GoDaddy Inc
For the period ended Jun 30, 2024. Filed Aug 2, 2024.
View on SEC.govAbout this filing
A company's report for each of its first three quarters. The financial statements are not audited. It shows how the business has moved since the last annual report, and what management says changed.
Jun 30, 2024 · Filed Aug 2, 2024
GDDY$114.38-4.8%Stored close · as of Nov 6, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-Q
Period ended 2024-03-31; filed 2024-05-03.
0001609711-24-000072
Item 1A. Risk FactorsCurrent report: 10-Q
Period ended 2024-06-30; filed 2024-08-02.
0001609711-24-000133
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 397 previous paragraphs and 403 current paragraphs.
305 unchanged; 77 reworded; 16 added; 11 removed; 4 previous and 5 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (16)
Current report
•We are subject to governmental regulation and other legal obligations related to, among other things, privacy, data protection, content moderation, cybersecurity and AI. Our failure to comply with these or any future laws, regulations or obligations could subject us to sanctions and damages and could harm our reputation and business.
Current report
Legal and regulatory frameworks related to the use of AI are rapidly evolving, as regulation of the use of AI continues to be considered and adopted by various U.S. and international governmental and regulatory entities, including the European Union (E.U.), the Securities and Exchange Commission and the Federal Trade Commission (FTC). Several jurisdictions have also passed, or are considering, new laws and regulations relating to the use of AI. For example, in 2024, the E.U. adopted the E.U. AI Act and Colorado adopted the Consumer Protections for Artificial Intelligence Act. While these new laws have not yet impacted our use of AI, the future impact on us of these or other new laws or regulations is uncertain. Any failure by us to comply with current, new and proposed AI-related laws and regulations could result in fines and negative publicity, which could result in reputational harm and damage to our business. We may not be able to adequately anticipate or respond to new laws and regulations, and we may need to expend additional resources to adjust our offerings in certain jurisdictions if applicable legal frameworks are inconsistent across jurisdictions. The cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could adversely affect our business, financial condition and results of operations.
Current report
Our reliance on the use of AI could also pose ethical concerns and lead to a lack of human oversight and control. If we enable or offer solutions that draw controversy, or these new offerings do not work as we describe them, we may experience brand or reputational harm, competitive harm or legal liability. Further, generative AI may create content that appears correct but is factually inaccurate, incomplete, insufficient, biased or otherwise flawed or contains copyrighted or other protected material, which may not be easily detectable despite internal policies and diligence efforts we may have in place which are designed to mitigate such deficiencies. To the extent we or our customers rely on such results, we could incur operational inefficiencies, competitive harm, brand or reputational harm, or other adverse impacts on our business and results of operations. Additionally, if any of our employees, contractors, vendors or service providers use any third-party AI-powered software in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure of our personal, sensitive, proprietary or confidential information into publicly available third-party training sets, which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or our personal, sensitive, proprietary or confidential information, harming our competitive position and business. The rapid evolution of the use of AI requires and will continue to require resources to develop, test and maintain our products and services to help ensure that AI is implemented appropriately in order to minimize unintended and harmful impacts.
Current report
We and our competitors continue to invest in AI, including generative AI and integration of AI capabilities into products and services. AI technology and services are highly competitive, rapidly evolving, and at times require significant investment, including with respect to development and operational costs, to meet the changing needs and expectations of our existing and potential customers. Further, other companies may develop AI products and technologies that are similar or superior to our technologies or more cost-effective to deploy. Any failure to successfully develop, adopt, use and maintain AI products and services, or effectively manage the related operational risks, could harm our reputation. Refer to our risk factor "The use of new and evolving technologies, such as AI, in our offerings may result in reputational harm and liability" for further information concerning the legal and other risks arising from the development, adoption, use, deployment and maintenance of AI.
Current report
Enhancements or migration of information and data to new technology platforms, systems or applications may disrupt our operations or could expose us to a cyber attack, a security breach or other cybersecurity incident which could delay or interrupt service to our customers, harm our reputation, cause us to incur substantial costs or subject us to significant liability.
Current report
•actual or perceived cyber attacks, security breaches or other incidents;
Current report
•ICANN, TLD operators, governments and governmental authorities may impose requirements for verification of domain name registrant information that are inconsistent with our current business practices or that result in inconsistency among industry participants;
Current report
We are subject to governmental regulation and other legal obligations related to, among other things, privacy, data protection, cybersecurity and content moderation. Our failure to comply with these or any future laws, regulations or obligations could subject us to sanctions and damages and could harm our reputation and business.
Current report
We collect, receive, store, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, share and otherwise process personal, sensitive, proprietary and confidential information necessary to provide our products and services, to operate our business, for legal and marketing purposes, and for other business-related purposes. As such, we are subject to laws and regulations in the U.S. and internationally relating to privacy, data protection, cybersecurity and content moderation. These laws and regulations may be interpreted and applied inconsistently from one jurisdiction to another and may conflict with one another, with other regulatory requirements, or with our own internal policies and procedures. Any failure or perceived failure by us to comply with U.S. or international laws and regulations (or our own internal policies and procedures, including those based on industry standards) may result in governmental enforcement actions, litigation, fines and penalties, reputational harm and could cause our customers to lose trust in us, which could have an adverse effect on our business.
Current report
The regulatory environment applicable to the processing of personal information, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results and financial condition being harmed. Additionally, we and our customers may face enforcement actions by data protection authorities. Any such enforcement actions could result in substantial costs, a diversion of resources, and a distraction of management’s and technical personnel's time and attention, each of which could negatively affect our business, operating results and financial condition. For example, the GDPR and the UK GDPR have broad extraterritorial effects on companies established outside the European Economic Area (EEA), with stringent requirements for processors and controllers of personal data. Non-compliance with the GDPR and the UK GDPR can trigger fines of up to the greater of €20 million (or GBP 17.5 million under the UK GDPR) or 4% of global annual revenues. While the GDPR and the UK GDPR remain substantially similar for the time being, the UK government has announced that it is seeking to chart its own path on data protection and reform its relevant laws, including in ways that may differ from the GDPR. In the U.S., at the federal level, we are subject to, among other things, various rules and regulations, including those promulgated under the authority of the FTC, which regulates unfair or deceptive acts or practices (including with respect to privacy, data protection and cybersecurity), and the U.S. Congress is also considering, and may in the future consider, various proposals for privacy, data protection and cybersecurity legislation and regulation. At the state level, the CCPA provides California residents with certain individual privacy rights and imposes privacy, data protection and cybersecurity obligations on covered companies, and a number of other states have enacted or are considering enacting, their own comprehensive privacy, data protection and cybersecurity laws. Additionally, laws in all 50 U.S. states require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a cyber attack, security breach or other cybersecurity incident.
Current report
Global developments in privacy, data protection, cybersecurity and content moderation regulation have changed and may continue to change some of the ways in which we, our sellers, our vendors and other third parties collect, store, transmit, or otherwise process personal, sensitive, proprietary or confidential information. These regulations have also created and will continue to create additional compliance obligations for us and our sellers, vendors, and other third parties. New cybersecurity laws and regulations may require us to incur additional costs and may negatively impact our business operations. For example, the E.U. member states are in the process of fully transposing into their respective national laws the NIS2 Directive, which concerns the cybersecurity of certain critical infrastructure sectors, including digital infrastructure. The particular requirements of the NIS2 Directive are uncertain but are expected to impose additional cybersecurity and other obligations on domain name registries and entities that provide domain name registration services, including those not established within the E.U., such as GoDaddy. These new requirements may result in our incurring significant additional costs to comply. In addition, any failure to comply could result in fines and negative publicity, which could cause reputational harm and damage to our business.
Current report
We are subject to governmental regulation and other legal obligations related to international transfers of personal data. Our failure to comply with these or any future laws, regulations or obligations could subject us to sanctions and damages and could harm our reputation and business.
Current report
Certain jurisdictions regulate international transfers of personal data. We have established processes for making data transfers consistent with the laws in the jurisdictions in which we operate.
Current report
We use Data Processing Addendums or other similar agreements for certain transfers of personal data from the E.U./EEA to other countries when required, including for transfers to the U.S. In addition, several of our companies also have self-certified their compliance with the E.U.-U.S. Data Privacy Framework relating to transfers of personal data.
Current report
•actual or perceived cyber attacks, security breaches or other cybersecurity incidents;
Current report
•new laws, regulations, other legal obligations or industry standards, or any modifications to, or new interpretations of, existing laws, regulations, other legal obligations or industry standards applicable to our business;
Removed paragraphs (11)
Previous report
•We are subject to governmental regulation and other legal obligations, particularly related to data privacy and cybersecurity. Our failure to comply with these or any future laws, regulations or obligations could subject us to sanctions and damages and could harm our reputation and business.
Previous report
Further, AI technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and our customers or others may rely on or use this flawed content to their detriment. In addition, we face significant competition from other companies that are developing their own AI products and technologies. Our competitors may develop AI products and technologies that are similar or superior to our technologies or are more cost-effective to develop or deploy.
Previous report
We are subject to governmental regulation and other legal obligations, particularly related to privacy, data and information security and cybersecurity. Our failure to comply with these or any future laws, regulations or obligations could subject us to sanctions and damages and could harm our reputation and business.
Previous report
We are subject to a variety of laws and regulations, including regulation by various federal government agencies, including the FTC, FCC and state and local agencies, as well as privacy, data protection and cybersecurity laws in jurisdictions outside of the U.S. We collect personal, sensitive and confidential information, including payment card information from our current and prospective customers, website users and employees. The U.S. federal and various U.S. state and foreign governments have adopted or proposed limitations on, or requirements regarding, the collection, distribution, use, security and storage of personal, sensitive and confidential information, including payment card information, and the FTC and many state attorneys general are applying federal and state consumer protection laws to impose standards on the online collection, use and dissemination of personal, sensitive and confidential information, including payment card information. Self-regulatory obligations, other industry standards, policies and other legal obligations may apply to our collection, distribution, use, security or storage of personal, sensitive and confidential information, including payment card information. These obligations may be interpreted and applied inconsistently from one jurisdiction to another and may conflict with one another, other regulatory requirements or our internal practices. Any failure or perceived failure by us to comply with U.S. or international privacy or security laws, policies, industry standards or legal obligations or any security incident resulting in the unauthorized access to, or acquisition, release or transfer of, personal, sensitive and confidential information, including payment card information of our customers, employees or others, may result in governmental enforcement actions, litigation, fines and penalties or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.
