TWILIO INC

Previous wording

•any breaches of our networks or systems, or those of Amazon Web Services (“AWS”) or our service providers;

Current wording

•any breaches of or incidents impacting our networks or systems, or those of our third-party service providers;

Previous wording

As a result of the reductions in force, we have incurred, and may continue to incur, additional costs in the short term, including cash expenditures for employee transitions, notice period and severance payments, employee benefits and related facilitation costs, as well as non-cash expenditures related to vesting of share-based awards. These additional cash and non-cash expenditures could have the effect of reducing our operating margins. Our reductions in force may result in unintended consequences, including employee attrition beyond our intended reduction in force; damage to our corporate culture and decreased employee morale among our remaining employees; diversion of management attention; damage to our reputation as an employer, which could make it more difficult for us to hire new employees in the future; and the loss of institutional knowledge and expertise of departing employees. If we experience any of these adverse consequences, our reductions in force and other restructuring efforts may not achieve or sustain their intended benefits, or the benefits, even if achieved, may not be adequate to meet our long-term profitability and operational expectations, which could adversely affect our business, results of operations and financial condition. In addition, our reductions in force and other restructuring efforts could lead us to fail to meet, or cause delays in meeting, our operational and growth targets. While positions have been eliminated, functions that they performed remain necessary to our operations, and we may be unsuccessful in effectively and efficiently distributing the duties and obligations of departed employees among our remaining employees. The reduction in our workforce could also prevent us from pursuing new opportunities and initiatives or require us to adjust our growth strategy. As part of our reductions in force, we have reduced the size of our sales force to drive further efficiencies in our sales operations. With a smaller workforce, we are relying more heavily on our self-service model to drive sales of our Communications products to customers that do not require direct account coverage. Our self-service capabilities may not be as successful as we anticipate, and similarly, our efforts to accelerate Segment sales may not be effective or may take longer than we expect to drive growth. If we experience any of these adverse consequences, our reductions in force and other restructuring efforts may not achieve or sustain their intended benefits, or the benefits, even if achieved, may not be adequate to meet our long-term profitability and operational expectations, which could adversely affect our business, results of operations and financial condition.

Current wording

As a result of the reductions in force, we have incurred, and may continue to incur, additional costs in the short term, including cash expenditures for employee transitions, notice period and severance payments, employee benefits and related facilitation costs, as well as non-cash expenditures related to vesting of share-based awards. These additional cash and non-cash expenditures could have the effect of reducing our operating margins. Our reductions in force may result in unintended consequences, including employee attrition beyond our intended reduction in force; damage to our corporate culture and decreased employee morale among our remaining employees; diversion of management attention; damage to our reputation as an employer, which could make it more difficult for us to hire new employees in the future; and the loss of institutional knowledge and expertise of departing employees. If we experience any of these adverse consequences, our reductions in force and other restructuring efforts may not achieve or sustain their intended benefits, or the benefits, even if achieved, may not be adequate to meet our profitability and operational expectations, which could adversely affect our business, results of operations and financial condition. In addition, our reductions in force and other restructuring efforts could lead us to fail to meet, or cause delays in meeting, our operational and growth targets. While positions have been eliminated, functions that they performed remain necessary to our operations, and we may be unsuccessful in effectively and efficiently distributing the duties and obligations of departed employees among our remaining employees. The reduction in our workforce could also prevent us from pursuing new opportunities and initiatives or require us to adjust our growth strategy. As part of our reductions in force, we have reduced the size of our sales force to drive further efficiencies in our sales operations. With a smaller workforce, we are relying more heavily on our self-service model to drive sales of our Communications products to customers that do not require direct account coverage. Our self-service capabilities may not be as successful as we anticipate, and similarly, our efforts to accelerate Segment sales may not be effective or may take longer than we expect to drive growth. If we experience any of these adverse consequences, our reductions in force and other restructuring efforts may not achieve or sustain their intended benefits, or the benefits, even if achieved, may not be adequate to meet our profitability and operational expectations, which could adversely affect our business, results of operations and financial condition.

Previous wording

As we seek to increase the adoption of our products by enterprises, including Segment and Engage, which are primarily aimed at complex customer data platform implementations at larger companies, we expect to incur higher costs and longer sales cycles. In the enterprise market segment, the decision to adopt our products may require the approval of multiple technical and business decision makers, including legal, security, compliance, procurement, operations and information technology (“IT”). In addition, while enterprise customers may quickly deploy our products on a limited basis, before they will commit to deploying our products at scale, they often require extensive education about our products and significant customer support time and also engage in protracted pricing and contract negotiations, which may be exacerbated by changing inflationary pressure and reduced IT budgets and may result in higher costs and longer sales cycles. In addition, sales cycles for enterprises are inherently more complex and less predictable than the sales through our self-service model, and some enterprise customers may not use our products enough to generate revenue that justifies the cost to obtain such customers. These complex and resource-intensive sales efforts could place additional strain on our product and engineering resources. Further, enterprises, including some of our existing customers, may choose to develop their own solutions that do not include our products. They may also demand reductions in pricing as their usage of our products increases, notwithstanding increased costs incurred by us to provide such products, which could have an adverse impact on our gross margin. Additionally, we have experienced, and may continue to experience, certain of our customers failing to renew their contracts with us, reducing or limiting their contract values, and engaging in longer sales cycles as these customers focus on general cost reductions in the face of macroeconomic uncertainty. As a result of our limited experience selling and marketing to enterprises, our efforts to sell to these potential customers may not be successful. If we are unable to increase the revenue that we derive from enterprises, then our business, results of operations and financial condition may be adversely affected.

Current wording

As we seek to increase the adoption of our products by enterprises, including our Segment product, which is primarily aimed at complex customer data platform implementations at larger companies, we expect to incur higher costs and longer sales cycles. In the enterprise market segment, the decision to adopt our products may require the approval of multiple technical and business decision makers, including legal, security, compliance, procurement, operations and information technology (“IT”). In addition, while enterprise customers may quickly deploy our products on a limited basis, before they will commit to deploying our products at scale, they often require extensive education about our products and significant customer support time and also engage in protracted pricing and contract negotiations, which may be exacerbated by changing inflationary pressure and reduced IT budgets and may result in higher costs and longer sales cycles. In addition, sales cycles for enterprises are inherently more complex and less predictable than the sales through our self-service model, and some enterprise customers may not use our products enough to generate revenue that justifies the cost to obtain such customers. These complex and resource-intensive sales efforts could place additional strain on our product and engineering resources. Further, enterprises, including some of our existing customers, may choose to develop their own solutions that do not include our products. They may also demand reductions in pricing as their usage of our products increases, notwithstanding increased costs incurred by us to provide such products, which could have an adverse impact on our gross margin. Additionally, we have experienced, and may continue to experience, certain of our customers failing to renew their contracts with us, reducing or limiting their contract values, and engaging in longer sales cycles as these customers focus on general cost reductions in the face of macroeconomic uncertainty. As a result of our limited experience selling and marketing to enterprises, our efforts to sell to these potential customers may not be successful. If we are unable to increase the revenue that we derive from enterprises, then our business, results of operations and financial condition may be adversely affected.

