Ibotta Inc

Previous wording

We have a history of net losses. For example, we incurred a net loss of $54.9 million for the year ended December 31, 2022, and as of December 31, 2023, we had an accumulated deficit of $209.2 million. While we achieved profitability for the fiscal year ended December 31, 2023, we may not be able to continue to be profitable. We expect our costs will increase over time as we expect to invest significant additional funds towards growing our business and operating as a public company. See the risk factor below titled “Operating and growing our business may require additional capital, and if capital is not available to us, our business, financial condition, results of operations, and prospects may suffer.” We have expended and expect to continue to expend substantial financial and other resources on developing our platform, including expanding our solutions, developing or acquiring new platform features and solutions, and increasing our sales and marketing efforts. These efforts may be more costly than we expect and may not result in increased revenue or growth in our business. Any failure to increase our revenue sufficiently to keep pace with our investments and other expenses could prevent us from achieving profitability or positive cash flow on a consistent basis. If we are unable to successfully address these risks and challenges as we encounter them, our business, financial condition, results of operations, and prospects could be adversely affected.

Current wording

We have a history of net losses. While we achieved profitability for the fiscal year ended December 31, 2023, we may not be able to continue to be profitable. For example, we incurred net losses of $34.0 million and $24.7 million for the three and six months ended June 30, 2024, respectively, and as of June 30, 2024, we had an accumulated deficit of $233.9 million. We expect our costs will increase over time as we expect to invest significant additional funds towards growing our business and operating as a public company. See the risk factor below titled “Operating and growing our business may require additional capital, and if capital is not available to us, our business, financial condition, results of operations, and prospects may suffer.” We have expended and expect to continue to expend substantial financial and other resources on developing our platform, including expanding our solutions, developing or acquiring new platform features and solutions, and increasing our sales and marketing efforts. These efforts may be more costly than we expect and may not result in increased revenue or growth in our business. Any failure to increase our revenue sufficiently to keep pace with our investments and other expenses could prevent us from achieving profitability or positive cash flow on a consistent basis. If we are unable to successfully address these risks and challenges as we encounter them, our business, financial condition, results of operations, and prospects could be adversely affected.

Previous wording

Our business, financial condition, results of operations, and prospects will be adversely affected if we do not renew, maintain, and expand our relationships with existing publishers and add new publishers to the IPN. We provide offers on a white-label basis to Walmart Inc., a Delaware corporation (Walmart), Dollar General Corporation, a Tennessee corporation (Dollar General), Shell plc, a United Kingdom public limited company (Shell), Exxon Mobil Corporation, a New Jersey corporation (Exxon), The Kroger Co., an Ohio corporation (Kroger), and other retailers. We have invested heavily in the IPN, which matches and distributes offers across a variety of publisher sites. Our contract negotiation process with such publishers can be lengthy, which can contribute to variability in our revenue generation and makes our revenue difficult to forecast. As a result, it is difficult to predict our ability to form new partnerships with publishers, and our revenue could be lower than expected, which would have an adverse effect on our business, financial condition, results of operations, and prospects.

Current wording

Our business, financial condition, results of operations, and prospects will be adversely affected if we do not renew, maintain, and expand our relationships with existing publishers and add new publishers to the IPN. We provide offers on a white-label basis to Walmart Inc., a Delaware corporation (Walmart), Dollar General Corporation, a Tennessee corporation (Dollar General), Family Dollar Stores LLC, a Delaware limited liability company (Family Dollar), Shell plc, a United Kingdom public limited company (Shell), Exxon Mobil Corporation, a New Jersey corporation (Exxon), and other retailers. We have invested heavily in the IPN, which matches and distributes offers across a variety of publisher sites. Our contract negotiation process with such publishers can be lengthy, which can contribute to variability in our revenue generation and makes our revenue difficult to forecast. As a result, it is difficult to predict our ability to form new partnerships with publishers, and our revenue could be lower than expected, which would have an adverse effect on our business, financial condition, results of operations, and prospects.

Previous wording

Both the redeemers and our redeemers’ level of redemptions are critical to our success. As of March 31, 2024, total redeemers were approximately 12.5 million. For clarity, if one consumer were to redeem on more than one publisher, they would be counted as a redeemer on each publisher. We have in the past experienced fluctuations and declines in the pace of growth of redeemers and could in the future be unable to grow or increase the engagement of our redeemers, and as a result our business may suffer. If we are unable to maintain and expand the use by consumers of digital promotions in our network or if we do not do so to a greater extent than our competitors, publishers, CPG brands, and retailers may find that offering digital promotions on our network does not reach consumers with the scale and effectiveness that is compelling to them.