Previous report
We expect there will continue to be newly enacted and proposed laws and regulations as well as emerging industry standards concerning privacy, data protection, cybersecurity and AI in the U.S., the E.U. and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. Such laws, regulations, standards and other obligations could impair our ability to, or the manner in which we, collect or use information to advertise, thereby having a negative impact on our ability to maintain and grow our total customers and increase revenue. For example, California enacted the California Consumer Protection Act, as amended by the California Privacy Rights Act (CPRA, and collectively, CCPA) that, among other things, requires covered companies to provide certain disclosures to California residents and afford such residents certain rights, including the right to opt-out of the sale or sharing of their personal information. Several other states have enacted, and others are considering enacting, similar data privacy and cybersecurity laws that require disclosures or notices to consumers and the recognition of certain rights relating to personal information, any of which may require us to modify our data processing practices in the future, for which the cost and impact are currently not predictable. Future restrictions on the collection, use, sharing or disclosure of personal information or additional requirements for express or implied consent of users for the use, disclosure or other processing of such personal information could increase our operating expenses, require us to modify our products, possibly in a material manner, or stop offering certain products, and could limit our ability to develop and implement new product features.
Previous report
In particular, with regard to transfers to the U.S. of personal data (as such term is used in the GDPR and applicable E.U. member state legislation) from our employees based in Europe and European customers and users, we historically relied upon the E.U.-U.S. Privacy Shield, as well as E.U. Standard Contractual Clauses (SCCs) in certain circumstances. The E.U.-U.S. Privacy Shield was invalidated by the Court of Justice of the E.U. (CJEU) in July 2020 (Schrems II), and the SCCs have been subject to legal challenge and were updated in June 2021. Following Schrems II, we have an ongoing process to utilize Data Processing Agreements with our customers and vendors, where there is a transfer involving a third country, to incorporate other data transfer mechanisms, such as the SCCs, for personal data transfers between E.U. and non-E.U. countries without an adequacy decision from the European Commission. We will continue to transfer personal data pursuant to the SCCs, but the CJEA has indicated that sole reliance on SCCs for transfers of personal information outside the European Economic Area may not be sufficient in all circumstances and the transfers must be assessed on a case-by-case basis.
Previous report
On July 10, 2023, the European Commission’s adequacy decision for the E.U.-U.S. Data Privacy Framework (DPF) entered into effect and the E.U.-U.S. DPF Principles (DPF Principles) entered into effect the same date. The DPF and the DPF Principles provide a new mechanism for transferring personal data from the European Economic Area (EEA) to the U.S., with the European Commission having determined that data transfers to the U.S. made by companies who have self-certified their adherence to the DPF and DPF Principles provides a level of data protection comparable to the protection offered in the E.U. However, this decision is facing legal challenges and ultimately may be invalidated by the CJEU just as was the E.U.-U.S. Privacy Shield. On July 17, 2023, the U.S. Department of Commerce recognized several GoDaddy entities, including Go Daddy Operating Company, LLC, as having self-certified their adherence to the DPF by virtue of their prior self-certification under the E.U.-U.S. Privacy Shield. We have updated our global privacy notice and certain other documents to reflect this self-certification, as required by the DPF. If the E.U.-U.S. DPF is invalidated or it is determined that we are not eligible to continue to transfer personal data pursuant to the DPF, we intend to continue to rely upon the 2021 SCCs as an alternative transfer mechanism. In addition, the UK and the U.S. recently entered into an agreement regarding an extension of the E.U.-U.S. Data Privacy Framework to provide a new mechanism for transfer of personal data from the UK to the U.S., which is described as the UK-U.S. Data Bridge. We have self-certified our compliance with the UK-U.S. Data Bridge. If the UK-U.S. DPF is invalidated or it is determined that we are not eligible to continue to transfer personal information pursuant to the DPF, we intend to continue to rely upon the UK International Data Transfer Agreement (IDTA) for transfers of personal data from the UK to the U.S. Our failure or inability to comply with all requirements of the DPF or a challenge to our use of the 2021 SCCs or ITDA could limit our ability to transfer data from the E.U., EEA, and UK to the U.S. However, we continue to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks associated herewith.
Previous report
Any new laws, regulations, other legal obligations or industry standards, or any changed interpretation of existing laws, regulations or other standards may require us to incur additional costs and restrict our business operations. For example, many jurisdictions have enacted laws requiring companies to notify individuals of cybersecurity breaches involving certain types of personal data. These mandatory disclosures regarding a security breach, or any other disclosures we may choose to undertake, could result in an increased risk of litigation and/or negative publicity to us, which may cause our customers to lose confidence in the effectiveness of our cybersecurity measures which could impact our operating results. In addition, we are required under the GDPR and other privacy laws (including the UK version of the GDPR and U.S. state privacy laws) to respond to certain customers' data subject access requests (DSARs), each within a certain time period, which can entail responding to requests to know, access, correct, delete or transfer personal information we process. We may also be required to disclose what specific data we disclose or sell to, or share with, third parties. We are also required under the GDPR and other data privacy laws (including the UK version of the GDPR and U.S. state privacy laws) to honor certain customers' requests relating to our use of customers’ personal information for marketing and advertising purposes. A failure to respond to DSARs properly could result in fines, negative publicity and damage to our business.
Previous report
Data localization requirements in certain jurisdictions in which we operate or maintain business may increase data center and company operating costs.
Previous report
•actual or perceived privacy or cybersecurity incidents;
Reworded paragraphs (77)
Previous wording
Our payments-related operations, including GoDaddy Payments, are subject to various laws, regulations, restrictions and risks. Our failure to comply with such rules, regulations, and restrictions regarding our payments-related operations could materially harm our business.
Current wording
•Our payments-related operations, including GoDaddy Payments, are subject to various laws, regulations, restrictions and risks. Our failure to comply with such rules, regulations, and restrictions regarding our payments-related operations or properly manage the risks inherent to such operations could materially harm our business.
Previous wording
•Governmental and regulatory policies or claims concerning the domain name registration system and the Internet in general, and industry reactions to those policies or claims, may cause instability in the industry and disrupt our business.
Current wording
•Laws, regulations, policies or claims concerning the domain name registration system and the Internet in general, and industry reactions to those policies or claims, may cause instability in the industry and disrupt our business.
Previous wording
Our success depends on our ability to attract and retain customers and increase sales to new and existing customers. Although our total customers and revenue have grown rapidly in the past, in recent periods our slower growth rates have reflected the larger size, scale and maturity of parts of our business. We cannot be assured that we will achieve similar growth rates in future periods as our total customers and revenue could decline or grow more slowly than we expect. The rate at which new and existing customers purchase and renew subscriptions to our products could fluctuate or decline as a result of a number of factors, such as lower demand for domain names, websites and related products, declines in our customers' level of satisfaction with our products and the support provided by our GoDaddy Guides, platform migration, divestitures, end of life related actions on previously acquired companies, the timeliness and success of product enhancements and introductions by us and those of our competitors, the pricing offered by us and our competitors and the frequency and severity of any system outages, breaches, or technological changes.
Current wording
Our success depends on our ability to attract and retain customers and increase sales to new and existing customers. Although our total customers and revenue have grown rapidly in the past, in recent periods our slower growth rates have reflected the larger size, scale and maturity of parts of our business. We cannot be assured that we will achieve similar growth rates in future periods as our total customers and revenue could decline or grow more slowly than we expect. The rate at which new and existing customers purchase and renew subscriptions to our products could fluctuate or decline as a result of a number of factors, such as lower demand for domain registrations and renewals, website hosting and related products, declines in our customers' level of satisfaction with our products and the support provided by our GoDaddy Guides, platform migration, divestitures, end of life related actions on previously acquired companies, the timeliness and success of product enhancements and introductions by us and those of our competitors, the pricing offered by us and our competitors and the frequency and severity of any system outages, breaches, technological changes or other factors that are not known to us at this time.
Previous wording
Our revenue has grown historically due in large part to sustained customer growth rates and strong renewals of subscriptions. Our future success depends in part on maintaining strong renewals. Our costs associated with renewals are substantially lower than costs associated with acquiring new customers and selling additional products to existing customers. Therefore, a reduction in renewals, even if offset by an increase in other revenue, could reduce our operating margins in the near term. Any failure by us to continue to attract new customers or maintain strong renewals could have a material adverse effect on our business, growth prospects and operating results.
Current wording
Our revenue has grown historically due in large part to sustained customer growth rates and strong levels of subscription renewals. Our future success depends in part on maintaining strong renewals. Our costs associated with renewals are substantially lower than costs associated with acquiring new customers and selling additional products to existing customers. Therefore, a reduction in renewals, even if offset by an increase in other revenue, could reduce our operating margins in the near term. Any failure by us to continue to attract new customers or maintain strong renewals could have a material adverse effect on our business, growth prospects and operating results.
Previous wording
Our business will suffer if the small business market for our solutions proves less lucrative than projected or if we fail to effectively acquire and service small business customers.
Current wording
Our business will suffer if the market for our solutions proves less lucrative than projected or if we fail to effectively acquire and service existing and new customers.
Previous wording
We focus our operations on small businesses, which frequently have limited budgets and may choose to allocate resources to items other than our solutions, especially in times of economic uncertainty or recessions. We believe that the small business market is underserved, and we intend to continue to devote substantial resources to it. We aim to grow our revenues by adding new small business customers, selling additional business solutions to existing small business customers and encouraging existing small business customers to continue to use and purchase our products and services. If the small business market fails to be as lucrative as we project or we are unable to market and sell our services to small businesses effectively, our ability to grow our revenues and maintain profitability will be harmed.
Current wording
We focus our operations on entrepreneurs, customers with new ventures and those with established small and medium-sized businesses, which frequently have limited budgets and may choose not to allocate resources to our solutions, especially in times of economic uncertainty or recessions. We believe this market is underserved, and we intend to continue to devote substantial resources to it. We aim to grow our revenues by adding new customers in this market, selling additional business solutions to these customers and encouraging them to continue to use and purchase our products and services that are tailored for them. If this market fails to be as lucrative as we project or we are unable to market and sell our services to these businesses effectively, our ability to grow our revenues and maintain profitability will be harmed.
