TWILIO INC

Previous wording

•the possibility that we may not realize the anticipated long-term stockholder value of our share repurchase programs;

Current wording

•the possibility that we may not realize the anticipated long-term stockholder value of our share repurchase program;

Previous wording

If customers fail to pay us as a result of adverse macroeconomic or geopolitical conditions or otherwise, we may be required to take steps to enforce the terms of our contracts and collect amounts due, which may not succeed. For example, in 2023, one of our customers in Brazil initiated reorganization proceedings exposing us to risks on collections of pre-petition receivables and ongoing revenue, and in 2024 its creditors approved a reorganization plan providing extended and discounted payment terms for pre-petition receivables. As a result of a reduction in ongoing payment activity from this customer, as of December 31, 2024, we fully reserved accounts receivable balances for this customer.

Current wording

If customers fail to pay us as a result of adverse macroeconomic or geopolitical conditions or otherwise, we may be required to take steps to enforce the terms of our contracts and collect amounts due, which may not succeed. For example, in 2023, one of our former customers in Brazil initiated reorganization proceedings exposing us to risks on collections of pre-petition receivables and ongoing revenue, and in 2024 its creditors approved a reorganization plan providing extended and discounted payment terms for pre-petition receivables. As a result of a reduction in ongoing payment activity, as of December 31, 2024, we fully reserved accounts receivable balances for this former customer.

Previous wording

Macroeconomic and political conditions and uncertainties have in the past and may in the future adversely affect our business, results of operations and financial condition, and exacerbate many of the other risks described in this “Risk Factors” section.

Current wording

Macroeconomic and political conditions and uncertainties have in the past adversely affected, and may in the future adversely affect, our business, results of operations and financial condition, and could exacerbate many of the other risks described in this “Risk Factors” section.

Previous wording

Customer usage of our products depends on factors generally outside of our control, so it is difficult to accurately predict customers’ usage levels. Our Dollar-Based Net Expansion Rate may decline for a number of reasons, including if customers are not satisfied with our products and related customer service experience, the value proposition of our products or our ability to meet their needs and expectations, due to reductions in customers’ budgets or as a result of adverse macroeconomic conditions. If we lose customers, or if our customers reduce their usage levels of our products, our business, results of operations and financial condition could be adversely affected.

Current wording

Customer usage of our products depends on factors generally outside of our control, so it is difficult to accurately predict customers’ usage levels. Our Dollar-Based Net Expansion Rate may decline for a number of reasons, including if customers are not satisfied with our products and related customer service experience, the value proposition of our products or our ability to meet their needs and expectations, due to reductions in customers’ budgets or as a result of adverse macroeconomic conditions.

Previous wording

Our sales and marketing strategies, and their effectiveness, are influenced by numerous factors. We have made, and may in the future make, changes to the organization of our sales force and sales motions in response to changes in company strategy, new market opportunities, new products or features, sales performance or effectiveness, changes in sales headcount, changes to the compensation structure of our sales organization, or other factors. Such changes may not lead to wider adoption of our products or to the cost-effective acquisition of additional customers or increased revenue from existing customers as quickly or to the extent we expect, or at all, and have resulted, and may in the future result, in a reduction of productivity, which could negatively impact our growth rate and results of operations. For example, in recent years, we have reduced the size of our sales force to drive further efficiencies in our sales operations and are continuing to improve and rely more heavily on our use of self-service capabilities to drive sales of our products to customers that do not require direct account coverage. We are also introducing AI and automation in our self-service platform aimed at improving sales and customer support. These efforts may not continue to be as effective as we anticipate in driving adoption or increased usage of our products, or may take longer than we expect to drive growth. In addition, if the costs of the marketing channels we use increase, then we may choose to use alternative or less expensive channels, which may not be as effective as the channels we currently use.

Current wording

Our sales and marketing strategies, and their effectiveness, are influenced by numerous factors. We have made, and may in the future make, changes to the organization of our sales force and sales motions in response to changes in company strategy, new market opportunities, new products or features, sales performance or effectiveness, changes in sales headcount, changes to the compensation structure of our sales organization, or other factors. Such changes may not lead to wider adoption of our products or to the cost-effective acquisition of additional customers or increased revenue from existing customers as quickly or to the extent we expect, or at all, and have resulted, and may in the future result, in a reduction of productivity, which could negatively impact our growth rate and results of operations. For example, in recent years, we have reduced the size of our sales force to drive further efficiencies in our sales operations and are continuing to improve and rely more heavily on our use of self-service capabilities to drive sales of our products to customers that do not require direct account coverage. We are also introducing AI and automation in our self-service platform aimed at improving sales and customer support. These efforts may not continue to be as effective as we anticipate in driving adoption or increased usage of our products, or may take longer than we expect to drive growth or increase efficiency. In addition, if the costs of the marketing channels we use increase, then we may choose to use alternative or less expensive channels, which may not be as effective as the channels we currently use.

Previous wording

We have incurred net losses in each year since our inception, including net losses of $109.4 million and $1.0 billion in the years ended December 31, 2024 and 2023, respectively. In addition, while we have experienced revenue growth in prior periods, it is not indicative of future revenue growth, and our revenue and revenue growth for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period. If we are unable to generate and sustain increased revenue levels and manage our operating expenses, we may not become profitable and achieve our stated profitability goals and, even if we do, we may not be able to maintain or increase our level of profitability. As we implement additional initiatives to increase revenue, our operating expenses may continue to rise over the long term, potentially including, among other things: investments in our engineering team; improvements in security and data protection; the development of new products, features and functionality and enhancements to our platform; sales and marketing; expansion of our operations and infrastructure, both domestically and internationally; and general administration, including legal, accounting and other expenses related to being a public company. Our efforts to grow our business may be more costly than we expect, and if our revenue growth does not meet estimates, we may not be able to offset our associated operating expenses, which could prevent us from achieving and sustaining profitability, or maintaining or increasing cash flow. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, or if we incur significant losses, the value of our business and common stock may significantly decrease.

Current wording

While we achieved net income of $42.4 million in the six months ended June 30, 2025, we have incurred net losses in each preceding year since our inception, including net losses of $109.4 million and $1.0 billion in the years ended December 31, 2024 and 2023, respectively. In addition, while we have experienced revenue growth in prior periods, it is not indicative of future revenue growth, and our revenue and revenue growth for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period. If we are unable to generate and sustain increased revenue levels and manage our operating expenses, we may not achieve and sustain profitability and, even if we do, we may not be able increase our level of profitability or achieve our stated profitability goals. As we implement additional initiatives to increase revenue, our operating expenses may continue to rise over the long term, potentially including, among other things: investments in our engineering team; improvements in security and data protection; the development of new products, features and functionality and enhancements to our platform; sales and marketing; expansion of our operations and infrastructure, both domestically and internationally; and general administration, including legal, accounting and other expenses related to being a public company. Our efforts to grow our business may be more costly than we expect, and if our revenue growth does not meet estimates, we may not be able to offset our associated operating expenses, which could prevent us from achieving and sustaining profitability, or maintaining or increasing cash flow. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, or if we incur significant losses, the value of our business and common stock may significantly decrease.

