DROPBOX, INC.

Previous wording

The rate of growth of our business and revenue has declined in recent periods and we have experienced negative growth. If we are unable to execute on our new product initiatives and plans for growth in the future, we may be unable to reverse this trend. Our new product initiatives, including any AI-based initiatives, are intended to result in growth, but such initiatives require a period of investment and ultimately may not succeed on the timelines we expect or at all. If our new products or product enhancements do not achieve adequate adoption by our customers or do not result in increased paid users or subsequent renewals, our competitive position will be impaired or our anticipated revenue growth may not be achieved. Any additional revenue our new initiatives generate may be insufficient to offset the amounts we have invested or the declining rates of growth in other areas of our business and may harm our profitability.

Current wording

The rate of growth of our business and revenue has declined in recent periods and we have experienced negative growth. If we are unable to execute on our new product initiatives and plans for growth in the future, we may be unable to reverse this trend. Our new product initiatives, including any AI-based initiatives and those related to advancing our recently announced DBX Agent Cloud infrastructure offering, are intended to result in growth, but such initiatives require a period of investment and ultimately may not succeed on the timelines we expect or at all. If our new products or product enhancements do not achieve adequate adoption by our customers or do not result in increased paid users or subsequent renewals, our competitive position will be impaired or our anticipated revenue growth may not be achieved. Any additional revenue our new initiatives generate may be insufficient to offset the amounts we have invested or the declining rates of growth in other areas of our business and may harm our profitability.

Previous wording

Many of our users initially access our platform free of charge. We strive to demonstrate the value of our platform to our registered users, thereby encouraging them to convert to paying users through in-product prompts and notifications, and time-limited trials of paid subscription plans. As of June 30, 2026, we served over 700 million registered users but only 18.19 million paying users. The actual number of unique users is lower than we report as one person may register more than once on our platform. As a result, we have fewer unique registered users that we may be able to convert to paying users. A majority of our registered users may never convert to a paid subscription to our platform, and failure to convert users to a paid subscription will restrict our ability to grow our revenue.

Current wording

Many of our users initially access our platform free of charge. We strive to demonstrate the value of our platform to our registered users, thereby encouraging them to convert to paying users through in-product prompts and notifications, and time-limited trials of paid subscription plans. As of September 30, 2026, we served over 700 million registered users but only 18.20 million paying users. The actual number of unique users is lower than we report as one person may register more than once on our platform. As a result, we have fewer unique registered users that we may be able to convert to paying users. A majority of our registered users may never convert to a paid subscription to our platform, and failure to convert users to a paid subscription will restrict our ability to grow our revenue.

Previous wording

Unauthorized parties have in the past gained access, and may in the future gain access, to systems, networks, or facilities used in our business through various means, including gaining unauthorized access to our systems, networks, or facilities, attempting to fraudulently induce our employees, users, or others into disclosing user names, passwords, or other sensitive information. For example, as previously disclosed in our Form 8-K filed with the Securities and Exchange Commission on May 1, 2024, on April 24, 2024, we became aware of unauthorized access to the Dropbox Sign production environment. We continue to face risks relating to this incident, including harm to our reputation and customer relationships, and ongoing litigation, in the form of a consolidated class action lawsuit that has been filed in federal court in the Northern District of California, and regulatory scrutiny related to this incident, and we may discover other impacts or new related events may occur that could affect our business operations, financial condition or results of operations. Any unauthorized or inadvertent access to, or an actual or perceived security breach of or incident impacting, our systems, or networks, or facilities, or those of third parties on which we rely, or those of any businesses or technologies we have acquired, could result in an actual or perceived loss of, or unauthorized access to or disclosure, modification, misuse, loss, corruption, unavailability, or destruction of, our data or our users' content, regulatory investigations, proceedings, and orders, claims, demands, and litigation, indemnity obligations, damages, penalties, fines, and other costs in connection with actual and alleged contractual breaches, violations of applicable laws and regulations or other actual or asserted obligations, and other liabilities. Any such incident could also materially damage our reputation and market position and harm our business, results of operations, and financial condition, including reducing our revenue, causing us to issue credits to users, negatively impacting our ability to accept and process user payment information, eroding our users’ trust in our services and payment solutions, subjecting us to costly user notification or remediation, harming our ability to retain users, harming our brand, or increasing our cost of acquiring new users. We maintain errors, omissions, and cyber liability insurance policies covering certain security and privacy damages. However, we cannot be certain that our coverage will be adequate for liabilities actually incurred or that insurance will continue to be available to us on economically reasonable terms, or at all. Further, if a high-profile security breach or incident occurs with respect to another content collaboration solutions provider, our users and potential users could lose trust in the security of content collaboration solutions providers generally, which could adversely impact our ability to retain users or…

