Uber Technologies (UBER) Risk Analysis

In certain jurisdictions, including India, Brazil, and Mexico, as well as certain other countries in North and South America, Europe, the Middle East, and Africa, we allow consumers to use cash to pay Drivers the entire fare of rides and cost of meal deliveries (including our service fee from such rides and meal or grocery deliveries). In 2025, cash-paid trips accounted for approximately 6% of our global Gross Bookings. This percentage may increase in the future. The number of countries and product types where cash is accepted is expected to continue to increase. The use of cash in connection with our technology raises regulatory, operational, and safety concerns. For example, many jurisdictions have specific regulations regarding the use of cash for ridesharing and certain jurisdictions prohibit the use of cash for ridesharing. Failure to comply with these regulations could result in the imposition of significant fines and penalties and could result in a regulator requiring that we suspend operations in those jurisdictions. In addition to these regulatory concerns, the use of cash with our Mobility products and Delivery offering can increase safety and security risks for Drivers and riders, including potential robbery, assault, violent or fatal attacks, and other criminal acts. In certain jurisdictions such as Brazil, serious safety incidents resulting in robberies and violent, fatal attacks on Drivers while using our platform have been reported. If we are not able to adequately address any of these concerns, we could suffer significant reputational harm, which could adversely impact our business. Expanding cash payments to additional cities or countries could amplify these risks. In addition, establishing the proper infrastructure to ensure that we receive the correct service fee on cash trips is complex, and has in the past meant and may continue to mean that we cannot collect the entire service fee for certain of our cash-based trips. We have created systems for Drivers to collect and deposit the cash received for cash-based trips and deliveries, as well as systems for us to collect, deposit, and properly account for the cash received, some of which are not always effective, convenient, or widely-adopted by Drivers. Creating, maintaining, and improving these systems requires significant effort and resources, and we cannot guarantee these systems will be effective in collecting amounts due to us. Further, operating a business that uses cash raises compliance risks with respect to a variety of rules and regulations, including anti-money laundering laws. If Drivers fail to pay us under the terms of our agreements or if our collection systems fail, we may be adversely affected by both the inability to collect amounts due and the cost of enforcing the terms of our contracts, including litigation. Such collection failure and enforcement costs, along with any costs associated with a failure to comply with applicable rules and regulations, could, in the aggregate, impact our financial performance.

We are the subject of DOJ inquiries and investigations, as well as enforcement inquiries and investigations by other federal, state and local government agencies and other regulators abroad. Those inquiries and investigations cover a broad range of matters, including but not limited to, our business practices, such as fees, driver and courier earnings, consumer pricing, earner benefits, and related disclosures, financial products that may be offered by our partners on our platform, policies and practices related to safety incidents, and compliance with federal or state anti-discrimination laws. These issues may continue to lead to costly and time-consuming regulatory investigations and litigation from other government entities, as well as potentially material fines and penalties imposed by other U.S. and international regulators. Investigations and enforcement actions from such entities, as well as continued negative publicity and an erosion of current and prospective platform users' trust, could severely disrupt our business. We are also subject to inquiries and investigations by government agencies related to certain transactions we have entered into in the United States and other countries. These government inquiries and investigations are time-consuming and require a great deal of financial resources and attention from us and our senior management. If any of these matters are resolved adversely to us, we may be subject to additional fines,penalties, and other sanctions, and could be forced to change our business practices substantially in the relevant jurisdictions. Any such determinations could also result in significant adverse publicity or additional reputational harm, and could result in or complicate other inquiries, investigations, or lawsuits from other regulators in future merger control or conduct investigations. Any of these developments could result in material financial damages or operational restrictions, and harm our business.

