Consensus Cloud Solutions, Inc.

Previous wording

Before deciding to invest in Consensus or to maintain or increase your investment, you should carefully consider the risks described below in addition to the other cautionary statements and risks described elsewhere in this Annual Report on Form 10-K and our other filings with the SEC, including our subsequent reports on Forms 10-Q and 8-K. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties not presently known to us or that we currently deem immaterial also may affect our business. If any of these known or unknown risks or uncertainties actually occurs, our business, prospects, financial condition, operating results and cash flows could be materially adversely affected. In that event, the market price of our common stock will likely decline and you may lose part or all of your investment.

Current wording

Before deciding to invest in Consensus or to maintain or increase your investment, you should carefully consider the risks described below in addition to the other cautionary statements and risks described elsewhere in this Annual Report on Form 10-K and our other filings with the SEC, including our subsequent reports on Forms 10-Q and 8-K. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties not presently known to us or that we currently deem immaterial also may affect our business. If any of these known or unknown risks or uncertainties actually occurs, our business, prospects, financial condition, operating results and cash flows could be materially adversely affected. In that event, the market price of our common stock will likely decline and you may lose part or all of your investment. The disclosures in this section reflect our beliefs and opinions as to factors that could materially and adversely affect us in the future. References to past events are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not such factors have occurred in the past.

Previous wording

•We have made and expect to continue to make acquisitions that could disrupt our operations and harm our operating results.

Current wording

•We have made and expect to continue to make acquisitions and investments that could disrupt our operations and harm our operating results.

Previous wording

•We may be found to infringe the intellectual property rights of others, and we may be unable to adequately protect of our own intellectual property rights.

Current wording

•We may be found to infringe the intellectual property rights of others, and we may be unable to adequately protect our own intellectual property rights.

Previous wording

We believe that one of the attractive features of our cloud fax products is that cloud fax signatures are a generally accepted method of executing contracts and a method of transmitting confidential information in a secure manner especially in the healthcare field in the United States. There are ongoing efforts by governmental and nongovernmental entities to create a universally accepted method for electronically signing documents. Widespread adoption of so-called “digital signatures” have reduced, and could continue to in the future reduce demand for our fax services where the fax service is primarily being used to evidence a wet signature. While we have introduced a digital signature product, other companies have offered such products for longer and have greater customer adoption. If future adoption of digital signature products results in a reduction for our fax services without a corresponding adoption of our digital signature or other products, it could have a material adverse effect on our business, prospects, financial condition, operating results and cash flows.

Current wording

We believe that one of the attractive features of our cloud fax products is that cloud fax signatures are a generally accepted method of executing contracts and a method of transmitting confidential information in a secure manner especially in the healthcare field in the United States. There are ongoing efforts by governmental and nongovernmental entities to create a universally accepted method for electronically signing documents. Widespread adoption of so-called “digital signatures” have reduced, and could continue to in the future reduce demand for our fax services where the fax service is primarily being used to

Previous wording

A wide variety of providers are working on solutions to address healthcare interoperability challenges, and interoperability can be defined in a variety of ways. For example, the Health Information Systems Management Society (“HIMSS”), which is generally recognized as an authority on health information technology, released its definition of interoperability and defined it four ways: foundational, structural, semantic and organizational. Customers or vendors could use any of these four components to define their particular “interoperability solution.” Separately, the Center for Medicare and Medicaid Services further defined a fifth component of interoperability that includes patients, which is not included in the HIMSS definition. Furthermore, the Office of the National Coordinator for Health Information Technology (the “ONC”) has developed another definition that is included in the 21st Century Cures Act, which includes the concept of “information blocking” as a component of healthcare interoperability. This wide variety of definitions has the potential to create a risk of confusion in the market, or allow competitors to reframe the problem to their advantage in a competitive situation, potentially

Current wording

Medicaid Services further defined a fifth component of interoperability that includes patients, which is not included in the HIMSS definition. Furthermore, the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (the “ONC”) has developed another definition that is included in the 21st Century Cures Act, which includes the concept of “information blocking” as a component of healthcare interoperability. This wide variety of definitions has the potential to create a risk of confusion in the market, or allow competitors to reframe the problem to their advantage in a competitive situation, potentially allowing less robust solutions to hold themselves out as healthcare interoperability solutions. We expect to encounter significant competition for customers as the healthcare interoperability market develops. Our current competitors in the healthcare interoperability space currently consist mostly of point solutions rather than full suites of healthcare interoperability solutions. If other companies develop solutions to address healthcare operability challenges more successfully than we do, or if customers otherwise adopt competing solutions rather than our solutions, it will adversely affect our business and operating results.

