Ziff Davis (ZD) Risk Analysis

We are subject to laws and regulations affecting our domestic and international operations in a number of areas. The application of existing domestic and international laws and regulations to us relating to issues such as labor, defamation, pricing, advertising, taxation, promotions, billing, e-commerce, consumer protection, accessibility, content regulation, data privacy, cybersecurity, AI, youth safety, export restrictions and sanctions, telecommunications, mobile communications and media, television, intellectual property ownership and infringement, real estate, anti-corruption, foreign exchange controls and cash repatriation restrictions, anti-competition, climate, environmental, health, safety, and accreditation, in many instances, is unclear or unsettled. In addition, we will also be subject to any new laws and regulations directly applicable to our domestic and international activities. Compliance with these laws, regulations and similar requirements may be onerous and expensive, and these laws may be inconsistent from jurisdiction to jurisdiction, further increasing the cost of compliance and doing business. Any such costs, which may rise in the future as a result of changes in these laws and regulations or in their interpretation, could individually or in the aggregate make our products and services less attractive to our customers, delay the introduction of new products in one or more regions, or cause us to change or limit our business practices. We have implemented policies and procedures designed to ensure compliance with applicable laws and regulations, but there can be no assurance that our employees, contractors, or agents will not violate such laws and regulations or our policies and procedures. Further, the application of existing laws to us or our subsidiaries regulating or requiring licenses for certain businesses of our advertisers including, for example, distribution of pharmaceuticals, alcohol, or other regulated substances, adult content, tobacco, or firearms, as well as insurance and securities brokerage, and legal services, can be unclear. Internationally, we may also be subject to laws regulating our activities in foreign countries and to foreign laws and regulations that are inconsistent from country to country. Our businesses utilize contractors, freelancers and/or staff from third-party outsourcers to provide content and other services. However, in the future, arrangements with such individuals may not be deemed appropriate by a relevant government authority, which could result in additional costs and expenses. We may incur substantial liabilities for expenses necessary to defend against litigation regarding these laws and regulations or to otherwise comply with these laws and regulations, and we may incur potentially substantial penalties for any failure to comply. Compliance with these laws and regulations may also cause us to change or limit our business practices in a manner adverse to our business. A number of laws, including those referenced below, impact our business. The Digital Millennium Copyright Act ("DMCA") is intended, in part, to limit the liability of eligible online service providers for listing or linking to third-party websites that include materials that infringe copyrights or other rights of others. Portions of the Communications Decency Act ("CDA") are intended to provide statutory protections to online service providers who distribute third-party content. We rely on the protections provided by both the DMCA and the CDA in conducting our business. If these or other laws or judicial interpretations are changed to narrow their protections or previously accepted U.S. constitutional protections, or if international jurisdictions refuse to apply similar provisions in international lawsuits, we will be subject to a greater risk of liability, our costs of compliance with these regulations or to defend litigation may increase, or our ability to operate certain lines of business may be limited. In the United States, the CDA provides statutory protections to online service providers like us who distribute third-party content. However, government authorities, elected officials, and political candidates have called for amendments to Section 230 of the CDA that would purport to limit or remove protections afforded to interactive computer service providers and our current protections from liability for third-party content in the United States could decrease or change. We could incur significant costs investigating and defending such claims and, if we are found liable, significant damages. We could also face fines, orders restricting or blocking our services in particular geographies, or other government-imposed remedies as a result of content hosted on our platform. Furthermore, a portion of our business includes acquiring and selling personal data. The acquisition and sale of data from or to third parties has become subject to increased regulatory scrutiny. Therefore, obtaining and selling data from third parties carries risk to us as a data purchaser and reseller. For example, as a data supplier, a portion of our business is currently required to register as a data broker under California, Oregon, Texas, and Vermont law and file reports with regulators, which exposes us to increased scrutiny. Additionally, California's Delete Act established a mechanism to allow California consumers to submit a single, verifiable request to delete all of their personal data held by all registered data brokers and their service providers. Moreover, third-party data suppliers have recently been subject to increased litigation under various claims of violating certain state privacy laws. These laws and challenges may make it so difficult for us and our suppliers to collect and sell data, and the costs associated with the data may materially increase, or the availability of such data that we or our data suppliers can provide may materially decrease. Cybersecurity, data privacy, data security, consumer protection, data protection, and