Previous wording

We currently interconnect with fixed and mobile network service providers around the world to enable our customers to use our products over their networks. Although we are in the process of acquiring authorization in many countries for direct access to phone numbers and for the provision of voice and messaging services on the networks of fixed and mobile network service providers, we expect that we will continue to rely on network service providers for these services. Where we do not have direct access to phone numbers, our reliance on network service providers has reduced our operating flexibility, ability to make timely service changes and control quality of service. In addition, the fees that we are charged by network service providers may change daily or weekly and we can be subject to the imposition of additional fees, penalties, or other administrative or technical requirements, and even service interruption, due to regulatory, competitive, or other industry related changes over which we have little to no control.

Current wording

We interconnect with fixed and mobile network service providers around the world to enable our customers to use our products over their networks. Although we currently hold or are in the process of acquiring authorization in many countries for direct access to phone numbers and for the provision of voice and messaging services on the networks of fixed and mobile network service providers, we expect that we will continue to rely on network service providers for these services. Where we do not have direct access to phone numbers, our reliance on network service providers has reduced our operating flexibility, ability to make timely service changes and control quality of service. In addition, the fees that we are charged by network service providers are subject to change and we can be subject to the imposition of additional fees, penalties, or other administrative or technical requirements, and even service interruption, due to regulatory, competitive, or other industry related changes over which we have little to no control.

Previous wording

For example, in recent years, multiple major U.S. mobile carriers have introduced A2P SMS service offerings that added a new fee for A2P SMS messages delivered to their respective subscribers, and, from time to time, other U.S. mobile carriers have added similar fees. While we have historically responded to these types of fee increases through a combination of further negotiating efforts with our network service providers, absorbing the increased costs or passing the fees through to customers, there is no guarantee that we will continue to be able to respond in these ways in the future without a material negative impact to our business. We typically do not change our customers’ pricing as rapidly and, as a result, such fee increases could adversely affect our business and results of operations. In addition, passing these fees through to our customers typically has the effect of increasing our revenue and cost of revenue, but typically does not impact the gross profit dollars received for sending these messages and, as a result, has a negative impact on our gross margins. Additionally, our ability to respond to any new fees may be constrained if all network service providers in a particular market impose equivalent fee structures, if the magnitude of the fees is disproportionately large when compared to the underlying prices paid by our customers, or if the market conditions limit our ability to increase the prices we charge our customers.

Current wording

From time to time, network service providers have instituted additional or increased fees that increase our network costs. For example, in June 2025, a major U.S. mobile carrier increased its fees for A2P SMS messages delivered to its subscribers, which will create a modest headwind to our gross margins going forward. Other U.S. mobile carriers may follow suit and such fees may increase over time. While we have historically responded to these types of fee increases through a combination of further negotiating efforts with our network service providers, absorbing the increased costs or passing the fees through to customers, there is no guarantee that we will continue to be able to respond in these ways in the future without a material negative impact to our business. The fees charged by our network service providers are subject to change, in some markets daily or weekly, and we may not change our customers’ pricing as rapidly and, as a result, such fee increases could adversely affect our business and results of operations. In addition, passing these fees through to our customers typically has the effect of increasing our revenue and cost of revenue, but typically does not impact the gross profit dollars received for sending these messages and, as a result, has a negative impact on our gross margins. Additionally, our ability to respond to any new fees may be constrained if all network service providers in a particular market impose equivalent fee structures, if the magnitude of the fees is disproportionately large when compared to the underlying prices paid by our customers, or if the market conditions limit our ability to increase the prices we charge our customers.

Previous wording

Further, we sometimes access network services through intermediaries who have direct access to network service providers. Although we are in the process of securing direct connections with network service providers in many countries, we expect that we will continue to rely on intermediaries for these services for some period of time. These intermediaries sometimes have offerings that directly compete with our products and may stop providing services to us on a cost-effective basis. If a significant portion of these intermediaries stop providing services or stop providing services on a cost-effective basis, our business could be adversely affected.

Current wording

Further, in cases where we do not have direct access to network service providers, we access network services through intermediaries. Although we are in the process of securing additional direct connections with network service providers in many countries, we expect that we will continue to rely on intermediaries for these services for some period of time. These intermediaries sometimes have offerings that directly compete with our products and may stop providing services to us on a cost-effective basis. If a significant portion of these intermediaries stop providing services or stop providing services on a cost-effective basis, our business could be adversely affected.

Previous wording

For certain of our products, we primarily charge our customers based on their usage of such products. One of the challenges of this usage-based pricing model is the variability of the fees that we pay to network service providers over whose networks we transmit communications. Such network fees can vary daily or weekly, differ across countries, and are affected by volume and other factors that may be outside of our control and which are difficult to predict. This can result in us incurring increased costs that we may be unable or unwilling to pass through to our customers, which could adversely impact our business, results of operations and financial condition. If we elect to pass through increased fees to our customers, it could adversely affect our relationship with our customers and our customers may look for lower cost alternatives.

Current wording

For certain of our products, we primarily charge our customers based on their usage of such products. One of the challenges of this usage-based pricing model is the variability of the fees that we pay to network service providers over whose networks we transmit communications. Such network fees can vary, in some markets daily or weekly, differ across countries, and are affected by volume and other factors that may be outside of our control and which are difficult to predict. This can result in us incurring increased costs that we may be unable or unwilling to pass through to our customers, which could adversely impact our business, results of operations and financial condition. If we elect to pass through increased fees to our customers, it could adversely affect our relationship with our customers and our customers may look for lower cost alternatives.

Previous wording

In the three months ended March 31, 2025 and the years ended December 31, 2024 and 2023, we derived 36%, 35% and 34% of our revenue from customer accounts located outside the United States, respectively. The future success of our business will depend, in part, on our ability to strategically maintain and expand our customer base worldwide. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic and political risks in addition to those we face in the United States.

Current wording

In the six months ended June 30, 2025 and the years ended December 31, 2024 and 2023, we derived 36%, 35% and 34% of our revenue from customer accounts located outside the United States, respectively. The future success of our business will depend, in part, on our ability to strategically maintain and expand our customer base worldwide. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic and political risks in addition to those we face in the United States.