Previous wording

We have made and expect to continue to make acquisitions that could disrupt our operations and harm our operating results.

Current wording

We have made and expect to continue to make acquisitions and investments that could disrupt our operations and harm our operating results.

Previous wording

We intend to continue to develop new products and services and enhance existing products and services through acquisitions of other companies, technologies and personnel.

Current wording

We intend to continue to develop new products and services and enhance existing products and services through acquisitions of and investments in other companies, technologies and personnel.

Previous wording

The impact of pandemics and global health crises, such as the COVID-19 pandemic, has in the past had, and may in the future have, a negative effect on the global economy, disrupting the financial markets and creating increasing volatility and overall uncertainty. Among other things, pandemics and global health crises have resulted in, and may in the future result in, travel bans around the world, declarations of states of emergency, stay- or shelter-at-home requirements, business and school closures and manufacturing restrictions. In addition, pandemics and global health crises have in the past, and may in the future, contribute to (i) increased unemployment and decreased consumer confidence and business generally; (ii) sudden and significant declines, and significant increases in volatility, in financial and capital markets; (iii) increased spending on our business continuity efforts, which has required and may further require that we cut costs or investments in other areas; and (iv) heightened cybersecurity, information security and operational risks as a result of work-from-home arrangements.

Current wording

The impact of pandemics and global health crises has in the past had, and may in the future have, a negative effect on the global economy, disrupting the financial markets and creating increasing volatility and overall uncertainty. Among other things, pandemics and global health crises have resulted in, and may in the future result in, travel bans around the world, declarations of states of emergency, stay- or shelter-at-home requirements, business and school closures and manufacturing restrictions. In addition, pandemics and global health crises have in the past, and may in the future, contribute to (i) increased unemployment and decreased consumer confidence and business generally; (ii) sudden and significant declines, and significant increases in volatility, in financial and capital markets; (iii) increased spending on our business continuity efforts, which has required and may further require that we cut costs or investments in other areas; and (iv) heightened cybersecurity, information security and operational risks as a result of work-from-home arrangements.

Previous wording

Our business is dependent on the ability of our customers to access our services and applications over broadband Internet connections. Internet access providers and Internet backbone providers may be able to block, degrade or charge for access or bandwidth use of certain of our products and services, which could lead to additional expenses and the loss of users. Our products and services depend on the ability of our users to access the Internet. Use of our products and services through mobile devices, such as smartphones and tablets, must have a high-speed data connection. Broadband Internet access services, whether wireless or landline, are provided by companies with significant market power. Many of these providers offer products and services that directly compete with ours.

Current wording

Our products and services depend on the ability of our users to access the Internet. Use of our products and services through mobile devices, such as smartphones and tablets, must have a high-speed data connection. Broadband Internet access services, whether wireless or landline, are provided by companies with significant market power. Many of these providers offer products and services that directly compete with ours.

Previous wording

-13- applicable regulations, the practices of telecommunications carriers that provide numbers, the cost of these numbers and the level of demand for new numbers. For example, several years ago the Federal Communications Commission (the “FCC”) conditionally granted petitions by Connecticut and California to adopt specialized “unified messaging” area codes, but neither state has adopted such a code. Adoption of a specialized area code within a state or nation could harm our ability to compete in that state or nation if it materially affects our ability to acquire numbers for our operations or makes our services less attractive due to the unavailability of numbers with a local geographic area.

Current wording

The future success of our phone number-based cloud fax services products depends on our ability to procure large quantities of local numbers in the U.S. and other countries in desirable locations at a reasonable cost and offer our services to our prospective customers without restrictions. Our ability to procure and distribute numbers depends on factors such as applicable regulations, the practices of telecommunications carriers that provide numbers, the cost of these numbers and the level of demand for new numbers. For example, several years ago the Federal Communications Commission (the “FCC”) conditionally granted petitions by Connecticut and California to adopt specialized “unified messaging” area codes, but neither state has adopted such a code. Adoption of a specialized area code within a state or nation could harm our ability to compete in that state or nation if it materially affects our ability to acquire numbers for our operations or makes our services less attractive due to the unavailability of numbers with a local geographic area.