Current wording

Both the redeemers and our redeemers’ level of redemptions are critical to our success. During the six months ended June 30, 2024, total redeemers were approximately 13.1 million. For clarity, if one consumer were to redeem on more than one publisher, they would be counted as a redeemer on each publisher. We have in the past experienced fluctuations and declines in the pace of growth of redeemers and could in the future be unable to grow or increase the engagement of our redeemers, and as a result our business may suffer. If we are unable to maintain and expand the use by consumers of digital promotions in our network or if we do not do so to a greater extent than our competitors, publishers, CPG brands, and retailers may find that offering digital promotions on our network does not reach consumers with the scale and effectiveness that is compelling to them.

Previous wording

As of December 31, 2023, we have over 850 different clients. The success and scale of our network depend on our strategic relationships with CPG brands. If we are not able to attract consumers, including through third-party publishers’ white-label loyalty programs, CPG brands may not be willing to use our network for digital promotions. If we do not renew, maintain, and expand these relationships or add new CPG brands, we may not be able to grow our redemptions and our business will be negatively affected.

Current wording

The success and scale of our network depend on our strategic relationships with CPG brands. If we are not able to attract consumers, including through third-party publishers’ white-label loyalty programs, CPG brands may not be willing to use our network for digital promotions. If we do not renew, maintain, and expand these relationships or add new CPG brands, we may not be able to grow our redemptions and our business will be negatively affected.

Previous wording

If our CPG brands choose to materially alter the breadth, depth, or targeting parameters of the offers they provide to us for distribution throughout our network, this could cause unforeseen reductions in the number of redemptions.

Current wording

If our CPG brands choose to materially alter the breadth, depth, or parameters of the offers they provide to us for distribution throughout our network, this could cause unforeseen reductions in the number of redemptions.

Previous wording

Historically, the growth rate of our business, and as a result, our revenue growth, has varied from quarter to quarter and year to year, and we expect that variability to continue. For the three months ended March 31, 2024, our revenue was $82.3 million. There can be no assurances that our revenue will grow at current rates and you should not rely on the revenue of any prior quarterly or annual period as an indication of our future performance. Our revenue growth rate may decline in future periods.

Current wording

Historically, the growth rate of our business, and as a result, our revenue growth, has varied from quarter to quarter and year to year, and we expect that variability to continue. For the three and six months ended June 30, 2024, our revenue was $87.9 million and $170.3 million, respectively. There can be no assurances that our revenue will grow at current rates and you should not rely on the revenue of any prior quarterly or annual period as an indication of our future performance. Our revenue growth rate may decline in future periods.

Previous wording

In some cases, we provide content to publishers indirectly, via third-party technology partners, as in the cases of Kroger, Shell, and Exxon. We have also entered into an agreement with AppCard, through which Ibotta gained access to the digital audiences of more than 300 small- or medium-sized grocery retailers, as of April 8, 2024. If any of our third-party technology partners terminate or reduce their relationships with us, or suspend, limit, or cease their operations or otherwise, we will not be able to reach certain retailers and our business, financial condition, results of operations, and prospects will suffer.

Current wording

In some cases, we provide content to publishers indirectly, via third-party technology partners, as in the cases of Shell and Exxon. We also entered into an agreement with AppCard, through which Ibotta gained access to the digital audiences of more than 300 small- or medium-sized grocery retailers in April 2024. If any of our third-party technology partners terminate or reduce their relationships with us, or suspend, limit, or cease their operations or otherwise, we will not be able to reach certain retailers and our business, financial condition, results of operations, and prospects will suffer.

Previous wording

As of December 31, 2023, we had 85 integrated retailers. Our integrated retailers provide us with item-level data that is integral to our platform because such data helps facilitate a simpler redemption of offers on our D2C properties. We also allow thousands of online retailers to advertise and present consumers with their own cash back offers on our D2C properties. Our ability to renew, maintain, and expand our relationships with retailers is dependent on, among other factors, our ability to increase the number of redeemers that use our network, and any failure to do so will negatively affect our business. If our retailers terminate their relationships with us or suspend, limit, or cease their operations or otherwise, our business, financial condition, results of operations, and prospects will suffer.