Excerpt shortened here; the source contains the full paragraph.

Current wording

California, and regulatory scrutiny related to this incident, and we may discover other impacts or new related events may occur that could affect our business operations, financial condition or results of operations. Any unauthorized or inadvertent access to, or an actual or perceived security breach of or incident impacting, our systems, or networks, or facilities, or those of third parties on which we rely, or those of any businesses or technologies we have acquired, could result in an actual or perceived loss of, or unauthorized access to or disclosure, modification, misuse, loss, corruption, unavailability, or destruction of, our data or our users' content, regulatory investigations, proceedings, and orders, claims, demands, and litigation, indemnity obligations, damages, penalties, fines, and other costs in connection with actual and alleged contractual breaches, violations of applicable laws and regulations or other actual or asserted obligations, and other liabilities. Any such incident could also materially damage our reputation and market position and harm our business, results of operations, and financial condition, including reducing our revenue, causing us to issue credits to users, negatively impacting our ability to accept and process user payment information, eroding our users’ trust in our services and payment solutions, subjecting us to costly user notification or remediation, harming our ability to retain users, harming our brand, or increasing our cost of acquiring new users. We maintain errors, omissions, and cyber liability insurance policies covering certain security and privacy damages. However, we cannot be certain that our coverage will be adequate for liabilities actually incurred or that insurance will continue to be available to us on economically reasonable terms, or at all. Further, if a high-profile security breach or incident occurs with respect to another content collaboration solutions provider, our users and potential users could lose trust in the security of content collaboration solutions providers generally, which could adversely impact our ability to retain users or attract new ones. We have also incorporated AI technologies into certain products and expect to continue to incorporate additional AI technologies into our products and otherwise into our business and operations in the future. The use of AI technologies and the accelerated product development lifecycle for AI products may create additional or increase existing cybersecurity risks and may result in security or privacy incidents. Further, cybersecurity attacks may use AI technologies and increase the risk of security incidents.