AI laws are constantly evolving at the federal and state levels in the United States, as well as abroad. We are currently subject to such laws both at the federal and state levels in the U.S. as well as similar laws in a variety of international jurisdictions. For example, our use or sharing or certain data subjects us to the Video Privacy Protection Act ("VPPA"), the California Invasion of Privacy Act ("CIPA"), the California Consumer Privacy Act (the "CCPA") as amended by the California Privacy Rights Act (the "CPRA") and may subject us to additional comprehensive or sector-specific U.S. state privacy laws, as well as international laws, including the General Data Protection Regulation ("GDPR") and the EU Data Act. The interpretation of these laws may be uncertain and may also impose conflicting obligations on us. The Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (the "CAN-SPAM Act"), which allows for penalties that run into the millions of dollars, requires commercial emails to include identifying information from the sender and a mechanism for the receiver to opt out of receiving future emails. Several states have enacted additional, more restrictive and punitive laws regulating commercial email. Foreign legislation exists as well, including Canada's Anti-Spam Legislation and the European laws that have been enacted pursuant to the GDPR and European Union Directive 2002/58/EC and its amendments. We use email as a significant means of communicating with our existing and potential users. We believe that our email practices comply with the requirements of the CAN-SPAM Act, state laws, and applicable foreign legislation. If we were ever found to be in violation of these laws and regulations, or any other laws or regulations, our business, financial condition, operating results, and cash flows could be materially adversely affected. Plaintiffs across the country have filed lawsuits arguing that websites and mobile applications are "places of public accommodation" under Title III of the Americans with Disabilities Act ("ADA") and, as such, must include functionality to make them accessible to and navigable by to persons with disabilities. There is currently a split in the federal courts of appeal as to whether a website or mobile application can be a "place of public accommodation" under the ADA. A majority of federal circuit courts to address the issue have concluded that standalone websites are not, because a place of public accommodation is a physical establishment. A minority of federal circuit courts have extended the concept of "places of public accommodation" to remote businesses, including standalone websites. The Supreme Court, which would have the authority to resolve the issue nationwide, has not yet ruled on the issue. We cannot predict how the Supreme Court will resolve the issue if and when it has the opportunity to do so. Native advertising is an increasing part of our Digital Media business's online advertising revenue. On December 22, 2015, the FTC issued Guidelines and an Enforcement Policy Statement on native advertising, described by the FTC as, in part, ads which often "resemble the design, style, and functionality of the media in which they are disseminated". We believe we are compliant with the requirements of these guidelines on our current practices and offerings. However, we will continue to monitor what effect this guideline and other related government regulations, and how the FTC enforces it, could have on our native advertising and branded content business. In addition, the timing and extent of any enforcement by the FTC with regard to our native advertising practices, or others', could reduce the revenue we generate from this line of business. The United Kingdom similarly has issued guidelines on native advertising in the United Kingdom Code of Non-broadcast Advertising and Direct & Promotional Marketing ("CAP Code") and is regulated, in part, by the Advertising Standards Authority. We believe we are compliant with the requirements of the CAP Code on our current practices and offerings and will continue to monitor the effect of these and other related governmental regulations. We believe that many of our cloud services are "information services" under the Telecommunications Act of 1996 and related precedent, or, if not "information services", that we are entitled to other exemptions. In connection with our Cybersecurity & Martech business, we utilize data transmissions over public telephone lines and other facilities provided by third-party carriers. These transmissions are subject to foreign and domestic laws, regulations and requirements by the Federal Communications Commission (the "FCC"), state public utility commissions, foreign governmental authorities, and industry trade associations such as the CTIA. These regulations and requirements affect our ability to provide services, the availability of numbers, the prices we pay for transmission services, the administrative costs associated with providing our services, the competition we face from telecommunications service providers and other aspects of our market. However, as the services we offer expand, we may become subject to other regulatory agency regulation. It is also possible that a federal or state regulatory agency could take the position that our offerings, or a subset of our offerings, are properly classified as telecommunications services or otherwise not entitled to certain exemptions upon which we currently rely. Such a finding could potentially subject us to fines, penalties or enforcement actions as well as liabilities for past regulatory fees and charges, retroactive contributions to various telecommunications-related funds, telecommunications-related taxes, penalties, and interest. It is also possible that such a finding could subject us to additional regulatory obligations that could potentially require us either to modify our offerings in a costly manner, diminish our ability to retain customers, or discontinue certain offerings, in order to comply with certain