Previous wording
We aim to serve customers with new ventures and those with established small or medium-sized businesses that may need help growing and expanding their digital capabilities (Independents). We also serve and provide products for other customer populations, such as website designers and developers (WebPros), organizations with their own domain registration offerings (Domain Registrars), individuals or organizations that manage a portfolio of registered domains (Domain Investors) and third party registrars and corporate domain portfolio owners, including those that are more technically savvy. For these customers we aim to develop new features and applications that may be used to start or grow their businesses. For example, we offer tools for our technically sophisticated web designers, developers and customers, including high-performance, flexible hosting and security products that can be used with a variety of open source design tools such as WordPress. If we are unable to increase sales of our products to all customer segments we may target, our estimated total addressable market may be overstated and our business, growth prospects and operating results may be adversely affected.
Current wording
We aim to serve entrepreneurs, customers with new ventures and those with established small or medium-sized businesses that may need help growing and expanding their digital capabilities (Independents). We also serve and provide products for other customer populations, such as website designers and developers (WebPros), organizations with their own domain registration offerings (Domain Registrars), individuals or organizations that manage a portfolio of registered domains (Domain Investors) and third party registrars and corporate domain portfolio owners, including those that are more technically savvy. For these customers we aim to develop new features and applications that may be used to start or grow their businesses. For example, we offer tools for our technically sophisticated web designers, developers and customers, including high-performance, flexible hosting and security products that can be used with a variety of open source design tools such as WordPress. If we are unable to increase sales of our products to all customer segments we target, and may target in the future, our estimated total addressable market may be overstated and our business, growth prospects and operating results may be adversely affected.
Previous wording
The markets where we compete are characterized by constant change and innovation, frequent new product and service introductions and evolving industry standards, and we expect them to continue to evolve rapidly. Our historical success has been based on our ability to identify and anticipate customer needs and design products that provide our customers with the tools they need to grow their businesses. For example, in 2023 we launched GoDaddy Airo™, an AI-powered experience designed to automatically build the interconnected pieces of the Entrepreneur's Wheel to save our customers time and effort. We also expanded our commerce offerings through the years by enabling payments through GoDaddy Payments in all Websites +
Current wording
The markets in which we compete are characterized by constant change and innovation, frequent new product and service introductions and evolving industry standards. We expect these markets to continue to rapidly evolve. Our historical success has been based on our ability to identify and anticipate customer needs and design products that provide our customers with the tools they need to grow their businesses. For example, in 2023 we launched GoDaddy Airo™, an AI-powered, customizable experience designed to automatically build the interconnected pieces of what we call the "Entrepreneur's Wheel," to save our customers time and effort. We also continue to expand our commerce offerings, for example, by rolling out GoDaddy Payments in Canada, introducing 'Buy Buttons' to enable payments through GoDaddy Payments in all Websites + Marketing products, introducing a new point-of-sale device to our line of GoDaddy Smart Terminals and providing on-the-go solutions such as Tap-to-Pay in the GoDaddy Mobile App, Pay Links and Virtual Terminal. To the extent we are not able to continue to identify challenges faced by entrepreneurs, small businesses and ventures and provide products responding in a timely and effective manner to their evolving needs, our business, operating results and financial condition may be adversely affected.
Previous wording
We are increasingly using new and evolving technologies, such as AI, to, among other things, develop new tools and products, and additional features in our existing products, including ongoing deployment and improvement of existing AI, and the development of new product technologies, such as generative AI. For example, in 2023 we launched GoDaddy Airo™, an AI-powered experience designed to automatically build the interconnected pieces of the Entrepreneur's Wheel to save our customers time and effort. There are significant risks involved in development and deploying AI, such as an increase in intellectual property infringement or misappropriation, data privacy, cybersecurity, operational and technological risks, harmful content, accuracy, bias and discrimination, any of which could affect our further development, adoption, and use of AI, and may cause us to incur additional research and development costs to resolve such issues. In addition, the introduction of AI technologies into new or existing products may result in new or enhanced governmental or regulatory scrutiny, litigation, privacy, confidentiality or security risks, ethical concerns or other complications that could adversely affect our business, reputation or financial results.
Current wording
We are increasingly using new and rapidly evolving technologies, such as AI, to, among other things, develop new tools and products, and additional features in our existing products, including ongoing deployment and improvement of existing AI, and the development of new product technologies, such as generative AI. For example, in 2023 we launched GoDaddy Airo™, an AI-powered, customizable experience designed to automatically build the interconnected pieces of what we call the "Entrepreneur's Wheel," to save our customers time and effort. There are significant risks involved in the development, adoption, use, deployment and maintenance of AI, such as an increase in intellectual property infringement or misappropriation, privacy, data protection, cybersecurity, confidentiality, operational and technological risks, as well as risks associated with harmful content, accuracy, bias and discrimination, any of which could affect our further development, adoption, use, deployment and maintenance of AI, and may cause us to incur additional research and development costs to resolve any issues arising from such risks. In addition to the foregoing risks, the introduction of AI technologies into new or existing products may result in new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns or other complications that could adversely affect our business, reputation or financial results.
Previous wording
AI is the subject of evolving review by various governmental and regulatory agencies around the globe, including the SEC and the FTC, and changes in laws, rules, directives and regulations governing the use of AI are evolving rapidly. For example, on October 30, 2023, the Biden administration issued an Executive Order to, among other things, establish extensive new standards for AI safety and security, and other jurisdictions may decide to adopt similar or more restrictive legislation that may render the use of such technologies challenging. Similarly, the intellectual property ownership and license rights, including copyright, surrounding AI technologies has not been fully addressed by U.S. courts or other federal or state laws or regulations, and the use or adoption of AI technologies in our products and services may subject us to copyright infringement or other intellectual property misappropriation claims. We may not always be able to anticipate how to respond to these frameworks and we may have to expend resources to adjust our tools, products or other offerings in certain jurisdictions if the legal frameworks on AI are not consistent across jurisdictions. Any inability to appropriately respond to this evolving landscape could result in legal liability, regulatory action or brand and reputational harm. Our reliance on AI could also pose ethical concerns and lead to a lack of human oversight and control. If we enable or offer solutions that draw controversy, or these new offerings do not work as we describe them to our customers, we may experience brand or reputational harm, competitive harm or legal liability. The rapid evolution of AI will require the application of resources to develop, test and maintain our products and services to help ensure that AI is implemented ethically in order to minimize unintended, harmful impacts.
Current wording
In addition, many existing laws and regulations apply to certain aspects of AI, such as automated decision making affecting fundamental data subject rights. Similarly, the intellectual property ownership and license rights, including as related to copyright, surrounding AI technologies has not been fully addressed by international and U.S. courts or the laws or regulations of the U.S., including U.S. states, and foreign jurisdictions. Any content created by us using generative AI tools may not be subject to copyright protection which may affect our intellectual property rights in, or ability to commercialize, such content. The use or adoption of AI technologies in our products and services may subject us to copyright infringement or other intellectual property claims. If we, or third-party developers whose AI we rely on, do not have sufficient rights to use the data or other material used or processed by such AI technology, we also may incur liability through the alleged violation of applicable laws and regulations, third-party intellectual property, privacy, or other rights or contractual obligations. We may not always be able to anticipate how to comply with these legal and regulatory frameworks and we may have to expend resources to adjust our tools, products or other offerings to meet standards set by such frameworks, which may vary by jurisdiction if AI-related legal and regulatory frameworks are not consistent across jurisdictions. Any inability to appropriately comply with the evolving AI regulatory landscape could result in legal liability, regulatory action or brand and reputational harm.
Previous wording
It is not possible to predict all of the risks related to the use of AI, and changes in laws, rules, directives and regulations governing AI may adversely affect our ability to develop and use AI or subject us to legal liability.
Current wording
It is not possible to predict all of the risks related to the use of AI, and changes in laws, rules, directives and regulations governing AI may adversely affect our development, adoption, use, deployment and maintenance of AI or subject us to legal liability, regulatory action or brand and reputational harm.
Previous wording
The market for our products and services is highly fragmented and competitive and we expect competition to increase in the future from our competitors. In addition, given our broad product portfolio, we compete with niche point-solution products and broader solution providers. These types of products and solutions continue to evolve, creating opportunity for new competitors to enter the market with point-solution products or address specific segments of the market. Our competitors include providers of domain registration services, web-hosting solutions, website creation and management solutions, e-commerce enablement providers, payment facilitation providers, cloud computing service and online security providers, alternative web presence and marketing solutions providers and providers of productivity tools such as business-class email. We consider the following to be a representative list of competitors we face in some of the major areas we operate in:
Current wording
The market for our products and services is highly fragmented and competitive and we expect this competition to increase in the future. In addition, given our broad product portfolio, we compete with niche point-solution products and broader solution providers. These types of products and solutions continue to evolve, creating opportunities for new competitors to enter the market with point-solution products or address specific segments of the market. Our competitors include providers of domain registration services, web-hosting solutions, website creation and management solutions, e-commerce enablement providers, payment facilitation providers, cloud computing service and online security providers, alternative web presence and marketing solutions providers and providers of productivity tools such as business-class email. We consider the following to be a representative, but not exhaustive list of competitors we face in some of the major areas we operate in:
Previous wording
Some of our current and potential competitors have greater resources, more brand recognition and consumer awareness, more diversified product offerings, greater international scope and larger customer bases than we do, and we may therefore not be able to effectively compete with them. In addition, some of our competitors seek to disrupt the market by offering their services and products at low or no cost; for example, Cloudflare offers domains at wholesale cost and Let's Encrypt offers security certificates at no cost. If these competitors and potential competitors decide to devote greater resources to the development, promotion and sale of products in the markets in which we compete, or if the products offered by these companies are more attractive to or better meet the evolving needs of our customers, our market share, growth prospects and operating results may be adversely affected. In addition, the extension of the Cooperative Agreement between VeriSign Inc. (VeriSign), the registry for .com and .net, and the U.S. Department of Commerce in 2018 gave VeriSign the right to become an ICANN-accredited registrar for any gTLD other than .com. While VeriSign has not publicly announced whether it will become a registrar, and there is no indication that it would, if it were to do so, it would become one of our competitors in this space, which could have a negative impact on our business and industry.
