개인정보

•actual or perceived significant data privacy or cybersecurity incidents involving our advertising solutions;

Over twenty other U.S. states have enacted similar privacy laws.

In the U.S., federal, state, and local governments have enacted numerous privacy and data security laws, such as, the Telephone Consumer Protection Act ("TCPA"), which imposes various consumer

In addition to the GDPR, the EU has also enacted legislation that would regulate non-personal data and establish new cybersecurity standards, and other countries, including the U.K., may similarly do so in the future.

Data Privacy, Cybersecurity and Intellectual Property Risks

The U.S. Department of Justice also has issued regulations restricting and imposing obligations in connection with certain transfers of sensitive personal information.

AI laws and regulations, such as the European Union's AI Act, impose compliance obligations on AI systems that process personal data.

We are subject to changing laws, regulations and contractual and other obligations concerning privacy, cybersecurity and data protection, including restrictions on cross-border data transfers and data localization as well as increasingly rigorous contractual provisions demanded by our customers and third-party providers.

Risk Factors— Risk Related to Cybersecurity, Privacy, and Regulatory Requirements” heading.

Our use or future adoption of artificial intelligence in our business, which may include tools developed by third parties, could expose us to breach of a data or software license, website terms of service claims, claimed violations of privacy rights or other tort claims.

Substantial fines may be imposed for breaches of data protection requirements, which, under the GDPR, can be up to 4% of a company's worldwide annual turnover or 20 million Euros, whichever is greater, and classes of individuals or consumer protection organizations may initiate litigation related to our processing of their personal data.

For example, juries have returned liability verdicts against us in certain trials, including in U.S. youth and privacy-related matters, and additional bellwether trials are scheduled for 2026 and beyond.

For example, the EU Data Act imposes service switching obligations, requires us to assist with data portability to facilitate switching, and imposes requirements related to the cross-border data transfer of non-personal data.

In addition, the DMA imposes interoperability obligations on the Company requiring it to make certain of its technologies and features available to third-party products and services for free, which increases security and privacy risks, requires significant engineering resources, and can adversely affect the functionality, competitiveness, and user experience of the Company’s products.

The use and availability of third-party AI models in our solutions could result in scrutiny and legal liability, including intellectual property infringement and privacy claims.

Further, jurisdictions are increasingly applying existing data privacy, consumer protection and other laws to AI, including emerging AI technologies such as generative AI.

Failure to comply with the GDPR or the

•We and our third-party service providers are subject to stringent and changing laws, regulations standards, and contractual obligations related to data privacy and security.

Our employees, consultants, partners or third-party vendors may use AI tools without authorization or in a manner inconsistent with our policies, which could expose proprietary, confidential or regulated information to unauthorized recipients or create claims relating to privacy, open-source software, contractual obligations or other legal requirements.

Our employees, contractors and vendors may adopt or use such AI tools, including through unauthorized or unsanctioned means, before we have had the opportunity to assess and mitigate the associated risks, which could result in the exposure of our or our customers' confidential, proprietary or personal information, interactions with unauthorized data sources or external tools, non-compliance with our internal security

These outcomes may give rise to public controversy, societal concerns, or regulatory actions relating to human rights, privacy, employment, or other social, economic, or political issues, and could adversely affect our reputation, competitive position, business, financial condition, and results of operations.

We manage AI-related risks through our existing cybersecurity, privacy, legal, compliance, information governance, and enterprise risk management processes.

Our use of AI tools could also result in the loss of confidential information or intellectual property or an inability to claim or enforce intellectual property rights, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy, cybersecurity, and the unauthorized use of Company data.

The failure of one or more such service providers to meet our expectations, including by use of AI tools in contravention of agreements with us, inputting our confidential or proprietary information into AI tools, or roll-out of new AI tools without our approval, may have an adverse effect on our operations or financial condition, result in legal or regulatory violations, jeopardize our intellectual property rights o

Colorado’s Automated Decision-Making Technology Act, which is expected go into effect on January 1, 2027, imposes obligations on developers and deployers of technology that processes personal data and uses computation to generate outputs used to make or assist decisions about individuals;

Many other U.S. states have enacted their own distinct privacy laws and regulations, which often impose different, overlapping, and sometimes conflicting requirements across multiple jurisdictions.

regulations, including, among others, those related to financial and other disclosures, trade (including import and export regulations), antitrust, environment, health and safety, privacy, data protection, and anti-corruption,

Privacy

Following that, the European Data Protection Supervisor found in March 2024 that the European Commission’s use of Microsoft 365 violated the GDPR in part due to EU personal data being transferred to countries that had not been determined by the EU to provide adequate level of protection suggests that EU regulators are continuing to subject data transfers outside the EU to careful scrutiny.

We are required to comply with stringent, complex and evolving laws, rules, regulations and standards in many jurisdictions, as well as contractual obligations, relating to data privacy and security.

For example, judicial invalidation of the EU-U.S. Privacy Shield and Safe Harbor frameworks that we relied on to transfer data created additional compliance challenges for the transfer of EU personal data to the U.S. While a new

Other such as the Texas Data Privacy Security Act, the Colorado Privacy Act, and the Oregon Consumer Privacy Act,

•The EU has proposed the Regulation on Privacy and Electronic Communications, which, if adopted, would impose new obligations on using personal information in the context of electronic communications, particularly with respect to online tracking technologies and direct marketing.