Twilio (TWLO) Risk Analysis

The Federal Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (the "CAN-SPAM Act") establishes certain requirements for commercial email messages and transactional email messages and specifies penalties for the transmission of email messages that are intended to deceive the recipient as to source or content. Among other things, the CAN-SPAM Act, obligates the sender of commercial emails to provide recipients with the ability to "opt-out" of receiving future commercial emails from the sender. In addition, some states have passed laws regulating commercial email practices that are significantly more restrictive and difficult to comply with than the CAN-SPAM Act. For example, certain states prohibit the sending of email messages that advertise products or services that minors are prohibited by law from purchasing or that contain content harmful to minors to email addresses listed on specified registries. Some portions of these state laws may not be preempted by the CAN-SPAM Act. In addition, certain non-U.S. jurisdictions in which we operate have enacted laws regulating the sending of email that are more restrictive than U.S. laws. For example, some foreign laws prohibit sending broad categories of email unless the recipient has provided the sender advance consent (or "opted-in") to receipt of such email. If we were found to be in violation of the CAN-SPAM Act, applicable state laws governing email not preempted by the CAN-SPAM Act or foreign laws regulating the distribution of email, whether as a result of violations by our customers or our own acts or omissions, we could be required to pay large penalties, which would adversely affect our financial condition, significantly harm our business, injure our reputation and erode customer trust. The terms of any injunctions, judgments, consent decrees or settlement agreements entered into in connection with enforcement actions or investigations against our company in connection with any of the foregoing laws may also require us to change one or more aspects of the way we operate our business, which could impair our ability to attract and retain customers or could increase our operating costs.

The future success of our business depends upon the continued use of the internet as a primary medium for commerce, communications and business applications. Federal, state or foreign government bodies or agencies have in the past adopted,and may in the future adopt, laws or regulations affecting the use of the internet as a commercial medium. Changes in these laws or regulations could require us to modify our products and platform in order to comply with these changes. In addition, government agencies or private organizations have imposed and may impose additional taxes, fees or other charges for accessing the internet or commerce conducted via the internet. These laws or charges could limit the growth of internet-related commerce or communications generally or result in reductions in the demand for internet-based products and services such as our products and platform. The current legislative and regulatory landscape regarding the regulation of the internet is subject to uncertainty. For example, in January 2025, the U.S. Court of Appeals for the Sixth Circuit struck down the FCC's net neutrality rules, and it is unlikely that similar federal rules will be adopted. Without federal net neutrality rules, we cannot predict whether internet access service providers may be able to limit our users' ability to access our platform or make our platform a less attractive alternative to our competitors' applications. Moreover, several states have enacted or are considering state-level legislation or executive action that would implement certain net neutrality protections. State broadband regulations have been upheld by courts in certain jurisdictions, creating the potential for a patchwork of disparate regulatory regimes and operational challenges. In a related regulatory context, while the EU requires equal access to internet content, under its Digital Single Market initiative the EU may impose additional requirements that could increase our costs. If new FCC, EU, or other rules directly or inadvertently impose costs on online providers like our business, our expenses may rise. Were any of these outcomes to occur, our ability to retain existing users or attract new users may be impaired, our costs may increase, and our business may be significantly harmed. In addition, the use of the internet as a business tool could be adversely affected due to delays in the development or adoption of new standards and protocols to handle increased demands of internet activity, security, reliability, cost, ease-of-use, accessibility and quality of service. The performance of the internet and its acceptance as a business tool has been adversely affected by "viruses," "worms," and similar malicious programs. If the use of the internet is reduced as a result of these or other issues, then demand for our products could decline, which could adversely affect our business, results of operations and financial condition.

