriters, and other third parties. Any lawsuit or legal action to which we are a party, with or without merit, may result in an unfavorable judgment or settlement, substantial monetary payments or fines, adverse changes to our offerings or business practices, reputational harm, and other consequences. We have in the past settled lawsuits, regulatory actions, and other disputes and may decide in the future to settle such actions, even if non-meritorious. In addition, defending claims is costly and can impose a significant burden on our management. We manage and mitigate certain legal risks through our House Rules, policies, and other terms of use, including through the use of informal dispute resolution, individual arbitration, mass arbitration procedures, limitations of liability, venue selection, choice-of-law, and indemnification requirements. These requirements may be subject to differing interpretations, risks, and legal frameworks in different U.S. federal, state, and foreign courts, and may not be enforceable in some jurisdictions. If certain of our House Rules, policies, and other terms are not enforceable in particular jurisdictions or disputes, we could experience increased costs and expenses, litigation in multiple jurisdictions, inconsistent decisions, and/or forum shopping by third parties seeking jurisdictions amenable to their claims. Lawsuits, enforcement actions, and other legal proceedings brought against us have resulted in judgments or settlements, and may result in injunctions, damages, fines, or penalties, which could have a material adverse effect on our financial condition or results of operations or require changes to our business. Although we establish accruals for our litigation and regulatory matters in accordance with applicable accounting guidance when they present loss contingencies that are both probable and reasonably estimable, there may be a material exposure to loss in excess of any amounts accrued, or in excess of any loss contingencies disclosed as reasonably possible, particularly in more uncertain legal or regulatory environments. Such loss contingencies may not be probable and reasonably estimable until the proceedings have progressed significantly, which could take several years and occur close to resolution of the matter.

We are subject to a variety of tax and tax collection obligations in the United States and in numerous other foreign jurisdictions. We record tax expense, including indirect taxes, based on current tax payments and our estimates of future tax payments, which may include reserves for estimates of probable or likely settlements of tax audits. We may recognize additional tax expense and be subject to additional tax liabilities, including tax collection obligations, due to changes in tax law, regulations, administrative practices, principles, and interpretations related to tax, including changes to the global tax framework, competition, and other laws and accounting rules in various jurisdictions. An increasing number of jurisdictions are considering or have adopted laws or administrative practices that impose new tax measures, including revenue-based taxes, such as digital services taxes or online sales taxes, targeting online commerce and the remote selling of goods and services. These include new obligations to withhold or collect sales, consumption, value added, or other taxes on online marketplaces and remote sellers, or other requirements that may result in liability for third-party obligations. For example, several jurisdictions have proposed or enacted taxes on online advertising and marketplace service revenues. Proliferation of these or similar unilateral tax measures may continue unless broader international tax reform is implemented. Our effective tax rate, results of operations and cash flows have at times been, and could in the future be, materially and adversely affected by additional taxes imposed on us prospectively or retroactively. We may also be subject to increased requirements for marketplaces to report, collect, remit, and hold liability for their customers' direct and indirect tax obligations, as a result of changes to regulations, administrative practices, outcomes of court cases, and changes to the global tax framework. Our effective tax rate and cash taxes paid in a given financial statement period may be adversely impacted by results of our business operations including changes in the mix of revenue among different jurisdictions, acquisitions, investments, entry into new geographies, the relative amount of foreign earnings, changes in foreign currency exchanges rates, changes in our stock price, intercompany transactions, changes to accounting rules, expectation of future profits, changes in our deferred tax assets and liabilities and our assessment of their realizability, and changes to our ownership or capital structure. Fluctuations in our tax obligations and effective tax rate could adversely affect our business. In the ordinary course of our business, there are numerous transactions and calculations for which the ultimate tax determination is uncertain. Although we believe that our tax positions and related provisions reflected in the financial statements are fully supportable, we recognize that these tax positions and related provisions may be challenged by various tax authorities. These tax positions and related provisions are reviewed on an ongoing basis and are adjusted as additional facts and information become available, including progress on tax audits, changes in interpretation of tax laws, developments in case law, and closing of statute of limitations. To the extent that the ultimate results differ from our original or adjusted estimates, our actual tax liability and/or effective tax rate could be adversely affected. The (provision) benefit for income taxes involves a significant amount of management judgment