Booking Holdings · Risk factors

•Adverse changes in market conditions for travel services;

•The effects of competition;

•Our ability to successfully manage growth and expand our global business;

•Adverse changes in third-party relationships;

•Our performance marketing efficiency and the effectiveness of our marketing efforts;

•Our ability to respond to and keep up with rapid technological or other market changes;

•The development and use of generative AI ("Gen AI");

•Our ability to attract and retain qualified personnel;

•Operational and technological infrastructure risks;

Our financial results depend upon sales of travel services, which can fluctuate based on consumer discretionary spending levels. Demand for and sales of travel services often decline during periods of perceived or actual adverse economic conditions and times of political or economic uncertainty. Economic and political uncertainty can negatively impact transaction growth rates, cancellation rates, and accommodation average daily rates ("ADRs"). While lower occupancy rates can increase distribution of accommodation reservations through third-party intermediaries such as us, if there are lower ADRs, it generally has a negative effect on our revenues and results of operations.

Macroeconomic uncertainties have led to significant volatility in currency exchange rates, stock markets, and oil prices, which can impact consumer travel behavior. The uncertainty of macroeconomic factors and their impact on consumer behavior makes it difficult to forecast industry and consumer trends and their potential impact on our business, which could adversely affect our ability to effectively manage our business and adversely affect our results of operations.

Other events beyond our control such as pandemics, terrorist attacks, natural disasters, wars and regional hostilities, travel-related accidents, or increased focus on the environmental impact of travel may disrupt or limit the ability or willingness of travelers to visit certain locations, or result in declines in demand for our travel offerings. Responses to such events by governments or global organizations could restrict travel in ways that could impact our ability to conduct our business. Because these events and their impacts are largely unpredictable, they can dramatically and suddenly affect travel behavior by consumers, demand for and provision of our services, and relationships with travel service providers and other partners, any of which can adversely affect our business and results of operations.

We compete globally with online and traditional travel and restaurant reservation and related services. The markets for the services we offer are intensely competitive and constantly evolving. Current and new competitors launch new services at a relatively low cost. Some of our current and potential competitors include the largest global technology companies, which have significantly more consumers, consumer data, and resources than we do, and may be able to leverage other aspects of their businesses (e.g., search or mobile device businesses or Gen AI and similar or related capabilities) to compete with us. For example, Google's online travel offerings have grown rapidly by linking travel search services to its dominant search functionality through flight, hotel, and alternative accommodations meta-search products, and integrating such products into Google Maps.

Similarly, several companies developing Gen AI-powered platforms have used travel search and reservation capabilities to illustrate the possible use cases for this technology. The structure of the travel industry or consumer preferences could also change in ways that disadvantage us and benefit competitors or new entrants. If we are unable to successfully adapt to such changes, our ability to compete, and our business and results of operations, would be adversely affected.

We currently, or may in the future, compete with companies that provide a variety of products and services, including:

•online platforms, including accommodation and alternative accommodation search or reservation services, travel meta-search, and large online companies including in search, social media, marketplace, Gen AI, and ride-sharing;

•travel service providers (e.g., accommodations, rental car companies, or airlines), which may offer lower prices on their direct channel than they provide to us;

•traditional travel agencies, travel management companies, wholesalers, and tour operators;

•companies offering software solutions and technology services to travel service providers, including global distribution systems ("GDSs") and hospitality software and payments platforms; and •companies offering AI agents powered by Gen AI that can perform or facilitate travel-related services, such as virtual assistants.

Some of our current and potential competitors may have greater resources or stronger competitive positions in certain geographic regions than we do. For example, some of our competitors may be domiciled in different countries and subject to political, legal, and regulatory regimes that enable them to compete more effectively than us.

The market for accommodations covers a wide range of property types including alternative accommodations, and companies like Airbnb and Vrbo (owned by Expedia) compete directly with our accommodations businesses. Meta-search services may lower the cost for new companies to enter the market by providing a distribution channel without the cost of promoting the new entrant's brand and also compete directly with us for customers. They may also evolve into more traditional online travel companies ("OTCs") by offering consumers the ability to make travel reservations directly. Moreover, some of our competitors and potential competitors offer a variety of online services, many of which are used by consumers more frequently than online travel services or have created "super-apps" where consumers can use such various services without leaving the company's app.

