Roblox (RBLX) Risk Analysis

We have been and may in the future become subject to intellectual property disputes, as well as costs and awards of damages and/or injunctive relief as a result of these disputes, and we are subject to liability for our intellectual property that we license to third parties. Our success depends, in part, on our ability to develop and commercialize our Platform without infringing, misappropriating, or otherwise violating the intellectual property rights of third parties. However, there is no assurance that our technologies or Platform will not be found to infringe, misappropriate, or otherwise violate the intellectual property rights of third parties. We also have entered into agreements with third parties to manufacture and distribute merchandise based on user content on our Platform, and there is a possibility that such content could be found to be infringing. Lawsuits are time consuming and expensive to resolve and they divert management's time and attention. Further, because of the substantial amount of discovery required in connection with intellectual property litigation, we risk compromising our confidential information during this type of litigation. Companies in the internet, technology, and gaming industries own large numbers of patents, copyrights, trademarks, domain names, and trade secrets and frequently enter into litigation based on allegations of infringement, misappropriation, or other violations of intellectual property or other rights. As we face increasing competition and gain a higher profile, the possibility of intellectual property rights and other claims against us grows. Our technologies may not be able to withstand any third-party claims against their use. In addition, many companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights and to defend claims that may be brought against them. We have a number of issued patents. We have also filed a number of additional U.S. and foreign patent applications, but these applications may not successfully result in issued patents. Any patent litigation against us may involve patent holding companies or other adverse patent owners that have no relevant product revenue, and therefore, our patents and patent applications may provide little or no deterrence as we would not be able to reach meaningful damages if we assert them against such entities or individuals. If a third party is able to obtain an injunction preventing us from exercising intellectual property rights, or if we cannot license or develop alternative technology for any infringing aspect of our business, we could be forced to limit or cease access to our Platform or cease business activities related to such intellectual property. In addition, we may need to settle litigation and disputes on terms that are unfavorable to us. We may be required to make substantial payments for legal fees, settlement fees, damages, royalties, license, or other fees in connection with a claimant securing a judgment against us. Although we carry general liability insurance, our insurance may not cover potential claims of this type or may not be adequate to cover all liability that may be imposed. We cannot predict the outcome of lawsuits and cannot ensure that the results of any such actions will not negatively affect our business, financial condition, or results of operations. Any intellectual property claim asserted against us, or for which we are required to provide indemnification, may require us to cease selling or using or to recall products that incorporate the intellectual property rights that we allegedly infringe, misappropriate, or violate; make substantial payments for legal fees, settlement payments, or other costs or damages; obtain a license, which may not be available on reasonable terms or at all, to sell or use the relevant technology; or redesign or rebrand the allegedly infringing products to avoid infringement, misappropriation, or violation, which could be costly, time-consuming, or impossible. Furthermore, certain federal statutes in the U.S. may apply to us with respect to various activities of our users, including the Digital Millennium Copyright Act of 1998 ("DMCA") and Section 230 of the Communications Decency Act ("CDA"). For example, our communications filters are designed to target speech we determine to be offensive based on our objective of creating a civil and safe place for all users. Bills have recently been proposed in Congress calling for a range of changes to Section 230 which include a complete repudiation of the statute to modifications of it in such a way as to remove certain social media companies from its protection. The FCC may also consider reforms to Section 230, which could include taking action to limit the scope of Section 230 and certain liability protections provided to online service providers and other entities. If Section 230 were so repealed, amended, or modified by judicial determination, we could potentially be subject to liability if we continue to censor speech, even if that speech were offensive to our users, or we could experience a decrease in user activity and revenues if we are unable to maintain a safe environment for our users if certain