Previous wording

Emerging and evolving cybersecurity threats pose significant challenges and involve increasingly sophisticated threat actors, including those leveraging AI and machine learning. Malware, ransomware, viruses, social engineering (such as phishing), denial of service, insider misuse, and other network attacks have become more prevalent, particularly against cloud-based services. Threat actors may use AI or autonomous AI agents to enhance and scale attacks, including generating convincing phishing content, deepfakes, and adaptive malware, making detection and mitigation more difficult. In this fast-changing threat environment, we are continuously assessing our security posture, including through the use of penetration testing and red team exercises, to identify gaps, threats, and vulnerabilities and, where we believe appropriate, we actively take additional and ongoing steps that are intended to strengthen our defenses, including cybersecurity capabilities, and to mitigate the risk of a breach or incident. We also evaluate risks associated with our use of AI, including risks related to data integrity, model security, and potential misuse or manipulation. However, AI technologies may introduce new or amplify existing risks, including unintended system behaviors or exploitation by malicious actors. If we fail to respond appropriately to any identified gaps, threats or vulnerabilities, including by providing sufficient investment and prioritizing strategic initiatives, or if we fail to adequately identify the gaps, threats or vulnerabilities, we face greater risk that an unauthorized party will obtain access to, or disrupt, our systems or networks or obtain access to data or content that we or third parties on which we rely store or otherwise process. Notwithstanding our efforts, we may fail to detect the existence of security breaches or incidents, including breaches or compromises of user content, and may be unable to prevent unauthorized access to user content. Malicious third parties might use techniques that we are unable to defend against to compromise and infiltrate our systems, infrastructure, and networks. The techniques used to obtain unauthorized access to, and to disable or degrade service, or sabotage systems change frequently and are often not recognized until launched against a target. They may originate from less regulated or remote areas around the world, or from state-sponsored actors, and the risks could also be elevated in connection with wars or other armed conflicts. If our security measures are breached or compromised or we, our systems, facilities or networks, or those of third parties on which we rely otherwise are subject to a security breach or incident, or our users’ content or other data is otherwise accessed, misused, modified, rendered unavailable, destroyed, or otherwise processed through unauthorized means, or if any such actions are believed to occur, our platform may be perceived as insecure, and we may lose existing u…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Emerging and evolving cybersecurity threats pose significant challenges and involve increasingly sophisticated threat actors, including those leveraging AI and machine learning. Malware, ransomware, viruses, social engineering (such as phishing), denial of service, insider misuse, and other network attacks have become more prevalent, particularly against cloud-based services. Rapid advancements in AI technologies have increased, and may continue to increase, the frequency, scale, and sophistication of cyberattacks, including by enabling threat actors to more rapidly identify and exploit vulnerabilities in systems and networks. Threat actors may use AI or autonomous AI agents to enhance and scale attacks, including generating convincing phishing content, deepfakes, and adaptive malware, making detection and mitigation more difficult, and reducing the time available to identify, respond to, and remediate such threats. These developments may increase risks of security breaches and incidents occurring and the impact of those that do occur. In this fast-changing threat environment, we are continuously assessing our security posture, including through the use of penetration testing and red team exercises, to identify gaps, threats, and vulnerabilities and, where we believe appropriate, we actively take additional and ongoing steps that are intended to strengthen our defenses, including cybersecurity capabilities, and to mitigate the risk of a breach or incident. We also evaluate risks associated with our use of AI, including risks related to data integrity, model security, and potential misuse or manipulation. However, AI technologies may introduce new or amplify existing risks, including unintended system behaviors or exploitation by malicious actors. If we fail to respond appropriately to any identified gaps, threats or vulnerabilities, including by providing sufficient investment and prioritizing strategic initiatives, or if we fail to adequately identify the gaps, threats or vulnerabilities, we face greater risk that an unauthorized party will obtain access to, or disrupt, our systems or networks or obtain access to data or content that we or third parties on which we rely store or otherwise process. Notwithstanding our efforts, we may fail to detect the existence of security breaches or incidents, including breaches or compromises of user content, and may be unable to prevent unauthorized access to user content. Malicious third parties might use techniques that we are unable to defend against to compromise and infiltrate our systems, infrastructure, and networks. The techniques used to obtain unauthorized access to, and to disable or degrade service, or sabotage systems change frequently and are often not recognized until launched against a target. They may originate from less regulated or remote areas around the world, or from state-sponsored actors, and the risks could also be elevated in connection with wars or other armed conflicts. If our sec…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We depend on the continued service and performance of our key personnel. In particular, our Co-Chief Executive Officers, Andrew W. Houston and Ashraf Alkarmi, as well as other members of our executive leadership team, are important to our vision, strategic direction, culture, and offerings. From time-to-time, there have been changes in our management team resulting from the hiring or departure of our executives, and there may be additional changes in the future. While we seek to manage these transitions carefully, such changes may result in a loss of institutional knowledge and may cause disruptions to our business. If we fail to successfully integrate new key personnel into our organization or if key employees are unable to successfully transition into new roles, our business could be adversely affected.