Previous wording

Individuals or entities have in the past attempted and will in the future attempt to penetrate the security of our platform, or of our network or systems, and to cause harm to our business operations, including by misappropriating our proprietary information or that of our customers, employees and business partners or to cause interruptions of our products and platform. In particular, cyberattacks and other malicious internet-based activity continue to increase in frequency and magnitude, and cloud-based companies have been targeted in the past. In addition to threats from traditional computer hackers, malicious code, software vulnerabilities, supply chain attacks and vulnerabilities through our third-party partners, employee theft or misuse, password spraying, phishing, smishing, vishing, credential stuffing and denial-of-service attacks, we also face threats from sophisticated organized crime, nation-state, and nation-state supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risk to our systems (including those hosted on cloud services), internal networks, our customers’ systems, our service providers’ networks, and the information that they store and process. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate or reduce the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Geopolitical tensions and events may further heighten risks we and our service providers face from these and other attacks. Because the techniques used to access, disrupt or sabotage devices, systems and networks change frequently and may not be recognized until launched against a target, we expect to be required to make further investments over time to protect data and infrastructure as cybersecurity threats develop, evolve and grow more complex over time. We may also be unable to anticipate these techniques, and we may not become aware in a timely manner of any security breach or incident, which could exacerbate any damage we experience.

Current wording

Individuals or entities have in the past attempted and will in the future attempt to penetrate the security of our platform, or of our network or systems, and to cause harm to our business operations, including by misappropriating our proprietary information or that of our customers, employees and business partners or to cause interruptions of our products and platform. In particular, cyberattacks and other malicious internet-based activity continue to increase in frequency and magnitude, and cloud-based companies have been targeted in the past. We face various threats from traditional computer hackers, sophisticated organized crime, nation-state and nation-state supported actors, malicious code, software vulnerabilities, supply chain attacks and vulnerabilities through our third-party partners, employee theft or misuse, attempts to bribe, extort, or compromise our employees or infiltrate our workforce, password spraying, phishing, smishing, vishing, credential stuffing, denial-of-service attacks, and advanced persistent threat intrusions, which threaten our systems (including those hosted on cloud services), internal networks, our customers’ systems, our service providers’ networks, and the information that they store and process. Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate or reduce the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Geopolitical tensions and events may further heighten risks we and our service providers face from these and other attacks. Because the techniques used to access, disrupt or sabotage devices, systems and networks change frequently and may not be recognized until launched against a target, we expect to be required to make further investments over time to protect data and infrastructure as cybersecurity threats develop, evolve and grow more complex over time. We may also be unable to anticipate these techniques, and we may not become aware in a timely manner of any security breach or incident, which could exacerbate any damage we experience.

Previous wording

The CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies. These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents (both consumers and employees) certain rights related to their personal information. The CCPA allows for statutory fines for noncompliance. Similar laws have been enacted in 20 other states with 13 laws currently in effect and the remainder becoming effective later in 2025 and 2026. Numerous other states, and the U.S. federal government, also have proposed general privacy legislation. Additionally, other states have proposed, and in certain cases enacted, other laws and regulations addressing privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action. If we become subject to new privacy, data protection or cybersecurity laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase, including individuals, via a private right of action, and state actors.

Current wording

In the United States, the CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies. These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents (both consumers and employees) certain rights related to their personal information. The CCPA allows for statutory fines for noncompliance. Numerous other states have enacted or are considering laws and regulations addressing privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action, and laws in several states relating to the provision of individual home address or telephone directory information. States and the U.S. federal government have also proposed general privacy legislation.

Previous wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and cybersecurity. For example, the GDPR, the United Kingdom’s General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”) and the Swiss Federal Act on Data Protection, impose strict requirements for processing the personal information of individuals protected by the legislation, whether their data is processed within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”). For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data re-usage, data retention, security of processing and international data transfers. Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data processing or data transfers, require a company to delete data, as well as impose significant fines, potentially ranging up to 20 million Euros under the GDPR, 17.5 million GBP under the UK GDPR, or 4% of a company’s worldwide revenue, whichever is higher. Further, individuals may initiate compensation claims or litigation related to our processing of their personal information. Other privacy and data protection laws in Europe impose strict requirements around marketing communications and the deployment of cookies on users’ devices. As another example, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to the GDPR. Additionally, we expect an increase in regulation of the use of AI and ML in products and services. For example, in Europe, the Artificial Intelligence Act, once effective, will impose onerous obligations related to the development, placement on the market and use of AI-related systems. In the United States, numerous states have established study commissions that could lead to regulation of AI, and certain states have enacted legislation regulating aspects of AI. Other countries also are contemplating laws regulating AI and ML. We may have to change our business practices to comply with obligations under these or other new and evolving regimes.

Current wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and cybersecurity. For example, the GDPR, the United Kingdom’s General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”) and the Swiss Federal Act on Data Protection impose strict requirements for processing personal information of covered individuals, whether within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”). For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data retention, security, and international data transfers. Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data transfers or other processing, require data deletion, and impose significant fines, potentially ranging up to the greater of 4% of a company’s worldwide revenue or 20 million Euros or 17.5 million GBP, respectively. Individuals also may initiate compensation claims or litigation related to our processing of their personal information. Other privacy and data protection laws in Europe impose strict requirements around marketing communications and the deployment of cookies. As another example, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to the GDPR.

Previous wording

Further, the interpretation and application of new domestic and foreign laws and regulations in many cases is uncertain, and our legal and regulatory obligations in such jurisdictions are subject to frequent and unexpected changes, including the potential for various regulatory or other governmental bodies to enact new or additional laws or regulations, to issue rulings that invalidate prior laws or regulations, or to increase penalties significantly. For example, the EU’s Digital Services Act, Digital Markets Act and Data Act entered into force in 2024, and the EU’s Network and Information Security Directive II, adopted in 2023, provides for EU member states to have issued implementing legislation by October 2024. Additionally, the EU’s Digital Operational Resiliency Act entered into force on January 17, 2025.

Current wording

The interpretation and application of laws and regulations are in many cases uncertain, and our legal and regulatory obligations are subject to frequent and unexpected changes, including the potential for new or additional laws or regulations, rulings that invalidate prior laws or regulations, or significant increases in penalties. Recent examples include the EU’s Digital Services Act, Digital Markets Act and Data Act effective in 2024, EU member state legislation implementing the EU’s Network and Information Security Directive II and the EU’s Digital Operational Resiliency Act effective in January 2025. New and changing privacy, data protection or cybersecurity laws and regulations may result in additional obligations, increase the risk of enforcement action against us, and increase the types and numbers of individuals or entities that can initiate actions against us.

Previous wording

Similarly, with our registration as an interconnected VoIP provider for certain products with the Federal Communications Commission (“FCC”), we also must comply with privacy laws associated with customer proprietary network information rules in the United States. In addition, states such as California have increasingly adopted or proposed, or may propose, regulations that may classify our services in such a manner as to subject us to additional privacy-related compliance obligations under state law. If we fail or are perceived to have failed to maintain compliance with these requirements, we could be subject to regulatory audits or inquiries, civil and criminal penalties, fines and breach of contract claims, as well as reputational damage, which could impact the willingness of customers to do business with us.