blocking and screening activities are prohibited by law. In addition, certain states have either passed or are debating laws that would create potential liability for moderating or removing certain user content. While we believe these laws are of dubious validity under the U.S. Constitution and in light of Section 230, they nevertheless present some risk to our content-moderation efforts going forward. While we rely on a variety of statutory and common-law frameworks and defenses, including those provided by the DMCA, the CDA, the fair-use doctrine in the U.S., and the DSA in the EU, differences between statutes, limitations on immunity, requirements to maintain immunity, and moderation efforts in the many jurisdictions in which we operate may affect our ability to rely on these frameworks and defenses, or create uncertainty regarding liability for information or content uploaded by creators or users or otherwise contributed by third parties to our Platform. As an example, Article 17 of the Directive on Copyright in the Digital Single Market was passed in the EU, which affords copyright owners some enforcement rights that may conflict with U.S. safe harbor protections afforded to us under the DMCA. In countries in Asia and Latin America, generally there are no similar statutes to the CDA or the DSA. The laws of countries in Asia and Latin America generally provide for direct liability if a platform is involved in creating such content or has actual knowledge of the content without taking action to take it down. Further, laws in some Asian countries also provide for primary or secondary liability, which can include criminal liability, if a platform fails to take sufficient steps to prevent such content from being uploaded. Although these and other similar legal provisions provide limited protections from liability for platforms like ours, if we are found not to be protected by the safe harbor provisions of the DMCA, CDA, or other similar laws, or if we are deemed subject to laws in other countries that may not have the same protections or that may impose more onerous obligations on us, including Article 17, we may owe substantial damages, and our brand, reputation, and financial results may be harmed. Additionally, we have incorporated, and are continuing to develop and deploy, AI in our products and the operations of our business. Content used to create, or created by using, AI tools and products may not be subject to copyright protection, the determination of which may adversely affect our intellectual property rights in, or ability to deploy, commercialize or use, such tools and products or the underlying content. In the U.S., a number of companies have faced civil lawsuits related to the foregoing and other issues, the outcome of any one of which may, among other things, require us to limit the ways in which we use AI in our business. In addition, regulatory obligations may require us to modify our practices with respect to intellectual property used in AI development. In addition to lawsuits and regulations focused on the AI service providers and deployers themselves, our use of output produced by AI tools may also expose us to claims, increasing our risks of liability. Even if claims do not result in litigation or are resolved in our favor, these claims, and the time and resources necessary to resolve them, could divert the resources of our management and harm our business and operating results. Moreover, there could be public announcements of the results of hearings, motions, or other interim proceedings or developments, and if securities analysts or investors perceive these results to be negative, it could negatively affect the market price of our Class A common stock. We expect that the occurrence of asserted infringement claims will grow as the market for our Platform grows. Accordingly, our exposure to damages resulting from infringement claims could increase, and this could further exhaust our financial and management resources.

We collect and store personal data and certain other sensitive, confidential, and proprietary information in the operation of our business, including creator, user, and employee information. While we have implemented measures designed to prevent unauthorized access to or loss of our confidential data, attacks such as malware, ransomware, viruses, hacking, social engineering, spam, and phishing attempts across our organization have occurred and may continue to occur on our Platform, our systems, and those of our third-party service providers. Because of the popularity of our Platform, we believe that we are an attractive target for these sorts of attacks and have seen the frequency of these types of attacks increase over time. The techniques used by malicious actors to obtain unauthorized access to, or to sabotage, our systems or networks, or to utilize our systems maliciously, are constantly evolving and generally are not identified as a threat vector until launched against a target. Threat actors are also increasingly leveraging AI, including agentic AI systems, to conduct reconnaissance, exploit vulnerabilities, craft highly personalized social engineering attacks, and adapt their methods in real time