Previous wording

If we are unable to successfully and cost-effectively increase adoption and usage of our existing products, develop and drive adoption of new products, maintain integrations with third-party products, or anticipate and keep pace with changes in technology, customers’ needs, customers’ expectations, and industry standards, our business, results of operations and financial condition would be adversely affected.

Current wording

If we are unable to successfully and cost-effectively increase adoption and usage of our existing products, develop and drive adoption of new products, maintain integrations with third-party products, or anticipate and keep pace with changes in technology, customers’ needs and expectations, and industry standards, our business, results of operations and financial condition would be adversely affected.

Previous wording

We have incurred net losses in each year since our inception, including net losses of $55.3 million, $1.0 billion and $1.3 billion in the three months ended March 31, 2024 and the years ended December 31, 2023 and 2022, respectively. We had an accumulated deficit of $5.5 billion as of March 31, 2024. We will need to generate and sustain increased revenue levels, and manage our operating expenses, in future periods to become profitable and achieve our stated profitability goals and, even if we do, we may not be able to maintain or increase our level of profitability. We expect to continue to expend substantial financial and other resources on, among other things: investments in our engineering team; improvements in security and data protection; the development of new products, features and functionality and enhancements to our platform; sales and marketing; expansion of our operations and infrastructure, both domestically and internationally; and general administration, including legal, accounting and other expenses related to being a public company. Our efforts to grow our business may be more costly than we expect, and we may not be able to increase our revenue enough to offset our associated operating expenses. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, or if we incur significant losses, the value of our business and common stock may significantly decrease.

Current wording

We have incurred net losses in each year since our inception, including net losses of $87.2 million, $1.0 billion and $1.3 billion in the six months ended June 30, 2024 and the years ended December 31, 2023 and 2022, respectively. We had an accumulated deficit of $6.4 billion as of June 30, 2024. We will need to generate and sustain increased revenue levels, and manage our operating expenses, in future periods to become profitable and achieve our stated profitability goals and, even if we do, we may not be able to maintain or increase our level of profitability. We expect to continue to expend substantial financial and other resources on, among other things: investments in our engineering team; improvements in security and data protection; the development of new products, features and functionality and enhancements to our platform; sales and marketing; expansion of our operations and infrastructure, both domestically and internationally; and general administration, including legal, accounting and other expenses related to being a public company. Our efforts to grow our business may be more costly than we expect, and we may not be able to increase our revenue enough to offset our associated operating expenses. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, or if we incur significant losses, the value of our business and common stock may significantly decrease.

Previous wording

Additionally, loss of services of senior management or other key employees could significantly delay or prevent the achievement of our development and strategic objectives. In January 2024, our co-founder, Jeff Lawson, resigned as Chief Executive Officer and as a member of our board of directors, and Khozema Shipchandler, our former President, Twilio Communications, was appointed as Chief Executive Officer and as a member of our board of directors. We will incur various expenses in connection with the transition and we may face challenges in connection with the transition, such as potential changes to our strategy, corporate culture, and other changes in our management structure or roles. Any of our executive officers may terminate employment with us at any time with no advance notice. We have experienced, and may continue to experience, high attrition among our senior management team and key employees. The replacement of any of our senior management or other key employees will involve significant time and costs, and any loss of services of any such key employee for any reason could significantly delay or prevent the achievement of our business objectives and could adversely affect our business, results of operations and financial condition.

Current wording

Additionally, loss of services of senior management or other key employees could significantly delay or prevent the achievement of our development and strategic objectives. In January 2024, our co-founder, Jeff Lawson, resigned as Chief Executive Officer and as a member of our board of directors, and Khozema Shipchandler, our former President, Twilio Communications, was appointed as Chief Executive Officer and as a member of our board of directors. We have incurred various expenses in connection with the transition and we may face challenges in connection with the transition, such as potential changes to our strategy, corporate culture, and other changes in our management structure or roles. Any of our executive officers may terminate employment with us at any time with no advance notice. We have experienced, and may continue to experience, high attrition among our senior management team and key employees. The replacement of any of our senior management or other key employees will involve significant time and costs, and any loss of services of any such key employee for any reason could significantly delay or prevent the achievement of our business objectives and could adversely affect our business, results of operations and financial condition.

Previous wording

The labor market for our business is subject to external factors that are beyond our control, including our industry’s highly competitive market for skilled workers and leaders. We must provide competitive compensation packages and a high-quality work environment to hire, retain and motivate employees. Volatility in, or the actual or perceived lack of performance of, our stock price may affect our ability to attract, motivate and retain key employees. In September 2022, February 2023 and December 2023, we implemented reductions in force, which may have an impact on our ability to hire, retain and motivate employees. If we are unable to retain and motivate our existing employees and attract qualified employees to fill key positions, we may be unable to manage our business effectively, including the development, marketing and sale of our products, which could adversely affect our business, results of operations and financial condition.

Current wording

The labor market for our business is subject to external factors that are beyond our control, including our industry’s highly competitive market for skilled workers and leaders. We must provide competitive compensation packages and a high-quality work environment to hire, retain and motivate employees. Volatility in, or the actual or perceived lack of performance of, our stock price may affect our ability to attract, motivate and retain key employees. We have also implemented reductions in force, which may have an impact on our ability to hire, retain and motivate employees. If we are unable to retain and motivate our existing employees and attract qualified employees to fill key positions, we may be unable to manage our business effectively, including the development, marketing and sale of our products, which could adversely affect our business, results of operations and financial condition.

Previous wording

To deliver our products, we rely on network service providers and internet service providers for our network service and connectivity, and disruption or deterioration in the quality of these services or changes in network service provider fees that we pay in connection with the delivery of communications on our platform could adversely affect our business, results of operations and financial condition.

Current wording

To deliver our products, we rely on network service providers and internet service providers for our network service and connectivity, and disruption or deterioration in the quality of these services or changes in provider fees that we pay in connection with the delivery of communications on our platform could adversely affect our business, results of operations and financial condition.

Previous wording

Furthermore, many of these network service providers do not have long-term committed contracts with us and may interrupt services or terminate their agreements with us without notice. If a significant portion of our network service providers stop providing us with access to their infrastructure, fail to provide these services to us on a cost-effective basis, cease operations, or otherwise terminate these services, the delay caused by qualifying and switching to other network service providers could be time consuming and costly and could adversely affect our business, results of operations and financial condition. Further, if problems occur with our network service providers, it may cause errors, service outages, or poor-quality communications on our products, and we could encounter difficulty identifying the source of the problem. The occurrence of errors, service outages, or poor-quality communications on our products, whether caused by our platform or a network service provider, may result in the loss of our existing customers or the delay of adoption of our products by potential customers and may adversely affect our business, results of operations and financial condition.