Current wording

We depend on the continued service and performance of our key personnel. In particular, our Co-Chief Executive Officers, Andrew W. Houston and Ashraf Alkarmi, as well as other members of our executive leadership team, are important to our vision, strategic direction, culture, and offerings. From time-to-time, there have been changes in our management team resulting from the hiring or departure of our executives, and there may be additional changes in the future. For example, we announced on October 28, 2026 that Ali Dasdan plans to resign as our Chief Technology Officer. While we seek to manage these transitions carefully, such changes may result in a loss of institutional knowledge and may cause disruptions to our business. If we fail to successfully integrate new key personnel into our organization or if key employees are unable to successfully transition into new roles, our business could be adversely affected.

Previous wording

To execute our business plan, we must attract and retain highly qualified personnel. Competition for these employees is intense and we may not be successful in attracting and retaining qualified personnel. We have experienced, and we may continue to experience, difficulty in hiring and retaining highly skilled employees with appropriate qualifications. As we continue to operate in a Virtual First work model, our recent hires and planned hires may not become as productive as we expect, and we may be unable to hire, integrate, or retain sufficient numbers of qualified individuals. Many of the companies with which we compete for experienced personnel have greater resources than we have. In addition, in making employment decisions, particularly in the internet and high-technology industries, job candidates often consider the value of the equity they are to receive in connection with their employment. Employees may be more likely to leave us if the shares they own or the shares underlying their equity incentive awards have significantly appreciated or significantly reduced in value. Many of our employees may receive significant proceeds from sales of our equity in the public markets, which may reduce their motivation to continue to work for us. If we fail to attract new personnel, or fail to retain and motivate our current personnel, our business, financial results, and growth prospects could be harmed.

Current wording

To execute our business plan, we must attract and retain highly qualified personnel. Competition for these employees is intense and we may not be successful in attracting and retaining qualified personnel. We have experienced, and we may continue to experience, difficulty in hiring and retaining highly skilled employees with appropriate qualifications. As we continue to operate in a Virtual First work model, our recent hires and planned hires may not become as productive as we expect, and we may be unable to hire, integrate, or retain sufficient numbers of qualified individuals. Many of the companies with which we compete for experienced personnel have greater resources than we have. In addition, in making employment decisions, particularly in the internet and high-technology industries, job candidates often consider the value of the equity they are to receive in connection with their employment. Employees may be more likely to leave us if the shares they own or the shares underlying their equity incentive awards have significantly appreciated or significantly reduced in value. Many of our employees may receive significant proceeds from sales of our equity in the public markets, which may reduce their motivation to continue to work for us. Furthermore, our 2026 reductions in workforce may result in increased attrition beyond our intended reduction-in-force, reduce employee morale, and negatively impact employee recruiting and retention. If we fail to attract new personnel, or fail to retain and motivate our current personnel, our business, financial results, and growth prospects could be harmed.

Previous wording

We use software and services licensed and procured from third parties to develop and offer our platform. We may need to obtain additional licenses and services from third parties to use intellectual property and technology associated with the development of our platform, which might not be available to us on acceptable terms, or at all. Any loss of the right to use any software or services required for the development and maintenance of our platform could result in delays in the provision of our platform until equivalent technology is either developed by us, or, if available from others, is identified, obtained, and integrated, which could harm our platform and business. Any errors or defects in third-party software or services could result in errors or a failure of our platform, which could harm our business, results of operations, and financial condition.

Current wording

We use software and services licensed, procured, or otherwise provided by third parties, including through connected apps and integrations, to develop and offer our platform. We may need to obtain additional licenses and services from third parties to use intellectual property and technology associated with the development of our platform, which might not be available to us on acceptable terms, or at all. Any loss of the right to use any software or services required for the development and maintenance of our platform could result in delays in the provision of our platform until equivalent technology is either developed by us, or, if available from others, is identified, obtained, and integrated, which could harm our platform and business. Any errors or defects in third-party software or services could result in errors or a failure of our platform, which could harm our business, results of operations, and financial condition.