regarding interpretation of relevant facts and laws in the jurisdictions in which we operate. Future changes in applicable laws, including any implementation of the Organization for Economic Cooperation and Development ("OECD") "two pillar" project, projected levels of taxable income, and tax planning could change the effective tax rate and tax balances recorded by us. In addition, tax authorities periodically review income tax returns filed by us and raise issues regarding filing positions, timing and amount of income and deductions, and the allocation of income among the jurisdictions in which we operate. A significant period of time may elapse between the filing of an income tax return and the ultimate resolution of an issue raised by a revenue authority with respect to that return. Any adjustments as a result of any examination may result in additional taxes or penalties against us. If the ultimate result of these audits differs from original or adjusted estimates, they could have a material impact on our effective tax rate and tax liabilities. At any one time, we typically have multiple tax years subject to audit by various taxing jurisdictions. As a result, we could be subject to higher than anticipated tax liabilities as well as ongoing variability in our quarterly tax rates as audits close and exposures are re-evaluated. Strategic Risks Related to Our Business and Industry

We collect, receive, use, store, disclose, share, and transfer a host of personal, confidential, proprietary, and otherwise potentially protected information in the course of our operations, including to operate our business and for legal, compliance, and marketing purposes, which subjects us to an increasingly complex array of global privacy, AI, and data protection regulations. Authorities around the world have adopted and are considering a number of legislative and regulatory proposals affecting data protection, data usage, data transfer, localization, AI, and information security, among other things. These laws and regulations are evolving, are subject to interpretation, in some cases may conflict with each other, and create substantial operational, financial, regulatory, reputational, and legal risk to our business. We are subject to regular inquiries and requests from regulators regarding these efforts. Examples of these laws include: - The E.U. General Data Protection Regulation and the U.K. General Data Protection Regulations, which apply to our activities conducted from an establishment in the European Union or the United Kingdom, respectively, or related to products and services that we offer to our users in the European Union or the United Kingdom. - Various comprehensive U.S. state and international privacy laws, which give new data privacy rights to their respective residents (including, in California, a private right of action in the event of a data breach resulting from our failure to implement and maintain reasonable security procedures and practices) and impose significant obligations on controllers and processors of consumer and employee data. - U.S. state laws governing the processing of biometric information, including laws in Illinois, Texas, and Washington, which impose obligations on businesses that collect or disclose consumer biometric information and contain broad definitions of biometric information. - Various federal, state, and international laws, like the Children's Online Privacy Protection Act of 1998, state age assurance laws, and the U.K. Age-Appropriate Design Code, which govern the provision of services to children and minors, including the collection and processing of their data. Further, we are subject to evolving international laws, regulations, decisional authority, and guidance governing whether, how, and under what circumstances we can transfer, process, and/or receive personal data. The validity of various cross-border data transfer mechanisms remains subject to legal, regulatory, and political developments in both the European Union and the United States. Any changes to existing frameworks may require us to adapt our existing arrangements or could impede our ability to effectively transfer data to our users, vendors, and partners in other jurisdictions. We incorporate AI and machine learning technologies into our products and internal operations. As a result, we are increasingly subject to a rapidly developing body of laws and regulations specifically addressing AI. These evolving laws may impose significant compliance burdens, including requirements for impact assessments, risk management systems, human review of AI outputs, and disclosures to users. Moreover, because these technologies are themselves highly complex and rapidly developing, it is not possible to predict all of the legal, cybersecurity, or regulatory risks that may arise relating to our use of such technologies. Our failure to comply with these emerging AI laws and regulations could result in significant fines, restrictions on the deployment or use of AI systems, reputational harm, and legal liability. Collectively, worldwide privacy, data protection, AI, and information security laws and regulations have and may continue to change some of the ways that we, our sellers, our vendors, and other third parties collect, use, and share protected information, in some cases creating costly compliance obligations and/or impeding our business. For example, some of these requirements may introduce friction into the user experience on our platforms, restrict our ability to use data in ways that could benefit our sellers and our business, or impact the scope and effectiveness of our marketing efforts, any of which could negatively impact our business and future outlook. We may fall short of our data protection obligations due to various factors either within our control (such as limited internal resource allocation) or outside our control (such as a lack of vendor cooperation, new regulatory interpretations, or lack of regulatory guidance in respect of certain requirements). Any actual or perceived failure to comply with applicable privacy or data protection laws, our contractual obligations to third parties, our privacy policies, or similar requirements, could subject us to significant damages, fines, penalties, regulatory investigations, lawsuits, remediation costs, reputational damage, and/or other liabilities. In addition, although our sellers and vendors are independent businesses with their own data protection and privacy obligations, it is possible that a privacy authority could deem us jointly and severally liable for actions of our sellers or vendors, which would increase our potential liability and costs of compliance and could harm our business. We are also subject to various data breach notification laws and, in some instances, have contractual and other obligations to notify relevant stakeholders in the event of an actual or potential breach. Our contracts, our contractual representations, and/or industry standards, to varying extents, may require us to use industry-standard or other reasonable measures to safeguard personal or confidential information. Cyber-related events and security breaches, even if only related to the actions of a third-party vendor, are and have been costly, could lead to legal liability or negative publicity, may cause our users, employees, or other stakeholders to lose confidence in our security measures, may cause us to breach certain contracts, and may require us to expend significant resources to remediate and/or defend against regulatory inquiries or litigation. There can be no assurance that indemnity, contractual remedies, or insurance will be available or adequate to protect us from liabilities or damages in the event of a breach or cyber-related incident.

Maintaining and promoting awareness of our marketplaces and services is important to our ability to attract and retain sellers and buyers. One of the key parts of our strategy for the Etsy marketplace is to bring new buyers to the marketplace, reactivate lapsed buyers, and create more habitual buyers by inspiring more frequent purchases across multiple categories and purchase occasions. We continue to iterate on and invest in our marketing strategies for each of our marketplaces, which may not succeed for a variety of reasons, including our inability to execute and implement our plans. Our digital marketing efforts currently include, among others, agentic search integration, search engine optimization, search engine marketing, affiliate marketing, and display advertising, as well as social media, mobile push notifications, and email marketing. If we fail to scale and deliver an effective return on investment in any of our marketing efforts, it may harm our business. We also engage with celebrities and influencers as part of our marketing efforts, and our perceived affiliation with these individuals could cause us brand or reputational damage in the event they are perceived to be or take actions inconsistent with our brands and values. Additionally, we invest significantly in brand advertising via channels such as television and digital video advertising. If we do not produce effective content or purchase effective air time and placement for that content, it could fail to deliver a return on our investment, and damage our brands and/or business. Many of our marketing efforts include our sellers and products from their shops selected via automated systems. These automated systems may not always operate effectively. While both our manual and automated systems have tools and procedures designed to account for our and our partners' policies, despite our best efforts, we may inadvertently include in our marketing efforts sellers or their products inconsistent with our policies, brands, and values, which could result in failure to deliver a return on our investment, media or regulatory scrutiny, and damage to our brands and/or business. We obtain a significant number of visits via search engines such as Google. Search engines frequently change the algorithms that determine the ranking and display of results of a user's search, alter analytics or search engine optimization data available to us, or make other changes to the way results and source content are displayed. These changes have and may continue to negatively affect the placement of links to our marketplaces and reduce the number of visits we receive from search engines. We continue to adjust our marketing strategies to account for these changes, but there can be no guarantee these adjustments will be effective. We have entered into strategic relationships with certain third-party platforms, including AI–enabled applications, that surface our sellers' products within those platforms and, in some cases, enable buyers to complete purchases directly through those applications. These arrangements represent an additional channel through which buyers may discover and purchase items from our sellers, and we rely on these third parties to operate their platforms in a manner that supports accurate product presentation and reliable transaction completion. These platforms are operated by parties outside of our control and may experience outages, disruptions, errors, or changes to functionality, policies, or business practices that could impair product discovery, reduce buyer engagement, or negatively affect the marketing and sale of our sellers' products. We cannot control the availability of such third-party AI-enabled applications, especially in a highly competitive environment, and we may be unable to negotiate favorable economic terms with the applicable providers. If any such third-party AI-enabled applications become incompatible with our solutions or unavailable for use, or if the providers of such models