Current wording

Furthermore, many of these network service providers do not have long-term committed contracts with us and may interrupt services or terminate their agreements with us without notice. If a significant portion of our network service providers stop providing us with access to their infrastructure, fail to provide these services to us on a cost-effective basis, cease operations, or otherwise terminate these services, the delay caused by qualifying and switching to other network service providers could be time consuming and costly and could adversely affect our business, results of operations and financial condition. Further, if problems occur with our network service providers, such problems have in the past caused, and may in the future cause, errors, service outages, security incidents, or poor-quality communications on our products, and we could encounter difficulty identifying the source of the problem. The occurrence of errors, service outages, security incidents, or poor-quality communications on our products, whether caused by our platform or a network service provider, may result in the loss of our existing customers or the delay of adoption of our products by potential customers and may adversely affect our business, results of operations and financial condition.

Previous wording

In each of the three months ended March 31, 2024 and the years ended December 31, 2023 and 2022, we derived 34% of our revenue from customer accounts located outside the United States. The future success of our business will depend, in part, on our ability to strategically maintain and expand our customer base worldwide. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic and political risks in addition to those we face in the United States.

Current wording

In the six months ended June 30, 2024 and the years ended December 31, 2023 and 2022, we derived 35%, 34% and 34% of our revenue from customer accounts located outside the United States, respectively. The future success of our business will depend, in part, on our ability to strategically maintain and expand our customer base worldwide. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic and political risks in addition to those we face in the United States.

Previous wording

In the three months ended March 31, 2024 and the years ended December 31, 2023 and 2022, our 10 largest Active Customer Accounts generated an aggregate of 10%, 10% and 12% of our revenue, respectively. If any of these customers, or other large customers, do not continue to use our products, use fewer of our products, or use our products in a more limited capacity, or not at all, our business, results of operations and financial condition could be adversely affected. Additionally, the usage of our products by customers that do not have long-term contracts with us may change between periods. Those with no long-term contract with us may reduce or fully terminate their usage of our products at any time without notice, penalty or termination charges, which may adversely impact our results of operations.

Current wording

In the six months ended June 30, 2024 and the years ended December 31, 2023 and 2022, our 10 largest Active Customer Accounts generated an aggregate of 10%, 10% and 12% of our revenue, respectively. If any of these customers, or other large customers, do not continue to use our products, use fewer of our products, or use our products in a more limited capacity, or not at all, our business, results of operations and financial condition could be adversely affected. Additionally, the usage of our products by customers that do not have long-term contracts with us may change between periods. Those with no long-term contract with us may reduce or fully terminate their usage of our products at any time without notice, penalty or termination charges, which may adversely impact our results of operations.

Previous wording

From time to time we may also divest or stop investing in certain businesses or products. For example, in the second quarter of 2023, we sold our Internet of Things assets and liabilities, and in the third quarter of 2023, we sold our ValueFirst business. The sale of a business or product may require us to restructure operations and/or terminate employees, and could expose us to unanticipated ongoing obligations and liabilities, including as a result of our indemnification obligations. Additionally, such transactions could disrupt our customer, supplier and/or employee relationships and divert management and our employees’ time and attention. During the pendency of a divestiture, we may be subject to risks related to a decline in the business, loss of employees, customers, or suppliers, and that the transaction may not close, which could have an adverse effect on the business to be divested and on us. Additionally, we may experience harm to our financial results, including loss of revenue, and we may not realize the expected benefits and cost savings of these actions and our operating results may be adversely impacted.

Current wording

From time to time we may also divest or stop investing in certain businesses or products. For example, in the second quarter of 2023, we sold our Internet of Things assets and liabilities, and in the third quarter of 2023, we sold our ValueFirst business. The sale of a business or product has in the past and may in the future require us to restructure operations and/or terminate employees, and could expose us to unanticipated ongoing obligations and liabilities, including as a result of our indemnification obligations. During the pendency of a divestiture, we may be subject to risks related to a decline in the business, loss of employees, customers, or suppliers, and that the transaction may not close, which could have an adverse effect on the business to be divested and on us. Additionally, we are winding down the software component of our Zipwhip business in 2024, which we expect will negatively impact revenue growth rates in 2024. Divestitures or winding down businesses or products could disrupt our customer, supplier and/or employee relationships and divert the time and attention of our management and employees. Additionally, we may experience harm to our financial results, including loss of revenue, and we may not realize the expected benefits and cost savings of these actions and our operating results may be adversely impacted.

Previous wording

Breaches of or incidents impacting our networks or systems, or those of AWS or our service providers, could degrade our ability to conduct our business, compromise the integrity of our products, platform and data, result in significant loss or unavailability of data and the theft of our intellectual property, damage our reputation, expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data.

Current wording

Breaches of or incidents impacting our networks or systems, or those of our third-party service providers, could degrade our ability to conduct our business, compromise the integrity of our products, platform and data, result in significant loss or unavailability of data and the theft of our intellectual property, damage our reputation, expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data.

Previous wording

We depend upon our IT systems to conduct virtually all of our business operations, ranging from our internal operations and research and development activities to our marketing and sales efforts and communications with our customers and business partners. We have in the past and may in the future be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss or unavailability of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, natural disasters, and other similar threats.

Current wording

We depend upon our IT systems to conduct virtually all of our business operations, ranging from our internal operations and research and development activities to our marketing and sales efforts and communications with our customers and business partners. We have in the past and will in the future be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel or service provider misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss or unavailability of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, natural disasters, and other similar threats.

Previous wording

Individuals or entities may attempt to penetrate the security of our platform, or of our network or systems, and to cause harm to our business operations, including by misappropriating our proprietary information or that of our customers, employees and business partners or to cause interruptions of our products and platform. In particular, cyberattacks and other malicious internet-based activity continue to increase in frequency and in magnitude generally, and cloud-based companies have been targeted in the past. In addition to threats from traditional computer hackers, malicious code, software vulnerabilities, supply chain attacks and vulnerabilities through our third-party partners, employees theft or misuse, password spraying, phishing, smishing, vishing, credential stuffing and denial-of-service attacks, we also face threats from sophisticated organized crime, nation-state, and nation-state supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risk to our systems (including those hosted on AWS or other cloud services), internal networks, our customers’ systems and the information that they store and process. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate or reduce the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Because the techniques used to access, disrupt or sabotage devices, systems and networks change frequently and may not be recognized until launched against a target, we may be required to make further investments over time to protect data and infrastructure as cybersecurity threats develop, evolve and grow more complex over time. We may also be unable to anticipate these techniques, and we may not become aware in a timely manner of any security breach or incident, which could exacerbate any damage we experience.