Previous wording

Moreover, uncertainty in the regulatory landscape relating to AI along with new or enhanced governmental or regulatory scrutiny could negatively impact our business in the U.S. or in other jurisdictions where we operate. For example, the European Union enacted the Artificial Intelligence Act in March 2024 that prohibits certain AI applications and systems and imposes additional requirements on the use of certain applications or systems. Additionally, several U.S. states have proposed, and in certain cases have enacted, legislation covering the deployment and regulation of AI technology, or otherwise imposing obligations in connection with the use of AI.

Current wording

Union enacted the Artificial Intelligence Act in March 2024 that prohibits certain AI applications and systems and imposes additional requirements on the use of certain applications or systems. Additionally, several U.S. states have proposed, and in certain cases have enacted, legislation covering the deployment and regulation of AI technology, or otherwise imposing obligations in connection with the use of AI.

Previous wording

Additionally, several states in the U.S. have enacted new data privacy laws. For example, the California Consumer Privacy Act of 2018 (“CCPA”), which affords consumers expanded privacy protections, went into effect on January 1, 2020. The California Privacy Rights Act ("CPRA"), effective as of January 1, 2023, significantly modified the CCPA, resulting in uncertainty and requiring us to incur additional costs and expenses. The enactment of the CCPA has led numerous other states to propose, and in many cases enact, legislation similar to the CCPA. Other laws relating to privacy and cybersecurity, many of which are similar to the CCPA and CPRA, are being considered by other state legislatures, and certain U.S. states have enacted such legislation, such as Washington’s My Health, My Data Act, which includes a private right of action. The U.S. federal government also is contemplating federal privacy legislation. These developments create the potential for a patchwork of overlapping but different laws throughout the U.S. relating to privacy and cybersecurity. The effects of the CCPA and these other laws remain far-reaching and, depending on final regulatory guidance and other related developments, may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. Similarly, a number of legislative initiatives in the EEA and the United States, at both the federal and state level, as well as other jurisdictions have been proposed or enacted, and could impose new obligations in areas affecting our business. For example, on November 17, 2022, the Digital Services Act (“DSA”) entered into force in the EU and includes new obligations to limit the spread of illegal content and illegal products online, increase the protection of minors, and provide users with more choice and transparency and allows for fines of up to 6% of annual turnover. The impacts of the DSA on the overall industry, business models and our operations are uncertain, and these regulations could result in changes to our subscriptions or introduce new operational requirements and administrative costs, each of which could have an adverse effect on our business, results of operations, and financial condition. Further, the EU has enacted or revised numerous regimes relating to cybersecurity. For example, it has revised its Cybersecurity Directive (“NIS2”), with EU member states having been obligated to transpose it into national law by October 17, 2024, but with some member states’ transpositions yet to be finalized. NIS2, among other things, obligates companies to adopt or update policies and procedures on issues such as incident handling and supply chain security, implementing certain administrative measures, and requires top management’s involvement in cybersecurity risk-management measures, with top management potentially held liable for non-compliance. More generally, NIS2 provides for significant penalties for noncomplian…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Additionally, several