regulations. Changes in the regulatory environment could decrease our revenues, increase our costs and restrict our service offerings. In many of our international locations, we are subject to regulation by the applicable governmental authority. In the U.S., Congress, the FCC, and a number of states require regulated telecommunications carriers to contribute to federal and/or state Universal Service Funds ("USF"). Generally, USF is used to subsidize the cost of providing service to low-income customers and those living in high cost or rural areas. If there are changes to USF requirements, we may need to absorb the increased costs or raise the amount we currently collect from some of our customers, which could cause us to alter or eliminate our non-paid services and to raise the price of our paid services, which in turn could cause us to lose customers, reduce our profit margins, or diminish any price advantage that we may have currently have. Any of these results could lead to a decrease in our revenues and net income and could materially adversely affect our business, prospects, financial condition, operating results, and cash flows. In addition, due to the number of text messages, phone calls and other communications we send or make on behalf of our customers in connection with the services we provide, communication-related privacy laws could result in particularly significant damage awards or fines. For example, in the United States, the Telephone Consumer Protection Act ("TCPA") prohibits placing calls or sending text messages to mobile phones without "prior express consent" subject to limited exceptions. As currently construed, the TCPA does not distinguish between voice and data, and, as such, text and SMS/MMS messages may also be "calls" for the purpose of TCPA obligations and restrictions. For violations of the TCPA, a plaintiff may seek actual monetary loss or statutory damages of $500 per violation, whichever is greater, and courts may treble the damage award for willful or knowing violations. Parties that solely enable calling or text messaging are only directly liable under the TCPA pursuant to federal common law vicarious liability principles. We take significant steps to ensure that users understand that they are responsible for how they use our technology, including complying with relevant federal and state law. However, because we do not enjoy absolute exemption from liability under the TCPA and related FCC and FTC rules, we could face inquiries from the FCC and FTC or enforcement actions by these agencies, or private causes of action, if someone uses our service for such impermissible purposes. If this were to occur and we were to be held liable for someone's use of our service for unauthorized calling or text messaging mobile users, the financial penalties could cause a material adverse effect on our operations and harm our business reputation. Also, in the United States, the Communications Assistance to Law Enforcement Act ("CALEA") requires any telecommunications carriers to be capable of performing wiretaps and recording other call identifying information in cooperation with law enforcement. In September 2005, the FCC expanded the definition of "telecommunications carriers" to include facilities-based broadband internet access providers and Voice-over-Internet-Protocol ("VoIP") providers that interconnect with the public switched telephone network. As a result of this definition, our VoIP offerings are subject to CALEA, which has impacted our operations. Moreover, our Everyday Health Group business may be subject to additional government oversight or regulation by Congress, the FTC, the United States Food and Drug Administration ("FDA"), the U.S. Department of Health and Human Services and state legislatures and regulatory agencies. In addition, certain services provided by Everyday Health Group constituent businesses are also subject to private regulation both directly by accrediting bodies and indirectly by industry codes followed by commercial supporters and providers of continuing education programs for healthcare professionals. While we believe we are in compliance with the relevant laws and regulations, we could be subject to enforcement actions, fines, forfeitures, and other adverse actions. Any failure or perceived failure by us, our partners, our vendors, or third parties on which we rely for our operations could result in a significant liability to us (including in the form of judicial decisions and/or settlements, regulatory findings and/or forfeitures, and other means), cause considerable harm to us and our reputation (including requiring notification to customers, regulators, and/or the media), cause a loss of confidence in our products and services, and deter current and potential customers from using our services. Any of these events could have a material adverse effect on our business, prospects, financial condition, operating results, and cash flows.

Users access health-related content through our Everyday Health Group properties, including information regarding particular medical conditions, diagnosis and treatment, and possible adverse reactions or side effects from medications. If our content, or content we obtain from third parties, contains inaccuracies, it is possible that consumers or professionals who rely on that content or others may make claims against us with various causes of action. Although our properties contain terms and conditions, including disclaimers of liability, that are intended to reduce or eliminate our liability, third parties may claim that these online agreements are unenforceable. Our editorial and other quality control procedures may not be sufficient to ensure that there are no errors or omissions in our content offerings or to prevent such errors and omissions in content that is controlled by our partners. Even if potential claims do not result in liability to us, investigating and defending against these claims could be expensive and time-consuming and could divert management's attention away from our operations.