unfavorably change the terms on which such AI-enabled platforms are offered or terminate their relationship with us, our solutions may become less appealing to our customers and our business will be harmed. We do not control the user interface, ranking, prompts, rates of updates or information fields through which our sellers' products are displayed on these third-party platforms and rely on our partners to surface complete and accurate product information. If product information is displayed inaccurately or incompletely, or if automated or AI–driven outputs produce unexpected results, buyers may have a negative experience or be confused about the source of a transaction. Such outcomes could result in reputational harm, reduced trust in our marketplace, increased customer support costs, or claims from consumers, payments partners/networks, or regulators. We also obtain a significant number of visits from social media platforms such as Facebook, Instagram, and Pinterest. Search engines, social networks, and other third parties typically require compliance with their policies and procedures, which may be subject to change or new interpretation with limited ability to negotiate, which from time to time negatively impacts our marketing capabilities (including marketing services for our sellers), GMS, and revenue. Limits on how data can be used in connection with third-party advertising and the growing use of online ad-blocking software and technological changes to browsers and mobile operating systems that, for example, limit access to usage information for advertisers like Etsy, impact the effectiveness of, or our visibility and insights into, our marketing efforts. As a result, we may fail to bring more buyers, or fail to increase frequency of visits, to our platforms. In addition, ongoing legal and regulatory changes in the data privacy, social media and technology spheres in U.S. states and countries throughout the world – and the interpretation of these laws by major search, social, and operating system providers – have and may continue to impact the scope and effectiveness of marketing and advertising services generally, including those used on our platforms. We also obtain a significant number of visits through email marketing. If we are unable to successfully deliver emails to our sellers and buyers, if our email subscription tools do not function correctly, or if our sellers and buyers do not open our emails, whether by choice, because those emails are marked as low priority or spam, or for other reasons, our business could be adversely affected. As e-commerce, search, and social networking, as well as related regulatory regimes, evolve, we must continue to evolve our marketing tactics and technology accordingly and, if we are unable to do so, our business could be adversely affected. Many providers of consumer devices, mobile or desktop operating systems, and web browsers have blocked, or have announced options to block, third-party cookies and similar online tracking technologies, which has and may continue to reduce the effectiveness of traditional online tracking methods. Similarly, our vendors, particularly those providing advertising and analytics products and services have modified and may continue to modify their products and services based on legal and technical changes relating to privacy in ways that could reduce the efficiency of our marketing efforts and our access to data about use of our platforms. Any reduction in our ability to make effective use of such technologies could harm our ability to personalize the experience of buyers, increase our costs, and limit our ability to attract and retain our sellers and buyers on cost-effective terms. As a result, our business and results of operations could be adversely affected.

Our intellectual property is an essential asset of our business. To establish and protect our intellectual property rights, we rely on a combination of copyright, trademark, and patent laws, as well as confidentiality procedures and contractual provisions. We also rely on trade secret protection for parts of our technology and intellectual property. The efforts we have taken to protect our intellectual property may not be sufficient or effective. We generally do not elect to register our copyrights, relying instead on the laws protecting unregistered intellectual property, which may not be sufficient. We rely on both registered and unregistered trademarks, which may not always be comprehensive in scope. In addition, our copyrights, trademarks, and patents may be held invalid or unenforceable if challenged, and may be of limited territorial reach. While we have obtained or applied for patent protection with respect to some of our intellectual property, patent filings may not be adequate alone to protect our intellectual property, and may not be sufficiently broad to protect our proprietary technologies. Additionally, it is expensive to maintain these rights, both in terms of application and maintenance costs and the time and cost required to defend such rights, if necessary. From time to time, we acquire or license intellectual property from third parties, but these acquired assets, like our internally developed intellectual property, may lapse, be abandoned, be challenged or circumvented by others, be held invalid, be unenforceable, or may otherwise not be effective in protecting our platforms. In addition, we may not be effective in policing unauthorized use of our intellectual property and authorized uses may not have the intended effect. Even when we do detect violations, enforcing our rights may require us to engage in litigation, use of takedowns and similar procedures, or licensing. Any enforcement efforts we undertake, including litigation, could be time-consuming and expensive and could divert our management's attention. In addition, our efforts may be met with