GoDaddy (GDDY) Risk Analysis

ICANN is a multi-stakeholder, private sector, not-for-profit corporation formed in 1998 for the express purposes of overseeing a number of internet related tasks, including managing the Domain Name System (DNS) allocation of IP addresses, accreditation of domain name registrars and registries and the definition and coordination of policy development for these functions. We are accredited by ICANN as a domain name registrar and thus our ability to offer domain name registration products is subject to our ongoing relationship with, and accreditation by, ICANN. Further, our gTLD registry business is based on contracts with ICANN, per TLD, and therefore, is subject to existing requirements and any changes or modifications to those requirements. Additionally, we continue to face the following possibilities: - the structure and accountability mechanisms contained in the Bylaws for ICANN, as amended, are not fully tested, which may result in ICANN not being accountable to its stakeholders and unable to make, implement or enforce its policies;- the internet community, key commercial industry participants, the U.S. government or other governments may (i) refuse to recognize ICANN's authority or support its policies, (ii) attempt to exert pressure on ICANN, or (iii) enact laws in conflict with ICANN's policies, each of which could create instability in the domain name registration system;- the terms of the Registrar Accreditation Agreement (RAA) under which we are accredited as a registrar or the Registry Agreement (RA) under which we are accredited as a registry, could change in ways that are disadvantageous to us or under certain circumstances could be terminated by ICANN, thereby preventing us from operating our registrar or registry service, or ICANN could adopt unilateral changes to the RAA or RA that are unfavorable to us, that are inconsistent with our current or future plans, or that affect our competitive position;- governments, via ICANN's Governmental Advisory Committee, may seek greater influence over ICANN policies and contracts with registrars and registries and may advocate changes that may adversely affect our business;- international regulatory or governing bodies may gain increased influence over the management and regulation of the domain name registration system, leading to increased regulation in areas such as taxation, privacy, data protection, cybersecurity, international trade and sanctions compliance, content regulation and the monitoring of our customers' hosted content;- ICANN or any TLD operators may implement policy changes impacting our ability to run our current business practices throughout the various stages of the lifecycle of a domain name;- the U.S. Congress or other legislative bodies in the U.S. could take action unfavorable to us, influencing customers to move their business from our products to those located outside the U.S.;- the U.S. Congress or other legislative bodies in the U.S. could adopt regulations that are in direct conflict with other jurisdictions (e.g., the E.U.), which could fragment our platform and product offerings;- the U.S. Congress or other legislative bodies in the U.S. or in other countries could adopt laws that erode the safe harbors from third-party liability in the Communications Decency Act (CDA) (Section 230) and the Digital Millennium Copyright Act;- ICANN could fail to maintain its role, potentially resulting in instability in DNS services administration and operation;- our business as a vertically integrated operation of a registrar and registry could lead to increased regulatory scrutiny;- ICANN, TLD operators, governments and governmental authorities may impose requirements for verification of domain name registrant information that are inconsistent with our current business practices or that result in inconsistency among industry participants, including but not limited to changes under the E.U. NIS2 Directive being transposed into member state law;- ICANN, TLD operators, governments and governmental authorities may impose requirements for, or prohibit, the registration of domain names containing certain words or phrases;- some governments and governmental authorities outside the U.S. have in the past disagreed, and may in the future disagree, with the actions, policies or programs of ICANN and TLD operators relating to the DNS, which could fragment the single, unitary internet into a loosely-connected group of one or more networks, each with different rules, policies and operating protocols;- multi-party review panels established by ICANN's Bylaws may take positions unfavorable to our business; and - changes in ICANN leadership could introduce uncertainty that could delay or postpone programs, such as the current application round for new generic TLDs (gTLD), and that could have a material impact on our business. If any of these events occur, they could create instability in the domain name registration system and may make it difficult for us to continue to offer existing products and introduce new products, or serve customers in certain international markets. These events could also disrupt or suspend portions of our domain name registration product and subject us to additional restrictions on how the registrar and registry products businesses are conducted, which would result in reduced revenue. In addition, due to changes in privacy and data protection laws, rules and regulations around the world, ICANN and its stakeholders have modified their policies, procedures and contracts related to how registrars collect, store, transmit, publish or otherwise process the personal information of domain name registrants in publicly accessible directories. We continue to work with ICANN and our industry counterparts to reconcile conflicts and inconsistencies with such laws, rules and regulations. If ICANN is unable to maintain policies, procedures and contracts consistent with applicable privacy and data protection laws and regulations, our efforts to comply with applicable laws may cause us to violate our existing ICANN contractual obligations. As a result, we could experience difficulties in selling domain name registrations and keeping our existing customer domain names under management, which could have a material adverse effect on our operations and revenue. In addition to the above, courts and regulators in certain jurisdictions have adopted, and may continue to adopt, broad or evolving interpretations of the obligations of domain name registrars and registries. Such interpretations may include, among other things, disclosure of registrant information, restrictions on the availability or promotion of certain domain names, limitations on privacy or proxy services, requirements to implement intellectual property protection or anti-fraud measures (including Know Your Customer requirements), and compliance with local court orders, sanctions, export control obligations or other enforcement requests, including in cross-border contexts. Compliance with such interpretations, or with inconsistent or conflicting legal requirements across jurisdictions, may increase our costs, require operational changes, limit certain product offerings or expose us to increased litigation, regulatory scrutiny, fines, penalties or enforcement actions, including restrictions on our ability to operate or offer services in certain markets. For more information, please refer to the risk factor "Our business could be affected by new laws, rules, regulations or court orders regarding the internet."

