DROPBOX INC

Previous wording

Additionally, many of our users initially access our platform free of charge. We strive to demonstrate the value of our platform to our registered users, thereby encouraging them to convert to paying users through in-product prompts and notifications, and time-limited trials of paid subscription plans. As of March 31, 2024, we served over 700 million registered users but only 18.16 million paying users. The actual number of unique users is lower than we report as one person may register more than once for our platform. As a result, we have fewer unique registered users that we may be able to convert to paying users. A majority of our registered users may never convert to a paid subscription to our platform, and failure to convert users to a paid subscription will restrict our ability to grow our revenue.

Current wording

Additionally, many of our users initially access our platform free of charge. We strive to demonstrate the value of our platform to our registered users, thereby encouraging them to convert to paying users through in-product prompts and notifications, and time-limited trials of paid subscription plans. As of June 30, 2024, we served over 700 million registered users but only 18.22 million paying users. The actual number of unique users is lower than we report as one person may register more than once for our platform. As a result, we have fewer unique registered users that we may be able to convert to paying users. A majority of our registered users may never convert to a paid subscription to our platform, and failure to convert users to a paid subscription will restrict our ability to grow our revenue.

Previous wording

Unauthorized parties have in the past gained access, and may in the future gain access, to systems, networks, or facilities used in our business through various means, including gaining unauthorized access to our systems, networks, or facilities, attempting to fraudulently induce our employees, users, or others into disclosing user names, passwords, or other sensitive information. For example, as previously disclosed in our Form 8-K filed with the Securities and Exchange Commission on May 1, 2024, on April 24, 2024, we became aware of unauthorized access to the Dropbox Sign production environment. We continue to face risks relating to this incident, including harm to our reputation and customer relationships along with litigation and regulatory scrutiny. Our investigation of this incident is ongoing and we may discover other impacts or new events related to this incident may occur that could affect our business operations, financial condition or results of operation. Any unauthorized or inadvertent access to, or an actual or perceived security breach of or incident impacting, our systems, or networks, or facilities, or those of third parties on which we rely, or those of any businesses or technologies we have acquired, could result in an actual or perceived loss of, or unauthorized access to or disclosure, modification, misuse, loss, corruption, unavailability, or destruction of, our data or our users' content, regulatory investigations, proceedings, and orders, claims, demands, and litigation, indemnity obligations, damages, penalties, fines, and other costs in connection with actual and alleged contractual breaches, violations of applicable laws and regulations or other actual or asserted obligations, and other liabilities. Any such incident could also materially damage our reputation and market position and harm our business, results of operations, and financial condition, including reducing our revenue, causing us to issue credits to users, negatively impacting our ability to accept and process user payment information, eroding our users’ trust in our services and payment solutions, subjecting us to costly user notification or remediation, harming our ability to retain users, harming our brand, or increasing our cost of acquiring new users. We maintain errors, omissions, and cyber liability insurance policies covering certain security and privacy damages. However, we cannot be certain that our coverage will be adequate for liabilities actually incurred or that insurance will continue to be available to us on economically reasonable terms, or at all. Further, if a high-profile security breach or incident occurs with respect to another content collaboration solutions provider, our users and potential users could lose trust in the security of content collaboration solutions providers generally, which could adversely impact our ability to retain users or attract new ones. We have also incorporated AI technologies into certain products and expect …

Excerpt shortened here; the source contains the full paragraph.