without human intervention. These AI-driven techniques may enable attackers to operate at a speed, scale, and degree of sophistication that outpaces our ability to detect and respond to threats. In addition to actions by individuals, such attacks could also potentially be launched by nation states, state-sponsored bad actors, or other well-funded and highly sophisticated individuals. Despite the measures we have taken, we at times have not been able to anticipate these techniques by implementing preventive measures, detecting, or reacting in a timely manner, which has resulted in and could continue to result in, delays in our detection or remediation of, or other responses to, security breaches and other security-related incidents. In addition, the use of open source and third-party software in our Platform has exposed us to security vulnerabilities in the past and will likely continue to expose us to security vulnerabilities in the future. The use of AI in our products and business practices may increase or create additional cybersecurity and privacy risks, including risks of data breaches and security incidents. In particular, the deployment of agentic AI introduces new attack surfaces and risk profiles for us to address. Prompt injection attacks, in which malicious instructions cause an AI agent to take unintended or unauthorized actions, are an emerging threat vector for which established defenses are still developing. As AI use expands across our products and operations, we expect the frequency and sophistication of AI-targeted attacks to increase. Beyond external threats, agentic AI systems operating with limited human oversight at each step may also inadvertently expose proprietary or confidential information by autonomously executing tasks across data boundaries without explicit human authorization. Our Platform and services operate in conjunction with, and we are dependent upon, third-party products, services, and components. Our reliance on third-party service providers, including cloud infrastructure providers, payment processors, analytics tools, distribution channels, and customer support providers and platforms, introduces significant and evolving risks related to cybersecurity and data privacy. These risks extend to the third-party AI models, tools, and services that we and our service providers increasingly incorporate into our operations. AI components sourced from third parties may contain vulnerabilities, behave in unintended ways, or be compromised before or after integration with our systems. As AI systems become more autonomous and interconnected, a security failure in a third-party AI component could have cascading effects across our Platform. We do not have complete visibility into or control over the development, training, and security practices of all third-party AI providers in our supply chain, and our contractual protections, vendor assessments, and monitoring capabilities may not be sufficient to prevent or promptly identify such issues. Our ability to influence and monitor our third-party service providers' cybersecurity is limited, and in any event, attackers may be able to circumvent our third-party service providers' cybersecurity measures. There have been and may continue to be significant attacks on certain of our third-party providers, and we cannot guarantee that our or our third-party providers' systems and networks have not been breached or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us. Specifically, these third parties have been and may in the future be targeted by threat actors seeking to gain access to our data or systems through a less secure entry point; experience their own security incidents, data breaches, or operational failures, even if unrelated to our specific data, which could still impact our services or expose our users' information; or employ individuals who are bad actors and could intentionally compromise data or systems, or who may be susceptible to social engineering or other tactics by malicious individuals. Additionally, these third parties may have inadequate security protocols, policies, or infrastructure, creating security weaknesses that we cannot directly control; or fail to promptly identify or remediate vulnerabilities, leading to prolonged exposure. Actual or alleged security vulnerabilities, errors, or other bugs in these third-party products, services, or components, and security exploits targeting them have at times caused and could continue to cause us to face increased costs, regulatory fines, claims, liability, reduced revenue, and harm to our reputation or competitive position. We and our service providers may be unable to anticipate these techniques, react, remediate, or otherwise address any security vulnerability, breach, or other incident in a timely manner, or implement adequate preventative measures. If any unauthorized access to our network, systems, or data, including our sensitive and proprietary information, personal data from our users or creators, or other data, or any other loss or unavailability of, or unauthorized use, modification, disclosure, or other processing of personal data or any other security breach or incident occurs or is