A competitor that has established other, more frequent online or app-based interactions with consumers may be able to more easily or cost-effectively acquire customers for its online travel services than we can. Some competitors include private equity-funded platforms, which can more easily withstand significant losses for an extended period of time while building market share through heavy marketing and/or discounting of their services. In addition, competitors may more effectively invest in online marketing channels, which could hinder growth of our services if they are more successful at promoting their platform than us.

For many consumers, the price of a travel service is the primary factor determining whether to book a reservation. In some cases, our competitors are willing to make little or no profit on a transaction or offer travel services at a loss in order to gain market share. In certain markets, we may need to provide discounts or other incentives in order to be competitive, which may make it difficult for us to maintain or grow market share, maintain historical profit margins, and may also result in lower ADRs and lower revenues as a percentage of gross bookings. Consolidation among travel service providers or the development of alternative offerings as a result of Gen AI could result in lower OTC commission rates, increased discounting, and greater incentives for consumers to join closed-user groups as such travel service providers expand their offerings. If we are unable to effectively offer competitive prices, our revenues, market share, business, and results of operations could be materially adversely affected.

We have significant operations in countries outside the United States and derive a substantial portion of our gross bookings from these countries. Our OTC operations outside of the United States historically had achieved significant year-over-year growth in their gross bookings, though growth rates have generally declined over time as the absolute level of our gross bookings increased and online travel growth rates declined. Other factors may also slow the growth rates of our businesses outside of the United States, including economic conditions, strengthening of the U.S. Dollar versus other currencies, declines in ADRs, increases in cancellations, adverse changes in travel market conditions, and competition. Any decline in the growth rates of our businesses could negatively impact our revenue and earnings growth rates and as a consequence our stock price.

We are also subject to risks related to expanding our business internationally. International markets may have strong local competitors with an established brand and travel service provider or restaurant relationships making expansion in that market difficult or costly. Certain markets in which we operate have unique localized preferences or lower operating margins, or from time to time have experienced declining or no growth. Scaling and growing our business in such markets could require significant investment, which could have a negative impact on our profit margins. In some markets such as China, local requirements may restrict participation by foreign businesses, making our entry into and expansion in those markets costly, difficult, or impossible. If we are unsuccessful in expanding in new and existing markets and managing that expansion, our business and results of operations could be adversely affected.

We believe that the breadth, variety, and quality of accommodations on our platforms helps drive our growth. The growth rate of the number of accommodations on our platforms may vary in part due to removing accommodations from time to time. Many newer accommodations we offer may have fewer rooms or higher credit risk and may appeal to a smaller subset of consumers (e.g., hostels and bed and breakfasts). If occupancy rates increase, accommodation providers often limit their offerings to OTCs. Also, certain jurisdictions have instituted regulations intended to address the issues of "overtourism" and the impact of tourism on climate, including by restricting accommodation offerings near popular tourist destinations.

As a result, we may experience constraints on the number of listings or available accommodation room nights or decreased demand, which could negatively impact our business growth rate and results of operations.

We rely on providers of accommodations, rental cars, and airline tickets, and on restaurants, to make their services available to consumers for reservation through us. Our arrangements with travel service providers generally do not require them to make available any specific quantity of reservations, or to make reservations available in any geographic area, for any particular route, or at any particular price. Similarly, our arrangements with restaurants generally do not require them to provide all of their available tables and reservations to customers through us. Our arrangements with OTCs and travel service providers to provide pricing, schedules, availability, and other information in connection with Kayak's meta-search services are non-exclusive and can be terminated with little notice.

A significant reduction on the part of any of our major travel service providers, or restaurants, for a sustained period of time or their complete withdrawal from our services, including due to a provider's bankruptcy or closure, could have an adverse effect on our business, advertising revenue, market share, and results of operations. Further, as consolidation among travel service providers increases, or if Gen AI better enables, or offers alternatives for travel service providers to reach consumers, the potential adverse effect of a decision by a significant travel service provider to withdraw from or reduce its participation in our services also increases.