Current wording

Individuals or entities have in the past attempted and will in the future attempt to penetrate the security of our platform, or of our network or systems, and to cause harm to our business operations, including by misappropriating our proprietary information or that of our customers, employees and business partners or to cause interruptions of our products and platform. In particular, cyberattacks and other malicious internet-based activity continue to increase in frequency and in magnitude generally, and cloud-based companies have been targeted in the past. In addition to threats from traditional computer hackers, malicious code, software vulnerabilities, supply chain attacks and vulnerabilities through our third-party partners, employees theft or misuse, password spraying, phishing, smishing, vishing, credential stuffing and denial-of-service attacks, we also face threats from sophisticated organized crime, nation-state, and nation-state supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risk to our systems (including those hosted on cloud services), internal networks, our customers’ systems, our service providers’ networks, and the information that they store and process. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate or reduce the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Because the techniques used to access, disrupt or sabotage devices, systems and networks change frequently and may not be recognized until launched against a target, we expect to be required to make further investments over time to protect data and infrastructure as cybersecurity threats develop, evolve and grow more complex over time. We may also be unable to anticipate these techniques, and we may not become aware in a timely manner of any security breach or incident, which could exacerbate any damage we experience.

Previous wording

Additionally, we depend upon our employees and contractors to appropriately handle confidential and sensitive data, including customer data, and to deploy our IT resources in a safe and secure manner that does not expose our network systems to security breaches or incidents or the loss, alteration, unavailability, or other unauthorized processing of data. We have been and expect to be subject to cybersecurity threats and incidents, including denial-of-service attacks, employee errors or individual attempts to gain unauthorized access to information systems. We also continue to incorporate AI solutions and features into our platform, which may result in security incidents or otherwise increase cybersecurity risks. Further, AI technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents. Any data security incidents, including internal malfeasance or inadvertent disclosures by our employees or a third party’s fraudulent inducement of our employees to disclose information, unauthorized access or usage, the introduction of viruses or other malicious code or any other breach or incident or disruption of our platform, systems, or networks or those of our service providers, such as AWS, could result in loss, corruption, unavailability, or other unauthorized processing of confidential information, and any such event, or the perception that it has occurred, may result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigations, fines, penalties and other liabilities. For example, in June and August 2022, we became aware that threat actors had conducted sophisticated social engineering campaigns against some of our employees after having obtained employee names and cell phone numbers from unknown sources. The attack identified in August, which involved smishing text messages that purported to be from our IT department, resulted in the threat actor obtaining some of our employees’ credentials and access to certain data of approximately 209 customers out of our total customer base of approximately 270,000 at that time. We notified and worked with our affected customers. We also notified appropriate regulators and addressed their questions about the incident. We also took steps to remediate the incident, including enhancing our security training, improving our two factor authentication requirements, implementing additional layers of control within our VPN, reducing access to certain internal applications and tools, and increasing the refresh frequency for access to certain internal applications. Industry reports indicate that the threat actors also attacked other technology, telecommunication and cryptocurrency companies.

Current wording

We depend upon our employees and contractors to appropriately handle confidential and sensitive data, including customer data, and to deploy our IT resources in a safe and secure manner that does not expose our network systems to security breaches or incidents or the loss, alteration, unavailability, or other unauthorized processing of data. We have been and expect to be subject to cybersecurity threats and incidents, including denial-of-service attacks, employee errors or individual attempts to gain unauthorized access to information systems. We also continue to incorporate AI solutions and features into our platform, which may result in security incidents or otherwise increase cybersecurity risks. Further, AI technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents. Any data security incidents, including internal malfeasance or inadvertent disclosures by our employees or a third-party’s fraudulent inducement of our employees to disclose information, unauthorized access or usage, the introduction of viruses or other malicious code or any other breach or incident or disruption of our platform, systems, or networks or those of our service providers, could result in loss, corruption, unavailability, or other unauthorized processing of confidential information, and any such event, or the perception that it has occurred, may result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigations, fines, penalties and other liabilities. For example, in June and August 2022, we became aware that threat actors had conducted sophisticated social engineering campaigns against some of our employees after having obtained employee names and cell phone numbers from unknown sources. The attack identified in August 2022, which involved smishing text messages that purported to be from our IT department, resulted in the threat actor obtaining some of our employees’ credentials and access to certain data of approximately 209 customers out of our total customer base of approximately 270,000 at that time. We notified and worked with our affected customers. We also notified appropriate regulators and addressed their questions about the incident. We also took steps to remediate the incident, including enhancing our security training, improving our two factor authentication requirements, implementing additional layers of control within our VPN, reducing access to certain internal applications and tools, and increasing the refresh frequency for access to certain internal applications. Industry reports indicate that the threat actors also attacked other technology, telecommunication and cryptocurrency companies.

Previous wording

Furthermore, we are required to comply with laws and regulations that require us to maintain the security of personal information and we may have contractual and other legal obligations to notify customers, regulators, government agencies, impacted individuals or other relevant stakeholders of security breaches. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions and other actions or proceedings (for example, investigations, audits, and inspections), and related fines, penalties, required remedial actions, or other obligations and liabilities; additional reporting requirements and/or oversight; restrictions on processing or transferring data (including personal data); claims, demands, and litigation (including class claims); indemnification obligations; monetary fund diversions; interruptions in our operations (including availability of data); financial loss and other similar harms. Actual and perceived security incidents and attendant consequences could also lead to negative publicity and reputational harm, may cause our customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or mitigate the security incident. Accordingly, if our cybersecurity measures or those of AWS or our service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyberattacks), or if our employees or contractors compromise or mishandle data, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected.

Current wording

Furthermore, we are required to comply with laws and regulations that require us to maintain the security of personal information and we may have contractual and other legal obligations to notify customers, regulators, government agencies, impacted individuals or other relevant stakeholders of security breaches. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. Consequences associated with such security incidents may include: government enforcement actions and other actions or proceedings (for example, investigations, audits, and inspections), and related fines, penalties, required remedial actions, or other obligations and liabilities; additional reporting requirements and/or oversight; restrictions on processing or transferring data (including personal data); claims, demands, and litigation (including class claims); indemnification obligations; monetary fund diversions; interruptions in our operations (including availability of data); financial loss and other similar harms. Actual and perceived security incidents and attendant consequences could also lead to negative publicity and reputational harm, may cause our customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or mitigate the security incident. Accordingly, if our cybersecurity measures or those of our service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyberattacks), or if our employees or contractors compromise or mishandle data, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected.