Current wording

Similarly, with our registration as an interconnected VoIP provider for certain products with the Federal Communications Commission (“FCC”), we must comply with privacy laws associated with customer proprietary network information rules in the United States. In addition, some states have adopted, proposed, or may propose, regulations that may classify our services in such a manner as to subject us to additional privacy-related compliance obligations under state law. If we fail or are perceived to have failed to maintain compliance with these requirements, we could be subject to regulatory audits or inquiries, civil and criminal penalties, fines and breach of contract claims, as well as reputational damage, which could impact the willingness of customers to do business with us.

Previous wording

In addition to our legal obligations, our contractual obligations relating to privacy, data protection and cybersecurity have become increasingly stringent due to changes in laws and regulations and the expansion of our offerings. Certain privacy, data protection and cybersecurity laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. In addition, we support customer workloads that involve the processing of protected health information and are required to sign business associate agreements with customers that subject us to requirements under the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, as well as state laws that govern health information.

Current wording

In addition, our contractual obligations relating to privacy, data protection and cybersecurity have become increasingly stringent due to changes in laws and regulations and expansion of our offerings. Certain privacy, data protection and cybersecurity laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. In addition, we support customer workloads that involve the processing of protected health information and are required to sign business associate agreements with customers that subject us to requirements under the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, as well as state laws that govern health information.

Previous wording

EU to U.S. companies participating in the EU-U.S. Data Privacy Framework without having to put in place additional data protection safeguards. We are certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. If we cannot maintain valid mechanisms for cross-border data transfers, we and our customers may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from Europe or elsewhere. Any inability to transfer personal information to the United States or other jurisdictions could significantly and negatively impact our business operations; limit our ability to collaborate with parties that are subject to data privacy and security laws; or require us to increase our personal information processing capabilities in Europe and/or elsewhere at significant expense. In addition, outside of Europe, other jurisdictions have proposed and enacted laws relating to cross-border data transfer or requiring personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin. If we are unable to increase our data processing capabilities and storage in Europe and other jurisdictions to limit or eliminate the need for data transfers out of Europe and other applicable jurisdictions quickly enough, and valid solutions for personal information transfers to the United States or other jurisdictions are not available or are difficult to implement in the interim, we will likely face continuing reluctance from European and multinational customers to use our services and increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal information across borders.

Current wording

As a cumulative example of these risks, because our primary data processing facilities are in the United States, we have experienced hesitancy, reluctance, or refusal by European or multinational customers to continue to use our services due to potential risks arising from the Court of Justice’s July 2020 ruling in the “Schrems II” case, as well as related guidance from regulators and enforcement action against Meta by the Irish Data Protection Commission. For example, absent appropriate safeguards or other circumstances, the GDPR and laws in Switzerland and the UK generally restrict the transfer of personal information to many outside jurisdictions, such as the United States. On July 10, 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. Based on this decision, personal information can flow from the EU to U.S. companies participating in the EU-U.S. Data Privacy Framework without additional data protection safeguards. We are certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. If we cannot maintain valid mechanisms for cross-border data transfers, we and our customers may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from Europe or elsewhere. Any inability to transfer personal information to the United States or other jurisdictions could significantly and negatively impact our business operations; limit our ability to collaborate with parties that are subject to data privacy and security laws; or require us to increase our personal information processing capabilities in Europe and/or elsewhere at significant expense. In addition, outside of Europe, other jurisdictions have proposed and enacted laws relating to cross-border data transfer or requiring personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin. If we are unable to increase our data processing capabilities and storage in Europe and other jurisdictions to limit or eliminate the need for relevant data transfers quickly enough, and valid solutions for relevant personal information are not available or are difficult to implement in the interim, we will likely face continuing reluctance from European and multinational customers to use our services and increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal information across borders.

Previous wording

Our products and platform incorporate open source software, and we expect to continue to incorporate open source software in our products and platform in the future. Few of the licenses applicable to open source software have been interpreted by courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to commercialize our products and platform. Although we have implemented policies to regulate the use and incorporation of open source software into our products and platform, we cannot be certain that we have not incorporated open source software in our products or platform in a manner that is inconsistent with such policies. If we fail to comply with open source licenses, we may be subject to certain requirements, including requirements that we offer our products that incorporate the open source software for no cost, that we make available the source code for any modifications or derivative works we create based upon, incorporating or using the open source software and that we license such modifications or derivative works under the terms of applicable open source licenses. If an author or other third-party that distributes such open source software were to allege that we had not, or have not, complied with the terms and conditions of the license for such open source software, we could be required to incur significant legal expenses defending against such allegations and could be subject to significant damages, enjoined from generating revenue from customers using products that contained the open source software and required to comply with onerous conditions or restrictions on these products. In any of these events, we and our customers could be required to seek licenses from third parties in order to continue offering our products and platform and to re-engineer our products or platform or discontinue offering our products to customers in the event re-engineering cannot be accomplished on a timely basis. Any of the foregoing could require us to devote additional research and development resources to re-engineer our products or platform, damage our reputation, give rise to increased scrutiny regarding our use of open source software, result in customer dissatisfaction and may adversely affect our business, results of operations and financial condition.

Current wording

Our products and platform incorporate open source software, and we expect to continue to incorporate open source software in our products and platform in the future. Open source software presents certain risks in addition to those of third-party technology and intellectual property generally. Few of the licenses applicable to open source software have been interpreted by courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to commercialize our products and platform. Although we have implemented policies to regulate the use and incorporation of open source software into our products and platform, we cannot be certain that we have not incorporated open source software in our products or platform in a manner that is inconsistent with such policies. If we fail to comply with open source licenses, we may be subject to certain requirements, including requirements that we offer our products that incorporate the open source software for no cost, that we make available the source code for any modifications or derivative works we create based upon, incorporating or using the open source software and that we license such modifications or derivative works under the terms of applicable open source licenses. If an author or other third-party that distributes such open source software were to allege that we had not, or have not, complied with the terms and conditions of the license for such open source software, we could be required to incur significant legal expenses defending against such allegations and could be subject to significant damages, enjoined from generating revenue from customers using products that contained the open source software and required to comply with onerous conditions or restrictions on these products. In any of these events, we and our customers could be required to seek licenses from third parties in order to continue offering our products and platform and to re-engineer our products or platform or discontinue offering our products to customers in the event re-engineering cannot be accomplished on a timely basis. Any of the foregoing could require us to devote additional research and development resources to re-engineer our products or platform, damage our reputation, give rise to increased scrutiny regarding our use of open source software, result in customer dissatisfaction and may adversely affect our business, results of operations and financial condition.