states in the U.S. have enacted new data privacy laws. For example, the California Consumer Privacy Act of 2018 (“CCPA”), which affords consumers expanded privacy protections, went into effect on January 1, 2020. The California Privacy Rights Act ("CPRA"), effective as of January 1, 2023, significantly modified the CCPA, resulting in uncertainty and requiring us to incur additional costs and expenses. The enactment of the CCPA has led numerous other states to propose, and in many cases enact, legislation similar to the CCPA. Other laws relating to privacy and cybersecurity, many of which are similar to the CCPA and CPRA, are being considered by other state legislatures, and certain U.S. states have enacted such legislation, such as Washington’s My Health, My Data Act, which includes a private right of action. The U.S. federal government also is contemplating federal privacy legislation. These developments create the potential for a patchwork of overlapping but different laws throughout the U.S. relating to privacy and cybersecurity. The effects of the CCPA and these other laws remain far-reaching and, depending on final regulatory guidance and other related developments, may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. Similarly, a number of legislative initiatives in the EEA and the United States, at both the federal and state level, as well as other jurisdictions have been proposed or enacted, and could impose new obligations in areas affecting our business. For example, on November 17, 2022, the Digital Services Act (“DSA”) entered into force in the EU and includes new obligations to limit the spread of illegal content and illegal products online, increase the protection of minors, and provide users with more choice and transparency and allows for fines of up to 6% of annual turnover. The impacts of the DSA on the overall industry, business models and our operations are uncertain, and these regulations could result in changes to our subscriptions or introduce new operational requirements and administrative costs, each of which could have an adverse effect on our business, results of operations, and financial condition. Further, the EU has enacted or revised numerous regimes relating to cybersecurity. For example, it has revised its Cybersecurity Directive (“NIS2”), with EU member states having been obligated to transpose it into national law by October 17, 2024, but with some member states’ transpositions yet to be finalized. NIS2, among other things, obligates companies to adopt or update policies and procedures on issues such as incident handling and supply chain security, implementing certain administrative measures, and requires top management’s involvement in cybersecurity risk-management measures, with top management potentially held liable for non-compliance. More generally, NIS2 provides for significant penalties for noncomplian…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We own a large number of patents, copyrights, trademarks, domain names, and trade secrets and, from time-to-time, are subject to litigation based on allegations of infringement, misappropriation or other violations of intellectual property, or other rights. As we face increasing competition and gain an increasingly high profile, the possibility of intellectual property rights claims, commercial claims, and other assertions against us grows. We have in the past been, are currently, and may from time-to-time in the future become, a party to litigation and disputes related to our intellectual property, our business practices, transactions involving our securities and our platform. For example, as discussed in the section titled "Legal Proceedings," we have recently been involved in a legal proceeding against Entangled Media (the “Entangled Media Litigation”), which has alleged that Dropbox infringes certain of their respective patents. Trial is currently set for September 8, 2026. Any final judgment in the district court may be appealed by either party to the Federal Circuit.