Previous wording

The CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies. These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents (both consumers and employees) certain rights related to their personal information. The CCPA allows for statutory fines for noncompliance. Similar laws have been enacted or been proposed at the state and federal levels. For example, Connecticut, Utah, Virginia and Colorado have each passed laws similar to but different from the CCPA that took effect in 2023; Florida, Montana, Oregon and Texas have enacted similar legislation that becomes effective in 2024; Tennessee, Delaware, New Jersey and Iowa have passed such a law that will take effect in 2025; and Indiana has enacted similar legislation that will become effective in 2026. If we become subject to new privacy, data protection and data security laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase, including individuals, via a private right of action, and state actors.

Current wording

California residents (both consumers and employees) certain rights related to their personal information. The CCPA allows for statutory fines for noncompliance. Similar laws have been enacted in 18 other states with 6 laws currently in effect and the remainder becoming effective later in 2024, 2025 and 2026, respectively. Numerous other states, and the U.S. federal government, also have proposed general privacy legislation recently. Additionally, other states have proposed, and in certain cases enacted, other laws and regulations addressing privacy and data security, such as Washington’s My Health, My Data Act, which includes a private right of action. If we become subject to new privacy, data protection and data security laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase, including individuals, via a private right of action, and state actors.

Previous wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and data security. For example, the GDPR, the United Kingdom’s Data Protection Act 2018 (“UK GDPR”) and the new Swiss Federal Act on Data Protection, impose strict requirements for processing the personal information of individuals protected by the legislation, whether their data is processed within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”). For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data re-usage, data retention, security of processing and international data transfers. Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data processing or data transfers, require a company to delete data, as well as impose significant fines, potentially ranging up to 20 million Euros under the GDPR, 17.5 million GBP under the UK GDPR, or 4% of a company’s worldwide revenue, whichever is higher. Further, individuals may initiate compensation claims or litigation related to our processing of their personal information. Other privacy laws in Europe impose strict requirements around marketing communications and the deployment of cookies on users’ devices. As another example, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the GDPR. Additionally, we expect an increase in the regulation of the use of AI and ML in products and services. For example, in Europe, the proposed Artificial Intelligence Act (“AI Act”), once adopted, could impose onerous obligations related to the development, placing on the market and use of AI-related systems. We may have to change our business practices to comply with obligations under these or other new and evolving regimes.

Current wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and data security. For example, the GDPR, the United Kingdom’s Data Protection Act 2018 (“UK GDPR”) and the new Swiss Federal Act on Data Protection, impose strict requirements for processing the personal information of individuals protected by the legislation, whether their data is processed within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”). For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data re-usage, data retention, security of processing and international data transfers. Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data processing or data transfers, require a company to delete data, as well as impose significant fines, potentially ranging up to 20 million Euros under the GDPR, 17.5 million GBP under the UK GDPR, or 4% of a company’s worldwide revenue, whichever is higher. Further, individuals may initiate compensation claims or litigation related to our processing of their personal information. Other privacy laws in Europe impose strict requirements around marketing communications and the deployment of cookies on users’ devices. As another example, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the GDPR. Additionally, we expect an increase in the regulation of the use of AI and ML in products and services. For example, in Europe, the Artificial Intelligence Act (“AI Act”), once adopted, will impose onerous obligations related to the development, placing on the market and use of AI-related systems. We may have to change our business practices to comply with obligations under these or other new and evolving regimes.

Previous wording

Further, the interpretation and application of new domestic and foreign laws and regulations in many cases is uncertain, and our legal and regulatory obligations in such jurisdictions are subject to frequent and unexpected changes, including the potential for various regulatory or other governmental bodies to enact new or additional laws or regulations, to issue rulings that invalidate prior laws or regulations, or to increase penalties significantly. For example, the EU’s Digital Services Act, Digital Markets Act and Data Act recently entered into force. Also, the UK Parliament is currently debating the Data Protection and Digital Information (No. 2) Bill which, if enacted, will introduce certain changes to the UK’s data protection laws.

Current wording

Further, the interpretation and application of new domestic and foreign laws and regulations in many cases is uncertain, and our legal and regulatory obligations in such jurisdictions are subject to frequent and unexpected changes, including the potential for various regulatory or other governmental bodies to enact new or additional laws or regulations, to issue rulings that invalidate prior laws or regulations, or to increase penalties significantly. For example, the EU’s Digital Services Act, Digital Markets Act and Data Act recently entered into force. Also, the UK Parliament’s on-going debate of the Data Protection and Digital Information (No. 2) Bill which, if enacted, will introduce certain changes to the UK’s data protection laws.

Previous wording

As a cumulative example of these risks, because our primary data processing facilities are in the United States, we have experienced hesitancy, reluctance, or refusal by European or multinational customers to continue to use our services due to the potential risks posed as a result of the Court of Justice’s July 2020 ruling in the “Schrems II” case, as well as related guidance from regulators and the recent enforcement action against Meta by the Irish Data Protection Commission. For example, absent appropriate safeguards or other circumstances, the GDPR and laws in Switzerland and the UK generally restrict the transfer of personal information to countries outside of the EEA, Switzerland and the UK such as the United States. On July 10, 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. Based on this decision, personal information can flow from the EU to U.S. companies participating in the EU-U.S. Data Privacy Framework without having to put in place additional data protection safeguards. We are certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. If we cannot maintain a valid mechanism for cross-border data transfers, we and our customers may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from Europe or elsewhere. The inability to transfer personal information to the United States could significantly and negatively impact our business operations; limit our ability to collaborate with parties that are subject to data privacy and security laws; or require us to increase our personal information processing capabilities in Europe and/or elsewhere at significant expense. In addition, outside of Europe, other jurisdictions have proposed and enacted laws relating to cross-border data transfer or requiring personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin. If we are unable to increase our data processing capabilities and storage in Europe and other countries to limit or eliminate the need for data transfers out of Europe and other applicable countries quickly enough, and valid solutions for personal information transfers to the United States or other countries are not available or are difficult to implement in the interim, we will likely face continuing reluctance from European and multinational customers to use our services and increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal information across borders.

Current wording

As a cumulative example of these risks, because our primary data processing facilities are in the United States, we have experienced hesitancy, reluctance, or refusal by European or multinational customers to continue to use our services due to the potential risks posed as a result of the Court of Justice’s July 2020 ruling in the “Schrems II” case, as well as related guidance from regulators and enforcement action against Meta by the Irish Data Protection Commission. For example, absent appropriate safeguards or other circumstances, the GDPR and laws in Switzerland and the UK generally restrict the transfer of personal information to countries outside of the EEA, Switzerland and the UK such as the United States. On July 10, 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. Based on this decision, personal information can flow from the EU to U.S. companies participating in the EU-U.S. Data Privacy Framework without having to put in place additional data protection safeguards. We are certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. If we cannot maintain a valid mechanism for cross-border data transfers, we and our customers may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from Europe or elsewhere. The inability to transfer personal information to the United States could significantly and negatively impact our business operations; limit our ability to collaborate with parties that are subject to data privacy and security laws; or require us to increase our personal information processing capabilities in Europe and/or elsewhere at significant expense. In addition, outside of Europe, other jurisdictions have proposed and enacted laws relating to cross-border data transfer or requiring personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin. If we are unable to increase our data processing capabilities and storage in Europe and other countries to limit or eliminate the need for data transfers out of Europe and other applicable countries quickly enough, and valid solutions for personal information transfers to the United States or other countries are not available or are difficult to implement in the interim, we will likely face continuing reluctance from European and multinational customers to use our services and increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal information across borders.