believed to have occurred, whether as a result of third-party action, employee negligence, error or malfeasance, defects, social engineering techniques, ransomware attacks, or otherwise, our reputation, brand, and competitive position could be damaged, our and our users' and creators' data and intellectual property could potentially be lost or compromised, and we could be required to spend capital and other resources to alleviate problems caused by such actual or perceived breaches or incidents and remediate our systems. In the past, we have experienced social engineering and phishing attacks aimed at compromising sensitive data, and if similar attacks occur and are successful, this could have a negative impact on our business or result in unfavorable publicity. Additionally, unauthorized access to sensitive data may occur due to user behavior outside of our control, which can nonetheless create the perception that our systems are not secure against third-party access. For example, users may accidentally disclose their passwords or store them on a mobile device that is "SIM swapped," lost, or stolen, resulting in the disclosure of their personal data and potential account takeovers by bad actors. We incur significant costs in an effort to detect and prevent security breaches and other security-related incidents, including those to secure our product development, test, evaluation, and deployment activities, and we expect our costs will increase as we make improvements to our systems and processes to prevent future breaches and incidents. The economic costs to us to reduce cyber or other security problems, such as spammers, errors, bugs, flaws, "cheating" programs, defects, or corrupted data, could be significant and may be difficult to anticipate or measure. Even the perception of these issues may cause creators and users to use our Platform less or stop using it altogether, and the costs could divert our attention and resources, any of which could result in claims, demands, and legal liability to us, regulatory investigations and other proceedings, and otherwise harm our business, reputation, financial condition, or results of operations. There could also be regulatory fines or non-monetary penalties imposed in connection with certain cyber incidents or data breaches that take place around the world. In addition, global laws and regulations relating to cybersecurity continue to evolve in their scope and complexity. For example, the EU's Network and Information Systems Directive 2 ("NIS2") and its implementing laws impose mandatory cybersecurity risk-management and incident reporting obligations on entities operating in a number of sectors, including social networking service platforms. Non-compliance may result in fines of up to the greater of €10 million or 2% of total worldwide annual turnover. NIS2 also introduces personal liability for management personnel, who may face temporary prohibition from exercising managerial functions for serious non-compliance. The EU's Cyber Resilience Act also imposes mandatory cybersecurity requirements on products with digital elements placed on the EU market, including incident reporting and core product obligations. Non-compliance may result in fines of up to the greater of €15 million or 2.5% of total worldwide annual turnover, and market surveillance authorities may order product withdrawal from the EU market. Our efforts to comply with evolving laws and regulations such as these have and could continue to lead to increased operational costs and we could be exposed to fines, product withdrawal orders, reputational harm, and other adverse impacts to our business if we are, or are alleged to be, unable to comply. Further, certain laws and regulations relating to privacy, biometrics, cybersecurity, and data protection, such as the California Consumer Privacy Act ("CCPA"), allow for a private right of action, which may lead to consumer litigation for various matters, including certain data breaches that relate to specified categories of personal information. From time to time, we identify product vulnerabilities, including through our bug bounty program. Although we have policies and procedures in place designed to promptly characterize the potential impact of such vulnerabilities and develop appropriate patching or upgrade recommendations and also maintain policies and procedures related to vulnerability scanning and management of our internal corporate systems and networks, such policies and procedures may not be followed or detect every issue, and from time to time, we have, and may in the future again, need to proactively disable access to our Platform in order to provide necessary patching or upgrades. Although we maintain cyber and privacy insurance, subject to applicable deductibles and policy limits, such coverage may not extend to all types of incidents relating to privacy, data protection, or cybersecurity, and it may be insufficient to cover all costs and expenses associated with such incidents. Further, such insurance may not continue to be available to us in the future on economically reasonable terms, or at all, and insurers may deny us coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.