We are a U.S.-based multinational company subject to tax in multiple U.S. and foreign tax jurisdictions. We are unable to predict what other global or U.S. tax reforms may be proposed or enacted in the future or what effects such future changes would have on our business. Any such changes in tax legislation, regulations, policies or practices in the jurisdictions in which we operate could increase the estimated tax liability that we have expensed to date and paid or accrued on our balance sheet; affect our financial position, future operating results, cash flows, and effective tax rates where we have operations; reduce post-tax returns to our stockholders; and increase the complexity, burden, and cost of tax compliance. We could become subject to new or additional digital services taxes in one or more jurisdictions where we operate. The governments of countries in which we operate and other governmental bodies could make unprecedented assertions about how taxation is determined in their jurisdictions that are contrary to the way in which we have interpreted and historically applied the rules and regulations described above in our income tax returns filed in such jurisdictions. New laws could significantly increase our tax obligations in the countries in which we do business or require us to change the manner in which we operate our business. As a result of the large and expanding scale of our international business activities, many of these changes to the taxation of our activities could increase our worldwide effective tax rate and harm our financial position, operating results, and cash flows.

The nature of our business exposes us to claims, including civil lawsuits in the United States such as those related to the 2016 Breach. These and any past or future privacy or security incidents could result in violation of applicable U.S. and international privacy, data protection, and other laws. Such violations subject us to individual or consumer class action litigation as well as governmental investigations and proceedings by federal, state, and local regulatory entities in the United States and internationally, resulting in exposure to material civil or criminal liability. Our data security and privacy practices have been the subject of inquiries from government agencies and regulators, not all of which are finally resolved. In April 2018, we entered into an FTC consent decree pursuant to which we agreed, among other things, to implement a comprehensive privacy program, undergo biennial third-party assessments, and not misrepresent how we protect consumer information through 2038. In October 2018, the FTC approved the final settlement, which exposes us to penalties for, amongst other activities, future failure to report security incidents. In November and December 2018, UK, Dutch and French supervisory authorities imposed fines totaling approximately $1.6 million. We have also entered into settlement agreements with numerous state enforcement agencies. For example, in January 2016, we entered into a settlement with the Office of the New York State Attorney General under which we agreed to enhance our data security practices. In addition, in September 2018, we entered into stipulated judgments with the state attorneys general of all 50 U.S. states and the District of Columbia relating to the 2016 Breach, which involved payment of $148 million and assurances that we would enhance our data security and privacy practices. In addition, in March 2022, Uber Technologies, Inc. and Uber B.V. were each fined €2.12 million by the Italian data protection authority for alleged privacy violations stemming from an investigation conducted in 2018. Additionally, in July 2022, we entered into a non-prosecution agreement with the DOJ concerning its investigation into our handling of the 2016 Breach. Failure to comply with these and other orders could result in substantial fines, enforcement actions, injunctive relief, and other penalties that may be costly or that may impact our business. We may also assume liabilities for breaches experienced by the companies we acquire as we expand our operations. For example, in April 2018, Careem publicly disclosed and notified relevant regulatory authorities that it had been subject to a data security incident that allowed access to certain personal information of riders and drivers on its platform as of January 14, 2018. If Careem becomes subject to liability as a result of this or other data security incidents or if we fail to remediate this or any other data security incident that Careem or we experience, we may face harm to our brand, business disruption, and significant liabilities. If we fail to remediate any data security incident that we experience, we may face harm to our brand, business disruption, and significant liabilities. Our insurance programs may not cover all potential claims to which we are exposed and may not be adequate to indemnify us for the full extent of our potential liabilities. We may also be impacted by privacy or security incidents at third-party service providers. We rely on third-party service providers to host or otherwise process some of our data and that of platform users, and they have experienced, and may again experience, security and privacy incidents. Any failure by such third-party providers to prevent or mitigate security breaches or improper access to, or use, acquisition, disclosure, alteration, or destruction of, such data could have similar adverse consequences for us. This risk is enhanced in certain jurisdictions with stringent privacy laws and, as we expand our products, offerings, and operations domestically and internationally, we have been, and may continue to become, subject to amended or additional laws that impose substantial additional obligations related to data privacy and security. The EU adopted the GDPR in 2016, and it became effective in May 2018. The GDPR applies extraterritorially and imposes stringent requirements for controllers and processors of personal data. Such requirements include higher consent standards to process personal data, robust disclosures regarding the use of personal data, strengthened individual data rights, data breach requirements, limitations on data retention, strengthened requirements for special categories of personal data and pseudonymised (i.e., key-coded) data, and additional obligations for contracting with service providers that may process personal data. In addition, the GDPR contains a provision that individuals shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Decisions based on AI or on automated processing of data, or insufficient disclosures regarding this processing, have and could impair our business and have and could subject us to lawsuits, regulatory investigations or other harm. The GDPR further provides that EU member states may institute additional laws and regulations impacting the processing of personal data, including (i) special categories of personal data (e.g., racial or ethnic origin, political