Previous wording

We depend upon third parties for critical elements of our business, and we do not control the operations of these parties or their facilities on which we depend. We rely on private third-party providers for our Internet, telecommunications and other connections and for data center hosting facilities and cloud computing needs. We have from time to time experienced interruptions in our services and such interruptions may occur in the future. Any damage to or disruption in the services provided by any of these suppliers, any adverse change in access to their platforms or services or in their terms and conditions of use or services, any cybersecurity or physical breach of their facilities, or any failure by them to handle current or higher volumes of activity could have a material adverse effect on our customer relations, business, prospects, financial condition, operating results and cash flows. Our arrangements with these third parties typically are not exclusive and do not extend over a significant period of time. Failure to continue these relationships on terms that are acceptable to us or to continue to create additional relationships could have a material adverse effect on our business, prospects, financial condition, operating results and cash flows. We do not control the operation of third-party facilities, and they may be vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures, and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism, and similar misconduct, as well as local administrative actions, changes to legal or permitting requirements, and litigation to stop, limit, or delay operation. The occurrence of a natural disaster, a pandemic (such as COVID-19) or an act of terrorism, a decision to close the facilities without adequate notice, or other unanticipated problems at these facilities could result in lengthy interruptions in our services.

Current wording

-14- operating results and cash flows. Our arrangements with these third parties typically are not exclusive and do not extend over a significant period of time. Failure to continue these relationships on terms that are acceptable to us or to continue to create additional relationships could have a material adverse effect on our business, prospects, financial condition, operating results and cash flows. We do not control the operation of third-party facilities, and they may be vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures, and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism, and similar misconduct, as well as local administrative actions, changes to legal or permitting requirements, and litigation to stop, limit, or delay operation. The occurrence of a natural disaster, a pandemic or an act of terrorism, a decision to close the facilities without adequate notice, or other unanticipated problems at these facilities could result in lengthy interruptions in our services.

Previous wording

Our operations are dependent on our network being free from material interruption by damage from fire, earthquake, flood, storm, tornado and other severe weather and climate conditions (including those resulting from or exacerbated by climate change), power loss, telecommunications failure, unauthorized entry, computer viruses, cyber-attacks or any other events beyond our control. Similarly, the operations of our partners and other third parties with which we work are also susceptible to the same risks. There can be no assurance that our existing and planned precautions of backup systems, regular data backups, security protocols and other procedures will be adequate to prevent significant damage, system failure or data loss and the same is true for our partners, vendors and other third parties on which we rely. We have experienced automated log in attempts to gain unauthorized access to customer accounts. To date, these events have not resulted in the material impairment of any business operations.

Current wording

Our operations are dependent on our network being free from material interruption by damage from fire, earthquake, flood, storm, tornado and other severe weather and climate conditions (including those resulting from or exacerbated by climate change), power loss, telecommunications failure, unauthorized entry, computer viruses, cyber-attacks or any other events beyond our control. Similarly, the operations of our partners and other third parties with which we work are also susceptible to the same risks. There can be no assurance that our existing and planned precautions of backup systems, regular data backups, security protocols and other procedures will be adequate to prevent significant damage, system failure or data loss and the same

Previous wording

A significant portion of our operations relies heavily on the secure processing, storage and transmission of confidential and other sensitive data. For example, a significant number of our customers authorize us to bill their credit or debit card accounts directly for all transaction fees charged by us. We rely on encryption and authentication technology to effect secure transmission of confidential information, including customer credit and debit card numbers. Advances in computer capabilities, new discoveries in the field of cryptography or other developments, including the use of increasingly sophisticated and evolving artificial intelligence and machine learning tools, may result in a material compromise or breach of the technology used by us, our partners, vendors, or other third parties, to protect transaction and other confidential data. Additionally, due to geopolitical tensions related to Russia’s invasion of Ukraine and the conflict in the Middle East, the risk of cyber-attacks may be elevated. Moreover, these threats are constantly evolving, thereby making it more difficult to successfully defend against them or to implement adequate preventative measures. We may not have the current capability to detect certain vulnerabilities, which may allow those vulnerabilities to persist in our systems over long periods of time. Any system failure or security breach that causes interruptions or data loss in our operations, our partners, vendors, or other third parties, or in the computer systems of our customers or leads to the misappropriation of our or our customers’ confidential information could result in a significant liability to us (including in the form of judicial decisions and/or settlements, regulatory findings and/or forfeitures, and other means), cause considerable harm to us and our reputation (including requiring notification to customers, regulators, and/or the