Our users expect fast, reliable, and resilient systems to enhance their experience and support their activity on our Platform, which depends on the continuing operation and availability of our Platform from our global network of data centers controlled and operated by us and our external service providers, including third-party "cloud" computing services. Our reliance on these third-party providers introduces inherent risks, as their actions, security practices, and operational resilience directly impact our ability to deliver services. We also provide services to our creator community through our Platform, including Developer Forum and Creator Hub for tutorials, hosting, customer service, regulatory compliance, and translation, among many others. The technology powering our Platform and the games created on our Platform are complex and maintaining the sophisticated internal and external technological infrastructure required to reliably deliver both is expensive and complex. The reliable delivery and stability of our Platform, referred to collectively as availability, has been, and could in the future be, adversely impacted by outages, disruptions, failures, or degradations in our network and related infrastructure or those of our partners or service providers, including those stemming from the malicious activities of threat actors such as the exploitation of vulnerabilities or via social engineering attacks such as phishing which may be enhanced through the malicious use of AI and other evolving technologies, or due to non-malicious root causes such as misconfigurations, insufficient capacity, or the inherent complexity of managing microsystems architecture. We have experienced outages from time to time since our inception when our Platform is unavailable for all or some of our users and creators. In addition, there may be times when access to our Platform for users and creators may be limited. Outages or service degradation can be caused by a number of factors, including as a result of proactive actions we take while we provide critical updates or an unexpected outcome of routine maintenance, a move to a new technology, exploitation of security vulnerabilities in new or existing technologies, the demand on our Platform exceeding the capabilities of our technological infrastructure (e.g., spikes in usage volume), delays or failures resulting from natural disasters, manmade disasters, or other catastrophic events, the migration of data among data centers and to third-party hosted environments, a decision to close our facilities without adequate notice, our inability to secure additional or replacement data center capacity as needed, increased energy consumption as a result of AI-related growth, a cyber event or act of terrorism, and issues relating to our reliance on third-party software, third-party application stores, and third parties that host our Platform in areas where we do not operate our own data centers. The unavailability of our Platform, particularly if outages should become more frequent or longer in duration, could cause our users to seek other entertainment options, including those provided by our competitors, which may adversely affect our financial results. If we or our partners or third-party service providers experience outages and our Platform is unavailable or if our creators and users are unable to access our Platform within a reasonable amount of time or at all, as a result of any such events, our reputation and brand may be harmed, creator and user engagement with our Platform may be reduced, we could be subject to fines, and our revenue, bookings, and profitability could be, and has been in the past, negatively impacted. We may also experience a negative impact to our financial results due to decreased usage on our Platform or decrease in payouts to creators, as well as potential monetary penalties. Despite a reliability program focused on anticipating and solving issues that may impact the availability of our Platform and precautions taken at our data centers, we may not have full redundancy for all of our systems and data at all times and our disaster recovery planning may not be sufficient to mitigate the risks of technological exploitation by threat actors, address all aspects of any consequence or incident, or allow us to maintain business continuity at profitable levels or at all. Further, in the event of damage or service interruption, our insurance policies may not adequately compensate us for losses that we may incur. In addition to the events described above, our data and our technological infrastructure may also be subject to laws, administrative actions or regulations, changes to legal or permitting requirements, and litigation that could stop, limit, or delay operations, particularly as we expand operations globally. Accordingly, the occurrence of any or all of these factors could result in interruptions or delays on our Platform, impede our ability to scale our operations or have other adverse impacts upon our business, and adversely impact our ability to serve our creators and users. Customer support personnel and technologies are critical to resolve issues and to allow creators and users to realize the full benefits that our Platform provides and deliver an excellent customer experience. High-quality support is important for retaining our creators and users and encouraging the expansion of their use of our Platform. We rely on third-party service providers for a variety of services, including to assist in our customer support, content moderation, and age-check systems. We cannot maintain complete control over the security practices of our third-party service providers, nor can we fully eliminate security risks posed by our employees, creators, and users. Consequently, these individuals and entities have been and may in the future be exploited by threat actors or otherwise cause the inadvertent or intentional exposure of our systems to unauthorized access, data breaches, or other cyber events. The occurrence of any of these events has in the past and could compromise our systems or personal information of our users, which could materially impact our business, results of operations, and our reputation. We must continue to invest in the infrastructure required to support our Platform. If we do not help our creators and users quickly resolve issues and provide effective ongoing support, our ability to maintain and expand our Platform to existing and new creators and users could suffer. In addition, if we do not make sufficient investments in servers, software, or personnel in support of our infrastructure, to scale effectively and accommodate increased demands placed on our infrastructure, the reliability of our underlying infrastructure will be harmed and our ability to provide a quality experience for our creators and users will be significantly harmed. This would lead to a reduction in the number of creators and users on our Platform, a reduction in our revenues, bookings, and ability to compete, and our reputation with existing or potential creators or users could suffer.