opinions, and religious or philosophical beliefs) and (ii) certain decisions based solely on automated processing, including profiling. Such additional laws and regulations could limit our ability to use and share personal or other data, thereby increasing our costs and harming our business and financial condition. Non-compliance with the GDPR (including any non-compliance by any acquired business) is subject to significant penalties, including fines of up to the greater of €20 million or 4% of total worldwide revenue, and injunctions against the processing of personal data. Other jurisdictions outside the EU are similarly introducing or enhancing privacy and data security laws, rules, and regulations, including for automated processing, decision making, and profiling, which will increase our compliance costs and the risks associated with non-compliance. For example, the California Consumer Privacy Act ("CCPA"), which provided new privacy rights for consumers and new operational requirements for businesses, went into effect in January 2020. The CCPA includes a statutory damages framework and private rights of action against businesses that fail to comply with certain CCPA terms or implement reasonable security procedures and practices to prevent data breaches. Other U.S. states have adopted, and likely will continue to adopt, similar laws that provide new consumer privacy rights and business operational requirements. Brazil and India similarly passed national privacy laws establishing new rights for individuals, and responsibilities for companies that collect personal data, in 2018 and 2023, respectively. These laws may be subject to amendments and regulations that may change over time, or result in additional follow-on laws such as the California Privacy Rights Act passed in California in November 2020. For further information on risks related to our use of certain decisions based solely on automated processing or profiling, see the risk factor titled "-Our growing use of artificial intelligence and machine learning may present additional risks, including risks associated with algorithm development or use, the tools and data sets used, and/or a complex, developing regulatory environment." Additionally, we are subject to laws, rules, and regulations regarding cross-border transfers of personal data, including laws relating to transfer of personal data outside the EEA. We rely on transfer mechanisms permitted under these laws. Such mechanisms have received heightened regulatory and judicial scrutiny and have undergone modifications, and a 2020 decision by the Court of Justice of the European Union had cast doubt on the adequacy of all of the formerly-approved mechanisms for transferring personal data from countries in the EEA to certain other countries such as the United States. While in July 2023 the European Commission deemed a new EU-US Data Privacy Framework adequate for personal data transfers from the EU (and the rest of the EEA) to the United States, this Framework has been challenged. If we cannot rely on existing mechanisms for transferring personal data from the EEA, the United Kingdom, or other jurisdictions, we may be unable to transfer personal data of Drivers, consumers, or employees in those regions, which could have an adverse effect on our business, financial condition, and operating results, and has resulted in and may result in substantial fines, enforcement actions, litigation, injunctive relief, and other penalties that may be costly or that may impact our business. In addition, we are subject to regulations that prohibit the transfer of personal data to, or access to personal data from, certain countries, such as those implemented by the DOJ prohibiting the bulk transfer of U.S. persons' sensitive personal data to specified countries, including China and its territories. Such prohibitions could adversely impact our business and operations. In the event we are unable to comply with such prohibitions, we could be subject to investigations, enforcement actions, criminal penalties, and other penalties that may be costly or that may impact our business. In addition, we may be required to disclose personal data pursuant to demands from government agencies, including from state and city regulators as a requirement for obtaining or maintaining a license or otherwise, from law enforcement agencies, and from intelligence agencies. This disclosure or potential disclosure may result in a failure or perceived failure by us to comply with privacy and data protection policies, notices, laws, rules, and regulations, could result in proceedings or actions against us in the same or other jurisdictions, and could have an adverse impact on our reputation and brand. In addition, Careem has historically shared certain user data with certain government authorities, which conflicts with our global policies regarding data use, sharing, and ownership. We expect to maintain our data use, sharing, and ownership practices for both our business and Careem's business, and doing so may cause our relationship with government authorities in certain jurisdictions to suffer, and may result in such government authorities assessing fines or penalties against us. Further, if any jurisdiction in which we operate changes its laws, rules, or regulations relating to data residency or local computation such that we are unable to comply in a timely manner or at all, we may risk losing our rights to operate in such jurisdictions. This could adversely affect the manner in which we provide our products and offerings and thus materially affect our operations and financial results. Such data protection laws, rules, and regulations are complex and their interpretation is rapidly evolving, making implementation and enforcement, and thus compliance requirements, ambiguous, uncertain, and potentially inconsistent. This includes, for example, those relating to the processing of data for purposes of advertising and profile creation, which are subject to evolving disclosure, choice, and consent requirements in the EU, United States, and other jurisdictions. Compliance with such laws may require changes to our data collection, use, transfer, disclosure, and other processing and certain other related business practices and may thereby increase compliance costs or otherwise adversely affect our operations. Additionally, any failure or perceived failure by us to comply with privacy and data protection policies, notices, laws, rules, orders and regulations could result in proceedings or actions against us by individuals, consumer rights groups, governmental entities or agencies, or others. We could incur significant costs investigating and defending such claims and, if found liable, significant damages. Further, these proceedings and any subsequent adverse outcomes may subject us to significant penalties and negative publicity. If any of these events were to occur, our business and financial results could be significantly disrupted and adversely affected.