Current wording

Our integrated retailers provide us with item-level data that is integral to our platform because such data helps facilitate a simpler redemption of offers on our D2C properties. We also allow thousands of online retailers to advertise and present consumers with their own cash back offers on our D2C properties. Our ability to renew, maintain, and expand our relationships with retailers is dependent on, among other factors, our ability to increase the number of redeemers that use our network, and any failure to do so will negatively affect our business. If our retailers terminate their relationships with us or suspend, limit, or cease their operations or otherwise, our business, financial condition, results of operations, and prospects will suffer.

Previous wording

31, 2020 to 815 as of December 31, 2023. This growth has placed, and may continue to place, significant demands on our management and our operational and financial infrastructure. Our ability to manage our growth effectively and to integrate new employees, technologies, and acquisitions into our existing business will require us to continue to expand our operational and financial infrastructure and to continue to retain, attract, train, motivate, and manage employees. Continued growth could strain our ability to develop and improve our operational, financial, and management controls; enhance our reporting systems and procedures; recruit, train, and retain highly skilled personnel; and maintain user satisfaction. Additionally, if we do not effectively manage the growth of our business and operations, the quality of our solutions could suffer, which could negatively affect our reputation and brand, business, financial condition, results of operations, and prospects.

Current wording

31, 2020 to 857 as of June 30, 2024. This growth has placed, and may continue to place, significant demands on our management and our operational and financial infrastructure. Our ability to manage our growth effectively and to integrate new employees, technologies, and acquisitions into our existing business will require us to continue to expand our operational and financial infrastructure and to continue to retain, attract, train, motivate, and manage employees. Continued growth could strain our ability to develop and improve our operational, financial, and management controls; enhance our reporting systems and procedures; recruit, train, and retain highly skilled personnel; and maintain user satisfaction. Additionally, if we do not effectively manage the growth of our business and operations, the quality of our solutions could suffer, which could negatively affect our reputation and brand, business, financial condition, results of operations, and prospects.

Previous wording

We will continue to monitor the COVID-19 situation closely. The ultimate impact of COVID-19 or a similar health epidemic is highly uncertain and subject to change. We do not know the full extent of COVID-19 on our business, operations, or the global economy as a whole. COVID-19 and the various responses to it may also have the effect of heightening many of the other risks discussed in this “Risk Factors” section.

Current wording

We will continue to monitor the COVID-19 situation closely. The ultimate impact of COVID-19 or a similar health epidemic is highly uncertain and subject to change. We do not know the full impact of COVID-19 on our business, operations, or the global economy as a whole. COVID-19 and the various responses to it may also have the effect of heightening many of the other risks discussed in this “Risk Factors” section.

Previous wording

The U.S. Federal Reserve has significantly raised, and may continue to raise, its benchmark interest rates. An increase in the federal benchmark rate has resulted in an increase in market interest rates. Although we do not have any outstanding borrowings under the 2021 Credit Facility or under any other debt agreement (other than convertible notes that were automatically converted into Class A common stock upon the completion of our initial public offering), because our interest rate is tied to market rates, if we incur debt in the future, including under the 2021 Credit Facility, rising interest rates could increase our borrowing costs on any future borrowings. In addition, operating and growing our business may require additional capital, which could include equity or debt financing. Rising interest rates could negatively impact our ability to obtain such financing on commercially reasonable terms or at all. Further, to the extent we are required to obtain financing at higher borrowing costs to support our operations, we may be unable to offset such costs through price increases to our clients, other cost control measures, or other means. Any attempts to offset cost increases with price increases may result in reduced sales, increased client dissatisfaction, or otherwise harm our reputation.

Current wording

The U.S. Federal Reserve has significantly raised, and may continue to raise, its benchmark interest rates. An increase in the federal benchmark rate has resulted in an increase in market interest rates. Although we do not have any outstanding borrowings under the 2021 Credit Facility or under any other debt agreement (other than convertible notes that were automatically converted into our Class A common stock upon the completion of our initial public offering), because our interest rate is tied to market rates, if we incur debt in the future, including under the 2021 Credit Facility, rising interest rates could increase our borrowing costs on any future borrowings. In addition, operating and growing our business may require additional capital, which could include equity or debt financing. Rising interest rates could negatively impact our ability to obtain such financing on commercially reasonable terms or at all. Further, to the extent we are required to obtain financing at higher borrowing costs to support our operations, we may be unable to offset such costs through price increases to our clients, other cost control measures, or other means. Any attempts to offset cost increases with price increases may result in reduced sales, increased client dissatisfaction, or otherwise harm our reputation.