defenses and counterclaims challenging the validity and enforceability of our intellectual property rights or may result in a court determining that our intellectual property rights are invalid or unenforceable. If we are unable to adequately prevent unauthorized use or misappropriation of our intellectual property by third parties, the value of our brand and other intangible assets may be diminished and customers may lose trust in Etsy. Any of these events could have an adverse effect on our business. We attempt to protect our intellectual property and confidential information, in part, through confidentiality, non-disclosure, and invention assignment agreements with employees, advisors, service providers, and other third parties who develop intellectual property on our behalf, or with whom we share information. However, we cannot guarantee that we have entered into such agreements with each party that has developed intellectual property on our behalf or that has or may have had access to our confidential information, trade secrets, and other intellectual property. These agreements may also be breached, or may not effectively prevent unauthorized use, disclosure, or misappropriation of our confidential information or intellectual property. Moreover, these agreements may not provide an adequate remedy for breaches or in the event of unauthorized use or disclosure of our confidential information or infringement of our intellectual property. The legal framework surrounding protection of intellectual property changes frequently throughout the world, particularly as to technologies used in e-commerce, and these changes may impact our ability to protect our intellectual property and defend against third-party claims. If we are unable to cost-effectively protect our intellectual property rights, our business could be harmed.

We use AI in connection with our business. The use of AI, a relatively new and emerging technology in the early stages of commercial use, exposes us to additional risks, such as damage to our reputation, competitive position, and business, legal, and regulatory risks and additional costs. For example, generative AI has been known to produce false or "hallucinatory" inferences or output, and certain generative AI uses machine learning and predictive analytics, which can create inaccurate, incomplete, or misleading content, unintended biases and other discriminatory or unexpected results, errors, or inadequacies, any of which may not be easily detectable by us or our related service providers. Accordingly, while AI-enabled applications may help provide more tailored or personalized user experiences, if the content, analyses, or recommendations that AI-enabled applications assist in producing in our products and solutions are, or are perceived to be, deficient, inaccurate, biased, unethical, or otherwise flawed, our reputation, competitive position, and business may be materially and adversely affected. In addition, laws, regulations, and industry standards governing the development and use of AI are rapidly evolving, and compliance with new or changing requirements may increase our costs and expose us to legal, regulatory, and reputational risk. Additionally, if any of our employees, contractors, consultants, vendors, or service providers use any third-party AI-enabled systems and software in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential information into training sets, which may impact our ability to realize the benefit of, or adequately maintain, protect, and enforce our intellectual property or confidential information, harming our competitive position and business. Any outputs that we create using AI-enabled tools may not be subject to copyright protection, which may adversely affect our intellectual property rights in, or ability to commercialize or use, any such content. To the extent that we do not have sufficient rights to use the data or other material or content used in or produced by the AI-enabled systems used in our business, or if we experience cybersecurity incidents in connection with our use or any third party's use of AI-enabled applications, it could adversely affect our reputation and expose us to legal liability or regulatory risk, including with respect to third-party intellectual property, data privacy, cybersecurity, publicity, contractual or other rights. Further, our competitors or other third parties may incorporate AI into their products more quickly or more successfully than us, which could impair our ability to compete effectively.

Our sellers manage their shops, certain shop policies, products and product descriptions, shipping, and returns. As a result, we do not have the ability to control important aspects of buyers' experiences on our platforms. For example, buyers may report that they have not received the items they purchased, that the items received were not as represented by a seller, or that a seller has not been responsive to their questions. In addition, popular or trending sellers may experience an influx of orders that may be beyond their ability to fulfill in a timely manner. While we have introduced features designed to protect buyers, there can be no assurance that these measures will be effective in combating fraudulent transactions or improve overall buyer satisfaction. Further, anything that prevents the timely processing of orders or delivery of goods to our buyers could harm our sellers. If buyers have a negative purchase experience, whether due to service interruptions or other reasons, or if sellers are unable to timely fulfill their orders from buyers, our reputation could be harmed. In addition, negative publicity and sentiment generated as a result of these types of complaints, or any associated enforcement action taken against sellers, could reduce our ability to attract and retain our sellers and buyers or damage our reputation.