Current wording

A significant portion of our operations relies heavily on the secure processing, storage and transmission of confidential and other sensitive data. For example, a significant number of our customers authorize us to bill their credit or debit card accounts directly for all transaction fees charged by us. We rely on encryption and authentication technology to effect secure transmission of confidential information, including customer credit and debit card numbers. Advances in computer capabilities, new discoveries in the field of cryptography or other developments, including the use of increasingly sophisticated and evolving artificial intelligence and machine learning tools, may result in a material compromise or breach of the technology used by us, our partners, vendors, or other third parties, to protect transaction and other confidential data. Additionally, due to geopolitical tensions related to Russia’s invasion of Ukraine and the conflict in the Middle East, the risk of cyber-attacks may be elevated. Moreover, these threats are constantly evolving, thereby making it more difficult to successfully defend against them or to implement adequate preventative measures. We may not have the current capability to detect certain vulnerabilities, which may allow those vulnerabilities to persist in our systems over long periods of time. Any system failure or security breach that causes interruptions or data loss in our operations, our partners, vendors, or other third parties, or in the computer systems of our customers or leads to the misappropriation of our or our customers’ confidential information could result in a significant liability to us (including in the form of judicial decisions and/or settlements, regulatory findings and/or forfeitures, and other means), cause considerable harm to us and our reputation (including requiring notification to customers, regulators, and/or the media), cause a loss of confidence in our products and services, and deter current and potential customers from using our services. Additionally, it may be difficult to determine the best way to investigate, mitigate, contain, and remediate the harm caused by a cybersecurity breach. Such efforts may not be successful, and we may make errors or fail to take necessary actions. It may take considerable time for us to investigate and evaluate the full impact of incidents, particularly for sophisticated attacks. These factors may inhibit our ability to provide prompt, full, and reliable information about the incident to customers, partners, regulators, and the public.

Previous wording

Our operations are dependent upon our ability to prevent system interruptions and, as we continue to grow, we will need to devote additional resources to improving our infrastructure in order to maintain the performance of our products and services. The applications underlying our products and services are inherently complex and may contain material defects or errors, which may cause disruptions in availability or other performance problems. We have from time to time found defects in our products and services and may discover additional defects in the future that could result in data unavailability or unauthorized access or other harm to, or loss or corruption of, our customers’ data. While we implement bug fixes and upgrades as part of our regularly scheduled system maintenance, we may not be able to detect and correct defects or errors before implementing our products and services. Consequently, we or our customers may discover defects or errors after our products and services have been employed. If we fail to perform timely maintenance or if customers are otherwise dissatisfied with the frequency and/or duration of our maintenance services and related system outages, our existing customers could elect not to renew their subscriptions, delay or withhold payment to us, or cause us to issue credits, make refunds or pay penalties, potential customers may not adopt our products and services and our brand and reputation could be harmed. In addition, the occurrence of any material defects, errors, disruptions in service or other performance problems with our software could result in warranty or other legal claims against us and diversion of our resources. The costs incurred in addressing and correcting any material defects or errors in our software and expanding our infrastructure and architecture in order to accommodate increased demand for our products and services may be substantial and could adversely affect our operating results.

Current wording

-16- errors, which may cause disruptions in availability or other performance problems. We have, from time to time, found defects in our products and services and may discover additional defects in the future that could result in data unavailability or unauthorized access or other harm to, or loss or corruption of, our customers’ data. While we implement bug fixes and upgrades as part of our regularly scheduled system maintenance, we may not be able to detect and correct defects or errors before implementing our products and services. Consequently, we or our customers may discover defects or errors after our products and services have been employed. If we fail to perform timely maintenance or if customers are otherwise dissatisfied with the frequency and/or duration of our maintenance services and related system outages, our existing customers could elect not to renew their subscriptions, delay or withhold payment to us, or cause us to issue credits, make refunds or pay penalties, potential customers may not adopt our products and services and our brand and reputation could be harmed. In addition, the occurrence of any material defects, errors, disruptions in service or other performance problems with our software could result in warranty or other legal claims against us and diversion of our resources. The costs incurred in addressing and correcting any material defects or errors in our software and expanding our infrastructure and architecture in order to accommodate increased demand for our products and services may be substantial and could adversely affect our operating results.

Previous wording

-16- services faster than we can. In addition, competitors may consolidate with each other or collaborate, and new competitors may enter the market. Some of our competitors in international markets have a substantial competitive advantage over us because they have dominant market share in their territories, are owned by local telecommunications providers, have greater brand recognition, are focused on a single market, are more familiar with local tastes and preferences, or have greater regulatory and operational flexibility due to the fact that we may be subject to both U.S. and foreign regulatory requirements.