As a result of the products and services we offer, we may be subject to liability and negative publicity due to our customers' activities on or in connection with their domain names, their websites or the data they store on our servers. In addition,as we expand our social media management and professional web services, we may be subject to liability for content we create on behalf of our customers. Although our terms of service prohibit the illegal use of our products by our customers and permit us to take down or suspend websites or take other appropriate actions in response to illegal uses (among other reasons), customers may nonetheless engage in prohibited activities or upload or store content on our products in violation of applicable law, our agreement or policies, or the customer's own policies, which could subject us to liability. Furthermore, our reputation and brand may be negatively impacted by customer actions and website content that are deemed hostile, offensive or inappropriate. We do not proactively monitor or review the appropriateness of the domain names our customers register or the content of their websites, and we do not have control over customer activities. The safeguards we have in place may not be sufficient to avoid harm to our reputation and brand, especially if such hostile, offensive or inappropriate customer content is high profile or misinterpreted as content supported by us. In addition, other bodies of law, including state criminal laws, may be deemed to apply or new statutes or regulations may be adopted in the future, any of which could expose us to further liability and increase our costs of doing business. Several U.S. federal statutes may apply to us with respect to various activities of our customers, including the Anti-Cybersquatting Consumer Protection Act (ACPA), which provides recourse for trademark owners against cybersquatters, the Digital Millennium Copyright Act (DMCA), which provides recourse for owners of copyrighted material who believe their rights under U.S. copyright law have been infringed on the internet, and the CDA, which addresses blocking and screening of content on the internet. Although these and other similar laws, rules and regulations provide limited protections from liability for providers like us, those protections may not be interpreted in a way that applies to us, may be amended or removed in the future, or may not provide us with complete protection from applicable claims. If we are found not to be protected by the safe harbor provisions of these laws, rules and regulations or if we are deemed subject to laws in other countries that may not have the same protections or that may impose more onerous obligations on us, we may owe substantial damages and our brand, reputation, and financial results may be harmed. Notwithstanding the exculpatory language of these bodies of law, the activities of our customers have resulted in, and may in the future result in, threatened or actual litigation against us. Although the ACPA, DMCA, CDA and relevant U.S. case law have generally shielded us from liability for customer activities to date, court rulings in pending or future litigation or future regulatory or legislative amendments may narrow the scope of protection afforded us under these laws. Additionally, neither the DMCA nor the CDA generally provides protection from claims of trademark violations and therefore, do not shield us from liability for claims under the Lanham Act or other similar laws. Furthermore, there have been, and continue to be, various congressional, state, judicial and executive efforts to narrow, reinterpret, remove or restrict the scope of the protections available under Section 230 of the CDA, which could narrow, condition or repeal existing statutory liability protections which, if successful could decrease our current protections from liability for third-party content and increase our litigation costs. For example, the Stop Enabling Sex Traffickers Act and the Allow States and Victims to Fight Online Sex Trafficking Act may limit the immunity previously available to us under the CDA, which could subject us to investigations or penalties if our customers' activities are deemed illegal or inappropriate. Furthermore, the DSA could negatively impact the scope of the limited immunity provided by the E-Commerce Directive in the E.U. If claims brought against us under these or similar laws are successful, our business and operating results could be adversely affected, and even if the claims do not result in litigation or are resolved in our favor, these claims, and the time and resources necessary to resolve them, could divert the resources of our management and adversely affect our business and operating results. Additionally, in May 2025, the U.S. federal government enacted the 'Take It Down Act,' which establishes mandatory takedown procedures for non-consensual intimate images and other specified content. Under the act, online platforms and service providers may be required to respond to verified takedown requests from individuals and remove or restrict access to such content. Failure to comply with applicable obligations under the Act could subject us to civil liability, fines, regulatory enforcement or other legal or compliance obligations. Moreover, because we do not generally pre-screen customer content, we may face challenges in meeting the compliance timelines or verification obligations set forth in the act, particularly if customer content is stored on distributed systems, served via third-party integrations or otherwise difficult to identify and remove promptly. Similar notice-and-takedown and online safety obligations have been enacted or proposed in other jurisdictions, and additional laws may impose differing or inconsistent compliance obligations across the jurisdictions in which we operate.