Previous wording

Developing and launching enhancements to our platform and new solutions on our platform may involve significant technical risks and upfront capital investments that may not generate return on investment. We may use new technologies ineffectively, or we may fail to adapt to emerging industry standards. If we face material delays in introducing new or enhanced platform features and solutions, or if our recently introduced solutions do not perform in accordance with our expectations, the publishers, CPG brands, retailers, and consumers that use our platform may forego the use of our solutions in favor of those of our competitors.

Current wording

We have scaled our business rapidly, and significant new platform features and solutions have in the past resulted in, and in the future may continue to result in, operational challenges affecting our business. Developing and launching enhancements to our platform and new solutions on our platform may involve significant technical risks and upfront capital investments that may not generate return on investment. We may use new technologies ineffectively, or we may fail to adapt to emerging industry standards. If we face material delays in introducing new or enhanced platform features and solutions, or if our recently introduced solutions do not perform in accordance with our expectations, the publishers, CPG brands, retailers, and consumers that use our platform may forego the use of our solutions in favor of those of our competitors.

Previous wording

We collect, receive, store, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, share, and otherwise process (Process or Processing) data about consumers, including personal information or personal data, as well as other confidential or proprietary information, for various purposes, including legal, marketing, and other business-related purposes.

Current wording

We collect, receive, store, generate, use, transfer, disclose, make accessible, dispose of, share, and otherwise process (Process or Processing) data about consumers, including personal information or personal data, and other confidential or proprietary information, for various purposes, including legal, marketing, and other business-related purposes. Cyberattacks, denial or degradation of service attacks, ransomware attacks, business email compromises, account takeover attacks, malware, viruses, social engineering (including phishing), identity theft, fraudulent payment requests, and other malicious online and related activities are prevalent in our and our customers’ and partners’ industries and continue to increase. Advances in computer and software capabilities and increasing sophistication of hackers have increased these and other risks that we and our service providers and partners face. We and our service providers and partners may experience attacks, unavailable or degraded systems, and unauthorized access to or other Processing of data due to these risks and various others, including employee error or malfeasance, theft or misuse, attacks by nation-state and affiliated actors, and advanced persistent threat intrusions. We may not be able to anticipate or to implement effective preventive and remedial measures against all threats, and we cannot guarantee that the security protocols, network protection mechanisms, and other security measures that we have integrated into our systems, networks, and physical facilities, nor our recovery systems, will be adequate to prevent, detect, or address security breaches or incidents, service degradation or interruptions, system failures and other impacts on the integrity and availability of systems, data loss, theft, or other unauthorized Processing, or other material adverse consequences. Our security measures, and those of companies we may acquire and our third-party service providers and partners, could fail or may be insufficient, resulting in interruptions or other disruptions to systems or the loss of, or unauthorized disclosure, modification, use, unavailability, destruction, or other Processing of our or our customers’ data or other data that we or our service providers or partners Process.

Previous wording

Cyberattacks, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, social engineering (including phishing), and other malicious internet-based activity are prevalent in our industry and our customers and partners’ industries and continue to increase. In addition, we may experience attacks, unavailable or degraded systems, and unauthorized access to or disclosure or other Processing of data due to employee or other theft or misuse, denial-of-service attacks, sophisticated attacks by nation-state and nation-state supported actors, and advanced persistent threat intrusions. Despite our efforts to ensure the security, privacy, integrity, confidentiality, and availability of our information technology networks and systems, our information, and our information Processing measures, we may not be able to anticipate or to implement effective preventive and remedial measures against all data security and privacy threats. We cannot guarantee that the recovery systems, security protocols, network protection mechanisms, and other security measures that we have integrated into our systems, networks, and physical facilities, which are designed to protect against, detect, and minimize security breaches, will be adequate to prevent or detect security breaches or incidents, service interruptions, system failures, data loss or theft, or other material adverse consequences. No security solution, strategy, or measures can address all possible security threats or effectively deter or prevent all methods of penetrating a network or otherwise perpetrating a security breach or incident. The risk of unauthorized circumvention of our security measures or those of our third-party providers, clients, and partners has been heightened by advances in computer and software capabilities and the increasing sophistication of hackers who employ complex techniques, including without limitation, the theft or misuse of personal and financial information, counterfeiting, “phishing” or social engineering incidents, ransomware, extortion, publicly announcing security breaches, account takeover attacks, denial or degradation of service attacks, malware, fraudulent payment, and identity theft. The techniques used to sabotage, disrupt, or obtain unauthorized access to our apps, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches and incidents while they are occurring, and we may face difficulties or delays in identifying or otherwise responding to breaches or incidents. The recovery systems, security protocols, network protection mechanisms, and other security measures that we have integrated into our apps, systems, networks, and physical facilities, which are designed to protect against, detect, and minimize security breaches, may not be adequate to prevent or detect service interrupt…

Excerpt shortened here; the source contains the full paragraph.

