Shutterstock, Inc.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer and our Chief Financial Officer, evaluated the effectiveness of our disclosure controls and procedures as of December 31, 2025. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, means controls and other procedures of a company that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, as appropriate, to allow timely decisions regarding required disclosure. However, any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objective.

Based on the evaluation of our disclosure controls and procedures as of December 31, 2025, and subject to the foregoing, our Chief Executive Officer and Chief Financial Officer concluded that, as of such date, our disclosure controls and procedures were effective at a reasonable assurance level.

Management’s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting. Our internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of our financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

Management assessed our internal control over financial reporting as of December 31, 2025. Management based its assessment on criteria established in Internal Control-Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

Based on our assessment, and subject to the foregoing, management has concluded that our internal control over financial reporting was effective as of December 31, 2025.

PricewaterhouseCoopers LLP, an independent registered public accounting firm (PCAOB ID 238), has audited the consolidated financial statements included in this Annual Report on Form 10-K and, as part of the audit, has issued a report on the effectiveness of our internal control over financial reporting as of December 31, 2025, which begins on page F-2 of this Annual Report on Form 10-K.

Changes in Internal Control Over Financial Reporting

There were no changes in our internal control over financial reporting identified in connection with management’s evaluation pursuant to Rules 13a-15(d) or 15d-15(d) of the Exchange Act that occurred during the three months ended December 31, 2025 that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Controls

Our disclosure controls and procedures and internal control over financial reporting are designed to provide reasonable assurance of achieving their objectives as specified above. Management does not expect, however, that our disclosure controls and procedures or our internal control over financial reporting will prevent or detect all error and fraud. The design of a control system must reflect that there are resource constraints, and the benefits of controls must be considered relative to their costs. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within the Company have been detected.