To continue to retain and attract Drivers, consumers, merchants, Shippers, and Carriers to our platform, we will need to continue to invest in the development of new products, offerings, and features that add value for Drivers, consumers, merchants, Shippers, and Carriers and that differentiate us from our competitors. For example, in January 2020, we introduced a number of product changes in California intended to, among other things, provide Drivers with more information about rider destinations, trip distance, and expected fares, display prices more clearly, and allow users to select preferred Drivers, all of which are intended to further strengthen the independence of Drivers in California and protect their ability to work flexibly when using the Uber platform. Developing and delivering new or upgraded products, offerings, and features is costly, and the success of such new products, offerings, and features depends on several factors, including the timely completion, introduction, and market acceptance of such products, offerings, and features. Moreover, any such new or upgraded products, offerings, or features may not work as intended or may not provide intended value to platform users. For example, some product changes in California have resulted in, and may continue to result in, reduced demand for rides and reduced supply of Drivers on our platform, Driver dissatisfaction, and adverse impacts on the operation of our platform. If we are unable to continue to develop new or upgraded products, offerings, and features, or if platform users do not perceive value in such new or upgraded products, offerings, and features, platform users may choose not to use our platform, which would adversely affect our operating results.

We rely heavily on information technology systems across our operations. Our information technology systems, including mobile and online platforms and mobile payment systems, administrative functions such as human resources, payroll, accounting, and internal and external communications, and the information technology systems of our third-party business partners and service providers, contain proprietary or confidential information related to business and personal data, including sensitive personal data, entrusted to us by platform users, employees, and job candidates, and make us a target for threat actors. Cyberattacks that leverage computer malware, ransomware, viruses, denial of service attacks, account takeovers, spamming, phishing, and social engineering have become more prevalent, have occurred on our systems in the past, and may occur on our systems in the future. Cyberthreats are constantly evolving and employing more sophisticated attack techniques. Our detection capabilities may not be sufficient to prevent or detect a sophisticated cyberattacker. Breaches of our facilities, network, applications, identity management solutions or data security have in the past and could in the future disrupt our business or the security of our systems and platforms, impair our ability to protect data, compromise confidential or technical business information harming our reputation or competitive position, result in theft or misuse of our intellectual property or other assets, subject us to regulatory scrutiny or legal liability, require us to allocate more resources to improve technologies, or otherwise adversely affect our reputation, business and operating results. In addition, our hybrid and remote working arrangements may heighten the foregoing risks. Various other factors may also cause system failures or security breaches, including power outages, catastrophic events, inadequate or ineffective redundancy, issues with upgrading or creating new systems or platforms, flaws in third-party software or services, intentional acts or errors by our employees or third-party service providers, or breaches in the security of these systems or platforms. For example, fraudsters may attempt to induce employees, contractors, or platform users to disclose information to gain access to our data or the data of platform users. If our incident response, disaster recovery, and business continuity plans do not resolve these issues in an effective manner, they could result in adverse impacts to our business operations and our financial results. Because of our prominence, the number of platform users, and the types and volume of personal data on our systems, we may be a particularly attractive target for such attacks. Although we have developed, and continue to develop, systems and processes that are designed to protect our data and that of platform users, and to prevent data loss, undesirable activities on our platform, and security breaches, we cannot guarantee that such measures will provide absolute security. Our efforts on this front may be unsuccessful