Previous wording

We use technology and intellectual property licensed from third parties in certain of our products and our platform, and we expect to license additional third-party technology and intellectual property in the future. Licensed technology and intellectual property may not continue to be available on commercially reasonable terms, or at all. The loss of the right to license and distribute third-party technology could limit the functionality of our products or platform and could require us to redesign our products or platform. In addition, if the third-party technology and intellectual property we use has errors, security vulnerabilities, or otherwise malfunctions, the functionality of our products and platform may be negatively impacted, our customers may experience reduced service levels, and our business may be adversely affected.

Current wording

We use technology and intellectual property licensed from third parties in certain of our products and our platform, and we expect to license additional third-party technology and intellectual property in the future. Licensed technology and intellectual property may not continue to be available on commercially reasonable terms, or at all. The loss of the right to license and distribute third-party technology could limit the functionality of our products or platform and could require us to redesign our products or platform. In addition, if the third-party technology and intellectual property we use has errors, service outages, security vulnerabilities, or otherwise malfunctions, the functionality of our products and platform may be negatively impacted, our customers may experience outages or reduced service levels, and our business may be adversely affected.

Previous wording

For example, we outsource a substantial majority of our cloud infrastructure to AWS, which hosts our products and platform. Our customers need to be able to reliably access our platform, without material interruption or degradation of performance. AWS runs its own platform that we access, and we are, therefore, vulnerable to service interruptions at AWS. We have experienced, and expect that we may experience interruptions, delays and outages in service and availability in the future due to a variety of factors, including infrastructure changes, human or software errors, website hosting disruptions and capacity constraints. Capacity constraints could be caused by a number of potential causes, including technical failures, natural disasters, public health epidemics or pandemics, fraud or security attacks. In addition, if our security, or that of AWS, is compromised, our products or platform become unavailable, or if our users are unable to use our products within a reasonable amount of time or at all, any one of which may be due to circumstances beyond our control, then our business, results of operations and financial condition could be adversely affected. In some instances, we may encounter difficulties or otherwise not be able to identify the cause or causes of these performance problems within a period of time acceptable to our customers. It may become increasingly difficult to maintain and improve our platform performance and to troubleshoot performance issues, especially during peak usage times, as our products become more complex and the usage of our products increases. To the extent that we do not effectively address capacity constraints, either through AWS or alternative providers of cloud infrastructure, or through other factors that may result in interruptions, delays and outages in service and availability of our products and/or services, our business, results of operations and financial condition may be adversely affected. In addition, if Amazon.com, Inc. (“Amazon”) requires that we comply with unfavorable terms in order to continue our use of AWS or if Amazon implements any changes in its service levels for AWS, the changes may adversely affect our ability to meet our customers’ requirements, result in negative publicity which could harm our reputation and brand and may adversely affect the usage of our platform.

Current wording

For example, we outsource a substantial majority of our cloud infrastructure to Amazon Web Services (“AWS”), which hosts our products and platform. Our customers need to be able to reliably access our platform, without material interruption or degradation of performance. AWS runs its own platform that we access, and we are, therefore, vulnerable to service interruptions at AWS. We have experienced, and expect that we may experience interruptions, delays and outages in service and availability in the future due to a variety of factors, including infrastructure changes, human or software errors, website hosting disruptions and capacity constraints. Capacity constraints could be caused by a number of potential causes, including technical failures, natural disasters, public health epidemics or pandemics, fraud or security attacks. In addition, if our security, or that of AWS, is compromised, our products or platform become unavailable, or if our users are unable to use our products within a reasonable amount of time or at all, any one of which may be due to circumstances beyond our control, then our business, results of operations and financial condition could be adversely affected. In some instances, we may encounter difficulties or otherwise not be able to identify the cause or causes of these performance problems within a period of time acceptable to our customers. It may become increasingly difficult to maintain and improve our platform performance and to troubleshoot performance issues, especially during peak usage times, as our products become more complex and the usage of our products increases. To the extent that we do not effectively address capacity constraints, either through AWS or alternative providers of cloud infrastructure, or through other factors that may result in interruptions, delays and outages in service and availability of our products and/or services, our business, results of operations and financial condition may be adversely affected. In addition, if Amazon.com, Inc. (“Amazon”) requires that we comply with unfavorable terms in order to continue our use of AWS or if Amazon implements any changes in its service levels for AWS, the changes may adversely affect our ability to meet our customers’ requirements, result in negative publicity which could harm our reputation and brand and may adversely affect the usage of our platform.

Previous wording

We continue to incorporate additional AI solutions and features into our platform and our business, including CustomerAI, and these solutions and features may become more important to our operations or to our future growth over time. We expect to rely on AI solutions and features to help drive future growth in our business, but there can be no assurance that we will realize the desired or anticipated benefits from AI. Our investments in AI solutions and features have and may continue to negatively impact our cost of revenue and gross margins, particularly for our Segment business, until we are able to increase revenue enough to offset these investments. We may also fail to properly implement or market our AI solutions and features. Our competitors or other third parties may incorporate AI into their products, offerings, and solutions more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations. Our ability to effectively implement and market our AI solutions and features will depend, in part, on our ability to attract and retain employees with AI expertise, and we expect significant competition for professionals with the skills and technical knowledge that we will require. Additionally, our offerings based on AI may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm. For example, our business, financial condition and results of operations may be adversely affected if content or recommendations that AI solutions or features assist in producing are or are alleged to be deficient, inaccurate, or biased, or if such content, recommendations, solutions, or features or their development or deployment (including the collection, use, or other processing of data used to train or create such AI solutions or features) are found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal obligations to which we are or may become subject. The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations. These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources. AI also presents emerging ethical issues, and if our use of AI becomes controversial, we may experience brand or reputational harm.