Current wording

Some of our existing competitors and possible entrants may have greater brand recognition for certain products and services, more expertise in a particular segment of the market, and greater operational, strategic, technological, financial, personnel, or other resources than we do. Many of our competitors have access to considerable financial and technical resources with which to compete aggressively, including by funding future growth and expansion and investing in acquisitions, technologies, and research and development. Further, emerging start-ups may be able to innovate and provide new products and services faster than we can. In addition, competitors may consolidate with each other or collaborate, and new competitors may enter the market. Some of our competitors in international markets have a substantial competitive advantage over us because they have dominant market share in their territories, are owned by local telecommunications providers, have greater brand recognition, are focused on a single market, are more familiar with local tastes and preferences, or have greater regulatory and operational flexibility due to the fact that we may be subject to both U.S. and foreign regulatory requirements.

Previous wording

Our brand recognition depends, in part, on our ability to protect our trademark portfolio and establish trademark rights covering new brands and territories. Some regulators and competitors have taken the view that certain of our brands, such as eFax, are descriptive or generic when applied to the products and services we offer. Nevertheless, we have obtained U.S. and foreign trademark registrations for our brand names, logos, and other brand identifiers, including eFax. If we are unable to obtain, maintain or protect trademark rights covering our brands across the territories in which they are or may be offered, the value of these brands may be diminished, competitors may be able to dilute, harm, or take advantage of our brand recognition and reputation, and our ability to attract customer may be adversely affected.

Current wording

Our brand recognition depends, in part, on our ability to protect our trademark portfolio and establish trademark rights covering new brands and territories. Some regulators and competitors have taken the view that certain of our brands, such as eFax, are descriptive or generic when applied to the products and services we offer. Nevertheless, we have obtained U.S. and foreign trademark registrations for our brand names, logos, and other brand identifiers, including eFax. If we are unable to obtain, maintain or protect trademark rights covering our brands across the territories in which they are or may be offered, the

Previous wording

To the extent we expand our business operations in countries outside the U.S., our future results could be materially adversely affected by a variety of uncontrollable and changing factors including, among others: foreign currency exchange rates; political or social unrest, economic instability, geopolitical tensions or war in a specific country or region (including the invasion of Ukraine by Russia and the conflict in the Middle East); trade protection measures and other regulatory requirements, such as U.S. imposed tariffs along with retaliatory measures taken by other nations in response to these tariffs, which may affect our ability to provide our services; difficulties in staffing and managing international operations; and adverse tax consequences, including imposition of withholding or other taxes on payments by subsidiaries and affiliates and transfer pricing implications. Any or all of these factors could have a material adverse impact on our future business, prospects, financial condition, operating results and cash flows.

Current wording

To the extent we expand our business operations in countries outside the U.S., our future results could be materially adversely affected by a variety of uncontrollable and changing factors including, among others: foreign currency exchange rates; political or social unrest, economic instability, geopolitical tensions or war in a specific country or region (including the invasion of Ukraine by Russia and the conflict in the Middle East); trade protection measures and other regulatory requirements, such as U.S. imposed tariffs and other trade restrictions along with retaliatory measures taken by other nations in response to these tariffs, which may affect our ability to provide our services; difficulties in staffing and managing international operations; and adverse tax consequences, including imposition of withholding or other taxes on payments by subsidiaries and affiliates and transfer pricing implications. Any or all of these factors could have a material adverse impact on our future business, prospects, financial condition, operating results and cash flows.

Previous wording

-18- financial condition. Such disputes could cause us to incur unforeseen expenses, divert operational resources, occupy a significant amount of our management’s time and attention and negatively affect our business operations and financial condition. The outcomes of such matters are subject to inherent uncertainties, carrying the potential for unfavorable rulings that could include monetary damages and injunctive relief. We may not always have insurance coverage for defense costs, judgments, and settlements. We may also be subject to indemnification requirements with business partners, vendors, current and former officers and directors, and other third parties. Payments under such indemnification provisions may be material.

Current wording

From time to time, we may be subject to litigation or claims or become involved in other legal disputes or regulatory inquiries, including in the areas of patent infringement and anti-trust that could negatively affect our business operations and financial condition. Such disputes could cause us to incur unforeseen expenses, divert operational resources, occupy a significant amount of our management’s time and attention and negatively affect our business operations and financial condition. The outcomes of such matters are subject to inherent uncertainties, carrying the potential for unfavorable rulings that could include monetary damages and injunctive relief. We may not always have insurance coverage for defense costs, judgments, and settlements. We may also be subject to indemnification requirements with business partners, vendors, current and former officers and directors, and other third parties. Payments under such indemnification provisions may be material.

Previous wording

A significant number of our customers pay for our services through credit and debit cards, particularly with respect to our SoHo fax products. Weakness in certain segments of the credit markets and in the U.S. and global economies could result in increased numbers of rejected credit and debit card payments. We believe this could result in increased customer cancellations and decreased customer signups. Rejected credit or debit card payments, customer cancellations and decreased customer sign up may adversely impact our revenues and profitability.