as a result of, for example, software bugs or other technical malfunctions; employee, contractor, or vendor error or malfeasance; government surveillance; or other threats that evolve, and we may incur significant costs in protecting against or remediating cyberattacks. Any actual or perceived failure to maintain the performance, reliability, security, and availability of our products, offerings, and technical infrastructure to the satisfaction of platform users, shareholders and certain regulators would likely harm our reputation and result in loss of revenue from the adverse impact to our reputation and brand, disruption to our business, decreased ability to attract and retain Drivers, consumers, merchants, Shippers, and Carriers, and subject us to regulatory scrutiny or legal liability.

One of the most important features of our platform is its broad interoperability with a range of devices, operating systems, and third-party applications. Our platform is accessible from the web and from devices running various operating systems such as iOS and Android. We depend on the accessibility of our platform across these third-party operating systems and applications that we do not control. Moreover, third-party services and products are constantly evolving, and we may not be able to modify our platform to assure its compatibility with that of other third parties following development changes. The loss of interoperability, whether due to actions of third parties or otherwise, could adversely affect our business.

Our historical workplace culture and forward-leaning approach created significant operational and cultural challenges that have in the past harmed, and may in the future continue to harm, our business results and financial condition. Our prior failure to prioritize compliance has led to increased regulatory scrutiny globally. Although we have since made changes in our company's cultural values and composition of our leadership team and have an ongoing commitment to promote transparency and collaboration, regulators may continue to perceive us negatively, which would adversely impact our business, financial condition, operating results, and prospects.

We use a combination of third-party cloud computing services and co-located data centers in the United States and abroad. We do not control the physical operation of any of the co-located data centers we use or the operations of our third-party service providers. These third-party operations and co-located data centers may experience break-ins, computer viruses, denial-of-service attacks, sabotage, acts of vandalism, and other misconduct. These facilities may also be vulnerable to damage or interruption from power loss, telecommunications failures, fires, floods, earthquakes, hurricanes, tornadoes, and similar events. Our systems do not provide complete redundancy of data storage or processing, and as a result, the occurrence of any such event, a decision by our third-party service providers to close our co-located data centers without adequate notice, or other unanticipated problems may result in our inability to serve data reliably or require us to migrate our data to either a new on-premise data center or cloud computing service. This could be time consuming and costly and may result in the loss of data, any of which could significantly interrupt the provision of our products and offerings and harm our reputation and brand. We may not be able to easily switch to another cloud or data center provider in the event of any disruptions or interference to the services we use, and even if we do, other cloud and data center providers are subject to the same risks. Additionally, our co-located data center facility agreements are of limited durations, and our co-located data center facilities have no obligation to renew their agreements with us on commercially reasonable terms or at all. If we are unable to renew our agreements with these facilities on commercially reasonable terms, we may experience delays in the provision of our products and offerings until an agreement with another co-located data center is arranged. Interruptions in the delivery of our products and offerings may reduce our revenue, cause Drivers, merchants, and Carriers to stop offering their services through our platform, and reduce use of our platform by consumers and Shippers. Our business and operating results may be harmed if current and potential Drivers, consumers, merchants, Shippers, and Carriers believe our platform is unreliable. In addition, if we are unable to scale our data storage and computational capacity sufficiently or on commercially reasonable terms, our ability to innovate and introduce new products on our platform may be delayed or compromised, which would have an adverse effect on our growth and business.