Current wording

For example, third parties may fraudulently induce our employees, redeemers, clients, publishers, or partners to disclose credentials or other information or otherwise compromise the security of our networks, systems, and/or physical facilities. Third parties may also exploit vulnerabilities in, or obtain unauthorized access to, platforms, apps, systems, networks, and/or physical facilities used by our service providers or partners. We have been and may in the future become the target of cyberattacks by third parties seeking unauthorized access to our data or data of our employees, redeemers, clients, publishers, or partners, or to disrupt our solutions or other aspects of our operations. Many of our employees work remotely, which may pose additional security risks. We also have incorporated AI and machine learning (AIML) solutions and features into our platform and may incorporate additional AIML solutions and features into our platform in the future. The use of AIML solutions may result in security incidents and our use of AIML solutions and features may create additional cybersecurity risks or increase cybersecurity risks. Further, AIML technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents. There also have been and may continue to be significant attacks on supply chains and on third-party service providers. We do not control the security measures of third parties, but we may be, or face assertions that we are, responsible for any breach of such third parties’ security measures or for any exploitable defects, vulnerabilities, or bugs in third-party components or services that we make use of or suffer reputational or other harm, and may not have recourse against the third party.

Previous wording

The time, expense, and resources required to respond to an actual or perceived security breach or incident and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. We could be required to implement additional security measures or to fundamentally change our business activities and practices in response to a security breach or incident or related claims, investigations, actions, or litigation by private actors or regulatory bodies, which could require us to incur substantial additional costs and may have an adverse effect on our business.

Current wording

We may be unable to implement adequate preventative measures or stop security breaches and incidents while they are occurring, we may suffer service degradation or interruption, system failure, and data loss or unavailability, and we may face difficulties or delays in identifying or otherwise responding to breaches or incidents. The time, expense, and resources required to respond to an actual or perceived security breach or incident and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation or degradation of service, negative publicity, and other harm to our business and our competitive position. We could be required to implement additional security measures or to fundamentally change our business activities and practices in response to a security breach or incident or related claims, investigations, actions, or litigation by private actors or regulatory bodies, which could require us to incur substantial additional costs and may have an adverse effect on our business.

Previous wording

If we or our service providers or partners experience compromises to security that result in actual or perceived performance or availability problems, the shutdown of one or more of our platforms, digital properties, or mobile apps or other solutions, or unauthorized access to or unauthorized use, disclosure, or other Processing of confidential information, personal information, or other data, publishers, CPG brands, retailers, and consumers may lose trust and confidence in us and decrease their use of our platform or stop using our platform entirely. Such compromises to personal or sensitive information or proprietary data could lead to claims, litigation, or other adversarial actions by publishers, CPG brands, retailers, consumers, or others.

Current wording

If any security breach or incident impacts a large amount of our data or data of one or more customers, clients, or partners, if we fail to detect, remediate, and otherwise address an actual or perceived security breach or incident in a timely manner, or if we suffer a cyberattack or other disruption that impacts our ability to operate our apps, systems, or networks, or if any of the foregoing is perceived to have occurred, we may suffer material damage to our reputation, business, financial condition, results of operations, and prospects. For example, any actual or perceived security breach or incident that results or is perceived to result in performance or availability problems, the shutdown of one or more of our platforms, digital properties, or mobile apps or other solutions, or unauthorized access to or unauthorized use, disclosure, or other Processing of confidential information, personal information, or other data, may cause publishers, CPG brands, retailers, and consumers to lose trust and confidence in us and decrease their use of our platform or stop using our platform entirely, and we may face claims, litigation, or other adversarial actions by publishers, CPG brands, retailers, consumers, or others. More generally, any cyberattack, security breach, or incident impacting our applications, systems, networks, or facilities, or those of our third-party partners, or resulting in the loss of, or unauthorized disclosure, modification, use, unavailability, destruction, or other Processing of our or our customers’ data or other data that we or our service providers or partners Process, or the perception that any of these has occurred, could result in claims, demands, litigation, indemnity obligations, regulatory enforcement actions, investigations, and other proceedings, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business, which may be material. These proceedings and other actions could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, and adversely affect our reputation and market position.