We rely upon Google and other search and meta-search services to generate a significant portion of traffic to our platforms, principally through pay-per-click marketing campaigns. The pricing and operating dynamics on these platforms can change rapidly. If the logic determining placement and display of results of a consumer's search changes, the placement of links to our platforms can be negatively affected and our costs to improve or maintain our placement can increase. A decline or slowing growth in travel search traffic also negatively impacts our ability to efficiently generate traffic to our platforms through performance marketing on general search platforms, which could have an adverse effect on our business and results of operations.

We rely on various third-party distribution channels (i.e., marketing affiliates) to distribute accommodation, rental car, and airline ticket reservations. If distribution through such third parties declines, our business, market share, and results of operations could be adversely affected.

We offer a range of insurance products related to our travel offerings, primarily through third-party insurance providers. Our business and reputation may be adversely affected if such providers no longer make such offerings available to us on economically reasonable terms or at all.

Our alternative accommodations business faces risks relating to claims of liability, regulatory developments, and continued growth and profitability. Because alternative accommodations are often either a single unit or a small collection of independent units, and may have additional costs to be offered on our platforms, these properties generally represent more limited booking opportunities and lower profit margins than hotels, motels, and resorts. Further, alternative accommodations may be subject to increased seasonality or may not be available at peak times due to use by property owners. To the extent alternative accommodations represent an increasing percentage of the properties we add to our platforms, we expect that our room-night growth rate and property growth rate will continue to diverge over time, and the number of reservations per property will likely continue to decrease.

Alternative accommodations are subject to claims of liability based on injury, death, discrimination, or criminal activities occurring at these properties. We have no control over the actions of our consumers, property owners, and other third parties during a stay, and cannot guarantee the safety of such individuals. We have not in the past and may not in the future undertake to systematically verify the safety, quality, and legal compliance of our alternative accommodation listings. We rely on property owners to disclose information relating to their listings and such information may be inaccurate or incomplete. Moreover, Booking.com facilitates the provision of partner liability insurance that may protect alternative accommodation partners against liability claims, lawsuits by third parties for bodily injury, or personal property damage that occur during a stay at a partner property.

This partner liability insurance, if applicable to the claim, may provide partners with up to $1.0 million equivalent (policy limit) of third party liability coverage related to the underlying claim, though the Company could be required to pay amounts in excess of the policy limit. Any resulting complaints or claims could result in negative publicity and increased costs, which could adversely affect our reputation, business, and results of operations.

Alternative accommodation regulation is new and evolving, and laws, regulations, or property association rules could impose obligations on property owners and managers that limit or negatively affect their ability to rent their properties. For example, in conjunction with the Digital Services Act ("DSA"), the European Commission (the "EC") has adopted a short-term rental regulation that imposes new obligations around property owner registration, property verification, and enforcement of local registration schemes. Some jurisdictions have adopted or are considering restrictions on the ability to offer alternative accommodation properties or that require online platforms, owners, or managers to obtain a license to rent or list alternative accommodations. From time to time, we have been and are subject to inquiries related to compliance with alternative accommodation legal requirements that have resulted in fines and could result in additional fines, adversely affect our reputation, or require modifications to our business operations.

Legal requirements applicable to alternative accommodations are evolving and can be inconsistent among individual localities, and we are unable to predict what effect they may have on our business. This dynamic regulatory environment requires us to expend significant time and resources and could negatively impact our alternative accommodation reservation business.

We invest considerable resources in the establishment and maintenance of our brands, marketing and other brand building efforts to preserve and enhance consumer awareness of our brands, and to attract and retain customers. Performance marketing costs to grow traffic to our platforms are variable because they are dependent on others' marketing spend in the same channels. If we are unable to maintain or enhance consumer awareness and acceptance of our brands or if such efforts are not cost-effective, our business, market share, and results of operations could be materially adversely affected.