Current wording

Unauthorized parties have in the past gained access, and may in the future gain access, to systems, networks, or facilities used in our business through various means, including gaining unauthorized access to our systems, networks, or facilities, attempting to fraudulently induce our employees, users, or others into disclosing user names, passwords, or other sensitive information. For example, as previously disclosed in our Form 8-K filed with the Securities and Exchange Commission on May 1, 2024, on April 24, 2024, we became aware of unauthorized access to the Dropbox Sign production environment. We continue to face risks relating to this incident, including harm to our reputation and customer relationships, and ongoing litigation, in the form of four proposed class action lawsuits that have been filed in federal court in the Northern District of California, and regulatory scrutiny related to this incident, and we may discover other impacts or new related events may occur that could affect our business operations, financial condition or results of operations. Any unauthorized or inadvertent access to, or an actual or perceived security breach of or incident impacting, our systems, or networks, or facilities, or those of third parties on which we rely, or those of any businesses or technologies we have acquired, could result in an actual or perceived loss of, or unauthorized access to or disclosure, modification, misuse, loss, corruption, unavailability, or destruction of, our data or our users' content, regulatory investigations, proceedings, and orders, claims, demands, and litigation, indemnity obligations, damages, penalties, fines, and other costs in connection with actual and alleged contractual breaches, violations of applicable laws and regulations or other actual or asserted obligations, and other liabilities. Any such incident could also materially damage our reputation and market position and harm our business, results of operations, and financial condition, including reducing our revenue, causing us to issue credits to users, negatively impacting our ability to accept and process user payment information, eroding our users’ trust in our services and payment solutions, subjecting us to costly user notification or remediation, harming our ability to retain users, harming our brand, or increasing our cost of acquiring new users. We maintain errors, omissions, and cyber liability insurance policies covering certain security and privacy damages. However, we cannot be certain that our coverage will be adequate for liabilities actually incurred or that insurance will continue to be available to us on economically reasonable terms, or at all. Further, if a high-profile security breach or incident occurs with respect to another content collaboration solutions provider, our users and potential users could lose trust in the security of content collaboration solutions providers generally, which could adversely impact our ability to retain users o…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

The content collaboration market is characterized by rapid technological change and frequent new product and service introductions. Our ability to grow our user base and increase revenue from existing users will depend heavily on our ability to enhance and improve our platform, introduce new features and products, increase our strategic partnerships with third parties, and interoperate across an increasing range of devices, operating systems, and third-party applications. Users may require features and capabilities that our current platform does not have. The need to respond to technological changes may require investments in our business that could impact short-term growth or profitability. We have made, and intend to continue making, significant investments in developing products that will incorporate AI, and while we are optimistic that such new products will drive future growth of our business, the development of such new features will incur significant costs, we expect to face increasing competition, and there is no guarantee that such new product offerings will ultimately be successful. Additionally, use of newly-developed AI technology could result in reputational harm, operational risks, or legal liability. Moreover, uncertainty in the regulatory landscape relating to AI along with new or enhanced governmental or regulatory scrutiny could negatively impact our business in the U.S. or in other jurisdictions where we operate. For example, the European Union has enacted an Artificial Intelligence Act that prohibits certain AI applications and systems and imposes additional requirements on the use of certain applications or systems.

Current wording

The content collaboration market is characterized by rapid technological change and frequent new product and service introductions. Our ability to grow our user base and increase revenue from existing users will depend heavily on our ability to enhance and improve our platform, introduce new features and products, increase our strategic partnerships with third parties, and interoperate across an increasing range of devices, operating systems, and third-party applications. Users may require features and capabilities that our current platform does not have. The need to respond to technological changes may require investments in our business that could impact short-term growth or profitability. We have made, and intend to continue making, significant investments in developing products that will incorporate AI, and while we are optimistic that such new products will drive future growth of our business, the development of such new features will incur significant costs, we expect to face increasing competition, and there is no guarantee that such new product offerings will ultimately be successful. Additionally, use of newly-developed AI technology could result in reputational harm, operational risks, or legal liability. Moreover, uncertainty in the regulatory landscape relating to AI along with new or enhanced governmental or regulatory scrutiny could negatively impact our business in the U.S. or in other jurisdictions where we operate. For example, the European Union enacted the Artificial Intelligence Act in March 2024 that prohibits certain AI applications and systems and imposes additional requirements on the use of certain applications or systems.