Current wording

We continue to incorporate additional AI solutions and features into our platform and our business, including CustomerAI, and these solutions and features may become more important to our operations or to our future growth over time. We expect to rely on AI solutions and features to help drive future growth in our business, but there can be no assurance that we will realize the desired or anticipated benefits from AI. Our investments in AI solutions and features have and may continue to negatively impact our cost of revenue and gross margins, particularly for our Segment business, until we are able to increase revenue enough to offset these investments. We may also fail to properly implement or market our AI solutions and features. Our competitors or other third parties may incorporate AI into their products, offerings, and solutions more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations. Our ability to effectively implement and market our AI solutions and features will depend, in part, on our ability to attract and retain employees with AI expertise, and we expect significant competition for professionals with the skills and technical knowledge that we will require. Additionally, our offerings based on AI may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm. For example, our business, financial condition and results of operations may be adversely affected if content or recommendations that AI solutions or features assist in producing are or are alleged to be deficient, inaccurate, or biased, or if such content, recommendations, solutions, or features or their development or deployment (including the collection, use, or other processing of data used to train or create such AI solutions or features) are found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal or contractual obligations to which we are or may become subject. The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations. These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources. AI also presents emerging ethical issues, and if our use of AI becomes controversial, we may experience brand or reputational harm.

Previous wording

In addition, in order to obtain allocations of, assign and retain Numbering Resources in the EU or certain other regions, we are often required to be licensed by local telecommunications regulatory authorities, some of which have been increasingly monitoring and regulating the categories of Numbering Resources that are eligible for provisioning to our customers. We have obtained licenses and are in the process of obtaining licenses in various countries in which we do business, but in some countries, the regulatory regime around provisioning of Numbering Resources is unclear, subject to change over time, and sometimes may conflict from jurisdiction to jurisdiction. Furthermore, these regulations and governments’ approach to their enforcement, as well as our products and services, are still evolving and we may be unable to maintain compliance with applicable regulations, or enforce compliance by our customers, on a timely basis or without significant cost. Also, compliance with these types of regulation may require changes in products or business practices that result in reduced revenue. Due to our or our customers’ assignment and/or use of Numbering Resources in certain countries in a manner that violates applicable rules and regulations, we have been subjected to government inquiries and audits, and may in the future be subject to significant penalties or further governmental action, and in extreme cases, may be precluded from doing business in that particular country. We have also been forced to reclaim Numbering Resources from our customers as a result of certain events of non-compliance. These reclamations result in loss of customers, loss of revenue, reputational harm, erosion of customer trust, and may also result in breach of contract claims, all of which could have an adverse effect on our business, results of operations and financial condition.

Current wording

In addition, in order to obtain allocations of, assign and retain Numbering Resources in the EU or certain other regions, we are often required to be licensed by local telecommunications regulatory authorities, some of which have been increasingly monitoring and regulating the categories of Numbering Resources that are eligible for provisioning to our customers. We have obtained licenses and are in the process of obtaining licenses in various countries in which we do business, but in some countries, the regulatory regime around provisioning of Numbering Resources is unclear, subject to change over time, and sometimes may conflict from jurisdiction to jurisdiction. Furthermore, these regulations and governments’ approach to their enforcement, as well as our products and services, are still evolving and we may be unable to maintain compliance with applicable regulations, or enforce compliance by our customers, on a timely basis or without significant cost. Also, compliance with these types of regulation may require changes in products or business practices that result in reduced revenue. Due to our or our customers’ assignment and/or use of Numbering Resources in certain countries in a manner that may violate applicable rules and regulations, we have been subjected to government inquiries and audits, and may in the future be subject to significant penalties or further governmental action, and in extreme cases, may be precluded from doing business in that particular country. We have also been forced to reclaim Numbering Resources from our customers as a result of certain events of non-compliance. These reclamations result in loss of customers, loss of revenue, reputational harm, erosion of customer trust, and may also result in breach of contract claims, all of which could have an adverse effect on our business, results of operations and financial condition.

Previous wording

The actual or perceived improper sending of text messages or voice calls may subject us to potential risks, including liabilities or claims relating to consumer protection laws and regulatory enforcement, including fines. For example, the Telephone Consumer Protection Act of 1991 (“TCPA”) restricts telemarketing and the use of automatic SMS text messages without explicit customer consent. TCPA violations can result in significant financial penalties, as businesses can incur penalties or criminal fines imposed by the FCC or be fined up to $1,500 per violation through private litigation or state attorneys general or other state actor enforcement. Class action suits are the most common method for private enforcement. This has resulted in civil claims against our company and requests for information through third-party subpoenas. The scope and interpretation of the laws that are or may be applicable to the delivery of text messages or voice calls are continuously evolving and developing. If we do not comply with these laws or regulations or if we become liable under these laws or regulations due to the failure of our customers to comply with these laws by obtaining proper consent, we could face direct liability.

Current wording

The actual or perceived improper sending of text messages or voice calls may subject us to potential risks, including liabilities or claims relating to consumer protection laws and regulatory enforcement, including fines. For example, the Telephone Consumer Protection Act of 1991 (“TCPA”) restricts telemarketing and the use of automatic SMS text messages without explicit customer consent. TCPA violations can result in significant financial penalties, as businesses can incur penalties or criminal fines imposed by the FCC or be fined up to $1,500 per violation through private litigation or state attorneys general or other state actor enforcement. Class action suits are the most common method for private enforcement. This has resulted in civil claims against our company and requests for information through third-party subpoenas. The scope and interpretation of the laws that are or may be applicable to the delivery of text messages or voice calls are continuously evolving and developing. If we do not comply with these laws or regulations or if we become liable under these laws or regulations due to the failure of our customers to comply with these laws, we could face direct liability.

Previous wording

The current legislative and regulatory landscape regarding the regulation of the Internet is subject to uncertainty. For example, in January 2018, the FCC released an order that repealed the “open Internet rules,” often known as “net neutrality,” which could affect the services used by us and our customers. In response to this decision California and a number of states implemented their own net neutrality rules which mirrored parts of the repealed federal regulations. In October 2023, the FCC voted to begin the process of reinstating substantially all of the net neutrality rules that had been in place prior to the 2018 repeal. We cannot predict the actions the FCC may take, whether any new FCC order or state initiatives regulating providers will be modified, overturned, or vacated by legal action, federal legislation, or the FCC itself, or the degree to which further regulatory action – or inaction – may adversely affect our business. Should the FCC not reinstate net neutrality or if state initiatives codifying similar protections are modified, overturned, or vacated, internet service providers may be able to limit our users’ ability to access our platform or make our platform a less attractive alternative to our competitors’ applications. On the other hand, if limits are imposed on the types of traffic that U.S. domestic carriers can carry over their broadband networks, it could adversely affect the amount of carrier-originated traffic that we carry. In a related regulatory context, while the EU requires equal access to internet content, under its Digital Single Market initiative the EU may impose additional requirements that could increase our costs. If new FCC, EU, or other rules directly or inadvertently impose costs on online providers like our business, our expenses may rise. Were any of these outcomes to occur, our ability to retain existing users or attract new users may be impaired, our costs may increase, and our business may be significantly harmed.