We and our customers are subject to numerous domestic (for example, the California Consumer Privacy Act ("CCPA")) and foreign (for example, the General Data Protection Regulation ("GDPR") in the European Union ("EU")) privacy, data protection and cybersecurity laws and regulations that restrict the collection, use, disclosure and processing of personal information, including financial and health data. These laws and regulations are expanding globally, evolving, and being tested in courts, may result in increasing regulatory and public scrutiny of our practices relating to personal information and may increase our exposure to regulatory enforcement action, sanctions and litigation. The breadth and depth of changes in data protection obligations has required significant time and resources, including a review of our technology and systems against the requirements of the GDPR. In the United States, the CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies. These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents (both consumers and employees) certain rights related to their personal information. The CCPA allows for statutory fines for noncompliance. Numerous other states have enacted or are considering laws and regulations addressing privacy and cybersecurity, such as Washington's My Health, My Data Act, which includes a private right of action, and laws in several states relating to the provision of individual home address or telephone directory information. States and the U.S. federal government have also proposed general privacy legislation. Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and cybersecurity. For example, the GDPR, the United Kingdom's General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR") and the Swiss Federal Act on Data Protection impose strict requirements for processing personal information of covered individuals, whether within or outside the European Economic Area ("EEA"), the United Kingdom ("UK") and Switzerland, respectively (such jurisdictions, collectively, "Europe"). For example, the GDPR imposes significant requirements regarding the processing of individuals' personal information, including in relation to transparency, lawfulness of processing, individuals' privacy rights, compliant contracting, data minimization, data breach notification, data retention, security, and international data transfers. Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data transfers or other processing, require data deletion, and impose significant fines, potentially ranging up to the greater of 4% of a company's worldwide revenue or 20 million Euros or 17.5 million GBP, respectively. Individuals also may initiate compensation claims or litigation related to our processing of their personal information. Other privacy and data protection laws in Europe impose strict requirements around marketing communications and the deployment of cookies. As another example, Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or "LGPD") (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to the GDPR. Additionally, we expect an increase in regulation of the use of AI and ML in products and services. For example, in Europe, the Artificial Intelligence Act, once effective, will impose onerous obligations related to the development, placement on the market and use of AI-related systems. A growing number of U.S. states are enacting legislation regulating aspects of AI or AI generally. Other countries are also contemplating laws regulating AI and ML. We may have to change our business practices to comply with obligations under these or other new and evolving regimes. The interpretation and application of laws and regulations are in many cases uncertain, and our legal and regulatory obligations are subject to frequent and unexpected changes, including the potential for new or additional laws or regulations, rulings that invalidate prior laws or regulations, or significant increases in penalties. Recent examples include the EU's Digital Services Act, Digital Markets Act and Data Act effective in 2024, EU member state legislation implementing the EU's Network and Information Security Directive II and the EU's Digital Operational Resiliency Act effective in January 2025. New and changing privacy, data protection or cybersecurity laws and regulations may result in additional obligations, increase the risk of enforcement action against us, and increase the types and numbers of individuals or entities that can initiate actions against us. Similarly, with our registration as an interconnected VoIP provider for certain products with the Federal Communications Commission ("FCC"), we must comply with privacy laws associated with customer proprietary network information rules in the United States. In addition, some states have adopted, proposed, or may propose, regulations that may classify our services in such a manner as to subject us to additional privacy-related compliance obligations under state law. If we fail or are perceived to have failed to maintain compliance with these requirements, we could be subject to regulatory audits or inquiries, civil and criminal penalties, fines and breach of contract claims, as well as reputational damage, which could impact the willingness of customers to do business with us. In addition, our contractual obligations relating to privacy, data protection and cybersecurity have become increasingly stringent due to changes in laws and regulations and expansion of our offerings. Certain privacy, data protection and cybersecurity laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. In addition, we support customer workloads that involve the processing of protected health information and are required to sign business associate agreements with customers that subject us to requirements under the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, as well as state laws that govern health information. Our actual or perceived failure to comply with laws, regulations, contractual commitments, or other actual or asserted obligations, including certain industry standards, regarding privacy, data protection and cybersecurity could lead to costly legal action, adverse publicity, significant liability, inability to process data, and decreased demand for our services, which could adversely affect our business, results of operations and financial condition. As a cumulative example of these risks, because our primary data processing facilities are in the United States, we have experienced hesitancy, reluctance, or refusal by European or multinational customers to continue to use our services due to potential risks arising from the Court of Justice's July 2020 ruling in the "Schrems II" case, as well as related guidance from regulators and enforcement action against Meta by the Irish Data Protection Commission. For example, absent appropriate safeguards or other circumstances, the GDPR and laws in Switzerland and the UK generally restrict the transfer of personal information to many outside jurisdictions, such as the United States. On July 10, 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. Based on this decision, personal information can flow from the EU to U.S. companies participating in the EU-U.S. Data Privacy Framework without additional data protection safeguards. We are certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. If we cannot maintain valid mechanisms for cross-border data transfers, we and our customers may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from Europe or elsewhere. Any inability to transfer personal information to the United States or other jurisdictions could significantly and negatively impact our business operations; limit our ability to collaborate with parties that are subject to data privacy and security laws; or require us to increase our personal information processing capabilities in Europe and/or elsewhere at significant expense. In addition, outside of Europe, other jurisdictions have proposed and enacted laws relating to cross-border data transfer or requiring personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin. If we are unable to increase our data processing capabilities and storage in Europe and other jurisdictions to limit or eliminate the need for relevant data transfers quickly enough, and valid solutions for relevant personal information are not available or are difficult to implement in the interim, we will likely face continuing reluctance from European and multinational customers to use our services and increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal information across borders. Evolving laws, regulations, and other actual and asserted obligations relating to privacy, data protection, and cybersecurity, as well as any new or evolving obligations relating to AI and ML technologies, could reduce demand for our platform, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data or, in some cases, impact our ability to offer our service in some locations and may subject us to liability. Further, in view of new or modified federal, state or foreign laws and regulations, industry standards, contractual obligations and other actual and asserted obligations, or any changes in their interpretation, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend significant resources to modify our practices and platform and otherwise adapt to these changes. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited.