The reliability, security and continuous availability of the software, hardware and workflow processes underlying our internal systems, networks and infrastructure and the ability to deliver our products are critical to our business. Any interruptions resulting in our inability to timely deliver our products or customer care, or materially impacting the efficiency or cost with which we provide our products and customer care, would harm our brand, profitability and ability to conduct business. In addition, many of the software and other systems we currently use will need to be enhanced over time or replaced with equivalent commercial products or services, which may not be available on commercially reasonable terms or at all. Enhancing or replacing our systems, networks or infrastructure could entail considerable effort and expense. If we fail to develop and execute reliable policies, procedures and tools to operate our systems, networks or infrastructure, we could face a substantial decrease in workflow efficiency and increased costs, as well as a decline in our revenue.

Our business activities are subject to U.S. export controls and trade and economic sanctions laws, including the U.S. Commerce Department's Export Administration Regulations and economic and trade sanctions regulations maintained by the U.S. Treasury Department's Office of Foreign Assets Control (OFAC), as well as similar laws and regulations imposed by other jurisdictions, including the United Kingdom and European Union. These regimes are complex, evolving and, in certain circumstances, overlapping, and may restrict our ability to provide products or services to certain countries, governments, entities, individuals or end users. We maintain compliance measures designed to support adherence to applicable export control and sanctions requirements, including customer screening, transaction monitoring and technical or geographic access controls in comprehensively sanctioned jurisdictions. These measures rely in part on information provided by customers and third parties and may not identify all restricted parties or prohibited transactions, particularly where information is incomplete, inaccurate or intentionally misleading. As a result, there is a risk that we could inadvertently engage in transactions involving sanctioned or otherwise restricted parties. Sanctions and export control regimes are subject to frequent changes, including updates to restricted party lists, licensing requirements, jurisdictional scope and enforcement priorities, which may require us to modify our compliance controls or limit offerings in certain markets. Any failure to comply with applicable export control or sanctions requirements could result in civil or criminal penalties, monetary fines, loss of export privileges, restrictions on our operations and reputational harm. In addition, changes in these laws or their enforcement could reduce demand for our products or limit our ability to sell internationally, adversely affecting our business, operating results, and growth prospects. Responding to investigations or enforcement actions could also require significant management time and result in substantial legal professional costs.

Due to the global nature of the internet, it is possible that any U.S. or foreign federal, state or local taxing authority might attempt to regulate our transmissions or levy transaction, income or other taxes relating to our activities. Tax authorities at the international, federal, state and local levels are regularly reviewing the appropriate treatment of companies engaged in e-commerce. New or revised international, federal, state or local tax regulations may subject either us or our customers to additional sales, income and other taxes. We cannot predict the effect of current attempts to impose sales, income or other taxes on e-commerce. New or revised taxes, particularly sales and other transaction taxes, would likely increase the cost of doing business online and decrease the attractiveness of advertising and selling goods and services over the internet. New taxes could also create significant increases in internal costs necessary to capture data and to collect and remit taxes. Any of these events could have an adverse effect on our business and results of operations.

We continue to refine our efforts in customer care so we can adequately serve our domestic and international customers. A portion of our GoDaddy Guides is engaged through third parties and not employed by us. If our agreements with such third parties are terminated for any reason, including a breach of agreement, if such third parties or the GoDaddy Guides engaged through the third parties do not perform the level of service expected of GoDaddy or our customers, or if such GoDaddy Guides engage in misconduct, our business and reputation could be harmed, and we may need to find and/or train alternative providers, which could increase our costs and delay services to our customers. In addition, such a disruption could adversely impact our ability to serve our customers and to sell products to new and existing customers and we may experience a decline in our subscription renewal rates and in our ability to cross-sell our products and our reputation may suffer, any of which could adversely affect our business, reputation and operating results.

We use a variety of marketing channels to maintain awareness of our brand, including online keyword search, sponsorships and endorsements, television, radio and print advertising, email and social media marketing. Our GoDaddy Guides also market our brand through their recommendations of our products or solutions to specifically meet the needs of our customers. In order to maintain and grow our revenues, we need to continuously optimize and diversify our marketing campaigns and strategies and increase our efforts to expand customer awareness of our brand and portfolio of products. There can be no assurance that our marketing efforts will succeed. If we lose access to one or more of these channels, we may be unable to promote our brand effectively, which could limit our ability to grow our business. Protecting and maintaining awareness of our brand is important to our success, particularly for continued acceptance of our existing and future products and solutions, attracting new customers and increasing customer awareness of our full product portfolio. Further, if our marketing activities fail to generate traffic to our website, attract new customers or lead to new sales or renewals of our products at the levels we anticipate or our efforts to personalize our marketing efforts are not successful, our business and operating results could be adversely affected. In the years ended December 31, 2025, 2024, and 2023, our marketing and advertising expenses were $375.1 million, $356.9 million and $352.9 million, respectively. If these costs or our customer acquisition costs increase or we fail to generate additional sales as a result of our marketing efforts, our business, operating results and financial performance could be adversely affected.