Previous wording

We have contractual and legal obligations to notify relevant stakeholders of security breaches. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach or certain security incidents involving customer or partner data on our systems or those of subcontractors Processing client or partner data on our behalf. Any such mandatory disclosures and any other disclosures we may find appropriate can be costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and may require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach or incident. Depending on the facts and circumstances of such an incident, these damages, penalties, and costs could be significant and may not be covered by insurance or could exceed our applicable insurance coverage limits. Such an event also could harm our reputation and result in claims, litigation, and other proceedings against us. Any of these results could materially adversely affect our financial performance. Our agreements with certain customers may obligate us to use industry-standard, reasonable, or other specified measures to safeguard sensitive personal information or confidential information, and any actual or perceived breach of such obligations, or actual or perceived incident relevant to such measures may increase the likelihood and frequency of client audits under our agreements, which is likely to increase our costs of doing business and may disrupt our operations. An actual or perceived security breach or incident could lead to claims by our customers or other relevant stakeholders that we have failed to comply with legal or contractual obligations to them and may result in customers ending their relationships with us and claims, demands, and other proceedings. Any limitations of liability, which we have in certain agreements, may not be enforceable or adequate or otherwise protect us from liabilities or damages.

Current wording

We have contractual and legal obligations to notify relevant stakeholders of security breaches. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of certain security breaches. In addition, our agreements with certain customers and partners may require us to notify them in the event of certain security breaches or incidents. Any such disclosures can be costly, could lead to negative publicity, and may cause our customers to lose confidence in the effectiveness of our security measures. Further, any such actual or perceived breach or incident, or other circumstances that may constitute or be perceived to constitute a breach of our security-related obligations under our contracts, may increase the likelihood and frequency of audits we face under our contracts with certain customers and partners, which is likely to increase our costs and may disrupt our operations, and may result in claims, demands, and other proceedings and customers ending their relationships with us. Any limitations of liability, which we have in certain agreements, may not be enforceable or adequate or otherwise protect us from liabilities or damages. Any of these results could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

If a breach or incident impacts a large amount of our data or data of one or more customers, clients, or partners, if we fail to detect or remediate an actual or perceived security breach or incident in a timely manner, or if we suffer a cyberattack or other disruption that impacts our ability to operate our apps, systems, or networks, we may suffer material damage to our reputation, business, financial condition, results of operations, and prospects. Further, we may not have adequate insurance coverage for security incidents or breaches, including fines, judgments, settlements, penalties, costs, attorney fees, and other impacts that arise out of incidents or breaches. Depending on the facts and circumstances of such an incident, the damages, penalties, and costs could be significant and may not be covered by insurance or could exceed our applicable insurance coverage limits. Cyberattacks and other means of disrupting systems, and security breaches and incidents, whether actual or perceived, may cause material adverse effects upon our business, financial condition, results of operations, and prospects. For example, if the impacts of a security incident or breach, or the successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), it could have an adverse effect on our business, financial condition, results of operations, and prospects. In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or that our insurers will not deny coverage as to all or part of any future claim or loss. Our risks are likely to increase as we continue to expand our apps, systems, or networks, grow our customer base, and Process, store, and transmit increasingly large amounts of proprietary and sensitive data.

Current wording

Damages, penalties, and other costs and liabilities relating to an actual or perceived security breach or incident could be significant and may not be covered by insurance or could exceed our applicable insurance coverage limits. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business, financial condition, results of operations, and prospects. In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or that our insurers will not deny coverage as to all or part of any future claim or loss. Our risks are likely to increase as we continue to expand our apps, systems, or networks, grow our customer base, and Process, store, and transmit increasingly large amounts of proprietary and sensitive data.

Previous wording

Our ability to provide solutions to consumers depends on our ability to communicate with our consumers through the internet and electronic networks that are owned and operated by third parties. We rely on third-party providers for computing infrastructure, network connectivity, and other technology-related services needed to deliver our solutions. Some of our other vendor agreements may be unilaterally terminated by the counterparty for convenience. Our computing infrastructure service providers have no obligation to renew their agreements with us on commercially reasonable terms or at all, and the terms of our agreements with such providers can change for reasons that are outside of our control, and as we increase our usage of such providers, any of which, could increase our expenses. If we are unable to renew these agreements on commercially reasonable terms or prices, or for any other reason, our expenses could increase. Also, if we are required to transition to a new provider, it could result in significant costs and possible service interruption or an impaired ability to access or save data stored to the cloud until equivalent services, if available, are identified, obtained, and implemented, all of which could harm our business, financial condition, results of operations, and prospects.