Previous wording

We have deployed, and continue to develop and incorporate, AI solutions and features into our platform and our business, and these solutions and features may become more important to our operations or to our future growth over time. We expect to rely on AI solutions and features to help drive future growth in our business, but there can be no assurance that we will realize the desired or anticipated benefits from AI. For example, we are focused on continued product innovations to combine our communications products with contextual data and AI to address evolving customer needs and expectations. We are also building out new AI capabilities internally, including AI automation and agents in our self-service platform and in our internal operations. Our investments in AI solutions and features have and may continue to negatively impact our cost of revenue and gross margins until we are able to increase revenue enough to offset these investments. We may also fail to properly implement or market our AI solutions and features. Our competitors or other third parties may incorporate AI into their products, offerings, and solutions more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations. Our ability to effectively implement and market our AI solutions and features will depend, in part, on our ability to attract and retain employees with AI expertise, and we expect significant competition for professionals with the skills and technical knowledge that we will require. Additionally, our offerings based on AI may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm. For example, our business, financial condition and results of operations may be adversely affected if content or recommendations that AI solutions or features assist in producing are or are alleged to be deficient, inaccurate, or biased, or if such content, recommendations, solutions, or features or their development or deployment (including the collection, use, or other processing of data used to train or create such AI solutions or features) are found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal or contractual obligations to which we are or may become subject. The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations. These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources. AI also presents emerging ethical issues, and…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We have deployed, and continue to develop and incorporate, AI solutions and features into our platform and our business, and these solutions and features may become more important to our operations or to our future growth over time. We expect to rely on AI solutions and features to help drive future growth and efficiency in our business, but there can be no assurance that we will realize the desired or anticipated benefits from AI in a timely or cost-effective manner. For example, we are focused on continued product innovations to combine our communications products with contextual data and AI to address evolving customer needs and expectations. We are also building out new AI capabilities internally, including AI automation and agents in our self-service platform and in our internal operations. We may also fail to properly implement or market our AI solutions and features. Our competitors or other third parties may incorporate AI into their products, offerings, and solutions more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations. Our ability to effectively implement and market our AI solutions and features will depend, in part, on our ability to attract and retain employees with AI expertise, and we expect significant competition for professionals with the skills and technical knowledge that we will require. Additionally, our offerings based on AI may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm. For example, our business, financial condition and results of operations may be adversely affected if content or recommendations that AI solutions or features assist in producing are or are alleged to be deficient, inaccurate, harmful, or biased, or if such content, recommendations, solutions, or features or their development or deployment (including the collection, use, or other processing of data used to train or create such AI solutions or features) are found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal or contractual obligations to which we are or may become subject. If we fail to obtain any required permissions to collect, use, or otherwise process data, including personal information, in relation to AI solutions or features, or if we jeopardize the privacy or security of such information, it could adversely affect our business, results of operations and financial condition. The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations. These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI, and which may require us to make signi…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

As a provider of communications products and a licensed telecommunications provider, we are subject to existing or potential FCC and state regulations relating to privacy, telecommunications, consumer protection and other requirements. If we do not comply with FCC rules and regulations, or other communications laws and regulations, we could be subject to enforcement actions, fines, loss of licenses and possibly restrictions on our ability to operate or offer certain of our products. For example, in early 2023, we received a “cease-and-desist” letter from the FCC related to reported fraudulent traffic on our messaging platform, and in response we undertook certain mitigation efforts and other improvements to reduce future risks. Any enforcement action by the FCC or another regulatory authority, which may be a public process, would hurt our reputation in the industry, could erode customer trust, possibly impair our ability to sell our VoIP, other telecommunications products and/or other services to customers and could adversely affect our business, results of operations and financial condition.

Current wording

As a provider of communications products and a licensed telecommunications provider, we are subject to existing or potential FCC and state regulations relating to privacy, telecommunications, consumer protection and other requirements. If we do not comply with FCC rules and regulations, or other communications laws and regulations, we could be subject to enforcement actions, fines, loss of licenses and possibly restrictions on our ability to operate or offer certain of our products. Any enforcement action by the FCC or another regulatory authority, which may be a public process, would hurt our reputation in the industry, could erode customer trust, possibly impair our ability to sell our VoIP, other telecommunications products and/or other services to customers and could adversely affect our business, results of operations and financial condition.

Previous wording

•the Telephone Consumer Protection Act of 1991 (“TCPA”), which limits the use of automatic dialing systems for calls and texts, artificial or prerecorded voice messages and fax machines;

Current wording

•the Telephone Consumer Protection Act of 1991 (“TCPA”), which limits the use of automatic dialing systems for calls and texts, artificial or prerecorded voice messages and fax machines and establishes quiet hours for solicitations;

Previous wording

In addition, Congress and the FCC continue to focus on mitigating the prevalence of robocalls and robotexts, including by requiring providers to implement call authentication technologies such as Signature-based Handling of Asserted Information Using toKENs (“SHAKEN”) and Secure Telephone Identity Revisited (“STIR”), which together establish a set of technical standards and protocols that allow for the authentication and verification of caller ID information for calls carried over IP networks. Combating illegal calls has long been one of the FCC’s top consumer protection priorities, and the FCC continues to take steps to strengthen and expand its call blocking and robocall and robotext mitigation rules, including those related to the STIR/SHAKEN framework. We cannot predict whether the FCC will require more or different robocall and robotext mitigation measures than those we have or are planning to implement. New regulations or requirements that restrict the types of customers allowed to use our platform or impose overly burdensome requirements for our customers could limit the customers that we are able to serve. In addition, the extension of telecommunications regulations to our non-interconnected VoIP services could result in additional federal and state regulatory obligations and taxes.

Current wording

In addition, Congress and the FCC continue to focus on mitigating the prevalence of robocalls and robotexts, including by requiring providers to implement call authentication technologies such as Signature-based Handling of Asserted Information Using toKENs and Secure Telephone Identity Revisited, which together establish a set of technical standards and protocols that allow for the authentication and verification of caller ID information, adopting stricter Robocall Mitigation Database (“RMD”) filing requirements and increasing the base forfeiture amount for submitting false or inaccurate statements to the RMD. Combating illegal calls is one of the FCC’s top consumer protection priorities, and the FCC continues to take steps to strengthen, expand and enforce its rules against the origination and carrying of illegal robocalls and robotexts. We cannot predict whether the FCC will require more or different robocall and robotext mitigation measures than those we have or are planning to implement. New regulations or requirements that restrict the types of customers allowed to use our platform or impose overly burdensome requirements for our customers could limit the customers that we are able to serve. In addition, the extension of telecommunications regulations to our non-interconnected VoIP services could result in additional federal and state regulatory obligations and taxes.