Our marketing efficiency, expressed as marketing expense as a percentage of gross bookings, and performance marketing return on investment ("ROIs") are impacted by a number of factors that are subject to variability and are in some cases outside of our control, including ADRs, costs per click, cancellation rates, foreign currency exchange rates, our ability to convert traffic to booking customers, and the timing and effectiveness of our brand marketing campaigns. Marketing efficiency can also be impacted by the extent to which consumers come directly to our platforms for bookings. If our marketing efforts are less effective at generating new bookings, our marketing efficiency could deteriorate and our margins, revenues, and earnings growth could be adversely affected.

For example, competition for desired rankings in search results and/or a decline in ad clicks by consumers could increase our costs-per-click and negatively impact our marketing efficiency. At times we may pursue a strategy of increasing marketing ROIs, which could negatively affect our gross bookings and revenue growth rates. Pursuing a strategy of improving performance marketing ROIs along with factors such as competitors' actions in the bidding environment, the amount of marketing invested by these channels to generate demand, and overall marketing platform traffic growth trends, may also impact our gross bookings and revenue growth rates. Negative trends in our marketing efficiency, performance marketing ROIs, or consumer shopping activity could negatively impact our business, market share, and results of operations.

We compete in markets characterized by rapidly changing technology, evolving industry standards, consolidation, frequent service developments, and changing consumer preferences. In addition, these market characteristics are heightened by the progress of technology adoption in various markets, including the continuing adoption of online commerce in certain geographies and the growth of mobile e-commerce transactions. We may not be able to keep up with these rapid changes.

Our long-term strategy to build the Connected Trip will require increased investments that could have an adverse impact on our results of operations until we achieve the expected return on these investments. The development of the Connected Trip is subject to uncertainties, including further development of the verticals and technological capabilities (which may include developing and integrating technologies like Gen AI) necessary for the Connected Trip experience, the ability to collect, store, and use customer data in a compliant and integrated fashion, and the attraction and retention of employees dedicated to this effort. It may take longer than we expect to realize the Connected Trip vision or it may not achieve the expected return on investment.

These efforts may also not be successful in improving the travel experience or retaining and attracting new customers. Further, regulatory restrictions may impact our ability to commercialize the Connected Trip or expose us to unanticipated liabilities. With any technical innovation such as the Connected Trip effort, there could be vulnerabilities and other technical failures, which could result in lost business, harm to our brand or reputation, consumer complaints, and other adverse consequences, any of which could adversely affect our business and results of operations.

In the future the competitive pressure to innovate could encompass a wider range of services and technologies, and our ability to keep pace may slow. Other companies, including emerging start-ups or large technology companies utilizing proprietary Gen AI or similar capabilities, may be able to innovate and focus on developing a new product or service faster than we can or may foresee consumer need for new services or technologies before we do. In addition, the widespread adoption of new technologies, such as Gen AI and machine learning, could influence how customers search for and book travel, render our existing technology obsolete, require us to modify or adapt our services or infrastructure, which could adversely affect our results of operations or financial condition.

Consumers increasingly use mobile devices and apps to make online travel bookings. The revenues earned on a mobile transaction may be less than a desktop transaction due to different purchasing patterns. To the extent mobile devices or platforms enable users to block advertising content, our advertising revenue and ability to market our brands may also be negatively affected. If we are unable to attract consumers to our mobile platforms, or app store providers like Google and Apple use their app distribution, mobile operating, or payment platforms to favor competing services to ours, we could lose market share and our business, future growth, and results of operations could be adversely affected.

Our ability to offer a variety of appropriate payment solutions is an important part of our value proposition for our partners and consumers. If we are unable to offer consumers their preferred method of payment, it would limit our growth opportunities and our business and results of operations could be harmed.

We are seeking to incorporate Gen AI in our business, including for internal productivity purposes and in consumer- and partner-facing initiatives such as AI travel assistants, price comparison tools, and as part of enhancing the development of our Connected Trip vision. Our evolving efforts to utilize Gen AI may increase risks related to harmful content, inaccuracies, bias or discrimination, intellectual property infringement or misappropriation, data privacy, cybersecurity, or other issues. In some instances we may make use of third-party foundational models that have been pre-trained on data which may be insufficient, erroneous, stale, contain biased information, or infringe intellectual property rights. Our implementation of AI systems could result in legal liability, regulatory action, brand, reputational, or competitive harm, or subject us to new regulatory frameworks (such as the European Union Artificial Intelligence Act).