Current wording

Our ability to provide solutions to consumers depends on our ability to communicate with our consumers through the internet and electronic networks that are owned and operated by third parties. We rely on third-party providers for computing infrastructure, network connectivity, and other technology-related services needed to deliver our solutions. Some of our other vendor agreements may be unilaterally terminated by the counterparty for convenience. Our computing infrastructure service providers have no obligation to renew their agreements with us on commercially reasonable terms or at all, the terms of our agreements with such providers can change for reasons that are outside of our control, and as we increase our usage of such providers, any of which, could increase our expenses. If we are unable to renew these agreements on commercially reasonable terms or prices, or for any other reason, our expenses could increase. Also, if we are required to transition to a new provider, it could result in significant costs and possible service interruption or an impaired ability to access or save data stored to the cloud until equivalent services, if available, are identified, obtained, and implemented, all of which could harm our business, financial condition, results of operations, and prospects.

Previous wording

In the United States, Data Protection Laws include rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the California Consumer Privacy Act of 2018 (CCPA), and other state and federal laws relating to privacy and data security. The CCPA requires covered companies to make certain disclosures to California consumers about their data collection, use, and sharing practices, and allows consumers to opt out of the sale of personal information with third parties and provides a private right of action and statutory damages for data breaches. In addition, the California Privacy Rights Act of 2020 (CPRA), which took effect on January 1, 2023, amended the CCPA and, among other things, gives California residents the ability to limit the use of their sensitive information, provides for penalties for CPRA violations concerning California residents under the age of 16, and established a new California Privacy Protection Agency to implement and enforce the law. The CCPA and CPRA have new regulations that are only partially complete and have been subject to legal challenge, creating uncertainty and compliance challenges. The enactment of the CCPA has prompted a wave of similar legislative developments in other states in the United States, which creates the potential for a patchwork of overlapping but different state laws and could mark the beginning of a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our business, financial condition, results of operations, and prospects. For example, Connecticut, Virginia, Utah, and Colorado have each enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have each enacted similar legislation that will become effective in 2024; Tennessee, Iowa, New Jersey, and Delaware have each enacted similar legislation that will take effect in 2025; and Indiana has enacted similar legislation that will become effective in 2026. The CCPA, as modified by the CPRA, and certain other state laws have increased our compliance costs and potential liability. Some countries also are considering or have passed legislation requiring local storage and Processing of data, or other requirements that may be, or may be asserted to be, applicable to our operations, which could increase the cost and complexity of providing our solutions and other aspects of our business.

Current wording

In the United States, Data Protection Laws include rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the California Consumer Privacy Act of 2018 (CCPA), and other state and federal laws relating to privacy and data security. The CCPA requires covered companies to make certain disclosures to California consumers about their data collection, use, and sharing practices, and allows consumers to opt out of the sale of personal information with third parties and provides a private right of action and statutory damages for data breaches. In addition, the California Privacy Rights Act of 2020 (CPRA), which took effect on January 1, 2023, amended the CCPA and, among other things, gives California residents the ability to limit the use of their sensitive information, provides for penalties for CPRA violations concerning California residents under the age of 16, and established a new California Privacy Protection Agency to implement and enforce the law. The CCPA and CPRA have new regulations that are only partially complete and have been subject to legal challenge, creating uncertainty and compliance challenges. The enactment of the CCPA has prompted a wave of similar legislative developments in other states in the United States, which creates the potential for a patchwork of overlapping but different state laws and could mark the beginning of a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our business, financial condition, results of operations, and prospects. For example, Connecticut, Virginia, Utah, and Colorado have each enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have each enacted similar legislation that have become or will become effective in 2024; Tennessee, Iowa, New Jersey, Delaware, Maryland, Minnesota, Nebraska, and New Hampshire have each enacted similar legislation that will take effect in 2025; and Indiana, Rhode Island, and Kentucky have enacted similar legislation that will become effective in 2026. The CCPA, as modified by the CPRA, and certain other state laws have increased our compliance costs and potential liability. Some countries also are considering or have passed legislation requiring local storage and Processing of data, or other requirements that may be, or may be asserted to be, applicable to our operations, which could increase the cost and complexity of providing our solutions and other aspects of our business.