Previous wording

compliance with applicable international laws, regulations, and standards including laws and regulations with respect to labor and employment, privacy, data protection, cybersecurity, consumer protection, tax, export control and sanctions, and unsolicited email, and the risk of penalties to our users and individual members of management or employees if our practices are deemed to be out of compliance;

Current wording

•compliance with applicable international laws, regulations, and standards including laws and regulations with respect to labor and employment, privacy, data protection, cybersecurity, AI, consumer protection, tax, export control and sanctions, and unsolicited email, and the risk of penalties to our users and individual members of management or employees if our practices are deemed to be out of compliance;

Previous wording

Google, each of whom charge us in-application purchase fees. As a result, if more of our users subscribe to our products through mobile applications, these fees may have an adverse impact on our results of operations. In addition, although we anticipate that our shift to a Virtual First work model will have a long-term positive impact on our financial results and business operations, the impact remains uncertain. We have incurred impairment charges related to our facilities and may incur additional or unanticipated expense related to subleasing our facilities, including lower than anticipated sublease income that may result in additional or higher impairment charges than we have currently estimated, particularly if we are unable to sublease our unused office space on favorable terms or at all or if our subtenants fail to make lease payments to us in connection with our shift to a Virtual First model. We may also encounter unforeseen or unpredictable factors, including fluctuations in foreign currency exchange rates, unforeseen operating expenses, complications, or delays, which may result in increased costs, or cause us to generate less sublease income than we have currently estimated. Furthermore, it is difficult to predict the size and growth rate of our market, user demand for our platform or for any new features or products we develop, user adoption and renewal of our platform or of any new features or products we develop, the entry of competitive products and services, or the success of existing competitive products and services. As a result, we may not achieve or maintain profitability in future periods, or we may not otherwise achieve our goals related to profitability. If we fail to grow our revenue sufficiently to keep pace with our investments and other expenses, our results of operations and financial condition would be adversely affected.

Current wording

Although we had been profitable on a GAAP basis in prior fiscal quarters, 2021 was our first profitable full fiscal year and we incurred net losses on an annual basis from our inception to that time. We may, however, not achieve or maintain profitability in future periods, or, if we are profitable, we may not fully achieve our profitability targets. As we strive to grow our business, expenses may increase, particularly as we continue to make investments to scale our business, reposition our products or respond to new technologies including significant investments in AI technologies and product development. For example, we will need an increasing amount of technical infrastructure to continue to satisfy the needs of our user base. Our research and development expenses may also increase as we plan to continue to hire employees for our engineering, product, and design teams to support these efforts. These investments may not result in increased revenue or growth in our business or our revenue may not grow to the extent we expect and expense growth may outpace revenue. Further, we have created mobile applications and mobile versions of Dropbox that are distributed to users primarily through app stores operated by Apple and Google, each of whom charge us in-application purchase fees. As a result, if more of our users subscribe to our products through mobile applications, these fees may have an adverse impact on our results of operations. In addition, although we anticipate that our shift to a Virtual First work model will have a long-term positive impact on our financial results and business operations, the impact remains uncertain. We have incurred impairment charges related to our facilities and may incur additional or unanticipated expense related to subleasing our facilities, including lower than anticipated sublease income that may result in additional or higher impairment charges than we have currently estimated, particularly if we are unable to sublease our unused office space on favorable terms or at all or if our subtenants fail to make lease payments to us in connection with our shift to a Virtual First model. We may also encounter unforeseen or unpredictable factors, including fluctuations in foreign currency exchange rates, unforeseen operating expenses, complications, or delays, which may result in increased costs, or cause us to generate less sublease income than we have currently estimated. Furthermore, it is difficult to predict the size and growth rate of our market, user demand for our platform or for any new features or products we develop, user adoption and renewal of our platform or of any new features or products we develop, the entry of competitive products and services, or the success of existing competitive products and services. As a result, we may not achieve or maintain profitability in future periods, or we may not otherwise achieve our goals related to profitability. If we fail to grow our revenue sufficiently to keep pac…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We are also subject to various U.S. and international anti-corruption laws, such as the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, and Irish Criminal Justice (Corruption Offences) Act 2018, as well as other similar anti-bribery and anti-kickback laws and regulations. These laws and regulations generally prohibit companies and their employees and intermediaries from authorizing, offering, or providing improper payments or benefits to officials and other recipients for improper purposes.