Current wording

A significant number of our customers pay for our services through credit and debit cards, particularly with respect to our SoHo fax products. Weakness in certain segments of the credit markets and in the U.S. and global economies could result in increased numbers of rejected credit and debit card payments. We believe this could result in increased customer cancellations

Previous wording

The Office of the National Coordinator for Health Information Technology (“ONC”) is the principal U.S. federal entity charged with the coordination of nationwide efforts to implement and use health IT for the electronic exchange of health information. ONC regularly proposes legislative changes to incentivize the healthcare industry to adopt specific electronic tools to exchange health information. Changes to information exchange requirements could impact the use of cloud fax as a communication choice for healthcare entities and have a material impact on our business, prospects, financial condition, operating results and cash flows.

Current wording

The ONC is the principal U.S. federal entity charged with the coordination of nationwide efforts to implement and use health IT for the electronic exchange of health information. ONC regularly proposes legislative changes to incentivize the healthcare industry to adopt specific electronic tools to exchange health information. Changes to information exchange requirements could impact the use of cloud fax as a communication choice for healthcare entities and have a material impact on our business, prospects, financial condition, operating results and cash flows.

Previous wording

In the U.S., Congress, the FCC, and a number of states require regulated telecommunications carriers to contribute to federal and/or state Universal Service Funds (“USF”). Generally, USF is used to subsidize the cost of providing service to low-income customers and those living in high cost or rural areas. Congress, the FCC and a number of states are reviewing the manner in which a provider’s contribution obligation is calculated, as well as the types of entities subject to USF contribution obligations. If any of these reforms are adopted, they could cause us to alter or eliminate our non-paid services and to raise the price of our paid services, which could cause us to lose customers. Any of these results could lead to a decrease in our revenues and net income and could materially adversely affect our business, prospects, financial condition, operating results and cash flows.

Current wording

In the U.S., Congress, the FCC, and a number of states require regulated telecommunications carriers to contribute to federal and/or state Universal Service Funds (“USF”). Generally, USF is used to subsidize the cost of providing service to low-income customers and those living in high cost or rural areas. Congress, the FCC and a number of states are reviewing the manner in which a provider’s contribution obligation is calculated, as well as the types of entities subject to USF contribution obligations. If any of these reforms are adopted, they could cause us to alter or eliminate our non-paid services and to raise the price of our paid services, which could cause us to lose customers. Any of these results could lead to a decrease in our revenues

Previous wording

We are a U.S.-based multinational company subject to taxes in the U.S. and foreign jurisdictions. Our provision for income taxes is based on a jurisdictional mix of earnings, statutory tax rates and enacted tax rules, including transfer pricing. Due to economic and political conditions, tax rates in various jurisdictions may be subject to significant change. As a result, our

Current wording

We are a U.S.-based multinational company subject to taxes in the U.S. and foreign jurisdictions. Our provision for income taxes is based on a jurisdictional mix of earnings, statutory tax rates and enacted tax rules, including transfer pricing. Due to economic and political conditions, tax rates in various jurisdictions may be subject to significant change. As a result, our future effective tax rates could be affected by changes in the mix of earnings in countries with differing statutory tax rates, changes in the valuation of deferred tax assets and liabilities, or changes in tax laws or their interpretation. These changes may adversely impact our effective tax rate and harm our financial position and results of operations.

Previous wording

-22- restrictive and punitive laws regulating commercial email. Foreign legislation exists as well, including Canada’s Anti-Spam Legislation and the European laws that have been enacted pursuant to the GDPR and European Union Directive 2002/58/EC and its amendments. We use email as a significant means of communicating with our existing and potential users. We believe that our email practices comply with the requirements of the CAN-SPAM Act, state laws, and applicable foreign legislation. If we were ever found to be in violation of these laws and regulations, or any other laws or regulations, our business, financial condition, operating results and cash flows could be materially adversely affected.

Current wording

The Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (the “CAN-SPAM Act”), which allows for penalties that run into the millions of dollars, requires commercial emails to include identifying information from the sender and a mechanism for the receiver to opt out of receiving future emails. Several states have enacted additional, more restrictive and punitive laws regulating commercial email. Foreign legislation exists as well, including Canada’s Anti-Spam Legislation and the European laws that have been enacted pursuant to the GDPR and European Union Directive 2002/58/EC and its amendments. We use email as a significant means of communicating with our existing and potential users. We believe that our email practices comply with the requirements of the CAN-SPAM Act, state laws, and applicable foreign legislation. If we were ever found to be in violation of these laws and regulations, or any other laws or regulations, our business, financial condition, operating results and cash flows could be materially adversely affected.