Current wording

The current legislative and regulatory landscape regarding the regulation of the Internet is subject to uncertainty. For example, in January 2018, the FCC released an order that repealed the “open Internet rules,” often known as “net neutrality,” which could affect the services used by us and our customers. In response to this decision California and a number of states implemented their own net neutrality rules which mirrored parts of the repealed federal regulations. In April 2024, the FCC voted to reinstate substantially all of the net neutrality rules that had been in place prior to the 2018 repeal. Those rules are under review by a federal appeals court. In addition, the results of the 2024 presidential election may influence whether the FCC maintains, modifies or, again, repeals these net neutrality rules. If the net neutrality rules are repealed, we cannot predict whether internet service providers may limit our users’ ability to access our platform or may make our platform a less attractive alternative compared to our competitors’ applications. In a related regulatory context, while the EU requires equal access to internet content, under its Digital Single Market initiative the EU may impose additional requirements that could increase our costs. If new FCC, EU, or other rules directly or inadvertently impose costs on online providers like our business, our expenses may rise. Were any of these outcomes to occur, our ability to retain existing users or attract new users may be impaired, our costs may increase, and our business may be significantly harmed.

Previous wording

We review our intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable. Goodwill is required to be tested for impairment at least annually. As of March 31, 2024, we carried a net $5.6 billion of goodwill and intangible assets. An adverse change in market conditions or significant changes in accounting conclusions, particularly if such changes have the effect of changing one of our critical assumptions or estimates, could result in a change to the estimation of fair value that could result in an impairment charge to our goodwill or intangible assets. For example, during the year ended December 31, 2023, we recorded an impairment of intangible assets related to Segment totaling approximately $285.7 million, as described in additional detail in Note 6 to our consolidated financial statements included in our Annual Report on Form 10-K filed with the SEC on February 27, 2024. Any such charges may adversely affect our results of operations.

Current wording

We review our intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable. Goodwill is required to be tested for impairment at least annually. As of June 30, 2024, we carried a net $5.5 billion of goodwill and intangible assets. An adverse change in market conditions or significant changes in accounting conclusions, particularly if such changes have the effect of changing one of our critical assumptions or estimates, could result in a change to the estimation of fair value that could result in an impairment charge to our goodwill or intangible assets. For example, during the year ended December 31, 2023, we recorded an impairment of intangible assets related to Segment totaling approximately $285.7 million, as described in additional detail in Note 6 to our consolidated financial statements included in our Annual Report on Form 10-K filed with the SEC on February 27, 2024. Any such charges may adversely affect our results of operations.

Previous wording

Historically, we have not billed or collected taxes in certain jurisdictions and, in accordance with GAAP, we have recorded a provision for our tax exposure in these jurisdictions when it is both probable that a liability has been incurred and the amount of the exposure can be reasonably estimated. We reserved $18.2 million and $20.0 million for domestic jurisdictions and jurisdictions outside of the United States, respectively, on our March 31, 2024 balance sheet for these tax payments. These estimates include several key assumptions, including, but not limited to, the taxability of our products, the jurisdictions in which we believe we have nexus or a permanent establishment, and the sourcing of revenues to those jurisdictions. In the event these jurisdictions challenge our assumptions and analysis, our actual exposure could differ materially from our current estimates and reserves. If the actual payments we make to any jurisdiction exceed the accrual in our balance sheet, our results of operations would be harmed. In addition, some customers may question the incremental tax charges and seek to negotiate lower pricing from us, which could adversely affect our business, results of operations and financial condition.

Current wording

Historically, we have not billed or collected taxes in certain jurisdictions and, in accordance with GAAP, we have recorded a provision for our tax exposure in these jurisdictions when it is both probable that a liability has been incurred and the amount of the exposure can be reasonably estimated. We reserved $18.6 million and $20.2 million for domestic jurisdictions and jurisdictions outside of the United States, respectively, on our June 30, 2024 balance sheet for these tax payments. These estimates include several key assumptions, including, but not limited to, the taxability of our products, the jurisdictions in which we believe we have nexus or a permanent establishment, and the sourcing of revenues to those jurisdictions. In the event these jurisdictions challenge our assumptions and analysis, our actual exposure could differ materially from our current estimates and reserves. If the actual payments we make to any jurisdiction exceed the accrual in our balance sheet, our results of operations would be harmed. In addition, some customers may question the incremental tax charges and seek to negotiate lower pricing from us, which could adversely affect our business, results of operations and financial condition.

Previous wording

In February 2023, our board of directors authorized the repurchase of up to $1.0 billion of our common stock from time to time through a share repurchase program. In March 2024, our board of directors authorized an additional $2.0 billion share repurchase program. Through March 31, 2024, we have repurchased $1.1 billion of our common stock on the open market under this program, such that up to $1.9 billion remained available for repurchase as of March 31, 2024. Under our share repurchase programs, we may make repurchases of stock through a variety of methods, including open share market purchases, privately negotiated purchases, entering into one or more confirmations or other contractual arrangements with a financial institution counterparty to effectuate one or more accelerated stock repurchase contracts, forward purchase contracts or similar derivative instruments, Dutch auction tender offers, or through a combination of any of the foregoing, in accordance with applicable federal securities laws. Our share repurchase programs terminate at 11:59 pm Pacific Time on December 31, 2024, do not obligate us to repurchase any specific number of shares, and may be suspended at any time at our discretion and without prior notice. The timing and amount of any repurchases, if any, will be subject to liquidity, stock price, market and economic conditions, compliance with applicable legal requirements such as Delaware surplus and solvency tests and other relevant factors. Any failure to repurchase stock after we have announced our intention to do so may negatively impact our reputation and investor confidence in us and may negatively impact our stock price.

Current wording

In February 2023, our board of directors authorized the repurchase of up to $1.0 billion of our common stock from time to time through a share repurchase program. In March 2024, our board of directors authorized an additional $2.0 billion share repurchase program. Through June 30, 2024, we have repurchased $2.0 billion of our common stock on the open market under this program, such that up to $1.0 billion remained available for repurchase as of June 30, 2024. Under our share repurchase programs, we may make repurchases of stock through a variety of methods, including open share market purchases, privately negotiated purchases, entering into one or more confirmations or other contractual arrangements with a financial institution counterparty to effectuate one or more accelerated stock repurchase contracts, forward purchase contracts or similar derivative instruments, Dutch auction tender offers, or through a combination of any of the foregoing, in accordance with applicable federal securities laws. Our share repurchase programs terminate at 11:59 pm Pacific Time on December 31, 2024, do not obligate us to repurchase any specific number of shares, and may be suspended at any time at our discretion and without prior notice. The timing and amount of any repurchases, if any, will be subject to liquidity, stock price, market and economic conditions, compliance with applicable legal requirements such as Delaware surplus and solvency tests and other relevant factors. Any failure to repurchase stock after we have announced our intention to do so may negatively impact our reputation and investor confidence in us and may negatively impact our stock price.