Current wording
Some of our current and potential competitors have greater resources, more brand recognition and consumer awareness, more diversified product offerings, greater international scope and larger customer bases than we do, and we may therefore not be able to effectively compete with them. In addition, some of our competitors seek to disrupt the market by offering their services and products at low or no cost; for example, Cloudflare offers domains at wholesale cost and Let's Encrypt offers security certificates at no cost. If these competitors and potential competitors decide to devote greater resources to the development, promotion and sale of products in the markets in which we compete, or if the products offered by these companies are more attractive to or better meet the evolving needs of our customers, our market share, growth prospects and operating results may be adversely affected.
Previous wording
Increased competition in our industry could result in lower sales, price reductions, reduced margins, loss of market share and increased marketing expenses. Furthermore, conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors or market consolidation. New or existing competitors, or groups of competitors working cooperatively, may invent similar or superior products and technologies competing with our products and technology. The continued entry of competitors into the domain name registration and web-hosting markets, and the rapid growth of some competitors already in each market, may make it difficult for us to maintain our market position. Our ability to compete will depend upon our ability to provide a better product than our competitors at a competitive price and supported by superior customer care. We may be required to make substantial additional investments in research, development, marketing and sales in order to respond to competition, and there can be no assurance that these investments will achieve any returns for us or that we will be able to compete successfully in the future.
Current wording
In addition, increased competition in our industry could result in lower sales, price reductions, reduced margins, loss of market share and increased marketing expenses. Conditions in our market could rapidly and significantly change as a result of technological advancements, partnering by our competitors or market consolidation. New or existing competitors, or groups of competitors working cooperatively, may invent similar or superior, or may significantly improve upon existing, products and technologies, which compete with our products and technology. The continued entry of competitors into the domain name registration and web-hosting markets, and the rapid growth of some competitors already in each market, may make it difficult for us to maintain our market position. Our ability to compete will depend upon our ability to provide a better product than our competitors at a competitive price and supported by superior customer care. We may be required to make substantial additional investments in research, development, marketing and sales in order to respond to competition, and there can be no assurance that these investments will achieve any returns for us or that we will be able to compete successfully in the future.
Previous wording
In February 2023, we announced a restructuring plan to reduce future operating expenses and improve cash flows through a combination of a reduction in force and a commitment to sell certain assets. As part of this plan, we announced a reduction in our then workforce of approximately 550 employees, representing approximately 8% of our total employee base at the time of announcement. Thereafter, to further reduce operating expenses and improve cash flows, we implemented additional restructuring activities, including reductions in force of approximately 250 and 180 employees in the remainder of 2023 and during the three months ended March 31, 2024, respectively. We expect to make substantially all remaining restructuring payments by the end of the third quarter of 2024.
Current wording
In February 2023, we announced a restructuring plan to reduce future operating expenses and improve cash flows through a combination of a reduction in force and a commitment to sell certain assets. As part of this plan, we announced a reduction in our then workforce of approximately 550 employees, representing approximately 8% of our total employee base at the time of the announcement. Thereafter, to further reduce operating expenses and improve cash flows, we implemented additional restructuring activities, including reductions in force of approximately 250, 180 and 100 employees during the remainder of 2023, and during the three months ended March 31, 2024 and June 30, 2024, respectively. We expect to make substantially all remaining restructuring payments by the end of the fourth quarter of 2024.
Previous wording
The restructuring activities may yield unintended consequences and costs, such as the loss of institutional knowledge and expertise, employee attrition beyond our intended reductions in force, a reduction in morale among our remaining employees, greater-than-anticipated costs incurred in connection with implementing the restructuring activities and the risk that we may not achieve the benefits from the restructuring activities to the extent or as quickly as we anticipate, all of which may have a material adverse effect on our results of operations or financial condition. These restructuring initiatives could place substantial demands on our management and employees, which could lead to the diversion of our management’s and employees’ attention from other business priorities. In addition, while we eliminated certain positions in connection with the restructuring activities, certain functions necessary to our reduced operations remain, and we may be unsuccessful in distributing the duties and obligations of departed employees among our remaining employees or to external service providers, which could result in disruptions to our operations. We may also discover that the workforce reductions and other restructuring efforts will make it difficult for us to pursue new opportunities and initiatives and require us to hire qualified replacement personnel, which may require us to incur additional and unanticipated costs and expenses. We may further discover that, despite the implementation of our restructuring activities, we may require additional capital to continue expanding our business, and we may be unable to obtain such capital on acceptable terms, if at all. Our failure to successfully accomplish any of the above activities and goals may have a material adverse impact on our business, financial condition and results of operations.
Current wording
The charges and expenditures that we expect to incur in connection with the restructuring activities, and timing thereof, are subject to a number of assumptions, including local law requirements in various jurisdictions, and we may incur costs that are greater than we currently expect in connection with the restructuring activities. The restructuring activities may yield unintended consequences and costs, such as the loss of institutional knowledge and expertise, employee attrition beyond our intended reductions in force, a reduction in morale among our remaining employees, greater-than-anticipated costs incurred in connection with implementing the restructuring activities and the risk that we may not achieve the benefits from the restructuring activities to the extent or as quickly as we anticipate, all of which may have a material adverse effect on our results of operations or financial condition. These restructuring initiatives could place substantial demands on our management and employees, which could lead to the diversion of our management’s and employees’ attention from other business priorities. In addition, while we eliminated certain positions in connection with the restructuring activities, certain functions necessary to our reduced operations remain, and we may be unsuccessful in distributing the duties and obligations of departed employees among our remaining employees or to external service providers, which could result in disruptions to our operations. We may also discover that the workforce reductions and other restructuring efforts will make it difficult for us to pursue new opportunities and initiatives and require us to hire qualified replacement personnel, which may require us to incur additional and unanticipated costs and expenses. We may further discover that, despite the implementation of our restructuring activities, we may require additional capital to continue expanding our business, and we may be unable to obtain such capital on acceptable terms, if at all. Our failure to successfully accomplish any of the above activities and goals may have a material adverse impact on our business, financial condition and results of operations.
Previous wording
Bookings outside of the U.S. represented approximately 33% of our total bookings for each of the years ended December 31, 2023, 2022 and 2021. We continue to review and add systems as necessary to accept payments in forms common outside of the U.S., optimize our marketing efforts in numerous non-U.S. geographies, equip our customer care team with the knowledge to serve these markets and maintain or establish customer care operations in overseas locations. Conducting and expanding international business subjects us to risks we generally do not face in the U.S., including:
Current wording
Bookings outside of the U.S. represented approximately 33% of our total bookings for each of the years ended December 31, 2023, 2022 and 2021. We continue to review and add systems as necessary to accept payments in forms common outside of the U.S., optimize our marketing efforts in numerous non-U.S. geographies, equip our customer care team with the knowledge to serve these markets and maintain or establish, as needed, customer care operations in overseas locations. Conducting and expanding international business subjects us to risks we generally do not face in the U.S., including:
Previous wording
•compliance with foreign laws, including laws regarding consumer protection, the Internet and e-commerce or mobile commerce, intellectual property, online disclaimers and advertising, liability of Internet service providers for activities of customers especially with respect to hosted content, competition, anti-bribery, and more stringent laws in foreign jurisdictions relating to consumer privacy and protection of data collected from individuals and other third parties;
Current wording
•compliance with international laws and regulations, including laws and regulations regarding consumer protection, the Internet and e-commerce or mobile commerce, intellectual property, online disclaimers and advertising, liability of Internet service providers for activities of customers especially with respect to hosted content, competition, anti-bribery, privacy, data protection and cybersecurity;
Previous wording
The expansion of our existing international business and entry into additional international markets has required and will continue to require significant management attention and financial resources. These additional costs may increase our cost of acquiring international customers, which may impair our ability to maintain profitability in the future. We may also face pressure to lower our prices in order to compete in emerging markets, which could adversely affect revenue derived from our international business.
Current wording
Maintaining business in international markets has required and will continue to require management attention and financial resources. These additional costs may increase our costs of acquiring international customers, which may impair our ability to maintain profitability in the future. We may also face pressure to lower our prices in order to compete in emerging markets, which could adversely affect revenue derived from our international business.
Previous wording
In addition, certain of our operations and business are in higher risk regions such as China, India and Ukraine. We do not have material operations in China or Ukraine but our operations have been, and we expect may continue, growing in India. As a result, unanticipated events, such as geopolitical changes associated with our international business could impair our growth prospects and adversely affect our business, operating results and financial condition. In addition, given the risks associated with our international business, we may decide to relocate international operations either to other foreign countries or domestically, which could require significant management attention and financial resources and may not prove to be successful and could adversely affect our business, operating results and financial condition. For example, there is uncertainty as to the future of U.S. trade policy with respect to China; in February 2022, Russia launched a military assault in Ukraine which has expanded to a full-scale military invasion of Ukraine by Russian troops; and in October 2023, Hamas launched assaults against Israel which has expanded conflicts in the Middle East. Although we have not seen a material impact, these and other factors associated with our international business could impair our growth prospects and adversely affect our business, operating results and financial condition. In particular, following Russia’s invasion of Ukraine, the U.S., UK and E.U. governments, among others, developed coordinated financial and economic sanctions targeting Russia that, in various ways, constrain transactions with numerous Russian entities, including major Russian banks, and individuals. We have no employees or facilities in Russia or Ukraine. We have a limited number of contractors in Ukraine and as a result, a prolonging of this conflict could cause delays in future product launches if such contractors are unable to work and/or it becomes necessary to locate and train new contractors to support these products. In addition, we opted to shut down our GoDaddy website in Russia and removed support for the Ruble. Our business has not been materially impacted to date by the ongoing conflicts between Russia and Ukraine and in the Middle East, however it is impossible to predict the extent to which our operations will be impacted or the ways in which the conflicts may impact our business in the long term. Furthermore, a widening of the conflict in the Middle East could lead to broader geopolitical destabilization and macro-economic impacts.