Current wording

We are also subject to various U.S. and international anti-corruption laws, such as the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, and Irish Criminal Justice (Corruption Offences) Act 2018, as well as other similar anti-bribery and anti-kickback laws and regulations. These laws and regulations generally prohibit companies and their employees and intermediaries from authorizing, offering, or providing improper payments or benefits to officials and other recipients for improper purposes. Although we take precautions to prevent violations of these laws, our exposure for violating these laws increases as we continue to expand our international presence and any failure to comply with such laws could harm our reputation and our business.

Previous wording

European Commission (“SCCs”) to transfer personal data. A recent decision by the Irish Data Protection Commission (“IDPC”) found the additional measures employed by Meta Platforms, Inc. (“Meta”) in response to the CJEU decision to be inadequate, resulting in an order for Meta to suspend transfers of EU data to the US. This decision was limited to Meta, but similar decisions against other providers are possible. The CJEU and IDPC decisions may result in data protection regulators applying differing standards for, and requiring additional measures in connection with, transfers of personal data from the EEA and Switzerland to the United States. The European Commission issued revised SCCs in June 2021 that are required to be implemented. The revised SCCs and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of the EEA and Switzerland, which may increase our costs, lead to increased regulatory scrutiny or liability, necessitate additional contractual negotiations, and adversely impact our business, results of operations, and financial results.

Current wording

While we rely on legal mechanisms to transfer data from the EEA, the United Kingdom, and Switzerland to the United States, there is some regulatory uncertainty surrounding the future of data transfers from these locations to the United States, and we are closely monitoring regulatory developments in this area. On July 16, 2020, the Court of Justice of the European Union (“CJEU”) imposed additional obligations on companies relying on standard contractual clauses approved by the European Commission (“SCCs”) to transfer personal data. A recent decision by the Irish Data Protection Commission (“IDPC”) found the additional measures employed by Meta Platforms, Inc. (“Meta”) in response to the CJEU decision to be inadequate, resulting in an order for Meta to suspend transfers of EU data to the US. This decision was limited to Meta, but similar decisions against other providers are possible. The CJEU and IDPC decisions may result in data protection regulators applying differing standards for, and requiring additional measures in connection with, transfers of personal data from the EEA and Switzerland to the United States. The European Commission issued revised SCCs in June 2021 that are required to be implemented. The revised SCCs and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of the EEA and Switzerland, which may increase our costs, lead to increased regulatory scrutiny or liability, necessitate additional contractual negotiations, and adversely impact our business, results of operations, and financial results.

Previous wording

Additionally, several states in the U.S. have enacted new data privacy laws. For example, the California Consumer Privacy Act of 2018 (“CCPA”), which affords consumers expanded privacy protections, went into effect on January 1, 2020. The California Privacy Rights Act ("CPRA"), effective as of January 1, 2023, significantly modified the CCPA, resulting in uncertainty and requiring us to incur additional costs and expenses. The enactment of the CCPA has prompted similar legislative developments in other states. For example, Virginia, Colorado, Utah, and Connecticut have each passed laws similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar laws that go into effect in 2024; Tennessee, Delaware, New Jersey, Nebraska, and Iowa have enacted similar laws that go into effect in 2025, and Indiana has enacted a similar law, that will go into effect in 2026. Other laws relating to privacy and cybersecurity, many of which are similar to the CCPA and CPRA, are being considered by other state legislatures, and the U.S. federal government is contemplating federal privacy legislation. These developments create the potential for a patchwork of overlapping but different laws throughout the U.S. relating to privacy and cybersecurity. The effects of the CCPA and these other laws remain far-reaching and, depending on final regulatory guidance and other related developments, may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. Similarly, a number of legislative initiatives in the EEA and the United States, at both the federal and state level, as well as other jurisdictions have been proposed or enacted, and could impose new obligations in areas affecting our business. For example, on November 17, 2022, the Digital Services Act (“DSA”) entered into force in the EU and includes new obligations to limit the spread of illegal content and illegal products online, increase the protection of minors, and provide users with more choice and transparency and allows for fines of up to 6% of annual turnover. The impacts of the DSA on the overall industry, business models and our operations are uncertain, and these regulations could result in changes to our subscriptions or introduce new operational requirements and administrative costs, each of which could have an adverse effect on our business, results of operations, and financial condition.