Current wording

We own a large number of patents, copyrights, trademarks, domain names, and trade secrets and, from time-to-time, are subject to litigation based on allegations of infringement, misappropriation or other violations of intellectual property, or other rights. As we face increasing competition and gain an increasingly high profile, the possibility of intellectual property rights claims, commercial claims, and other assertions against us grows. We have in the past been, are currently, and may from time-to-time in the future become, a party to litigation and disputes related to our intellectual property, our business practices, transactions involving our securities and our platform. For example, as discussed in the section titled "Legal Proceedings," we have recently been involved in a legal proceeding against Entangled Media (the “Entangled Media Litigation”), which has alleged that Dropbox infringes certain of their respective patents. Trial was scheduled for September 8, 2026, but the court vacated the trial after granting Dropbox's pre-trial motion that Entangled Media could not establish infringement. Entangled Media filed a motion for reconsideration, which was held on November 2, 2026, and adecision is pending. Any final judgment in the district court may be appealed by either party to the Federal Circuit.

Previous wording

Our Class A common stock has one vote per share, our Class B common stock has ten votes per share, and our Class C common stock has no voting rights, except as otherwise required by law and subject to any limitations provided in our articles of incorporation. As of June 30, 2026, our directors and executive officers, and their respective affiliates, held in the aggregate 83.3% of the voting power of our capital stock, with Mr. Houston holding approximately 83.3% of the voting power of our capital stock. We are including the Co-Founder Grant (as defined in “Stock-based compensation” included in Part I of this report) in this calculation since the shares underlying such grant are legally issued and outstanding shares of our Class A common stock and Mr. Houston is able to vote these shares prior to their vesting. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval so long as the shares of Class B common stock represent at least 9.1% of all outstanding shares of our Class A and Class B common stock. This concentrated control will limit or preclude other stockholders’ ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring or otherwise submitted for stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that other stockholders may feel are in their best interests as one of our stockholders.

Current wording

Our Class A common stock has one vote per share, our Class B common stock has ten votes per share, and our Class C common stock has no voting rights, except as otherwise required by law and subject to any limitations provided in our articles of incorporation. As of September 30, 2026, our directors and executive officers, and their respective affiliates, held in the aggregate 83.6% of the voting power of our capital stock, with Mr. Houston holding approximately 83.6% of the voting power of our capital stock. We are including the Co-Founder Grant (as defined in “Stock-based compensation” included in Part I of this report) in this calculation since the shares underlying such grant are legally issued and outstanding shares of our Class A common stock and Mr. Houston is able to vote these shares prior to their vesting. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval so long as the shares of Class B common stock represent at least 9.1% of all outstanding shares of our Class A and Class B common stock. This concentrated control will limit or preclude other stockholders’ ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring or otherwise submitted for stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that other stockholders may feel are in their best interests as one of our stockholders.

Previous wording

If the 2028 Notes are converted by holders of such series, we are required under the applicable indenture to pay cash up to the aggregate principal amount converted and pay or deliver, as the case may be, cash, Class A common stock, or any combination of cash or Class A common stock, at our election, in respect of the remainder, if any, of our conversion obligation in excess of the aggregated principal amount of such Notes converted. If we elect to deliver any Class A common stock upon conversion of the 2028 Notes with respect to our conversion obligation in excess of the aggregated principal amount of such

Current wording

If the 2028 Notes are converted by holders of such series, we are required under the applicable indenture to pay cash up to the aggregate principal amount converted and pay or deliver, as the case may be, cash, Class A common stock, or any combination of cash or Class A common stock, at our election, in respect of the remainder, if any, of our conversion obligation in excess of the aggregated principal amount of such Notes converted. If we elect to deliver any Class A common stock upon conversion of the 2028 Notes with respect to our conversion obligation in excess of the aggregated principal amount of such Notes converted, if any, it would dilute the ownership interests of existing stockholders. Any sales in the public market of the Class A common stock issuable upon such conversion could adversely affect prevailing market prices of our Class A common stock. In addition, certain holders of the 2028 Notes may engage in short selling to hedge their position in the Notes. Anticipated future issuances of shares of our Class A common stock upon conversion of the 2028 Notes could depress the price of our Class A common stock.

Previous wording

We initially implemented a stock repurchase program in 2020. In August 2025, the Board of Directors authorized the repurchase of up to an additional$1.5 billionof the outstanding shares of our Class A common stock and in June 2026, the Board of Directors authorized the repurchase of up to an additional$900.0 million of the outstanding shares of our Class A common stock. As of June 30, 2026, we have repurchased approximately $6.4 billion of outstanding shares of our Class A common stock, including under prior authorizations. The repurchase program does not have an expiration date and we are not obligated to repurchase a specified number or dollar value of shares. Share repurchases are made from time-to-time in private transactions or open market purchases, as permitted by securities laws and other legal requirements. Any future share repurchases remain subject to the circumstances in place at that time, including prevailing market prices. As a result, the timing and the volume of our share repurchases may fluctuate. In addition, the United States has implemented a 1% non-deductible excise tax on the value of certain stock repurchases by publicly traded companies. This tax will generally increase the costs to us of any share repurchases. The stock repurchase program could affect the price of our Class A common stock, increase volatility and diminish our cash reserves. Our repurchase program may be suspended or terminated at any time, and the pace or frequency of our repurchases may fluctuate or change, and our Board of Directors may not authorize additional amounts for repurchase in the future. Even if the current or future stock repurchase programs are fully implemented, such programs may not enhance long-term stockholder value.