Current wording
In addition, certain of our operations and business are in higher risk regions such as China, India and Ukraine. We do not have material operations in China or Ukraine but our operations have grown, and we expect may continue to grow, in India. As a result, unanticipated events, such as geopolitical changes associated with our international business could impair our growth prospects and adversely affect our business, operating results and financial condition. In addition, given the risks associated with our international business, we may decide to relocate international operations either to other foreign countries or domestically, which could require significant management attention and financial resources and may not prove to be successful and could adversely affect our business, operating results and financial condition. For example, there is uncertainty as to the future of U.S. trade policy with respect to China; in February 2022, Russia launched a military assault in Ukraine which has expanded to a full-scale military invasion of Ukraine by Russian troops; and in October 2023, Hamas launched assaults against Israel which has expanded conflicts in the Middle East. Although we have not seen a material impact, these and other factors associated with our international business could impair our growth prospects and adversely affect our business, operating results and financial condition. In particular, following Russia’s invasion of Ukraine, the U.S., UK and E.U. governments, among others, developed coordinated financial and economic sanctions targeting Russia that, in various ways, constrain transactions with numerous Russian entities, including major Russian banks, and individuals. We have no employees or facilities in Russia or Ukraine. We have a limited number of contractors in Ukraine and as a result, a prolonging of this conflict could cause delays in future product launches if such contractors are unable to work and/or it becomes necessary to locate and train new contractors to support these products. In addition, we opted to shut down our GoDaddy website in Russia and removed support for the Ruble. Our business has not been materially impacted to date by the ongoing conflicts between Russia and Ukraine and in the Middle East, however it is impossible to predict the extent to which our operations will be impacted or the ways in which the conflicts may impact our business in the long term. Furthermore, a widening of the conflict in the Middle East could lead to broader geopolitical destabilization and macro-economic impacts.
Previous wording
We have incurred, and will continue to incur, expenses relating to our investments in international business and infrastructure, such as: (i) our offerings and marketing presence in India, Europe, Latin America, the Middle East and North Africa, and Asia; (ii) our marketing spend to attract new customers, such as WebPros and Independents in non-U.S. markets; and (iii) investments in software systems and additional data center resources to keep pace with the growth of our cloud infrastructure and cloud-based product offerings. We have made significant investments in product development, corporate infrastructure and technology and development, and intend to continue investing in the development of our products and infrastructure and our marketing and GoDaddy Guides.
Current wording
We have incurred, and expect to continue to incur, expenses relating to our investments in international business and infrastructure, such as: (i) our offerings and marketing presence in India, Europe, Latin America, the Middle East and North Africa, and Asia; (ii) our marketing spend to attract new customers, such as WebPros and Independents in non-U.S. markets; and (iii) investments in software systems and additional data center resources to keep pace with the growth of our cloud infrastructure and cloud-based product offerings. We have made, and may make in the future, significant investments in product development, corporate infrastructure, technology and development, marketing and our GoDaddy Guides.
Previous wording
We review and make enhancements as necessary to existing platforms and tools to support our growth. While we are engaged in this work, we may experience difficulties in managing our existing systems and processes, which could disrupt our operations, the management of our finances and the reporting of our financial results. In addition, if we determine new systems or system updates are necessary, we may need to rely on legacy systems while we plan for implementation of such new or updated systems; such legacy systems may not be able to scale efficiently as our business grows, which may delay future product launches or enhancements. Our failure to improve our systems and processes or complete such system implementations or enhancements on a timely basis, or their failure to operate in the intended manner, may result in our inability to manage the growth of our business, successfully integrate our acquisitions and to accurately forecast and report our results.
Current wording
We maintain information and data on various platforms, systems and applications. From time to time, to support our growth, we review and make enhancements to our existing platforms or migrate information and data to new platforms, systems and applications. For example, we are in the process of migrating and upgrading some of our platforms, systems and applications, including platforms, systems and applications that we obtained as a result of prior acquisitions. While we are engaged in this work, we may experience difficulties in managing our existing platforms, systems and applications, which could disrupt our operations, the management of our finances and the reporting of our financial results. If we determine new platforms, systems or applications or updates to existing platforms, systems or applications are necessary, we may need to rely on legacy platforms, systems or applications while we plan for implementation of such new or updated platforms, systems or applications; such legacy platforms, systems or applications may not be able to scale efficiently as our business grows, which may delay future product launches or enhancements. In addition, any new platforms, systems or applications may operate differently than anticipated when introduced or when new versions or enhancements are released or, there may be unforeseen consequences as a result of these migrations that may cause disruptions to the availability of our products due to service outages, downtime or other similar issues that could harm our business. Further, our transition could involve significant time and expense. Our failure to improve our platforms, systems or applications, complete such implementations, enhancements or migrations on a timely basis, or a failure of such platforms, systems or applications to operate in the intended manner, may result in our inability to manage the growth of our business, successfully integrate our acquisitions and to accurately forecast and report our results, which could harm our financial condition and results of operations. In addition, the migration of information and data could subject us to additional risks of cyber attacks, security breaches, cybersecurity incidents or other improper access to our personal, sensitive, proprietary or confidential information which could delay or interrupt service to our customers, cause us to not be in compliance with local or international laws or regulations or harm our reputation, any of which could cause us to incur substantial costs or subject us to significant liabilities.
Previous wording
We may fail to identify all of the problems, liabilities or other shortcomings or challenges of an acquired company, including issues related to intellectual property, solution quality or architecture, privacy, data protection, cybersecurity practices, regulatory compliance practices, employment practices, customer or sales channels and integrations of prior acquisitions. We are also required to integrate, operate and manage an acquired company's security infrastructure, which may be particularly challenging when acquired businesses utilize heavily customized or outdated systems or if we face a loss of personnel of the acquired business. Challenges with acquired systems and/or the loss of personnel familiar with and responsible for such acquired systems could increase our vulnerability to network attacks, security incidents or similar events.
Current wording
We may fail to identify all of the problems, liabilities or other shortcomings or challenges of an acquired company, including issues related to intellectual property, solution quality or architecture, privacy, data protection, cybersecurity, AI, regulatory compliance practices, employment practices, customer or sales channels and integrations of prior acquisitions. We are also required to integrate, operate and manage an acquired company's security infrastructure, which may be particularly challenging when acquired businesses utilize heavily customized or outdated systems or if we face a loss of personnel of the acquired business. Challenges with acquired systems and/or the loss of personnel familiar with and responsible for such acquired systems could increase our vulnerability to cyber attacks, security breaches or other cybersecurity incidents.
Previous wording
In February 2023, we effected a workforce reduction as part of a restructuring plan which impacted our employee count. Thereafter, to further reduce operating expenses and improve cash flows, we implemented additional workforce reductions. Although we have not seen a material impact on our workforce or our business, the effects of these workforce reductions could make it more difficult to preserve our company culture and could negatively impact employee morale.
Current wording
In February 2023, we effected a workforce reduction as part of a restructuring plan which impacted our employee count. Thereafter, to further reduce operating expenses and improve cash flows, we have implemented additional workforce reductions. Although we have not seen a material impact on our workforce or our business, the effects of these workforce reductions could make it more difficult to preserve our company culture and could negatively impact employee morale.
Previous wording
We have experienced, and may in the future experience, system failures and outages disrupting the operation of our websites or our products such as web-hosting and email, or the availability of our customer care operations. Our revenue depends in large part on the volume of traffic to our websites, the number of customers whose websites we host on our servers and the availability of our customer care operations. Accordingly, the performance, reliability and availability of our websites and servers for our corporate operations and infrastructure, as well as in the delivery of products to customers, are critical to our reputation and our ability to attract and retain customers. Any such system failure or outage could generate negative publicity, which could negatively impact our reputation and financial results. As we continue to transition many of our services to Amazon Web Services (AWS) to host our products, we have become, and will become, more dependent on third parties to accommodate the high volume of traffic to our websites and those of our customers.
Current wording
We have experienced, and may in the future experience, system failures and outages disrupting the operation of our websites or our products such as web-hosting and email, or the availability of our customer care operations. Our revenue depends in large part on the volume of traffic to our websites, the number of customers whose websites we host on our servers and the availability of our customer care operations. Accordingly, the performance, reliability and availability of our websites and servers for our corporate operations and infrastructure, as well as in the delivery of products to customers, are critical to our reputation and our ability to attract and retain customers. Any such system failure or outage could generate negative publicity, which could negatively impact our reputation and financial results. As we continue to transition many of our services to Amazon Web Services (AWS) to host our products, we have become, and may further become, more dependent on third parties to accommodate the high volume of traffic to our websites and those of our customers.
Previous wording
A substantial portion of our cloud infrastructure is provisioned through AWS, which hosts some of our products and platforms. Our customers need to be able to access our platform at any time, without interruption or degradation of performance. AWS runs its own platform that we access, and we are, therefore, vulnerable to service interruptions at AWS. We may experience interruptions, delays and outages in service and availability of AWS services due to a variety of factors, including infrastructure changes, human or software errors, website hosting disruptions and capacity constraints due to any number of potential causes, including technical failures, natural disasters, pandemics such as the COVID-19 pandemic, fraud or cybersecurity attacks, all of which could impact our service to our customers. In addition, if security of AWS is compromised, or our products or platform are unavailable or our users are unable to use our products within a reasonable amount of time or at all, then our business, results of operations and financial condition could be adversely affected. In some instances, AWS or we may not be able to identify the cause or causes of these performance problems within a period of time acceptable to our customers. It may become increasingly difficult to maintain and improve our platform performance, especially during peak usage times, as our products become more complex and the usage of our products increases. To the extent that we do not effectively address capacity constraints, either through AWS or alternative providers of cloud infrastructure, our business, results of operations and financial condition may be adversely affected. In addition, any changes in service levels from AWS may adversely affect our ability to meet our customers’ requirements, result in negative publicity which could harm our reputation and brand and may adversely affect the usage of our platform.