Previous wording

Additionally, states such as California have increasingly adopted or proposed, or may propose, regulations that may subject us to additional registration, reporting, resiliency and/or compliance obligations. If we become subject to several new and/or different interconnected and/or non-interconnected VoIP regulations at the state level, it would increase our compliance costs and the risk of enforcement action against us, which in turn could adversely affect our business, results of operations and financial condition.

Current wording

Additionally, some states have adopted, proposed or may propose, regulations that may subject us to additional registration, reporting, resiliency and/or compliance obligations. If we become subject to several new and/or different interconnected and/or non-interconnected VoIP regulations at the state level, it would increase our compliance costs and the risk of enforcement action against us, which in turn could adversely affect our business, results of operations and financial condition.

Previous wording

Due to their limited availability, there are certain popular area code prefixes that we generally cannot obtain. Our inability to acquire or retain Numbering Resources for our operations may make our voice and messaging products less attractive to potential customers in these geographic areas. In addition, future growth in our customer base and those of other CPaaS providers may make it increasingly difficult to source larger quantities of Numbering Resources, and Numbering Resources may become more expensive or subject to more stringent regulation or conditions of usage.

Current wording

If we are unable to acquire or retain Numbering Resources, our voice and messaging products may be less attractive to potential customers. Certain popular area code prefixes have limited availability, and restrictive rules generally prevent us from obtaining or assigning certain number types. In addition, future growth in our customer base and those of other CPaaS providers may make it increasingly difficult to source larger quantities of Numbering Resources, and Numbering Resources may become more expensive or subject to more stringent regulation or conditions of usage.

Previous wording

The actual or perceived improper sending of text messages or voice calls may subject us to potential risks, including liabilities or claims relating to consumer protection laws and regulatory enforcement, including fines. For example, the TCPA restricts telemarketing and the use of automatic SMS text messages without prior express consent. TCPA violations can result in significant financial penalties, as businesses can incur penalties or criminal fines up to $1,500 per violation imposed by the FCC, state attorneys general or other state actors or through private litigation. Regulatory enforcement is often public, which would result in reputational harm.

Current wording

The actual or perceived improper sending of text messages or voice calls may subject us to potential risks, including liabilities or claims relating to consumer protection laws and regulatory enforcement, including fines. For example, the TCPA restricts telemarketing and the use of automatic SMS text messages without prior express consent. TCPA violations can result in significant financial penalties, as businesses can incur civil or criminal penalties imposed by the FCC, state attorneys general or other state actors or through private litigation. Regulatory enforcement is often public, which would result in reputational harm.

Previous wording

The current legislative and regulatory landscape regarding the regulation of the internet is subject to uncertainty. For example, in January 2025, the U.S. Court of Appeals for the Sixth Circuit struck down the FCC’s net neutrality rules, and it is unlikely that similar federal rules will be adopted. Without federal net neutrality rules, we cannot predict whether internet access service providers may be able to limit our users’ ability to access our platform or make our platform a less attractive alternative to our competitors’ applications. Moreover, several states such as California have enacted or are considering state-level legislation or executive action that would implement certain net neutrality protections. State broadband regulations have been upheld by courts in certain jurisdictions, creating the potential for a patchwork of disparate regulatory regimes and operational challenges.

Current wording

The current legislative and regulatory landscape regarding the regulation of the internet is subject to uncertainty. For example, in January 2025, the U.S. Court of Appeals for the Sixth Circuit struck down the FCC’s net neutrality rules, and it is unlikely that similar federal rules will be adopted. Without federal net neutrality rules, we cannot predict whether internet access service providers may be able to limit our users’ ability to access our platform or make our platform a less attractive alternative to our competitors’ applications. Moreover, several states have enacted or are considering state-level legislation or executive action that would implement certain net neutrality protections. State broadband regulations have been upheld by courts in certain jurisdictions, creating the potential for a patchwork of disparate regulatory regimes and operational challenges.

Previous wording

Certain of our products and services may be subject to international trade laws, including the U.S. Export Administration Regulations, U.S. customs laws, and U.S. economic and trade sanctions as well as similar laws and regulations in other countries in which we do business. Exports and imports of our products and the provision of our services must be made in compliance with these laws. We take precautions to prevent our products from being imported or exported and our services from being provided in violation of these laws; however, we are aware of certain of our products and services being provided to a small number of individuals and entities that are the subject of, or are located in countries or regions subject to, sanctions regulations administered by U.S. and foreign governmental authorities. If we fail to comply with these laws, we and certain of our employees could be subject to substantial civil or criminal penalties, including: the possible loss of export privileges; fines, which may be imposed on us and responsible employees or managers; criminal liability, which may be imposed on us and responsible employees or managers; and, in extreme cases, the incarceration of responsible employees or managers.

Current wording

Certain of our products and services may be subject to international trade laws, including the U.S. Export Administration Regulations, U.S. customs laws, and U.S. economic and trade sanctions as well as similar laws and regulations in other countries in which we do business. Exports and imports of our products and the provision of our services must be made in compliance with these laws. We take precautions to prevent our products from being imported or exported and our services from being provided in violation of these laws; however, we are aware of certain of our products and services being provided to, procured from, or that involve dealings with, a small number of individuals and entities that are the subject of, or are located in countries or regions subject to, sanctions regulations administered by U.S. and foreign governmental authorities. If we fail to comply with these laws, we and certain of our employees could be subject to substantial civil or criminal penalties, including: the possible loss of export privileges; fines, which may be imposed on us and responsible employees or managers; criminal liability, which may be imposed on us and responsible employees or managers; and, in extreme cases, the incarceration of responsible employees or managers.

Previous wording

From time to time, private entities and inbox service providers impose requirements that impact our and our customers’ ability to use and deliver email. For example, some of our IP addresses have become, and we expect will continue to be, listed with one or more denylisting entities due to the messaging practices of our customers and other users. We may be at an increased risk of having our IP addresses denylisted due to our scale and volume of email processed, compared to our smaller competitors. There can be no guarantee that we will be able to successfully remove ourselves from those lists. Because we fulfill email delivery on behalf of our customers, denylisting of this type could undermine the effectiveness of our customers’ transactional email, email marketing programs and other email communications, all of which could have a material negative impact on our business, financial condition and results of operations. In the first quarter of 2024, Google and Yahoo began enforcing new email sender requirements aimed at sender authentication, including Domain-based Message Authentication, Reporting and Conformance (“DMARC”) record requirements. These requirements have required us to devote time and resources toward compliance efforts, and these or similar authentication requirements imposed in the future could result in reduced volumes for our email products and could adversely affect our business, financial condition and results of operations.