Such risks are heightened if we or third-party developers or vendors lack sufficient responsible AI development or governance practices. If we enable or offer Gen AI solutions that have unintended consequences, are contrary to responsible AI policies and practices, or are otherwise controversial because of their impact on human rights, privacy, employment, or other social, economic, or political issues, our reputation, competitive position, business, financial condition, and results of operations may be adversely affected.

Our Gen AI initiatives will require increased investment in infrastructure and headcount. If our Gen AI investments are not successful or our competitors are better at the deployment of Gen AI technologies longer-term, our business and financial performance could be harmed.

Our performance relies on the talents and efforts of highly skilled individuals. Our future success depends on our continuing to attract and retain a highly skilled workforce. Our ability to attract and retain talent could be negatively impacted by factors such as the recently announced organizational changes, including an expected workforce reduction, and our hybrid work environment.

Competition for well-qualified employees, especially software engineers and other technology professionals, is intense and costly. In addition, our customer service resources (including outsource arrangements) may be unable to provide adequate customer service support. Our success has led to increased efforts by our competitors and others to hire our employees. These difficulties may be amplified by increased ability to work remotely, evolving restrictions on immigration or availability of visas or work permits for skilled technology workers, requirements of applicable collective bargaining agreements, and laws in certain jurisdictions that make recruiting senior talent more difficult, such as the reductions in the partial tax exemption that benefits certain non-Dutch citizens working in the Netherlands.

These factors combined with inflationary pressure on compensation has caused our personnel expenses to attract and retain key talent to increase, which may adversely affect our results of operations. If we do not succeed in attracting and retaining well-qualified employees, our business, ability to grow and innovate, competitive position, reputation, and results of operations would be adversely affected.

We have recorded and may in the future record impairments of goodwill, long-term investments, or long-lived assets. Future events and changing market conditions may result in the need to recognize goodwill, investment, or asset impairment charges, which could have a material adverse effect on our results of operations.

Any significant increase in our provision for expected credit losses and any significant increase in cash outlays to refund consumers could have a corresponding adverse effect on our results of operations and related cash flows. We could experience a high level of cancellations of existing reservations which could result in higher than normal cash outlays to refund consumers for prepaid reservations. In some instances, where we had agreed to provide free cancellations to consumers for non-refundable reservations, we did not estimate a recovery of prepayments already made to travel service providers. We may also offer cancellable room rates on behalf of a partner to provide flexibility to our consumers even if the partner has not provided a cancellable room rate, which could have a negative impact on our revenues if we are unable to facilitate booking from another consumer.

Our financial results depend on the successful execution of our operating plans. We previously announced our intention to implement certain organizational changes, including modernizing processes and systems, an expected workforce reduction, optimizing procurement, and seeking real estate savings (the "Transformation Program"). There are no assurances that we will achieve the estimated cost savings goals, realize the expected benefits from the Transformation Program, or manage the Transformation Program effectively. We may also incur significant charges related to the Transformation Program, which could reduce our profitability in the periods such charges are incurred. Our inability to generate anticipated cost savings, successfully implement our strategies, or efficiently manage our operating plans for the Transformation Program could negatively affect our business and results of operations.

Historically, our brands operated on a largely independent basis and many of them focused on particular services or geographies. We continue to optimize collaboration among our brands. As we manage this shift, in addition to managing changes in our workforce we may find it difficult to maintain the beneficial aspects of our corporate culture at our brands and throughout the organization. Any future expansion or shift increases the complexity of our business and places additional strain on our management, operations, technical performance, financial resources, and administrative, legal, tax, internal controls, and financial reporting functions. Our employees and outsourced resources, systems, procedures, and controls may not be adequate to support and effectively manage such changes and increased complexity, or could result in disruption of our service or customer support, especially as we have employees and outsourced resources around the world and we increase the number and variety of our products and payment systems.

In addition, we are conducting a multi-year phased migration to integrate and upgrade certain systems and processes. The implementation of new information technology, payment, enterprise resource planning, or other systems is disruptive and costly and may not be successful, which could adversely affect our business and results of operations. Any failure to implement or adapt to new technologies in a timely manner or at all could adversely affect our ability to compete, increase our consumer acquisition costs, or otherwise adversely affect our business, brands, market share, reputation, or results of operations.