Current wording

Additionally, several states in the U.S. have enacted new data privacy laws. For example, the California Consumer Privacy Act of 2018 (“CCPA”), which affords consumers expanded privacy protections, went into effect on January 1, 2020. The California Privacy Rights Act ("CPRA"), effective as of January 1, 2023, significantly modified the CCPA, resulting in uncertainty and requiring us to incur additional costs and expenses. The enactment of the CCPA has prompted similar legislative developments in other states. For example, Virginia, Colorado, Utah, and Connecticut have each passed laws similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar laws that have taken or will take effect in 2024; Tennessee, Delaware, New Jersey, Nebraska, Iowa, Maryland, Minnesota, and New Hampshire have enacted similar laws that go into effect in 2025, and Indiana, Kentucky, and Rhode Island have enacted similar laws that will go into effect in 2026. Other laws relating to privacy and cybersecurity, many of which are similar to the CCPA and CPRA, are being considered by other state legislatures, and the U.S. federal government is contemplating federal privacy legislation. These developments create the potential for a patchwork of overlapping but different laws throughout the U.S. relating to privacy and cybersecurity. The effects of the CCPA and these other laws remain far-reaching and, depending on final regulatory guidance and other related developments, may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. Similarly, a number of legislative initiatives in the EEA and the United States, at both the federal and state level, as well as other jurisdictions have been proposed or enacted, and could impose new obligations in areas affecting our business. For example, on November 17, 2022, the Digital Services Act (“DSA”) entered into force in the EU and includes new obligations to limit the spread of illegal content and illegal products online, increase the protection of minors, and provide users with more choice and transparency and allows for fines of up to 6% of annual turnover. The impacts of the DSA on the overall industry, business models and our operations are uncertain, and these regulations could result in changes to our subscriptions or introduce new operational requirements and administrative costs, each of which could have an adverse effect on our business, results of operations, and financial condition.

Previous wording

Our Class A common stock has one vote per share, our Class B common stock has ten votes per share, and our Class C common stock has no voting rights, except as otherwise required by law. As of March 31, 2024, our directors and executive officers, and their respective affiliates, held in the aggregate 75.8% of the voting power of our capital stock, with Mr. Houston holding approximately 75.6% of the voting power of our capital stock. We are including the Co-Founder Grant (as defined in “Significant Impacts of Stock-Based Compensation” included in Part II, Item 7 of this report) in this calculation since the shares underlying such grant are legally issued and outstanding shares of our Class A common stock and Mr. Houston is able to vote these shares prior to their vesting. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval so long as the shares of Class B common stock represent at least 9.1% of all outstanding shares of our Class A and Class B common stock. This concentrated control will limit or preclude other stockholders’ ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that other stockholders may feel are in their best interests as one of our stockholders.

Current wording

Our Class A common stock has one vote per share, our Class B common stock has ten votes per share, and our Class C common stock has no voting rights, except as otherwise required by law. As of June 30, 2024, our directors and executive officers, and their respective affiliates, held in the aggregate 76.4% of the voting power of our capital stock, with Mr. Houston holding approximately 76.2% of the voting power of our capital stock. We are including the Co-Founder Grant (as defined in “Significant Impacts of Stock-Based Compensation” included in Part II, Item 7 of this report) in this calculation since the shares underlying such grant are legally issued and outstanding shares of our Class A common stock and Mr. Houston is able to vote these shares prior to their vesting. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval so long as the shares of Class B common stock represent at least 9.1% of all outstanding shares of our Class A and Class B common stock. This concentrated control will limit or preclude other stockholders’ ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that other stockholders may feel are in their best interests as one of our stockholders.

Previous wording

(3) Includes 34,454 shares of restricted common stock withheld by the Company upon vesting of restricted stock awards to satisfy tax withholding requirements.

Current wording

(3) Includes 39,657 shares of restricted common stock withheld by the Company upon vesting of restricted stock awards to satisfy tax withholding requirements.