We are subject to income taxes in the United States (both federal and state) and in certain foreign jurisdictions. Due to economic and political conditions, tax rates in various jurisdictions may be subject to significant change, with or without notice. New tax laws, regulations and administrative practices could be enacted or adopted at any time, and existing tax laws, regulations and administrative practices could be interpreted, modified, or applied adversely to us, possibly with retroactive effect. These changes may adversely impact our effective tax rate and harm our financial position and results of operations. We are currently under or subject to examination by the U.S. Internal Revenue Service ("IRS") and other domestic and foreign tax authorities and government bodies for both direct and indirect taxes. We regularly assess the likelihood of adverse outcomes resulting from these examinations to determine the adequacy of our income tax and other tax reserves. If our reserves are not sufficient to cover these contingencies, such inadequacy could materially adversely affect our business, prospects, financial condition, operating results, and cash flows. In addition, due to the global nature of the internet, it is possible that various states or foreign countries might attempt to impose additional or new taxes, including digital services taxes, or regulations on our business. Tax authorities at the international, federal, state, and local levels are currently reviewing the appropriate treatment of companies engaged in e-commerce and online advertising. The application of existing, new, or revised taxes on our business would likely increase the cost of doing business online and decrease the attractiveness of selling products and advertising over the internet. The application of these taxes on our business could also create significant increases in internal costs necessary to capture data and collect and remit taxes. Any of these events could have a material adverse effect on our business, financial condition, and operating results. Furthermore, much of our Digital Media Businesses' e-commerce revenue comes from arrangements in which we are paid by retailers to promote their digital product and service offers on our sites. Certain states have implemented regulations that require retailers to collect and remit sales taxes on sales made to residents of such states if a publisher, such as us, that facilitated that sale is a resident of such state. Paid retailers in our marketplace that do not currently have a sales tax nexus in any state that subsequently passes similar regulations and in which we have operations, employees, or contractors now or in the future, may significantly alter the manner in which they pay us, cease paying us for sales we facilitate for that retailer in such state, or cease using our marketplace, each of which could adversely impact our business, financial condition, and operating results.

The use of consumer data is a topic of active interest among federal, state, and international regulatory bodies, as well as private parties, and the legal and regulatory environment is unsettled and evolving. Federal, state, and international laws and regulations govern the collection, use, retention, disclosure, sharing, and security of data that we receive from and about our users. Our privacy and cookie policies and practices concerning the collection, use, and disclosure of user data are posted on our websites. Certain business units within our Digital Media Businesses and Connectivity business collect and sell data about their users' online behavior, and the revenue associated with this activity could be impacted by government regulation and enforcement, industry trends, self-regulation, technology changes, consumer behavior and attitude, and private actions. We also use such information to work with our advertisers to more effectively target ads to relevant users and consumers, which ads command a higher rate. Many of our users voluntarily provide us with demographic and other information when they register for one of our services or properties. In order for our Everyday Health Group brands to deliver marketing and communications solutions to pharmaceutical and medical device companies, health insurers, hospital systems, and other customers, we rely on data provided by our users. We also purchase data from third-party sources to augment our user profiles and marketing databases so we are better able to personalize content, enhance our analytical capabilities and better target our marketing programs. If changes in user sentiment regarding the sharing of information results in a significant number of visitors to our websites and applications refusing to provide us with information such as demographic information, information about their specific health interests, or professional information, our ability to personalize content for our users and provide targeted marketing solutions would be impaired. If our users choose to opt-out of having their data used for behavioral targeting, it would be more difficult for us to offer targeted marketing programs to our customers. We append data from third-party sources to augment our user profiles. If we are unable to acquire data from third-party sources for whatever reason, if we are limited in use of such data, or if there is a marked increase in the cost of obtaining such data, our ability to personalize content and provide marketing solutions could be negatively impacted. Our use or sharing of certain data places us at risk for claims, whether or not the claims have merit, under a number of other laws, including but not limited to the VPPA and the CIPA. We and many other businesses have been sued and/or threatened with such claims. We cannot reliably predict the courts' or arbitrators' view of the theories asserted in the cases brought against us under the VPPA or CIPA and defending against them in court or in arbitration could substantially increase our legal costs and potential liability, and risk-mitigation measures to curb such claims could cause our revenues to decline and adversely affect our operating results. Numerous other countries have, or are developing, laws governing the collection, use and transmission