We have invested and in the future may invest in new business strategies and acquisitions of complementary businesses. Such endeavors may not be successful, such as our agreement to acquire European-based flights booking provider Etraveli Group that was terminated after the EC blocked the transaction in 2023. Additionally, such ventures may involve significant risks and uncertainties, including diversion of management's attention from current operations, greater than expected liabilities and expenses, increased regulatory scrutiny, failing to obtain required regulatory approvals on a timely basis or at all, the imposition of conditions that could delay or prevent us from completing a transaction or limit our ability to realize the anticipated benefits of a transaction, inadequate return on capital, new risks with which we are not familiar, legal and compliance obligations that previously did not apply to us, integration risks, and unidentified issues not discovered in our evaluations of those strategies and acquisitions.

We may issue shares of our common stock in these transactions, which could result in dilution to our stockholders. Entering new businesses involves risks and costs that could have an adverse effect on our business, reputation, results of operations, profit margins, cash flows or financial condition, as well as on our ability to achieve the expected benefits of any such investments or acquisitions. In addition, we may decide to make minority investments, including through joint ventures, in which we have limited or no management or operational control. The controlling person in such a case may have interests that are inconsistent with ours, and decisions of the company or venture in which we invested may result in harm to our reputation or business or adversely affect the value of our investment.

The integration of acquired businesses requires significant time and resources, and we may not manage these processes successfully. In addition to acquired businesses, we may integrate or manage differently certain of our internal businesses, integrate certain functions across our businesses, and restructure or cease operating certain assets or businesses, and we may do so in the future, including through divestitures. These actions are complex, costly, and create a variety of risks, including:

•disruption or harm to the businesses involved, or to our other businesses, including the need for management to spend time and attention on them;

•difficulty managing different company cultures, systems, processes, and human resource policies and practices, or implementing and maintaining effective internal controls, procedures, and policies;

•challenges retaining key personnel; and •loss of travel service providers, restaurants, or other partners.

We may not successfully integrate companies or achieve the strategic, financial, or operating objectives of an acquisition or integration, any of which could adversely affect our business, results of operations, or financial condition.

We depend on software and computing infrastructure (including open source software) for the operation of our business. If threat actors such as cyber-criminals, hackers, or state-sponsored organizations are able to circumvent, interrupt, or adversely affect our security measures, including as a result of our own acts or omissions, it could result in a compromise or breach of consumer, partner, or employee data. Data security is essential to maintaining consumer and partner confidence in our services and the uninterrupted availability of our web and mobile platforms is essential for our business. Consumers may provide us with their personal identity data and payment information, which in turn attracts attention from threat actors.

With cyberattacks evolving and increasing in frequency and sophistication, we may not be able to successfully defend against determined adversaries. In addition, our security policies and controls may not keep pace with the innovation of our offerings and technological advances of threat actors, such as leveraging AI. We have experienced and responded to cyberattacks, which we believe have not had a material impact on the integrity of our systems or the security of data we maintain.

Vulnerabilities in our consumer and partner systems could and have resulted in unauthorized access to personal and confidential data, such as the inadvertent disclosure of data to third-party partners that may be undetected for a period of time. These risks are likely to increase as we expand our offerings, integrate our products and services, incorporate AI, and store and process more data. The disclosure of sensitive Company, consumer, or other information through our systems or by our workforce or other parties could lead to information loss, reputational harm, monetary damages, regulatory penalties, or loss of a competitive advantage. We expend significant resources to protect against security breaches and to maintain or increase our systems' security.

Security breaches could result in negative publicity, damage our reputation, expose us to risk of loss or litigation and liability, subject us to regulatory penalties and sanctions, or cause consumers to lose confidence in us and choose to use the services of our competitors, any of which would have an adverse effect on our brands, market share, results of operations, and financial condition. Our efforts to protect information from unauthorized access have and could in the future result in the rejection or delay of legitimate attempts to book reservations through our services, which could result in lost business. Additionally, our consumers' personal data has in the past and could in the future be affected by inadvertent disclosure to, or security breaches at, third parties upon which we rely.

