Zillow Group Class C (Z) Risk Analysis

We are from time to time involved in, and have in the past or may in the future be subject to, legal proceedings arising from our business, including actions with respect to intellectual property, privacy, consumer protection, information security, mortgage brokering, mortgage origination, real estate, real estate brokerage, environmental, data protection, antitrust, the Real Estate Settlement Procedures Act of 1974 (RESPA), fair housing or fair lending, compliance with securities laws, or law enforcement matters, tax matters, labor and employment, and commercial claims, as well as actions involving content generated by our customers, shareholder derivative actions, purported class action lawsuits, and other matters. We are also from time to time involved in, and have in the past or may in the future be subject to, legal proceedings arising from or related to discontinued products and services, including actions with respect to the purchase, renovation and resale of properties, including homes previously held in our inventory. The number and scope of potential legal proceedings may increase as our business expands and our products and services evolve. For example, during 2025, among other claims, we were named in complaints filed by the Federal Trade Commission, certain state attorneys general, Compass, Inc., CoStar Group, Inc., and consumer plaintiffs in a purported class action, alleging antitrust, intellectual property, consumer protection, RESPA, and other claims. See Part II, Item 8 in Note 13 under the subsection titled "Legal Proceedings" in our Notes to Consolidated Financial Statements in this Annual Report on Form 10-K for additional information about certain of these and other legal proceedings. These and other legal proceedings that we are, have, or may be involved in are inherently uncertain, and their results cannot be predicted with certainty. Regardless of the outcome, any such legal proceedings could have an adverse impact on us because of legal costs, diversion of management and other personnel, reputational harm and other factors. In addition, it is possible that a resolution of one or more such proceedings could result in reputational harm, liability, fines, penalties, or sanctions, as well as judgments, consent decrees, or orders preventing us from offering certain features, functionalities, products, or services, or requiring a change in our business practices, products or technologies, which could in the future materially and adversely affect our business, operating results and financial condition. In some instances, third parties may have an obligation to indemnify us for liabilities related to litigation or governmental investigations, and they may be unable to, or fail to, fulfill such obligations. If such third parties fail to indemnify us, we may be financially responsible, which could adversely affect our financial condition.

We are subject to income taxes in the United States (federal and state) and certain foreign jurisdictions. Tax laws, regulations, and administrative practices in various jurisdictions may be subject to significant change, with or without notice, due to economic, political, and other conditions. New tax laws, regulations and administrative practices could be enacted or adopted at any time, and existing tax laws, regulations and administrative practices could be interpreted, modified or applied adversely to us, possibly with retroactive effect. These changes could require us to pay additional taxes, penalties, interest and other related costs, and also could increase our compliance, operating and other costs. Significant judgment is required in evaluating and estimating the taxes imposed under such tax laws. Our effective tax rates could be affected by numerous factors, such as entry into new businesses and geographies, changes to our existing business and operations, acquisitions and investments and how they are financed, changes in our stock price, changes in our deferred tax assets and liabilities and their valuation, and changes in the relevant tax, accounting, and other laws, regulations, administrative practices, principles, and interpretations. We are required to take positions regarding the interpretation of complex statutory and regulatory tax rules and on valuation matters that are subject to uncertainty, and the Internal Revenue Service or other tax authorities may challenge the positions we take.

Our success depends on our continued innovation to provide new, and improve upon existing, products and services that make real estate transactions faster, easier and less stressful for our customers and provide value to real estate, rental and mortgage professionals, home buyers and sellers and our other real estate partners. As a result, we must continually invest significant resources in technology and development to improve the attractiveness, competitiveness, and comprehensiveness of our products and services, enable more seamless and efficient real estate transactions, adapt to changes in technology and support new devices and operating systems. If we are unable to provide products and services that our customers want to use, on the devices they prefer, then those customers may become dissatisfied and use competitors' mobile apps, websites, products and services. If our customers begin to access more real estate information and services through other sources and we fail to innovate, our business may be negatively impacted. If we are unable to continue offering high-quality, innovative products and services, we may be unable to attract additional customers and real estate partners or retain our current customers and real estate partners, which could harm our business, results of operations and financial condition.