Current wording

From time to time, private entities and inbox service providers impose requirements that impact our and our customers’ ability to use and deliver email. For example, some of our IP addresses have become, and we expect will continue to be, listed with one or more denylisting entities due to the messaging practices of our customers and other users. We may be at an increased risk of having our IP addresses denylisted due to our scale and volume of email processed, compared to our smaller competitors. There can be no guarantee that we will be able to successfully remove ourselves from those lists. Because we fulfill email delivery on behalf of our customers, denylisting of this type could undermine the effectiveness of our customers’ transactional email, email marketing programs and other email communications, all of which could have a material negative impact on our business, financial condition and results of operations. For example, in 2024 and 2025, Google, Yahoo and Microsoft began enforcing new email sender requirements aimed at sender authentication, including Domain-based Message Authentication, Reporting and Conformance (“DMARC”) record requirements, requiring us to devote time and resources toward compliance efforts. These or similar authentication requirements imposed in the future could result in reduced volumes for our email products and could adversely affect our business, financial condition and results of operations.

Previous wording

We review our intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable. Goodwill is required to be tested for impairment at least annually. As of March 31, 2025, we carried a net $5.5 billion of goodwill and intangible assets. An adverse change in market conditions or significant changes in accounting conclusions, particularly if such changes have the effect of changing one of our critical assumptions or estimates, could result in a change to the estimation of fair value that could result in an impairment charge to our goodwill or intangible assets. For example, during the year ended December 31, 2023, we recorded an impairment of intangible assets related to Segment totaling approximately $285.7 million, as described in additional detail in Note 6 to our consolidated financial statements included in our Annual Report on Form 10-K for the year ended December 31, 2023. Any such charges may adversely affect our results of operations.

Current wording

We review our intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable. Goodwill is required to be tested for impairment at least annually. As of June 30, 2025, we carried a net $5.4 billion of goodwill and intangible assets. An adverse change in market conditions or significant changes in accounting conclusions, particularly if such changes have the effect of changing one of our critical assumptions or estimates, could result in a change to the estimation of fair value that could result in an impairment charge to our goodwill or intangible assets. For example, during the year ended December 31, 2023, we recorded an impairment of intangible assets related to Segment totaling approximately $285.7 million, as described in additional detail in Note 6 to our consolidated financial statements included in our Annual Report on Form 10-K for the year ended December 31, 2023. Any such charges may adversely affect our results of operations.

Previous wording

As of December 31, 2024, we had U.S. federal, state and foreign net operating loss carryforwards (“NOLs”), of $2.8 billion, $2.4 billion and $0.8 billion, respectively. Utilization of these NOL carryforwards depends on our future taxable income, and there is risk that a portion of our existing NOLs could expire unused and the use of our unexpired NOLs could be subject to limitations, which could materially and adversely affect our operating results. Under current law, our U.S. federal NOLs can generally be carried forward indefinitely, but the deductibility of such NOLs is generally limited to 80% of taxable income. Our state NOLs may also be subject to limitations, including periods during which the use of state NOL carryforwards is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. For example, California recently enacted legislation that limits the use of state NOLs for taxable years beginning on or after January 1, 2024 and before January 1, 2027.

Current wording

As of December 31, 2024, we had U.S. federal, state and foreign net operating loss carryforwards (“NOLs”), of $2.8 billion, $2.4 billion and $0.8 billion, respectively. Utilization of these NOLs depends on our future taxable income, and there is risk that a portion of our existing NOLs could expire unused and the use of our unexpired NOLs could be subject to limitations, which could materially and adversely affect our operating results. Under current law, our U.S. federal NOLs can generally be carried forward indefinitely, but the deductibility of such NOLs is generally limited to 80% of taxable income. Our state NOLs may also be subject to limitations, including periods during which the use of state NOLs is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. For example, in June 2024, California enacted legislation that limits the use of state NOLs for taxable years beginning on or after January 1, 2024 and before January 1, 2027.

Previous wording

Historically, we have not billed or collected taxes in certain jurisdictions and, in accordance with GAAP, we have recorded a provision for our tax exposure in these jurisdictions when it is both probable that a liability has been incurred and the amount of the exposure can be reasonably estimated. We reserved $42.2 million on our March 31, 2025 balance sheet for these tax payments. These estimates include several key assumptions, including, but not limited to, the taxability of our products, the jurisdictions in which we believe we have nexus or a permanent establishment, and the sourcing of revenues to those jurisdictions. In the event these jurisdictions challenge our assumptions and analysis, our actual exposure could differ materially from our current estimates and reserves. If the actual payments we make to any jurisdiction exceed the accrual in our balance sheet, our results of operations would be harmed. In addition, some customers may question the incremental tax charges and seek to negotiate lower pricing from us, which could adversely affect our business, results of operations and financial condition.

Current wording

Historically, we have not billed or collected taxes in certain jurisdictions and, in accordance with GAAP, we have recorded a provision for our tax exposure in these jurisdictions when it is both probable that a liability has been incurred and the amount of the exposure can be reasonably estimated. We reserved $43.6 million on our June 30, 2025 balance sheet for these tax payments. These estimates include several key assumptions, including, but not limited to, the taxability of our products, the jurisdictions in which we believe we have nexus or a permanent establishment, and the sourcing of revenues to those jurisdictions. In the event these jurisdictions challenge our assumptions and analysis, our actual exposure could differ materially from our current estimates and reserves. If the actual payments we make to any jurisdiction exceed the accrual in our balance sheet, our results of operations would be harmed. In addition, some customers may question the incremental tax charges and seek to negotiate lower pricing from us, which could adversely affect our business, results of operations and financial condition.

Previous wording

We are subject to income taxes in both the United States and numerous international jurisdictions. Significant judgment is required in determining our worldwide provision for income taxes. In the ordinary course of our business, there are many transactions and calculations where the ultimate tax determination is uncertain. Our effective tax rates may fluctuate significantly on a quarterly basis because of a variety of factors, including changes in the mix of earnings and losses in countries with differing statutory tax rates, changes in our business or structure, changes in tax laws that could adversely impact our income or non-income taxes or the expiration of or disputes about certain tax agreements in a particular country. We are subject to audit by various tax authorities. In accordance with GAAP, we recognize income tax benefits, net of required valuation allowances and accrual for uncertain tax positions. Although we believe our tax estimates are reasonable, the final determination of tax audits and any related litigation could be materially different than that which is reflected in historical income tax provisions and accruals. Should additional taxes be assessed as a result of an audit or litigation, an adverse effect on our results of operations, financial condition and cash flows in the period or periods for which that determination is made could result.