Previous wording

As of May 25, 2018, certain data transfers from and between the European Union (“EU”) are subject to the GDPR. As discussed in more detail below, the GDPR prohibits data transfers from the EU to other countries outside of the EU, including the U.S., without appropriate security safeguards and practices in place. Previously, for certain data transfers from and between the EU and the U.S., we, like many other companies, had relied on what is referred to as the “EU-U.S. Safe Harbor,” in order to comply with privacy obligations imposed by EU countries. The European Court of Justice invalidated the EU-U.S. Safe Harbor. Additionally, other countries that relied on the EU-U.S. Safe Harbor that were not part of the EU have also found that data transfers to the U.S. are no longer valid based on the European Court of Justice ruling. Although U.S. and EU policymakers approved a new framework known as “Privacy Shield” that would allow companies like us to continue to rely on some form of a safe harbor for the transfer of certain data from the EU to the U.S., on July 16, 2020, the Court of Justice of the European Union issued a judgment declaring as “invalid” the European Commission’s Decision (EU) 2016/1250 on the adequacy of the protection provided by the EU-U.S. Privacy Shield, rendering it invalid. We cannot predict how or if these issues will be resolved nor can we evaluate any potential liability at this time. While the EU policymakers approved a new EU-U.S. Data Privacy Framework in 2023, the validity of data transfer mechanisms and additional safeguards remains subject to legal, regulatory, and political review and developments in both Europe and the U.S.

Current wording

Certain data transfers from and between the European Union (“EU”) are subject to the GDPR. As discussed in more detail below, the GDPR prohibits data transfers from the EU to other countries outside of the EU, including the U.S., without appropriate security safeguards and practices in place. With respect to data transfers from the E.U. to the U.S., the European Commission adopted the adequacy decision for the EU-U.S. Data Privacy Framework (the “Framework”), which permits personal data to flow from the E.U. to U.S. companies participating in the Framework. Similarly, the U.K. government adopted an adequacy decision for the U.S., the UK-US Data Bridge, which permits personal data to flow from the U.K. to U.S.

Previous wording

On June 28, 2018, the California legislature enacted the California Consumer Privacy Act (“CCPA”), which took effect on January 1, 2020 and became enforceable starting July 1, 2020. The CCPA, which covers businesses that obtain or access personal information on California resident consumers grants consumers enhanced privacy rights and control over their personal information and imposes significant requirements on covered companies with respect to consumer data privacy rights. The CCPA provides consumers with the right to opt out of the sale of their personal information including the requirement to include a “Do Not Sell” link on our websites and applications that sell personal data of California resident consumers. We believe we have implemented such links to the extent necessary and our privacy policies have been updated and posted on our websites. Further, on November 3, 2020, the California Privacy Rights Act (the “CPRA”) was voted into law by California residents. The CPRA significantly amends the CCPA and imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes and opt outs for certain uses of sensitive data. It also creates a new California data protection agency specifically tasked to enforce the law, which could result in increased regulatory scrutiny of California businesses in the areas of data protection and security. The substantive requirements for businesses subject to the CPRA went into effect on January 1, 2023 and became enforceable on July 1, 2023. Similar laws have been passed in several other states and have been proposed in additional states and at the federal level.

Current wording

The Company is also subject to the California Consumer Privacy Act (“CCPA”), which covers businesses that obtain or access personal information on California resident consumers grants consumers enhanced privacy rights and control over their personal information and imposes significant requirements on covered companies with respect to consumer data privacy rights. The CCPA provides consumers with the right to opt out of the sale of their personal information including the requirement to include a “Do Not Sell” link on our websites and applications that sell personal data of California resident consumers. We believe we have implemented such links to the extent necessary and our privacy policies have been updated and posted on our websites. Further, on November 3, 2020, the California Privacy Rights Act (the “CPRA”) was voted into law by California residents. The CPRA significantly amended the CCPA and imposed additional data protection obligations on companies doing business in California, including additional consumer rights processes and opt outs for certain uses of sensitive data. It also created a new California data protection agency specifically tasked to enforce the law, which could result in increased regulatory scrutiny of California businesses in the areas of data protection and security. Similar laws have been passed in several other states and have been proposed in additional states and at the federal level.