Our products and services involve the transmission, processing, and/or storage of users' information, some of which may be private or include sensitive personal information such as social security numbers, financial account information, and credit card information. For example, our real estate transaction management software stores sensitive personal and financial information, our mortgage product and pricing software for mortgage professionals processes social security numbers, our rental applications product allows customers to obtain credit and background checks containing sensitive personal and financial information, and our mortgage origination and real estate closings operations receive, handle and transmit highly sensitive personal and financial information about their customers. Cyber-attacks, malicious internet-based activity, online and offline fraud, administrative or technical failures and other similar activities threaten the confidentiality, integrity and availability of our information technology systems, including those of the third parties upon which we rely, and our sensitive data, including customer, employee and real estate partner data as well as intellectual property and other confidential business information, which could result in potential significant liability and litigation. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain and ability to produce, sell and distribute our services. We and the third parties upon which we rely have been and may continue to be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, or floods, attacks enhanced or facilitated by AI, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, negative impacts on our ability to provide our products or services, loss of sensitive data and income, reputational harm and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Outside parties may attempt to fraudulently induce employees, officers, directors, customers or real estate partners to disclose sensitive information in order to gain access to our information or our customers' or real estate partners' information, and our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to user error, malfeasance or other disruptions. If we experience compromises to our security that result in the loss or unauthorized disclosure of confidential information, our customers and real estate partners may lose trust in us, customers may decrease the use of our mobile apps or websites or stop using our mobile apps, websites, or services in their entirety, real estate partners may decrease or stop advertising on our mobile apps or websites, and we may be subject to legal claims and liability, government investigation and additional state and federal legal requirements. If we experience compromises to our security that result in the loss of availability of our data, our mobile apps, websites, or services may be unable to function at a level necessary to meet our customers' needs. Our reliance on vendors could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. We engage a variety of vendors to process and store sensitive data, including certain customer information, some of which may be private or include personally identifiable information. We also depend on vendors to host many of the systems and infrastructure used to provide our products and services. The visibility we receive from our risk-based assessments of certain vendors' information security practices is inherently limited, and these vendors may not have adequate information security controls in place. If our vendors experience a security incident or other interruption, we could experience adverse consequences, including harm to our business, results of operations and financial condition. Further, a security breach at our vendor could be perceived by customers or our real estate partners as a breach of our systems and could result in damage to our reputation and expose us to other losses. Any award we may be entitled to receive if our vendors fail to satisfy their privacy or security-related obligations to us may be insufficient to cover our damages, or we may be unable to recover such an award. In addition, supply-chain attacks have increased in frequency and severity and there have been high-profile incidents of third-party service providers causing widespread disruptions in their customers' infrastructures due to errors in their Software-as-a-Service ("SaaS") offerings. We cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of or access to our sensitive data or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our services. There can be no assurance that the security controls we designed to protect against security incidents will be effective. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently, often are not recognized until launched against a target, and may originate from less regulated and remote areas around the world, we may be unable to proactively address all these techniques or to implement adequate preventative measures. We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Unremediated high risk or critical vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive data (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss and other similar harms. Any or all of these consequences could negatively impact our ability to attract new customers and increase engagement by existing customers, prevent or cause existing customers to stop using our products or services or close their accounts, or cause existing real estate partners to cancel their contracts, thereby harming our business, results of operations and financial condition. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with the use of AI technologies by our employees, personnel or vendors. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages or claims related to our data privacy and information security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all or that such coverage will pay future claims.

We maintain insurance to cover costs and losses from certain risk exposures in the ordinary course of our operations, including risk exposures related to cybersecurity matters and securities litigation, but our insurance may not cover 100% of the costs and losses from all events. We are responsible for certain retentions and deductibles that vary by policy, and we may suffer losses that exceed our insurance coverage by a material amount. We may also incur costs or suffer losses arising from events against which we have no insurance coverage. In addition, large scale insurance market trends or the occurrence of adverse events in our business may raise our cost of procuring insurance or limit the amount or type of insurance we are able to secure. We may not be able to maintain our current coverage, or obtain new coverage in the future, on commercially reasonable terms or at all. Any of these occurrences could harm our financial condition.