Current wording
A substantial portion of our cloud infrastructure is provisioned through AWS, which hosts some of our products and platforms. Our customers need to be able to access our platform at any time, without interruption or degradation of performance. AWS runs its own platform that we access, and we are, therefore, vulnerable to service interruptions at AWS. We may experience interruptions, delays and outages in service and availability of AWS services due to a variety of factors, including infrastructure changes, human or software errors, website hosting disruptions and capacity constraints due to any number of potential causes, including technical failures, natural disasters, pandemics such as the COVID-19 pandemic, fraud or cybersecurity attacks, all of which could impact our service to our customers. In addition, if the security of AWS is compromised, or our products or platform are unavailable or our users are unable to use our products within a reasonable amount of time or at all, then our business, results of operations and financial condition could be adversely affected. In some instances, AWS or we may not be able to identify the cause or causes of these performance problems within a period of time acceptable to our customers. It may become increasingly difficult to maintain and improve our platform performance, especially during peak usage times, as our products become more complex and the usage of our products increases. To the extent that we do not effectively address capacity constraints, either through AWS or alternative providers of cloud infrastructure, our business, results of operations and financial condition may be adversely affected. In addition, any changes in service levels from AWS may adversely affect our ability to meet our customers’ requirements, result in negative publicity which could harm our reputation and brand and may adversely affect the usage of our platform.
Previous wording
A network attack, a security breach or other cybersecurity incident could delay or interrupt service to our customers, harm our reputation, cause us to incur substantial costs, or subject us to significant liability.
Current wording
A cyber attack, a security breach or other cybersecurity incident could delay or interrupt service to our customers, harm our reputation, cause us to incur substantial costs, or subject us to significant liability.
Previous wording
We maintain an enterprise-wide cybersecurity program to manage the risks to our information systems from cybersecurity threats and incidents. Our operations depend on our ability to protect our information systems against interruption, a breach of confidentiality, or other damage from unauthorized entry, computer viruses, denial of service attacks and other security threats both within and beyond our control. These cybersecurity threats may arise from human error, fraud, or malice on the part of our employees, insiders, or third parties, or they may result from accidental technological failure. Threat actors may also attempt to fraudulently induce employees, customers, or other third-party users of our systems to disclose sensitive information, wittingly or unwittingly, to gain access to our data or that of our customers or third parties with whom we interact.
Current wording
We maintain an enterprise-wide cybersecurity program to manage the risks to our information systems from cybersecurity threats and incidents. Our operations depend on our ability to protect our information systems against interruption, a breach of confidentiality, or other damage from unauthorized entry, computer viruses, denial of service attacks and other cybersecurity threats and incidents both within and beyond our control. These cybersecurity threats and incidents may arise from human error, fraud, or malice on the part of our employees, insiders, or third parties, or they may result from accidental technological failure. Recent advances in AI may increase the size, frequency and sophistication of these cybersecurity threats and incidents; for example, threat actors are able to create more personalized and targeted communications using information derived from people’s relationships, online behavior and preferences. Threat actors may also attempt to fraudulently induce employees, customers, or other third-party users of our systems to disclose sensitive information, wittingly or unwittingly, to gain access to our data or that of our customers or third parties with whom we interact.
Previous wording
As an operator of a large Internet infrastructure, the company is frequently targeted and experiences a high rate of attacks, some of which have allowed threat actors to gain access to our networks and data. We have made and continue to make investments to improve our security posture. However, we continue to see attackers pivoting to new methods of attack and seeking new entry points in our network despite these investments. Examples of the types of attacks we have experienced include opportunistic attacks leveraging previously undetected vulnerabilities and configuration errors. We also have experienced more sophisticated forms of attacks, such as advanced persistent threat attacks and zero-day attacks and situations where the threat is not compiled or does not have detection signatures within our observation and threat indicators space until the moment it is launched. For example, we have experienced, and may experience in the future, distributed denial of service (DDoS) attacks aimed at disrupting service to our customers, attempts to place illegal or abusive content on our or our customers' websites, and other attacks on our systems by sophisticated threat actors. In addition, there has been an increase in the number of malicious software attacks in the technology industry generally, including newer strains of malware, ransomware and cryptocurrency mining software exploiting zero-day vulnerabilities in open source and third-party software. Retaliatory acts by Russia in response to economic sanctions or other measures taken by the international community against Russia arising from the Russia-Ukraine military conflict could include an increased number or severity of cyber attacks from Russia or its allies. We have seen an increasing number of cyber attacks from threat actor groups located in or leveraging systems, sites and infrastructure hosted in the Russian region to target attacks on our infrastructure. Our response to any such attacks may be insufficient to protect our network and systems, especially as attacks increase in size and nation-state actors use attacks against political and economic adversaries. In addition to the above, the remote work environment has increased our vulnerability to consumer privacy, cybersecurity and fraud risks as a result of our personnel working remotely, which may require us to invest in risk mitigation efforts that may not be successful.
Current wording
As an operator of a large Internet infrastructure, GoDaddy is frequently targeted and experiences a high rate of cyber attacks, some of which have allowed threat actors to gain access to our networks and data. We have made and continue to make investments to improve our security posture. However, we continue to see threat actors pivoting to new methods of attack and seeking new entry points in our network despite these investments. Examples of the types of cyber attacks we have experienced include opportunistic cyber attacks leveraging previously undetected vulnerabilities and configuration errors and more sophisticated forms of cyber attacks, such as advanced persistent threat attacks, zero-day attacks and situations where the threat is not compiled or does not have detection signatures within our observation and threat indicators space until the moment it is launched. For example, we have experienced, and may experience in the future, distributed denial of service (DDoS) attacks aimed at disrupting service to our customers and attempts to place illegal or abusive content on our or our customers’ websites. There has also been an increase in the number of cyber attacks in the technology industry generally, including newer strains of malware, ransomware and cryptocurrency mining software exploiting zero-day vulnerabilities in open source and third-party software. In addition, retaliatory acts by Russia in response to economic sanctions and other measures taken by the international community against Russia due to the Russia-Ukraine military conflict could include an increased number or severity of cyber attacks from Russia or its allies. We have seen an increasing number of cyber attacks on our infrastructure from threat actor groups located in or leveraging systems, sites and infrastructure hosted in the Russian region. Our response to any such cyber attacks may be insufficient to protect our network and systems, especially as cyber attacks increase in size, frequency and sophistication or as nation-state actors use attacks against political and economic adversaries. In addition to the above, the remote work environment has increased our vulnerability to privacy, data protection, cybersecurity and fraud risks as a result of our personnel working remotely, which may require us to invest in risk mitigation efforts that may not be successful.
Previous wording
Social engineering efforts may compromise our personnel or those of our third-party vendors, leading to unauthorized access to information systems we have a responsibility to protect, which could lead to the unauthorized acquisition of information, the unavailability of our information systems (or information contained on those systems) or the compromise of customer accounts. Despite efforts to promote security awareness and training for our personnel and vendors, malicious actors are increasingly sophisticated and successful in their use of social engineering techniques. We have experienced, and may continue to experience, social engineering attempts, some of which have been successful, including by a persistent threat actor group, which, among other things, has attempted to transfer customer domain names and has targeted customer domains related to cryptocurrency. Recent advances in AI may increase the sophistication of these types of attacks; for example, as attackers are able to create more personalized and targeted communications using information derived from people’s relationships, online behavior and preferences. We have taken steps and continue to work to enhance our cybersecurity and resilience against social engineering, requiring additional engineering efforts and modifications to our technology architecture as well as the expenditure of time and additional cost. We cannot guarantee that our efforts will be successful or that future social engineering incidents will not cause financial, operational and/or reputational harm.
Current wording
Social engineering efforts may compromise our personnel or those of our third-party vendors, leading to unauthorized access to information systems we have a responsibility to protect, which could lead to the unauthorized acquisition of information, the unavailability of our information systems (or information contained on those systems) or the compromise of customer accounts. Despite efforts to promote security awareness and training for our personnel and vendors, malicious actors are increasingly sophisticated and successful in their use of social engineering techniques. We have experienced, and may continue to experience, social engineering attempts, some of which have been successful, including by a persistent threat actor group, which, among other things, has attempted to transfer customer domain names and has targeted customer domains related to cryptocurrency. We have taken steps and continue to work to enhance our cybersecurity and resilience against social engineering, requiring additional engineering efforts and modifications to our technology architecture as well as the expenditure of time and additional cost. We cannot guarantee that our efforts will be successful or that future social engineering incidents will not cause financial, operational and/or reputational harm.
Previous wording
We cannot guarantee that our backup systems and regular data backups will be adequate to protect against loss of our information or information of our customers and third parties. In addition, we cannot guarantee that our cybersecurity program, including our related security protocols, network protection mechanisms, cybersecurity awareness training, insider threat protection program, access controls, and other procedures and measures currently in place, or that may be in place in the future, will be adequate to prevent or remedy network and service interruptions, system failure and software vulnerabilities, damage to one or more of our systems, data loss, data breaches or other cybersecurity incidents. Also, many of our products are cloud-based and we store our customers' data on our servers. Despite the implementation of cybersecurity measures, our information systems may be vulnerable to computer viruses, worms, other malicious software programs, social engineering attacks, insider threats, credential theft and related abuse, illegal or abusive content or similar disruptive problems caused by our customers, employees, consultants or other Internet users who attempt to invade or disrupt public and private data networks or to improperly access, use or obtain data.
Current wording
We cannot guarantee that our backup systems and regular data backups will be adequate to protect against loss of our information or information of our customers and third parties. In addition, we cannot guarantee that our cybersecurity program, including our related security protocols, network protection mechanisms, cybersecurity awareness training, insider threat protection program, access controls, and other procedures and measures currently in place, or that may be in place in the future, will be adequate to prevent or remedy network and service interruptions, system failure and software vulnerabilities, damage to one or more of our systems, data loss, cyber attacks, security breaches or other cybersecurity incidents. Also, many of our products are cloud-based and we store our customers' data on our servers. Despite the implementation of cybersecurity measures, our information systems may be vulnerable to computer viruses, worms, other malicious software programs, social engineering attacks, insider threats, credential theft and related abuse, illegal or abusive content or similar disruptive problems caused by our customers, employees, consultants or other Internet users who attempt to invade or disrupt public and private data networks or to improperly access, use or obtain data.