Factors such as inflation, increased fuel prices, and increased vehicle purchase, rental, insurance, or maintenance costs, including increased prices of new and used vehicle parts as a result of recent tariffs, global supply chain challenges, and increased fuel prices as result of the conflict between Russia and Ukraine and the conflict in the Middle East, have and may continue to increase the costs incurred by Drivers and Carriers when providing services on our platform. Similarly, factors such as inflation, increased food costs, increased labor and employee benefit costs, increased rental costs, and increased energy costs may increase merchant operating costs, particularly in certain international markets, such as Egypt. Many of the factors affecting Driver, merchant, and Carrier costs are beyond the control of these parties. In many cases, these increased costs may cause Drivers and Carriers to spend less time providing services on our platform or to seek alternative sources of income. Likewise, these increased costs may cause merchants to pass costs on to consumers by increasing prices, which would likely cause order volume to decline, may cause merchants to cease operations altogether, or may cause Carriers to pass costs on to Shippers, which may cause shipments on our platform to decline. A decreased supply of Drivers, consumers, merchants, Shippers, or Carriers on our platform would decrease our network liquidity, which could harm our business and operating results. Dependencies on Third Parties

To remain competitive in certain markets and generate network scale and liquidity, we have in the past lowered, and may continue to lower, fares or service fees, and we have offered and may continue to offer significant Driver incentives and consumer discounts and promotions. At times, in certain geographic markets, we have offered, and may continue to offer, Driver incentives that cause the total amount of the fare that a Driver retains, combined with the Driver incentives a Driver receives from us, to increase, at times meeting or exceeding the amount of Gross Bookings we generate for a given Trip. In certain geographic markets and regions, we do not have a leading category position, which may result in us choosing to further increase the amount of Driver incentives and consumer discounts and promotions that we offer in those geographic markets and regions. We cannot assure you that offering such Driver incentives and consumer discounts and promotions will be successful. Driver incentives, consumer discounts, promotions, and reductions in fares and our service fee have negatively affected, and will continue to negatively affect, our financial performance. Additionally, we rely on pricing models to calculate consumer fares and Driver earnings, which have been modified over time and will likely in the future be modified, and pricing models at times vary based upon jurisdiction. We cannot assure you that our pricing models or strategies will be successful in attracting consumers and Drivers. For example, changes we have made in California to the information that Drivers see in the application, as well as pricing and offer structure changes, adversely impacted usage of the application. If we are unable to successfully manage these and similar kinds of changes in the future, our business may be adversely impacted. The markets in which we compete have attracted significant investments from a wide range of funding sources, and we anticipate that many of our competitors will continue to be highly capitalized. Moreover, certain of our stockholders have made substantial investments in certain of our competitors and may increase such investments, make new investments in other competitors, or enter into strategic transactions with competitors in the future. These investments or strategic transactions, along with other competitive advantages discussed above, may allow our competitors to compete more effectively against us and continue to lower their prices, offer Driver incentives or consumer discounts and promotions, or otherwise attract Drivers, consumers, merchants, Shippers, and Carriers to their platform and away from ours. Such competitive pressures may lead us to maintain or lower fares or service fees or maintain or increase our Driver incentives and consumer discounts and promotions. Ridesharing and certain other categories in which we compete are relatively nascent, and we cannot guarantee that they will stabilize at a competitive equilibrium that will allow us to maintain profitability.