The global regulatory landscape around payment-related activities is characterized by a lack of uniformity and increasing scrutiny especially when younger users are involved. Examples of payment-related activities on our Platform include the purchase of prepaid gift cards, Robux, and subscriptions. In addition, our Developer Exchange Program allows creators to be paid in fiat currency based on the amount of earned Robux they have accumulated under certain conditions. We have seen and may continue to see increased application of laws and regulations typically applicable to financial institutions such as regulations around money transmission, virtual currency, unclaimed property, and gift cards, many of which include anti-money laundering, KYC, and sanction screening obligations to digital game and social media companies. Regulators may impose restrictions or bans on our ability to operate our Developer Exchange Program or on the sale of prepaid gift cards. Any such restrictions or prohibitions may adversely affect our Platform, business, revenue, bookings, and our creators. In the U.S., the SEC, its staff, and similar state regulators have deemed certain virtual currencies to be securities subject to regulation under the federal and state securities laws. While we do not consider Robux to be a regulated virtual currency, money transmission, or security, if Robux were deemed to be subject to such federal or state laws, we may be required to redesign our Platform in a manner that would be disruptive to operations and costly to implement, which may threaten the viability of the Platform. We may also be subject to enforcement or other regulatory actions by federal or state regulators, as well as private litigation, which could be costly to resolve. For example, some existing laws regarding the regulation of currency, money transmitters and other financial institutions, and unclaimed property have been interpreted to cover virtual currencies, and could potentially be viewed as covering Robux. The increased use of interactive entertainment offerings like ours by consumers, including younger consumers, have prompted and may continue to prompt calls for more stringent consumer protection laws and regulations throughout the world that may impose additional burdens on companies such as ours making virtual currencies like Robux available for sale. For example, in the EU, consumer regulatory authorities issued the Consumer Protection Guidelines, which are new interpretations of existing law regarding virtual currencies that would treat certain virtual currencies as a representation of value and therefore impose strict disclosure and other requirements on the offer and acquisition of those virtual currencies. The European Commission has also indicated that it will seek to enact new legislation in the near future to provide additional protections for consumers online, including in the context of video games and e-commerce. In the U.K., the ICO has published industry guidance for game developers on how to comply with the AADC, including recommendations relating to in-game purchases, and the U.K. Digital Markets, Competition and Consumers Act also introduces specific obligations regarding transparent pricing and subscription contracts. These regulations and guidance could require us to make changes to our Platform, products, or policies or how we operate our business in certain jurisdictions and could have a material adverse effect on our business, financial condition, or results of operations. Increased regulatory scrutiny globally may increase compliance obligations and require us to devote legal and other resources and make changes to our Platform to address such regulations or otherwise become subject to fines or other penalties, which may negatively impact our business and results of operations. Although we have structured our virtual currency, prepaid gift cards, and Developer Exchange Program with applicable laws and regulations in mind, in some jurisdictions, the application or interpretation of applicable laws and regulations is not clear and a regulator could subject us to monetary fines or other penalties such as a cease and desist order, or we may be required to make product changes, any of which could be unpopular with or burdensome on our users or creators, or could have an adverse effect on our business and financial results. If a relevant regulator disagreed with our analysis of and compliance with applicable laws, we may be required to seek licenses, authorizations, or approvals from those regulators, which may be dependent on us meeting certain capital and other requirements and may subject us to additional regulation and oversight, all of which could significantly increase our operating costs.