of personal information. For example, we are subject to the GDPR which governs the collection and use of personal data in the European Union ("EU"), including by companies outside of the European Union. The GDPR harmonizes EU data privacy laws and contains significant obligations and requirements that have resulted in a greater compliance burden with respect to our operations and data use in Europe, which will continue to increase our costs. The GDPR, which is wide-ranging in scope, imposes several requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals, the security and confidentiality of the personal data, data breach notification, and the use of third-party processors in connection with the processing of the personal data. Individuals also have the right to compensation under the GDPR. The GDPR also prohibits data transfers from the EU to other countries outside of the EU, including the United States, without appropriate security safeguards and practices in place, creates mandatory breach notification requirements under certain circumstances, enhances enforcement authority and imposes large penalties for noncompliance. The UK has implemented data protection laws that are broadly equivalent to the GDPR, and many other jurisdictions have adopted GDPR-style privacy regimes that impose similarly stringent obligations. These laws can increase compliance costs, constrain our operations, and require changes to our products, processes and vendor arrangements. Non-compliance may result in investigations, corrective orders and material fines, as well as litigation and reputational harm. Additionally, on March 25, 2022, the U.S. and European Commission announced that they had agreed in principle to a new Trans-Atlantic Data Privacy Framework (the "TDPF") to enable trans-Atlantic data flows and address the concerns raised in the Schrems II decision (there are equivalent frameworks for transfers from the UK and Switzerland). To implement the commitments of the U.S. under the TDPF, in October 2022, President Biden signed an Executive Order on Enhancing Safeguards for the United States Signals Intelligence Activities (the Executive Order). This subsequently prompted the European Commission to formally launch the process to adopt an adequacy decision based on the Executive Order in December 2022, and the adequacy decision was adopted on July 10, 2023. The TDPF has been recognized as adequate under the E.U. to allow transfers of personal data from the E.U. to companies in the U.S. that have self-certified to the framework. However, the TDPF remains subject to legal challenges and could be invalidated by EU courts, which could increase compliance costs and could disrupt or restrict our cross-border data transfers. We have put into place various alternative frameworks and grounds on which to rely in order to be in compliance with relevant law for the transfer of data from overseas locations to the United States, including reviewing our data collection process and procedures and putting into place Data Processing Agreements that incorporate Standard Contractual Clauses as well as supplementary measures with vendors, partners and other third parties. Some independent data regulators have adopted the position that other forms of compliance are also invalid, though the legal grounds for these findings remain unclear at this time. We cannot predict at this time whether the alternative grounds that we continue to implement will be found to be consistent with relevant laws nor can we evaluate what, if any, potential liability may be at this time. The CCPA, in its original form and as amended under the CPRA, similarly contains significant obligations and requirements that have resulted in a greater compliance burden with respect to our operations and data usage of California residents, which will continue to increase our costs. The CCPA covers businesses that obtain or access personal information of California resident consumers, grants consumers enhanced privacy rights and control over their personal information and imposes significant requirements on covered companies with respect to consumer data privacy rights. The CCPA provides consumers with the right to opt out of the sale of their personal information including the requirement to include a "Do Not Sell" link on our websites and applications that sell personal data of California resident consumers. Individuals may have the right to file a class action under the CCPA in certain circumstances. In November 2020, California voters adopted the CPRA that amends the CCPA, including creating a new agency to implement and enforce the law and enhancing and strengthening regulatory requirements and individual protections under the CCPA. The CPRA took effect on January 1, 2023. As of January 19, 2026, other states have enacted, and more are considering similar privacy, data protection and information security laws, which may subject us to additional requirements and restrictions that could have an impact on our business, further complicating our privacy compliance obligations through the introduction of increasingly disparate requirements across the various U.S. jurisdictions in which we operate. Additionally, several states have enacted health-specific privacy laws or strengthened protection of health- and location-related data, and other states are considering similar legislation. Congress is considering legislation that may preempt some or all of such U.S. state privacy laws, but provide a more robust private right of action. In certain instances, we may be subject to enhanced privacy obligations based on the type of information we store and process. For instance, the Children's Online Privacy Protection Act ("COPPA") is intended to impose restrictions on the ability of online services to collect some types of information from children under the age of 13. Additionally, certain states have passed laws restricting the ability to offer services to minors without parental consent or otherwise limiting the services that we can provide to minors. In addition, the Providing Resources, Officers, and Technology to Eradicate Cyber Threats to Our Children Act of 2008 ("PROTECT Act") requires online service providers to report evidence of violations of federal