We have made, published, or released, and may continue to make, publish, or release, public statements, disclosures, targets, and product features relating to social impact and innovation, environmental sustainability, climate-related metrics (including science-based targets for reducing greenhouse gas emissions), workforce matters, responsible business practices, and other sustainability-related topics. These statements, disclosures, targets, and product features reflect plans, assumptions, methodologies, and third-party data sources available to us at the time they were made, published, or released, and are subject to evolving standards, interpretations, and data limitations. Our failure, or perceived failure, to accomplish or accurately track, measure, substantiate, or disclose information related to these statements, disclosures, targets, and product features, or to timely update them as circumstances change, could result in reputational harm, increased scrutiny from investors, regulators, and other stakeholders, enforcement actions under emerging "greenwashing" or consumer protection laws, or private litigation. Expectations regarding sustainability-related practices, disclosures, and business decisions continue to evolve and are increasingly varied across investors, regulators, customers, employees, policymakers, and other stakeholders. As a result, actions or disclosures that are intended to address the expectations of certain stakeholders, may be viewed by others as insufficient, excessive, or misaligned with their views. This dynamic may expose us to reputational harm, political or regulatory scrutiny, consumer or partner boycotts, retaliatory legislative or regulatory actions, employee relations challenges, or reduced demand for our products or services, any of which could adversely affect our business, operating results, or financial condition. In addition, the inclusion, exclusion, modification, or presentation of sustainability-related information within our products or services, including information derived from third-party sources, may give rise to similar reputational, legal, or commercial risks.

The success of our business depends, directly and indirectly, on the health of the United States residential real estate market. The health of the United States residential real estate market is affected, in part, by general economic conditions beyond our control. Recent market factors, including low housing inventory, elevated and volatile mortgage interest rates, home price fluctuations, inflationary conditions, and changes in rental inventory and occupancy rates have impacted demand for our products and services by consumers and advertisers, which in turn has impacted our financial performance. The extent to which these and additional economic factors, such as those described below, impact our operating results and financial position will depend on future developments, which are uncertain and difficult to predict: - Fluctuations in the United States residential real estate market – both seasonal and cyclical – which may be due to one or more factors, whether included in this list or not;- changes in federal monetary policy or inflationary conditions;- changes in international, national, regional, or local economic, demographic, or real estate market conditions;- slow economic growth or recessionary conditions;- increased levels of unemployment or a decrease in labor availability, and/or slowly growing or declining wages;- declines in the value of residential real estate and/or the pace of home appreciation, or the lack thereof;- illiquidity in residential real estate;- overall conditions in the housing market, including macroeconomic shifts in demand, and increases in costs for homeowners such as property taxes, homeowners association fees and availability and affordability of insurance;- low levels of customer confidence in the economy and/or the United States residential real estate industry;- low home and/or rental inventory levels or lack of affordably priced homes and rentals;- changes in interest rates, mortgage rates or down payment requirements and/or restrictions on mortgage financing availability;- changes to how real estate commissions are negotiated or paid, or changes to other industry standards and practices;- federal, state, or local legislative or regulatory changes that would negatively impact rental properties or the residential real estate industry; and/or - natural and man-made disasters and other catastrophic events, such as pandemics, hurricanes, earthquakes, wildfires, floods, terrorist attacks and other events that disrupt local, regional, or national real estate markets.

We provide products and services to customers throughout the United States and to a lesser extent, in Canada. In addition, Zillow Home Loans originates loans in 49 states and the District of Columbia. Although the majority of our workforce has shifted to a distributed work environment, we maintain offices and large employee populations, including those supporting our licensed operations, in cities including Seattle, Washington; New York, New York; San Francisco, California; and Irvine, California. The occurrence of a natural disaster, climate change or other catastrophic event such as a pandemic, health crisis, earthquake, hurricane, windstorm, fire, flood, power loss, telecommunications failure, cyber-attack, geopolitical instability, war, civil unrest, terrorist attack or other similar event in any of the markets in which we provide services or any locality in which we have a significant operational presence may disrupt our operations, impair local and regional real estate markets or economies and negatively impact our business, results of operations and financial condition. Business continuity and disaster recovery planning is important, and if we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster, catastrophic event, or other emergency, and successfully execute on those plans in the event of a disaster, catastrophic event, or other emergency, our business and reputation may be harmed.