Although we, either directly or through our third-party distribution channels, collect and remit taxes from users in certain countries and regions on the sale of our virtual currency, there are some jurisdictions in which we operate where we do not currently collect taxes from users. The application of tax laws pertaining to the collection of sales, value added, and similar taxes to e-commerce businesses, such as ours, is a complex and evolving area. Jurisdictions may classify our product offerings differently such as intangible property, digital goods, or services, each with different tax rules and requirements. For example, many countries have enacted tax laws that require non-resident providers to register for and levy value added taxes on electronically provided services to such country's residents. This would require us to calculate, collect, and remit value added taxes in some jurisdictions, even if we have no physical presence in such jurisdictions. Further, we may need to invest substantial amounts to modify our solutions or our business model to be able to collect and remit sales, value added, or similar taxes under such tax laws in the future. Further, many jurisdictions have also adopted or are considering adopting marketplace facilitator laws that shift the burden of tax collection to digital marketplaces. In certain jurisdictions, we may be characterized as a marketplace facilitator for the sale of digital content or physical goods between our creators and users, and in such instances, we may need to invest substantial amounts to modify our solutions or business model to be able to meet any reporting and collection obligations with respect to sales, value added, or similar taxes. A successful assertion by a jurisdiction that we should have been or should be collecting additional sales, value added, or other taxes for the sale of content or physical goods between our creators and users, could, among other things, result in substantial tax payments, create significant administrative burdens for us, discourage potential users or creators from subscribing to our Platform, or otherwise harm our business, results of operations, and financial condition.

Our Platform relies on our creators to create games and virtual items on our Platform for our users, and we believe the interactions between and within the creator and user communities on our Platform create a thriving and organic ecosystem. To facilitate and incentivize the creation of games and virtual items by creators, our Platform offers creators an opportunity to accumulate Robux, a virtual currency on our Platform, which, as described in our terms of use, is a license to engage in games and/or obtain virtual items. When virtual items are acquired on our Platform, the originating creator accumulates a portion of the Robux paid for the item. Creators are paid fiat currency based on the amount of earned Robux they have accumulated under certain conditions outlined in our Developer Exchange Program. In addition, we have paid access games where creators can offer access to their games to users for a set price in fiat currency and in exchange earn a higher revenue share of these user purchases. While we have millions of creators on our Platform, a substantial portion of user engagement is concentrated in a relatively small number of highly popular games. For example, 51% of in-game hours engaged were spent in the top 50 games in the month ended December 31, 2025. If the popularity of such games decreases and our users do not consider other content to be appealing, our DAUs and engagement could decline, which would have a material impact on our business, financial condition, and results of operations. We compete to attract and retain creators with gaming and metaverse platforms such as Epic Games, Unity, Meta Platforms, and Valve, which also give creators the ability to create or distribute interactive content, and we expect competition to continue to increase in the future. We generally do not have any agreements with our creators that require them to continue to use our Platform for any time period. Some of our creators have developed attractive businesses in developing content, including games, on our Platform. Many of our existing competitors have, and some of our potential competitors could have, substantial competitive advantages, such as larger sales and marketing budgets and resources; broader and more established relationships with our target demographics; greater resources to make acquisitions and enter into strategic partnerships; lower labor and research and development costs; larger and more mature intellectual property portfolios; and substantially greater financial, technical, and other resources. We continue to update our Platform and policies in an effort to increase creator earnings to further incentivize them to build on our Platform, but there can be no guarantee that these efforts will be successful. If we are unable to continue attracting and retaining creators and they elect to develop content on other platforms, this could result in an overall reduction in the quantity and quality of our content, make our Platform less appealing for creators, and harm our results of operations. In addition, we continuously review and revise our Platform and policies to enhance regulatory compliance and the trust and safety of our Platform, such as implementing age-check systems, eligibility requirements for publishing and updating content, and new account types. However, we have received negative feedback from certain of our creators on some of our Platform or policy changes because of their perceived impact to creator monetization and profitability. If our creators believe any of our Platform or policy changes will materially impact the monetization and profitability of their content, they may stop developing content on our Platform, which could harm our results of operations, and particularly if such creators are responsible for a substantial portion of our user engagement. We spend substantial amounts of time and money to evolve our Platform to incorporate additional features, improve functionality, and make other enhancements to meet the rapidly evolving demands of our creators and users while also prioritizing safety and security. Developments and innovations on our Platform may rely on new or evolving technologies which may at times be still in development and may never be fully developed. Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential. Despite our efforts, creators may become dissatisfied with our Platform technology or policies, billing or payment policies, our handling of personal data, or other aspects of our Platform, such as our efforts to control botting and other forms of automated play on our Platform. If we fail to adequately address these or other complaints, negative publicity about us or our Platform could diminish confidence in and the use of our Platform. If we do not provide the right technologies, education, or financial incentives to our creators, they may develop less or lower quality content or choose not to monetize their content, which could decrease engagement on our Platform and adversely affect our revenue and bookings. Furthermore, when we develop new or enhanced features for our Platform, we typically incur expenses and expend resources upfront to develop, market, promote, and sell new features, and we may not be able to realize some or all of the anticipated benefits of these investments.