child pornography laws under certain circumstances, as well as other federal, state or international laws and legislative efforts designed to protect children on the internet may impose additional requirements on us. U.S. export control laws and regulations impose requirements and restrictions on exports to certain nations and persons and on our business. New and expanding "Do Not Track" regulations have been enacted or proposed that protect users' right to choose whether or not to be tracked online. These regulations seek, among other things, to allow consumers to have greater control over the use of private information collected online, to forbid the collection or use of online information, to demand a business to comply with their choice to opt out of such collection or use, and to place limits upon the disclosure of information to third-party websites. Similarly, exercise of the "Do Not Sell" right under the CCPA and other state privacy laws limits a business' ability to monetize certain personal information collected online. Such laws and regulations could have a significant impact on the operation of our advertising and data businesses. U.S. regulatory agencies have also placed an increased focus on online privacy matters and, in particular, on online advertising activities that utilize cookies or other tracking tools. Consumer and industry groups have expressed concerns about online data collection and use by companies, which has resulted in the release of various industry self-regulatory codes of conduct and best practice guidelines that are binding for member companies and that govern, among other things, the ways in which companies can collect, use and disclose user information, how companies must give notice of these practices and what choices companies must provide to consumers regarding these practices. We may be required or otherwise choose to adopt Do Not Track mechanisms or self-regulation principles or provide opt-outs from the sale of certain user data, in which case our ability to use our existing tracking technologies, to collect and sell user behavioral data, and permit their use by other third parties could be impaired. This could cause our revenues to decline and adversely affect our operating results. Moreover, U.S. and foreign governments have enacted or considered or are considering legislation or regulations that could significantly restrict our ability to collect, augment, analyze, use, and share de-identified or anonymous data, which could increase our costs and reduce our revenue. Additionally, the EU Data Act may apply to our products and services and could require us to provide users (and, at their direction, third parties) with access to and portability of certain data. Compliance may require changes to our systems, APIs, access controls, security measures and support processes, which could increase costs and introduce new operational and cyber-security risks. The EU Data Act may also limit our ability to use and monetize data by reducing exclusivity over certain datasets, enabling customers and third parties to reuse data, including in competing offerings, and imposing prescriptive contractual and process requirements. These obligations could lead to disputes over scope, timing, security standards, trade secret protections, technical feasibility and commercial terms. Regulators may investigate and impose orders and penalties for non-compliance. Any of these factors could materially and adversely affect our business, financial condition and results of operations. While we work to comply with all applicable law and relevant "best practices" addressing cybersecurity, data, privacy, data security, consumer protection, and data protection, this is an area of the law that is constantly evolving as are the relevant industry codes and threat matrix. Further it is possible that applicable law and "best practices" are interpreted in an inconsistent or conflicting manner either by differing federal, state or international authorities or across the jurisdictions in which we operate. Some privacy laws are currently being challenged and litigation in this space could impact the privacy rights of our community, including modifying the ability of third parties to obtain private communications between users, which in turn may negatively impact users' experience, trust, and satisfaction and decrease their engagement with our products. Further, failure or perceived failure by us to comply with our policies, applicable laws and regulatory requirements, or industry self-regulatory principles related to the collection, use, sharing, or security of personal information, or other privacy, data, data-retention or data­ protection matters could result in a loss of user confidence in us, damage to our brands, and ultimately in a loss of users and advertising partners, which could adversely affect our business. Changes in these or any other laws and regulations or the interpretation of them could increase our future compliance costs, limit the amount and type of data we can collect, transfer, share, or sell, make our products and services less attractive to our users, or cause us to change or limit our business practices. Further, any failure on our part to comply with any relevant laws or regulations may subject us to significant civil or criminal liabilities.

The industries in which we operate are subject to rapid and significant technological change. We cannot predict the effect of technological changes on our business. We expect that new services and technologies will emerge in the markets in which we compete. These new services and technologies may be superior to the services and technologies that we use or these new services may render our services and technologies obsolete. Our future success will depend, in part, on our ability to anticipate and adapt to technological changes and evolving industry standards, including for example with respect to the use of AI. We may be unable to obtain access to new technologies on acceptable terms or at all and may therefore be unable to offer services in a competitive manner. Any of the foregoing risks could have a material adverse effect on our business, prospects, financial condition, operating results, and cash flows.