Previous wording

Our Class B common stock has 20 votes per share, and our Class A common stock has one vote per share. Upon the closing of our initial public offering, Mr. Leach and entities affiliated with Mr. Leach held all of the issued and outstanding shares of our Class B common stock. Accordingly, upon the closing of our initial public offering in April 2024, Mr. Leach held approximately 69.84% of the voting power of our outstanding capital stock in the aggregate, which voting power may increase over time as Mr. Leach’s equity awards are exercised or vested. If all such equity awards held by Mr. Leach had been exercised or vested as of the date of the completion of our initial public offering, Mr. Leach and entities affiliated with Mr. Leach would collectively have held 77.06% of the voting power of our outstanding capital stock. As a result, Mr. Leach will generally be able to determine any action requiring the approval of our stockholders, subject to limited exceptions, including the election of our board of directors, the adoption of amendments to our amended and restated certificate of incorporation and amended and restated bylaws (where adopted by stockholders), and the approval of any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transactions. Mr. Leach may have interests that differ from those of our stockholders and may vote in a way with which our stockholders disagree and that may be adverse to our stockholders’ interests. This concentrated control may have the effect of delaying, preventing, or deterring a change in control of Ibotta, could deprive our stockholders of an opportunity to receive a premium for their capital stock as part of a sale of Ibotta, and might ultimately affect the market price of our Class A common stock.

Current wording

Our Class B common stock has 20 votes per share, and our Class A common stock has one vote per share. Upon the closing of our initial public offering, Mr. Leach and entities affiliated with Mr. Leach held all of the issued and outstanding shares of our Class B common stock. As of June 30, 2024, Mr. Leach held approximately 69.55% of the voting power of our outstanding capital stock in the aggregate, which voting power may increase over time as Mr. Leach’s equity awards are exercised or vested. If all such equity awards held by Mr. Leach had been exercised or vested as of June 30, 2024, Mr. Leach and entities affiliated with Mr. Leach would collectively have held 76.82% of the voting power of our outstanding capital stock. As a result, Mr. Leach will generally be able to determine any action requiring the approval of our stockholders, subject to limited exceptions, including the election of our board of directors, the adoption of amendments to our amended and restated certificate of incorporation and amended and restated bylaws (where adopted by stockholders), and the approval of any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transactions. Mr. Leach may have interests that differ from those of our stockholders and may vote in a way with which our stockholders disagree and that may be adverse to our stockholders’ interests. This concentrated control may have the effect of delaying, preventing, or deterring a change in control of Ibotta, could deprive our stockholders of an opportunity to receive a premium for their capital stock as part of a sale of Ibotta, and might ultimately affect the market price of our Class A common stock.

Previous wording

For example, on May 17, 2021, we issued a common stock purchase warrant to Walmart (Walmart Warrant) in connection with a multi-year strategic relationship that makes Ibotta the exclusive provider of digital item-level rebate offer content for Walmart U.S. Pursuant to the terms of the Walmart Warrant, Walmart has the right to purchase up to 4,121,034 shares of our Class A common stock at an exercise price of $70.12 per share.

Current wording

For example, on May 17, 2021, we issued a common stock purchase warrant to Walmart (Walmart Warrant) in connection with a multi-year strategic relationship that makes Ibotta the exclusive provider of digital item-level rebate offer content for Walmart U.S. Pursuant to the terms of the Walmart Warrant, Walmart has the right to purchase up to 4,121,034 shares of our Class A common stock at an exercise price of$70.12 per share.

Previous wording

From January 1, 2024 through March 31, 2024, we granted to our directors, officers, employees, consultants, and other service providers an aggregate of 948,229 shares of our common stock issuable upon the vesting and settlement of restricted stock unit awards under our 2011 Equity Incentive Plan (2011 Plan), 643,057 of which were shares of Class A common stock issuable upon the vesting and settlement of restricted stock unit awards that became effective immediately prior to our initial public offering, based upon our initial public offering price of $88.00 per share.

Current wording

From April 1, 2024 through June 30, 2024, we granted to our directors an aggregate of 27,270 shares of our Class A common stock issuable upon the vesting and settlement of restricted stock unit awards under our 2024 Equity Incentive Plan that became effective immediately after our initial public offering, based upon our initial public offering price of $88.00 per share.