Previous wording

Failure or perceived failure by us to comply with our policies, applicable requirements, or industry self-regulatory principles related to the collection, use, sharing or security of personal information, or other privacy, data-retention or data-protection matters could result in a loss of user confidence in us, damage to our brands, and ultimately in a loss of users and advertising partners, which could adversely affect our business. Changes in these or any other laws and regulations or the

Current wording

Failure or perceived failure by us to comply with our policies, applicable requirements, or industry self-regulatory principles related to the collection, use, sharing or security of personal information, or other privacy, data-retention or data-protection matters could result in a loss of user confidence in us, damage to our brands, and ultimately in a loss of users and advertising partners, which could adversely affect our business. Changes in these or any other laws and regulations or the interpretation of them could increase our future compliance costs, limit the amount and type of data we can collect, transfer, share, or sell, make our products and services less attractive to our users, or cause us to change or limit our business practices. Further, any failure on our part to comply with any relevant laws or regulations may subject us to significant civil or criminal liabilities.

Previous wording

As of December 31, 2024, Consensus has total outstanding indebtedness of approximately $598 million, of which $249 million will mature on October 15, 2026 and the remainder with mature on October 15, 2028. We may also incur additional indebtedness in the future. This significant amount of debt could have important adverse consequences to us and our investors, including:

Current wording

As of December 31, 2025, Consensus has total outstanding indebtedness of approximately $562.2 million, of which $7.5 million will mature in each of the years 2026 and 2027, and the remainder will mature in 2028. We may also incur additional indebtedness in the future. This significant amount of debt could have important adverse consequences to us and our investors, including:

Previous wording

In addition, the indentures governing our indebtedness contain, and the agreements governing any future indebtedness may contain, restrictive covenants that may limit our ability to engage in activities that may be in our long-term best interest. Our failure to comply with those covenants could result in an event of default which, if not cured or waived, could result in the acceleration of substantially all of our debt.

Current wording

In addition, the indentures governing our indebtedness contain, and the agreements governing any future indebtedness may contain, restrictive covenants that may limit our ability to engage in activities that may be in our long-term best interest.

Previous wording

As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act and the Dodd-Frank Act and are required to prepare our financial statements according to the rules and regulations required by the SEC. In addition, the Exchange Act requires that we file annual, quarterly and current reports. Our failure to prepare and disclose this information in a timely manner or to otherwise comply with applicable law could subject us to penalties under federal securities laws, expose us to lawsuits and restrict our ability to access financing. In addition, the Sarbanes-Oxley Act requires, among other things, that we establish and maintain effective internal controls and procedures for financial reporting and disclosure purposes. Internal control over financial reporting is complex and may be revised over time to adapt to changes in our business, or changes in applicable accounting rules. As reported elsewhere in this Annual Report on Form 10-K, we previously identified material weaknesses in our internal control over financial reporting. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our consolidated financial statements will not be prevented or detected on a timely basis.

Current wording

As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act and the Dodd-Frank Act and are required to prepare our financial statements according to the rules and regulations required by the SEC. In addition, the Exchange Act requires that we file annual, quarterly and current reports. Our failure to prepare and disclose this information in a timely manner or to otherwise comply with applicable law could subject us to penalties under federal securities laws, expose us to lawsuits and restrict our ability to access financing. In addition, the Sarbanes-Oxley Act requires, among other things, that we establish and maintain effective internal controls and procedures for financial reporting and disclosure purposes. Internal control over financial reporting is complex and may be revised over time to adapt to changes in our business, or changes in applicable accounting rules. We have previously identified material weaknesses in our internal control over financial reporting, although all such material weaknesses have been remediated. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our consolidated financial statements will not be prevented or detected on a timely basis.

Previous wording

We completed remediation measures related to the material weaknesses and concluded that our internal control over financial reporting was effective as of December 31, 2023. Completion of remediation does not provide assurance that our remediation or other controls will continue to operate properly or remain adequate. Further, our current internal control over financial reporting and any additional internal control over financial reporting that we develop may become inadequate because of changes in conditions in our business. We also cannot assure you that a material weakness will not be discovered with respect to a prior period for which we had previously believed that internal controls were effective. If we are not able to maintain effective internal control over financial reporting, our independent registered public accounting firm will not be able to certify as to the effectiveness of our internal control over financial reporting, if and when required.

Current wording

Completion of remediation does not provide assurance that our remediation or other controls will continue to operate properly or remain adequate. Further, our current internal control over financial reporting and any additional internal control over financial reporting that we develop may become inadequate because of changes in conditions in our business. We also cannot assure you that a material weakness will not be discovered with respect to a prior period for which we had previously believed that internal controls were effective. If we are not able to maintain effective internal control over financial reporting, our independent registered public accounting firm will not be able to certify as to the effectiveness of our internal control over financial reporting, if and when required.