Previous wording
We experience cybersecurity incidents, and any actual or perceived breach of our security could expose us to a risk of loss or litigation and possible liability. Cybersecurity incidents also could subject us to regulatory or other government inquiries or investigations, which will require us to expend significant capital and other resources to remediate the breach, any of which would harm our business, financial condition and operating results. For example, in July 2020 and October 2021 we received Civil Investigative Demands from the FTC relating to a cybersecurity incident that we first discovered in March 2020. The FTC’s investigation is ongoing, the timing and resolution of this matter is uncertain, and could result in our being subject to substantial monetary or other costs to the business. We have continued to experience other cybersecurity and data privacy incidents since 2020 that have required notification to government regulators and/or data subjects in the United States and internationally. Based on our investigations, we believe some of these incidents are part of a multi-year campaign by a sophisticated threat actor group which, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy, while others are one-time or opportunistic attacks by unrelated threat actors. To date, these incidents as well as other cyber threats and attacks have not resulted in any material adverse impact to our business, operations or financial condition, but such threats are constantly evolving, increasing the difficulty of detecting and successfully defending against them. In case of a future incident, a history of past incidents, such as those mentioned herein, may subject us to a greater risk of significant costs and sanctions, or investigations into past incidents may be re-invigorated.
Current wording
Any actual or perceived breach of our security could expose us to a risk of loss or litigation and possible liability. Cybersecurity incidents could also subject us to regulatory or other government inquiries or investigations, which will require us to expend significant capital and other resources to remediate the breach, any of which would harm our business, financial condition and operating results. For example, in July 2020 and October 2021 we received Civil Investigative Demands from the FTC relating to a cybersecurity incident that we first discovered in March 2020. The FTC’s investigation is ongoing, the timing and resolution of this matter is uncertain, and could result in our being subject to substantial monetary or other costs to the business and/or costly and time-consuming litigation with the FTC. We have continued to experience other privacy, data protection and cybersecurity incidents since 2020 that have required notification to government regulators and/or data subjects in the U.S. and internationally. Based on our investigations, we believe some of these incidents are part of a multi-year campaign by a sophisticated threat actor group which, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy, while others are one-time or opportunistic attacks by unrelated threat actors. To date, these incidents as well as other cyber threats and attacks have not resulted in any material adverse impact to our business, operations or financial condition, but such threats are constantly evolving, increasing the difficulty of detecting and successfully defending against them. In case of a future incident, a history of past incidents, such as those mentioned herein, may subject us to a greater risk of significant costs and sanctions, or investigations into past incidents may be re-invigorated.
Previous wording
Our business involves the storage and transmission of confidential information, including personal information and payment card information. In addition, nearly all of our products are cloud-based and we process such data for our customers on our servers, and on servers used by our vendors and partners, such as AWS. We take measures intended to protect the security, integrity and confidentiality of the personal information or other information, including payment card information, that we collect, store or transmit, but cannot guarantee that inadvertent or unauthorized use or disclosure of such information will not occur or that third parties, including nation-states and bad actors, or our personnel, or those of our vendors will not gain unauthorized or other malicious access to this information or systems where personal information is processed despite our preventative efforts or those of our vendors or partners.
Current wording
Our business involves the storage and transmission of personal, sensitive, proprietary and confidential information, including payment card information. In addition, nearly all of our products are cloud-based and we process such data for our customers on our servers, and on servers used by our vendors and partners, such as AWS. We take measures intended to protect the security, integrity and confidentiality of the personal, sensitive, proprietary and confidential information, including payment card information, that we collect, store, transmit, or otherwise process but cannot guarantee that inadvertent or unauthorized use or disclosure of such information will not occur or that third parties, including nation-states and bad actors, or our personnel, or those of our vendors will not gain unauthorized or other malicious access to this information or systems where personal, sensitive, proprietary and confidential information is processed despite our preventative efforts or those of our vendors or partners.
Previous wording
If third parties succeed in penetrating our security measures or those of our vendors and partners, or in otherwise accessing or obtaining without authorization the personal, sensitive or confidential information, including payment card information we or our vendors and partners maintain, we could be subject to liability, loss of business, litigation, government investigations or other losses. As we continue to rely more on third-party and public-cloud infrastructures, such as AWS and other third-party service providers, we have become, and will become, more dependent on third-party security measures to protect against unauthorized access, cyber attacks and the mishandling of customer data. Increased handling of personal, sensitive or confidential information, including payment card information, by third parties may create increased risks of unauthorized disclosure, misuse or loss of these types of information and may require us to expend significant time and resources to address incidents of failure in such third parties' security measures. We also anticipate being required to expend significant resources to maintain and improve our oversight of vendors and other third parties with whom we share data or otherwise process data on our behalf. In addition, our customers and partners have in the past and may in the future request we produce evidence of our cybersecurity program as part of their own compliance programs. Responding to such requests may be costly and time consuming.
Current wording
If third parties succeed in penetrating our security measures or those of our vendors and partners, or in otherwise accessing or obtaining without authorization the personal, sensitive, proprietary or confidential information, including payment card information, we or our vendors and partners maintain or otherwise process, we could be subject to liability, loss of business, litigation, government investigations or other losses. As we continue to rely more on third-party and public-cloud infrastructures, such as AWS and other third-party service providers, we have become, and will become, more dependent on third-party security measures to protect against cyber attacks, security breaches and other cybersecurity incidents, including unauthorized access to and mishandling of customer data. Increased handling of personal, sensitive, proprietary or confidential information, including payment card information, by third parties may create increased risks of unauthorized disclosure, misuse or loss of these types of information and may require us to expend significant time and resources to address incidents of failure in such third parties’ security measures. We also anticipate being required to expend significant resources to maintain and improve our oversight of vendors and other third parties with whom we share data or otherwise process data on our behalf. Further, our control over and ability to monitor the security posture of our vendors and partners, including any third-party service providers we rely on, remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any cyber attack, security breach or other cybersecurity incident impacting the infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such cyber attack, security breach or other cybersecurity incident. In addition, our customers and partners have in the past and may in the future request we produce evidence of our cybersecurity program as part of their own compliance programs. Responding to such requests may be costly and time consuming.
Previous wording
If we or our partners experience any breaches or sabotage of our security measures, or otherwise suffer unauthorized use or disclosure of, or access to, personal, sensitive or confidential information, including payment card information, we might be required to expend significant capital and resources to remediate these problems and protect against additional breaches or sabotage. We may not be able to remedy any problems caused by threat actors in a timely manner, or at all, due to, among other things, a lack of qualified personnel to handle such problems or the failure of our personnel to follow internal policies and procedures. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until after they are launched against a target, we and our vendors and partners may be unable to anticipate these techniques or to implement adequate preventative measures on a timely basis. Advances in computer capabilities, discoveries of new weaknesses, increased likelihood of nation-state cyber attacks (including retaliatory cyber attacks by Russia in response to economic sanctions resulting from the Russia-Ukraine military conflict), and other developments with software generally used by the Internet community, such as the Zenbleed and Downfall vulnerabilities, which exploit security flaws in processors manufactured by both AMD and Intel, continually evolving ransomware attacks, or developments related to vendor software (e.g., SolarWinds Orion product incident), also increase the risk that we, or our customers using our servers and services, will suffer a security breach. We or our partners may also suffer security breaches or unauthorized access to personal, sensitive or confidential information, including payment card information, due to employee error, rogue employee activity, unauthorized access by third parties acting with malicious intent or committing an inadvertent mistake, or social engineering. If a breach of our security or other cybersecurity incident occurs or is perceived to have occurred, the perception of the effectiveness of our security measures and our reputation could be harmed and we could lose current and potential customers.
Current wording
If we or our partners experience any breaches or sabotage of our security measures, or otherwise suffer unauthorized use or disclosure of, or access to, personal, sensitive, proprietary or confidential information, including payment card information, we might be required to expend significant capital and resources to remediate these problems and protect against additional breaches or sabotage. We may not be able to remedy any problems caused by threat actors in a timely manner, or at all, due to, among other things, a lack of qualified personnel to handle such problems or the failure of our personnel to follow internal policies and procedures. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until after they are launched against a target, we and our vendors and partners may be unable to anticipate these techniques or to implement adequate preventative measures on a timely basis. Advances in computer capabilities, discoveries of new weaknesses, increased likelihood of nation-state cyber attacks (including retaliatory cyber attacks by Russia in response to economic sanctions resulting from the Russia-Ukraine military conflict), and other developments with software generally used by the Internet community, such as the Zenbleed and Downfall vulnerabilities, which exploit security flaws in processors manufactured by both AMD and Intel, continually evolving ransomware attacks, or developments related to vendor software (e.g., SolarWinds Orion product incident), also increase the risk that we, or our customers using our servers and services, will suffer a cyber attack, security breach or other cybersecurity incident. We or our partners may also suffer cyber attacks, security breaches, cybersecurity incidents or other unauthorized access to personal, sensitive, proprietary or confidential information, including payment card information, due to employee error, rogue employee activity, unauthorized access by third parties acting with malicious intent or committing an inadvertent mistake, or social engineering. If a cyber attack, security breach or other cybersecurity incident occurs or is perceived to have occurred, the perception of the effectiveness of our security measures and our reputation could be harmed and we could lose current and potential customers.
Previous wording
Security breaches or other unauthorized access to personal, sensitive or confidential information, including payment card information, could result in mandatory customer, regulator, contractual, and/or payment card provider notifications, litigation, government investigations, adverse publicity, and claims against us for unauthorized purchases with payment card information, identity theft or other similar fraud claims, and claims for other misuses of personal information, including for unauthorized marketing purposes, which could result in a material adverse effect on our business, financial condition or reputation. Moreover, these claims could cause us to incur penalties from payment card associations (including those resulting from our failure to adhere to industry cybersecurity standards), or termination by payment card associations of our ability to accept credit or debit card payments, any of which could have a material adverse effect on our business and financial condition. Although we maintain cyber liability insurance coverage that may cover certain liabilities in connection with a security breach or other security incident, we cannot be certain our insurance coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on commercially reasonable terms (if at all) or that any insurer will not deny coverage as to any future claim. In addition, certain insurers have denied coverage if a nation-state is declared the sponsor or perpetrator of such security breach or incident. For example, following the U.S., the UK, Canadian and Australian governments' attribution of Russia for the NotPetya ransomware attack, Zurich American Insurance Co. denied Mondelez International, Inc.'s claim for damages from that attack, which resulted in litigation between Zurich and Mondelez that was eventually settled prior to trial. In January 2022, a court in New Jersey permitted Merck & Co. to recover under its cyber insurance policies for a NotPetya attack, leading to a settlement prior to trial that was publicly announced in January 2024. These examples suggest there continues to be uncertainty across the cyber insurance market regarding the availability of coverage for nation-state-led cyber attacks. The successful assertion of one or more large claims against us that exceed available insurance coverage, the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, or denials of coverage based on "act of war" or similar exclusions triggered by attribution of an attack to a nation-state, particularly given the heightened risk of cyber attacks due to the ongoing Russia-Ukraine military conflict, could have a material adverse effect on our business, including our financial condition, results of operations and reputation.