We have experienced rapid growth in prior periods relative to our quarterly forecast and historic trends, which may not be indicative of our financial and operating results in future periods. For example, historically we experienced periods of increased activity levels due in part to the COVID-19 lockdowns, prepaid gift card partnerships, and the emergence of viral hits, each of which led to increased demand for and engagement with our Platform. These periods of increased activity levels, while significant, have generally not been sustainable. For periods of increased engagement impacted by viral games, our results have generally moderated as peak engagement of viral games naturally declines. The long-term impact of these increased activity levels to our business, operations, and financial results will depend on numerous evolving factors that we may not be able to accurately predict and therefore our results have and may continue to fluctuate. In addition, our growth has and could continue at times to be affected to the extent certain users only engage with our Platform due to viral games which may not remain popular. We believe our overall market acceptance, revenue growth, and increases in bookings depend on a number of factors, some of which are not within our control. There can be no assurance that users will not reduce their usage or engagement with our Platform or reduce their discretionary spending on our Platform, particularly if the popularity of viral or other key games wanes, which would adversely impact our revenue and financial condition. If we are unable to continue to maintain the attractiveness of our Platform to creators and users, including through a diverse and continuously engaging set of games, they may no longer seek new games on our Platform, which would result in decreased market acceptance, lower revenue, fewer bookings, and could harm our results of operations.

Only a small portion of our users regularly purchase Robux compared to all users who use our Platform in any period. If our efforts to attract and retain paying users are not successful, our business, operating results, and financial condition may be adversely impacted. We may not succeed in further monetizing our Platform and user base, which would harm our ability to grow revenue and our financial performance generally due to various factors including, but not limited to, if: - our user growth outpaces our ability to monetize our users, and particularly as our user growth occurs in markets that are not profitable or less profitable;- we fail to provide the tools and education to our creators to enable them to monetize their games and creators do not create engaging or new games for users;- we fail to continue to incentivize creators on our Platform to develop content that our users consider to be of value;- we launch new features on our Platform that cannot be monetized;- we fail to accurately predict which specific Platform features encourage users to become paying users;- we introduce new or adjust existing features or pricing in a manner that is not favorably received by our users, including trust and safety features;- we fail to establish a successful advertising model;- we fail to increase or maintain the amount of time spent on our Platform;- we fail to increase the number of games or content that our users are willing to pay for;- we fail to increase the features of our Platform, allowing it to more broadly serve the entertainment, education, communication, and business markets;- we fail to increase penetration and engagement across all demographics, including our goal of reaching 10% of the global gaming content market;- measures intended to make our Platform more attractive to older users create the perception that our Platform is not safe for younger users;- our paying users stop interacting with our Platform and purchasing Robux as they increase in age; and - if paying users reduce their spend on our Platform due to reasons such as the need to reduce household expenses or the perception that competitive services provide better value.