Our operations are dependent on our network being free from material interruption by damage from fire, earthquake, or other natural disaster, power loss, telecommunications failure, unauthorized entry, computer viruses, cyber-attacks, or any other events beyond our control. Similarly, the operations of our partners and other third parties with which we work are also susceptible to the same risks. There can be no assurance that our existing and planned precautions of backup systems, regular data backups, security protocols, and other procedures will be adequate to prevent significant damage, system failure or data loss, and the same is true for our partners, vendors, and other third parties on which we rely. These precautions may change over time as laws and regulations regarding data privacy, security, and protection of information change.

Our business is dependent on the ability of our customers and visitors to our online properties to access our services and applications over broadband internet connections. Internet access providers and internet backbone providers may be able to block, degrade, or charge for access or bandwidth use of certain of our products and services, which could lead to additional expenses and the loss of users. Our products and services depend on the ability of our users to access the internet. Use of our services and applications through mobile devices, such as smartphones and tablets, must have a high-speed data connection. Broadband internet access services, whether wireless or landline, are provided by companies with significant market power. Many of these providers offer products and services that directly compete with ours. Many of the largest providers of broadband services have publicly stated that they will not degrade or disrupt their customers' use of applications and services, like ours. If such providers were to degrade, impair, or block our services, it would negatively impact our ability to provide services to our customers and likely result in lost revenue and profits, and we would incur legal fees in attempting to restore our users' access to our services. Broadband internet access providers may also attempt to charge us or our customers additional fees to access services like ours that may result in the loss of customers and revenue, decreased profitability, or increased costs to our retail offerings that may make our services less competitive.

In most cases, our agreements with advertisers have a term of one year or less and may be terminated at any time by the advertiser or by us without penalty. We believe that advertising on the internet, as in traditional media, fluctuates significantly as a result of a variety of factors, many of which are outside of our control. Some of these factors include (a) budget constraints of our advertisers, (b) cancellations or delays of projects by our advertisers due to numerous factors, including but not limited to, supply chain issues and any significant changes to free trade agreements, trade protection measures, tariffs and other trade regulations, laws, and policies, (c) the cyclical and discretionary nature of advertising spending, (d) general economic, internet-related, and media industry conditions, (e) tax, tariffs, and other legislation and regulation, as well as (f) extraordinary events, such as war, acts of terrorism or aggression, extreme weather events including as exacerbated by climate change, and pandemics or other public health crises. The state of the global economy and availability of capital has impacted and could further impact the advertising spending patterns of existing and potential advertisers. Continued reduction in spending by, or loss of, existing or potential advertisers would negatively impact our revenue and operating results. Further, we may be unable to adjust our expenses and capital expenditures quickly enough to compensate for any unexpected revenue shortfall.

A portion of our display revenue comes from advertisers that pay for advertising on a price-per-click basis, meaning that the advertisers pay a fee every time a user clicks on their advertising. This pricing model can be vulnerable to so-called "click fraud", which occurs when clicks are submitted on ads by a user who is motivated by reasons other than genuine interest in the subject of the ad. A portion of our display revenue also comes from advertisers that pay for advertising on the bases of price-per-impression, price-per-visit or price-per-engagement. These pricing models can also be vulnerable to fraud known variously as "invalid traffic" or "non-human traffic", which occurs when the impression, visit or engagement is generated for reasons other than genuine interest in the subject of the ad. We or our third-party service providers may be exposed to the risk of click fraud, invalid traffic or other clicks, actions or conversions that advertisers may perceive as undesirable. If fraudulent or other malicious activity is perpetrated by others and we or our third-party service providers are unable to detect and prevent it, or choose to manage traffic quality in a way that advertisers find unsatisfactory, the affected advertisers may experience or perceive a reduced return on their investment in our advertising programs which could lead the advertisers to become dissatisfied with our advertising programs and they might refuse to pay, demand refunds, or withdraw future business. Undetected click fraud could damage our brands and lead to a loss of advertisers and revenue. We obtain third-party certification that certain of our products apply "best practices" to detect and prevent click fraud. If we are unable to maintain such certification, advertisers might refuse to pay, demand refunds, and withdraw future business, and our business reputation might be harmed.