Current wording

We initially implemented a stock repurchase program in 2020. In August 2025, the Board of Directors authorized the repurchase of up to an additional$1.5 billionof the outstanding shares of our Class A common stock and in June 2026, the Board of Directors authorized the repurchase of up to an additional$900.0 million of the outstanding shares of our Class A common stock. As of September 30, 2026, we have repurchased approximately $6.6 billion of outstanding shares of our Class A common stock, including under prior authorizations. The repurchase program does not have an expiration date and we are not obligated to repurchase a specified number or dollar value of shares. Share repurchases are made from time-to-time in private transactions or open market purchases, as permitted by securities laws and other legal requirements. Any future share repurchases remain subject to the circumstances in place at that time, including prevailing market prices. As a result, the timing and the volume of our share repurchases may fluctuate. In addition, the United States has implemented a 1% non-deductible excise tax on the value of certain stock repurchases by publicly traded companies. This tax will generally increase the costs to us of any share repurchases. The stock repurchase program could affect the price of our Class A common stock, increase volatility and diminish our cash reserves. Our repurchase program may be suspended or terminated at any time, and the pace or frequency of our repurchases may fluctuate or change, and our Board of Directors may not authorize additional amounts for repurchase in the future. Even if the current or future stock repurchase programs are fully implemented, such programs may not enhance long-term stockholder value.

Previous wording

Our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business. Additionally, to the extent we acquire other businesses, the acquired company may not have a sufficiently robust system of internal controls and we may uncover new deficiencies. Weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future. Furthermore, the loss of expertise and institutional knowledge of employees may negatively impact our ability to maintain adequate controls and procedures. Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement that could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods. Any failure to implement and maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that are required to be included in our periodic reports that will be filed with the SEC. Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on Nasdaq.

Current wording

Our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business. Additionally, to the extent we acquire other businesses, the acquired company may not have a sufficiently robust system of internal controls and we may uncover new deficiencies. Weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future. Furthermore, the loss of expertise and institutional knowledge of employees, including as a result of our 2026 reductions in workforce, may negatively impact our ability to maintain adequate controls and procedures. Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement that could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods. Any failure to implement and maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that are required to be included in our periodic reports that will be filed with the SEC. Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on Nasdaq.

Previous wording

The following table presents information with respect to Dropbox's repurchases of Class A common stock during the

Current wording

The following table presents information with respect to Dropbox's repurchases of Class A common stock during the quarter ended September 30, 2026.

Previous wording

(1)The Board of Directors has authorized a share repurchase program for the repurchase of shares of our Class A common stock. As of June 30, 2026, $1.4 billion remained available for repurchases, including an increase of $900.0 million authorized by the Board of Directors in June 2026. Under the program, shares may be repurchased, subject to general business and market conditions and other investment opportunities, through open market purchases or privately held negotiated transactions, including through Rule 10b5-1 plans, in each case as permitted by securities laws and other legal requirements. The repurchase programs do not have an expiration date. See Note 11 "Stockholders' Deficit" to our condensed consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q.

Current wording

(1)The Board of Directors has authorized a share repurchase program for the repurchase of shares of our Class A common stock. As of September 30, 2026, $1.2 billion remained available for repurchases, including an increase of $900.0 million authorized by the Board of Directors in June 2026. Under the program, shares may be repurchased, subject to general business and market conditions and other investment opportunities, through open market purchases or privately held negotiated transactions, including through Rule 10b5-1 plans, in each case as permitted by securities laws and other legal requirements. The repurchase programs do not have an expiration date. See Note 11 "Stockholders' Deficit" to our condensed consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q.