Significant judgments and estimates are required in determining our provision for income taxes and other tax liabilities. Our tax expense may be impacted, for example, if tax laws change or are clarified to our detriment or if tax authorities successfully challenge the tax positions that we take, such as, for example, positions relating to the arm's-length pricing standards for our intercompany transactions and our indirect tax positions. In determining the adequacy of our provision for income taxes, we assess the likelihood of adverse outcomes that could result if our tax positions were challenged by the Internal Revenue Service ("IRS"), and other tax authorities. Should the IRS or other tax authorities assess additional taxes as a result of examinations, we may be required to record charges to operations that could adversely affect our results of operations and financial condition. We conduct operations in many tax jurisdictions throughout the United States and internationally. In many of these jurisdictions, non-income-based taxes, such as sales tax, value-added tax, goods and services tax, and telecommunications taxes, are assessed on our operations or our sales to customers. We are subject to indirect taxes, and may be subject to certain other taxes, in some of these jurisdictions. We collect certain telecommunications-based taxes from our customers in certain jurisdictions, and we expect to continue expanding the number of jurisdictions in which we will collect these taxes in the future. Many states are also pursuing legislative expansion of the scope of goods and services that are subject to sales and similar taxes as well as the circumstances in which a vendor of goods and services must collect such taxes. Following the United States Supreme Court decision in South Dakota v. Wayfair, Inc., states are now free to levy taxes on sales of goods and services based on an "economic nexus," regardless of whether the seller has a physical presence in the state. Any additional fees and taxes levied on our services by any state may adversely impact our results of operations. Historically, we have not billed or collected taxes in certain jurisdictions and, in accordance with GAAP, we have recorded a provision for our tax exposure in these jurisdictions when it is both probable that a liability has been incurred and the amount of the exposure can be reasonably estimated. We reserved $43.6 million on our June 30, 2025 balance sheet for these tax payments. These estimates include several key assumptions, including, but not limited to, the taxability of our products, the jurisdictions in which we believe we have nexus or a permanent establishment, and the sourcing of revenues to those jurisdictions. In the event these jurisdictions challenge our assumptions and analysis, our actual exposure could differ materially from our current estimates and reserves. If the actual payments we make to any jurisdiction exceed the accrual in our balance sheet, our results of operations would be harmed. In addition, some customers may question the incremental tax charges and seek to negotiate lower pricing from us, which could adversely affect our business, results of operations and financial condition. We are in discussions with certain jurisdictions regarding potential sales and other indirect taxes for prior periods that we may owe. If any of these jurisdictions disagree with management's assumptions and analysis, the assessment of our tax exposure could differ materially from management's current estimates, which may increase our costs of doing business and negatively affect the prices our customers pay for our products.

We generally conduct our global operations through subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions. In particular, our intercompany relationships are subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions. Also, our tax expense could be affected depending on the applicability of withholding and other taxes (including withholding and indirect taxes on software licenses and related intercompany transactions) under the tax laws of certain jurisdictions in which we have business operations. The relevant revenue and taxing authorities may disagree with positions we have taken generally, or our determinations as to the value of assets sold or acquired or income and expenses attributable to specific jurisdictions. If such a disagreement were to occur, and our position were not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations.

We have deployed, and continue to develop and incorporate, AI solutions and features into our platform and our business, and these solutions and features may become more important to our operations or to our future growth over time. We expect to rely on AI solutions and features to help drive future growth and efficiency in our business, but there can be no assurance that we will realize the desired or anticipated benefits from AI in a timely or cost-effective manner. For example, we are focused on continued product innovations to combine our communications products with contextual data and AI to address evolving customer needs and expectations. We are also building out new AI capabilities internally, including AI automation and agents in our self-service platform and in our internal operations. We may also fail to properly implement or market our AI solutions and features. Our competitors or other third parties may incorporate AI into their products, offerings, and solutions more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations. Our ability to effectively implement and market our AI solutions and features will depend, in part, on our ability to attract and retain employees with AI expertise, and we expect significant competition for professionals with the skills and technical knowledge that we will require. Additionally, our offerings based on AI may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm. For example, our business, financial condition and results of operations may be adversely affected if content or recommendations that AI solutions or features assist in producing are or are alleged to be deficient, inaccurate, harmful, or biased, or if such content, recommendations, solutions, or features or their development or deployment (including the collection, use, or other processing of data used to train or create such AI solutions or features) are found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal or contractual obligations to which we are or may become subject. If we fail to obtain any required permissions to collect, use, or otherwise process data, including personal information, in relation to AI solutions or features, or if we jeopardize the privacy or security of such information, it could adversely affect our business, results of operations and financial condition. The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations. These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources. AI also presents emerging ethical issues, and if our use of AI becomes controversial, we may experience brand or reputational harm.