Current wording

We are subject to income taxes in both the United States and numerous international jurisdictions. Significant judgment is required in determining our worldwide provision for income taxes. In the ordinary course of our business, there are many transactions and calculations where the ultimate tax determination is uncertain. Our effective tax rates may fluctuate significantly on a quarterly basis because of a variety of factors, including changes in the mix of earnings and losses in countries with differing statutory tax rates, changes in our business or structure, changes in tax laws that could adversely impact our income or non-income taxes or the expiration of or disputes about certain tax agreements in a particular country. We are subject to audit by various tax authorities. In accordance with GAAP, we recognize income tax benefits, net of required valuation allowances and accrual for uncertain tax positions. Although we believe our tax estimates are reasonable, the final determination of tax audits and any related litigation could be materially different than that which is reflected in our historical income tax provisions and accruals. Should additional taxes be assessed as a result of an audit or litigation, an adverse effect on our results of operations, financial condition and cash flows in the period or periods for which that determination is made could result.

Previous wording

Changes in tax laws or tax rulings, or changes in interpretations of existing laws, could cause us to be subject to additional income-based taxes and non-income taxes (such as payroll, sales, use, value-added, digital tax, net worth, property, and goods and services taxes), which in turn could materially affect our financial position and results of operations. Additionally, new, changed, modified, or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products. For example, on August 16, 2022, the Inflation Reduction Act of 2022 was signed into law, with tax provisions primarily focused on implementing a 15% minimum tax on global adjusted financial statement income of corporations with adjusted financial statement income exceeding $1.0 billion, effective for tax years beginning after December 31, 2022, and a 1% excise tax on share repurchases occurring after December 31, 2022, which resulted in an excise tax payable calculated on our 2023 and 2024 share repurchases.

Current wording

Changes in tax laws, including recently enacted U.S. federal tax legislation commonly referred to as the One Big Beautiful Bill Act (the “OBBB Act”), or tax rulings, or changes in interpretations of existing laws, could cause us to be subject to additional income-based taxes and non-income taxes (such as payroll, sales, use, value-added, digital tax, net worth, property, and goods and services taxes), which in turn could materially affect our financial position and results of operations. The OBBB Act could potentially increase our effective tax rate as we continue to expand our international operations in the coming years. Additionally, new, changed, modified, or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products. For example, on August 16, 2022, the Inflation Reduction Act of 2022 was signed into law, with tax provisions primarily focused on implementing a 15% minimum tax on global adjusted financial statement income of corporations with adjusted financial statement income exceeding $1.0 billion, effective for tax years beginning after December 31, 2022, and a 1% excise tax on share repurchases occurring after December 31, 2022, which resulted in an excise tax payable calculated on our 2023 and 2024 share repurchases.

Previous wording

On October 8, 2021, the Organization for Economic Co-operation and Development (the “OECD”) announced the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (the “Framework”) which agreed to a two-pillar solution to address tax challenges arising from digitalization of the economy. On December 20, 2021, the OECD released Pillar Two Model Rules defining the global minimum tax rules, which contemplate a minimum tax rate of 15% for large multinational companies. On December 15, 2022, the European Union (EU) Member States formally adopted the EU’s Pillar Two Directive and various countries have enacted or are in the process of enacting legislation on these rules. These changes, when enacted by various countries in which we do business, may increase our taxes in these countries.

Current wording

As another example, in 2021, the Organization for Economic Co-operation and Development (the “OECD”) announced the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (the “Framework”) and released Pillar Two Model Rules defining global minimum tax rules (“Pillar Two”), contemplating a minimum tax rate of 15% for large multinational companies. In 2022, the European Union (EU) Member States adopted the EU’s Pillar Two Directive, and various other countries have proposed or enacted similar legislation that may increase our taxes in these countries. On June 28, 2025, the G7 released a joint statement that it had reached an understanding with the United States for a side-by-side system based on certain accepted principles, including that U.S.-parented groups, such as ours, would be exempt from certain provisions of Pillar Two. However, this statement has not yet been incorporated into the Framework.

Previous wording

We may not realize the anticipated long-term stockholder value of our share repurchase programs, and any failure to repurchase our common stock after we have announced our intention to do so may negatively impact our stock price.

Current wording

We may not realize the anticipated long-term stockholder value of our share repurchase program, and any failure to repurchase our common stock after we have announced our intention to do so may negatively impact our stock price.

Previous wording

In January 2025, our board of directors authorized the repurchase of up to $2.0 billion of our common stock from time to time through a share repurchase program. As of March 31, 2025, we had repurchased $130.2 million of outstanding shares of our common stock under this program, such that approximately $1.9 billion remained available for purchase as of such date. Under our share repurchase program, we may make repurchases of stock through a variety of methods, including open share market purchases, privately negotiated purchases, entering into one or more confirmations or other contractual arrangements with a financial institution counterparty to effectuate one or more accelerated stock repurchase contracts, forward purchase contracts or similar derivative instruments, Dutch auction tender offers, or through a combination of any of the foregoing, in accordance with applicable federal securities laws. Our share repurchase program terminates at 11:59 pm Pacific Time on December 31, 2027, does not obligate us to repurchase any specific number of shares, and may be suspended at any time at our discretion and without prior notice. The timing and amount of any repurchases, if any, will be subject to liquidity, stock price, market and economic conditions, compliance with applicable legal requirements such as Delaware surplus and solvency tests and other relevant factors. Any failure to repurchase stock after we have announced our intention to do so may negatively impact our reputation and investor confidence in us and may negatively impact our stock price.

Current wording

In January 2025, our board of directors authorized the repurchase of up to $2.0 billion of our common stock from time to time through a share repurchase program. As of June 30, 2025, we had repurchased $306.9 million of outstanding shares of our common stock under this program, such that approximately $1.7 billion remained available for purchase as of such date. Under our share repurchase program, we may make repurchases of stock through a variety of methods, including open share market purchases, privately negotiated purchases, entering into one or more confirmations or other contractual arrangements with a financial institution counterparty to effectuate one or more accelerated stock repurchase contracts, forward purchase contracts or similar derivative instruments, Dutch auction tender offers, or through a combination of any of the foregoing, in accordance with applicable federal securities laws. Our share repurchase program terminates at 11:59 pm Pacific Time on December 31, 2027, does not obligate us to repurchase any specific number of shares, and may be suspended at any time at our discretion and without prior notice. The timing and amount of any repurchases, if any, will be subject to liquidity, stock price, market and economic conditions, compliance with applicable legal requirements such as Delaware surplus and solvency tests and other relevant factors. Any failure to repurchase stock after we have announced our intention to do so may negatively impact our reputation and investor confidence in us and may negatively impact our stock price.

Previous wording

The Delaware Forum Provision and the Federal Forum Provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers or employees, which may discourage lawsuits against us and our directors, officers and employees. If a court were to find the Delaware Forum Provision and the Federal

Current wording

The Delaware Forum Provision and the Federal Forum Provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers or employees, which may discourage lawsuits against us and our directors, officers and employees. If a court were to find the Delaware Forum Provision and the Federal Forum Provision in our bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could seriously harm our business.