In 2025, more than 75% of our Gross Bookings were paid by credit card, debit card, or digital wallet. As such, the loss of our payment acceptance privileges would significantly limit our business model. We are required by our payment processors to comply with payment card network operating rules, including the Payment Card Industry ("PCI") and Data Security Standard (the "Standard"). The Standard is a comprehensive set of requirements for enhancing payment account data security developed by the PCI Security Standards Council to help facilitate the broad adoption of consistent data security measures. Our failure to comply with the Standard and other network operating rules could result in fines or restrictions on our ability to accept payment cards. Under certain circumstances specified in the payment card network rules, we may be required to submit to periodic audits, self-assessments, or other assessments of our compliance with the Standard. Such activities may reveal that we have failed to comply with the Standard. If an audit, self- assessment, or other test determines that we need to take steps to remediate any deficiencies, such remediation efforts may distract our management team and require us to undertake costly and time consuming remediation efforts. In addition, even if we comply with the Standard, there is no assurance that we will be protected from a security breach. Moreover, the payment card networks could adopt new operating rules or interpret existing rules that we or our processors might find difficult or even impossible to follow, or costly to implement. In addition to violations of network rules, including the Standard, any failure to maintain good relationships with the payment card networks could impact our ability to receive incentives from them, could increase our costs, or could otherwise harm our business. The loss of our payment acceptance privileges for any one of these reasons, or the significant modification of the terms under which we obtain payment acceptance privileges, may have an adverse effect on our business, revenue, and operating results.

We face climate-related physical and transition risks, which include risks associated with market shifts toward more sustainable or renewable forms of energy and energy conservation. In the context of our business, this includes market shifts toward electric vehicles ("EVs"), investing in the transition to operating high-power fast-charging infrastructure for autonomous vehicles, and lower carbon business models, which carry a potential of increasing energy costs and emissions, despite advancing fleet electrification. If we fail, or are perceived to fail, to keep up with these market shifts, including changes in consumer preferences and evolving stakeholder expectations, we may lose customers or face criticism or public scrutiny, from the media, or our stakeholders or others, and our business, reputation, financial condition and results of operations could be adversely affected. Physical climate risks include risks related to extreme weather events or natural disasters, and include extreme storms and temperatures, flooding, droughts, freezes, wildfires, earthquakes and tsunamis, as well as chronic changes such as sea-level rise. Climate-related events, including the increasing frequency, severity and duration of extreme weather events and their impact on critical infrastructure in the United States and elsewhere, have the potential to disrupt our business, our third-party suppliers, and the business of merchants, Shippers, Carriers and Drivers using our platform, and may cause us to experience higher losses and additional costs to maintain or resume operations. While we and third parties may take various actions to mitigate business risks associated with climate-related events, this may require incurring substantial costs and may not be successful, due to, among other things, the uncertainty associated with the longer-term projections associated with managing climate risks. Additionally, we are or may become subject to emerging environmental and social laws and regulations, including climate policies and regulations adopted in California, including for example, in May 2021 requiring 90% of vehicle miles traveled by rideshare fleets in California to have been in zero emission vehicles by 2030, with interim targets beginning in 2023. Certain jurisdictions have also developed and implemented rules to address the environmental impact of rideshare, and additional jurisdictions may consider similar rules and regulations. We are also subject to the Corporate Sustainability Reporting Directive, which was adopted in the European Union in December 2022. In addition, Drivers may be subject to climate-related policies that indirectly impact our business, such as the Congestion Charge Zone and Ultra Low Emission Zone schemes adopted in London that impose fees on drivers that do not meet specified emissions standards, which may impact our ability to attract and maintain Drivers on our platform, and to the extent we experience Driver supply constraints in a given market, we may need to increase Driver incentives. Additional regulations may require us to incur significant additional costs to comply, including increased costs related to reporting, the implementation of extensive internal controls processes and procedures regarding matters that have not been subject to such levels of controls in the past, and impose increased oversight obligations on our management and board of directors, as well as require us to hire third party experts. Additional regulatory requirements may also end up exposing us to increased activism, litigation and enforcement. All of these risks may also impact our suppliers, business partners or customers, which may impact our business, financial condition, or results of operations.