Current wording
Cyber attacks, security breaches, cybersecurity incidents or other unauthorized access to personal, sensitive, proprietary or confidential information, including payment card information, could result in mandatory customer, regulator, contractual, and/or payment card provider notifications, litigation, government investigations, adverse publicity, and claims against us for unauthorized purchases with payment card information, identity theft or other similar fraud claims, and claims for other misuses of personal, sensitive, proprietary or confidential information, including for unauthorized marketing purposes, which could result in a material adverse effect on our business, financial condition or reputation. Moreover, these claims could cause us to incur penalties from payment card associations (including those resulting from our failure to adhere to industry cybersecurity standards), or termination by payment card associations of our ability to accept credit or debit card payments, any of which could have a material adverse effect on our business and financial condition. Although we maintain cyber liability insurance coverage that may cover certain liabilities in connection with a cyber attack, security breach or other cybersecurity incident, we cannot be certain our insurance coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on commercially reasonable terms (if at all) or that any insurer will not deny coverage as to any future claim. In addition, certain insurers have denied coverage if a nation-state is declared the sponsor or perpetrator of such cyber attack, security breach or other cybersecurity incident. For example, following the U.S., the UK, Canadian and Australian governments’ attribution of Russia for the NotPetya ransomware attack, Zurich American Insurance Co. denied Mondelez International, Inc.’s claim for damages from that attack, which resulted in litigation between Zurich and Mondelez that was eventually settled prior to trial. In January 2022, a court in New Jersey permitted Merck & Co. to recover under its cyber insurance policies for a NotPetya attack, leading to a settlement prior to trial that was publicly announced in January 2024. These examples suggest there continues to be uncertainty across the cyber insurance market regarding the availability of coverage for nation-state-led cyber attacks. The successful assertion of one or more large claims against us that exceed available insurance coverage, the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, or denials of coverage based on “act of war” or similar exclusions triggered by attribution of an attack to a nation-state, particularly given the heightened risk of cyber attacks due to the ongoing Russia-Ukraine military conflict, could have a material adverse effect on our business, including our financial condition, r…
Excerpt shortened here; the source contains the full paragraph.
Previous wording
We have expended and expect to continue to expend significant resources to protect against security breaches and other cybersecurity incidents. While these investments have reduced our vulnerability to certain types of attacks, we have observed ongoing attempts to probe our defenses for other opportunities to attack our systems and access our network. Thus, we remain vulnerable to cyberattacks despite our investments. In addition, the risk that these types of events could seriously harm our business is likely to increase as we expand the number of cloud-based products we offer and as we operate or expand our business into more countries.
Current wording
We have expended and expect to continue to expend significant resources to protect against cyber attacks, security breaches and other cybersecurity incidents. While these investments have reduced our vulnerability to certain types of attacks, we have observed ongoing attempts to probe our defenses for other opportunities to attack our systems and access our network. Thus, we remain vulnerable to cyber attacks despite our investments. In addition, the risk that these types of events could seriously harm our business is likely to increase as we expand the number of cloud-based products we offer and as we operate or expand our business into more countries.
Previous wording
Our products and services, and the products and services of our third-party vendors and partners, may be subject to fraudulent usage, including but not limited to domain name hijacking, revenue share fraud, and other fraudulent schemes. In addition, although our customers are required to set passwords or personal identification numbers to protect their accounts, third parties have in the past been, and may in the future be, able to access and use our customers' accounts through fraudulent means. Fraudulent activity can result in, among other things, interruption of our services to our customers, and substantial and reputational harm. Although we implement multiple fraud prevention and detection controls, we cannot be certain that our efforts to address external fraudulent activity, such as revenue share fraud, domain name hijacking or other fraudulent use of our, or our third parties' and vendors' products and services, will be successful in eliminating these threats, any of which could adversely affect our business, results of operations and financial condition.
Current wording
Our products and services, and the products and services of our third-party vendors and partners, may be subject to fraudulent usage, including but not limited to domain name hijacking, revenue share fraud, and other fraudulent schemes. In addition, although our customers are required to set passwords or personal identification numbers to protect their accounts, third parties have in the past been, and may in the future be, able to access and use our customers' accounts through fraudulent means. Fraudulent activity can result in, among other things, interruption of our services to our customers, and substantial business and reputational harm. Although we implement multiple fraud prevention and detection controls, we cannot be certain that our efforts to address external fraudulent activity, such as revenue share fraud, domain name hijacking or other fraudulent use of our, or our third parties' and vendors' products and services, will be successful in eliminating these threats, any of which could adversely affect our business, results of operations and financial condition.
Previous wording
We continue to refine our efforts in customer care so we can adequately serve our domestic and international customers. A portion of our GoDaddy Guides is engaged through third parties and not directly employed by us. If our agreements with such third parties are terminated for any reason, including a breach of agreement, if such third parties or the GoDaddy Guides engaged through the third parties do not perform the level of service expected of GoDaddy or our customers, or if such GoDaddy Guides engage in misconduct, our business and reputation could be harmed and we may need to find and/or train alternative providers, which could increase our costs and delay services to our customers. In addition, such a disruption could adversely impact our ability to serve our customers and to sell products to new and existing customers and we may experience a decline in our subscription renewal rates and in our ability to cross-sell our products and our reputation may suffer, any of which could adversely affect our business, reputation and operating results.
Current wording
We continue to refine our efforts in customer care so we can adequately serve our domestic and international customers. A portion of our GoDaddy Guides is engaged through third parties and not employed by us. If our agreements with such third parties are terminated for any reason, including a breach of agreement, if such third parties or the GoDaddy Guides engaged through the third parties do not perform the level of service expected of GoDaddy or our customers, or if such GoDaddy Guides engage in misconduct, our business and reputation could be harmed and we may need to find and/or train alternative providers, which could increase our costs and delay services to our customers. In addition, such a disruption could adversely impact our ability to serve our customers and to sell products to new and existing customers and we may experience a decline in our subscription renewal rates and in our ability to cross-sell our products and our reputation may suffer, any of which could adversely affect our business, reputation and operating results.
Previous wording
Our failure to properly register or maintain our customers' domain names could subject us to additional expenses, claims of loss or negative publicity that could have a material adverse effect on our business.
Current wording
Our failure to properly register or maintain our customers' domain names or comply with applicable laws and regulations relating to domain name registration and maintenance could subject us to additional liability, regulatory action, expenses, claims of loss or negative publicity that could have a material adverse effect on our business.
Showing the first 40 of 77 pairs. Open the source sections for the rest.
Rearranged current paragraphs (5)
Current report — wording carried from elsewhere
In addition, the extension of the Cooperative Agreement between VeriSign, Inc. (VeriSign), the registry for .com and .net, and the U.S. Department of Commerce in 2018 gives VeriSign the right to become an ICANN-accredited registrar for any generic top level domain (TLD) other than .com. While VeriSign has not publicly announced whether it will become a registrar, and there is no indication that it would, if it were to do so, it would become one of our competitors in this space, which could have a negative impact on our business and industry.
Current report — wording carried from elsewhere
As described in Note 2 to our audited financial statements, we generally recognize revenue from our customers ratably over the respective terms of their subscriptions in accordance with generally accepted accounting principles in the U.S. (GAAP).
Current report — wording carried from elsewhere
2020, VeriSign and ICANN amended the .com registry agreement to allow fees to be increased to no more than $10.26 annually for each .com registration. VeriSign has increased such fees in recent years and in February 2024, VeriSign announced it would increase the annual registry-level wholesale fee for new and renewal .com domain name registrations from $9.59 to $10.26, effective September 1, 2024. If fees continue to increase, costs to our customers could be higher, which could have an adverse impact on our results of operations. We have no control over ICANN, VeriSign or other domain name registries and cannot predict their future fee structures.
Current report — wording carried from elsewhere
If our privacy, data protection or cybersecurity measures fail to comply with current or future laws, regulations, policies, legal obligations or industry standards, or are perceived to have done so, we have in the past been, and may be in the future, subject to litigation and/or regulatory investigations, and may incur fines or other liabilities, as well as negative publicity and a potential loss of business. Moreover, if future laws, regulations, other legal obligations or industry standards, or any changed interpretations of the foregoing, limit our customers' ability to collect, store, transmit, or otherwise process personal, sensitive, proprietary and confidential information, including payment card information, or our ability to collect, store, transmit, or otherwise process such information, demand for our products could decrease, our costs could increase and our business, operating results and financial condition could be harmed.
Current report — wording carried from elsewhere
U.S. federal district courts will be the exclusive forum for resolving any complaint asserting a cause of action under the Securities Act.
Rearranged previous paragraphs (4)
Previous report — wording carried elsewhere
Marketing through 'Buy Buttons' and provided on-the-go solutions such as Tap-to-Pay capability in the GoDaddy Mobile App, Pay Links and Virtual Terminal. To the extent we are not able to continue to identify challenges faced by entrepreneurs, small businesses and ventures and provide products responding in a timely and effective manner to their evolving needs, our business, operating results and financial condition may be adversely affected.
Previous report — wording carried elsewhere
The charges and expenditures that we expect to incur in connection with the restructuring activities, and timing thereof, are subject to a number of assumptions, including local law requirements in various jurisdictions, and we may incur costs that are greater than we currently expect in connection with the restructuring activities.
Previous report — wording carried elsewhere
If the security of the personal, sensitive or confidential information, including payment card information, we or our vendors or partners maintain, including that of our customers and the visitors to our customers' websites stored in our information systems, is breached or otherwise subjected to unauthorized access, our reputation may be harmed and we may be exposed to liability.
Previous report — wording carried elsewhere
Our business could be negatively impacted by shareholder activism.