For example, we are currently assessing an inadvertent personal customer data disclosure to a limited number of marketing partners that was recently discovered by Booking.com. We have contracts that include confidentiality provisions with such partners and at this time do not believe the information was exposed beyond such partners, but are continuing to assess this matter.

We receive and store a large volume of personally identifiable data and payment information. The handling and storage of such data, as well as privacy rights of consumers, are subject to complex and evolving laws and regulations in numerous jurisdictions. While we invest significant resources to comply with regulations such as the European Union's (the "EU") General Data Protection Regulation (the "GDPR"), the California Consumer Privacy Act (the "CCPA"), the Personal Information Protection Law in the People's Republic of China, the Digital Personal Data Protection Act in India, and the EU Digital Markets Act ("DMA"), they are complex, subject to uncertain interpretation, and impose significant compliance obligations and costs on us.

For example, under the GDPR violations could result in fines of up to 20 million Euros or up to 4% of the annual global revenues of the infringer, whichever is greater. In many cases, these laws apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information. These laws and their interpretations continue to develop and may be inconsistent from jurisdiction to jurisdiction. Some of these regulations, such as the CCPA, give consumers a private right of action against companies for alleged violations. Non-compliance with these laws could result in negative publicity, damage to our reputation, significant penalties, or other legal liability.

If laws or regulations are expanded to require changes in our business practices, or interpreted in ways that negatively affect our business, our results of operations, financial condition, or competitive position could be adversely affected.

If our systems cannot cope with the level of demand required to service our consumers and partners, we could experience unanticipated disruptions in service, slower response times, decreased customer service and customer satisfaction, and delays in the introduction of new services. We are dependent on the internet, connectivity, and mobile systems throughout the world. Disruptions in internet access could materially adversely affect our business and results of operations. While we maintain redundant systems and hosting services, they may not be sufficient to prevent interruptions. Moreover, while we maintain insurance policies to protect against potential losses caused by security breaches, our insurance policies may not be adequate to reimburse us for all losses caused by security breaches.

We have computer hardware for operating our services located in hosting facilities around the world. Although we have disaster recovery plans, these systems and operations are vulnerable to damage or interruption and they may not cover us in every region. If such events were to occur, we may not be able to recover our back-up systems immediately and it could result in lengthy interruptions or delays in our services. Any system failure that causes an interruption or delay in service could impair our reputation, damage our brands, increase customer service costs, or result in lost business, any of which could adversely affect our business and results of operations. We seek to improve the reliability and redundancy of our systems, however, these steps are expensive, may reduce our margins, and may not be successful in reducing the frequency or duration of unscheduled downtime.

We have experienced targeted and organized malware, phishing, and account takeover attacks, and may in the future experience these and other forms of attack such as ransomware, SQL injection (where a third party attempts to insert malicious code into our software through data entry fields in our websites in order to gain control of the system), and attempts to use our websites as a platform to launch a denial-of-service attack on another party. Our existing security measures have not always been, and in the future may not be, successful in preventing attacks on our systems. For instance, we have incurred costs related to customer reimbursement and customer service, reputational harm, and lost revenue from fictitious listings and account takeovers.

Our existing IT business continuity and disaster recovery practices are less effective against certain types of attacks, which could result in interruption of our services, data exposure, and/or an extortion attempt. Reductions in the availability and response time of our online services could cause loss of substantial business volumes and measures we may take to divert suspect traffic could result in the diversion of bona fide customers. These issues are more difficult to manage during any expansion of the number of places where we operate and the variety of services we offer, and as the tools and techniques used in such attacks, such as Gen AI or similar technologies, become more advanced.

We use advanced technology to identify cybersecurity threats; however, cyberattacks may go undetected for a period of time resulting in harm to our computer systems and the loss of data. This could result in regulatory fines, loss of consumers or partners, and reputational harm, among other costs. Successful attacks could result in significant interruptions to our operations, severe damage to our information technology infrastructure, negative publicity, reputational harm, and/or prevent consumers from using our services during the attack, any of which could cause consumers to use the services of our competitors, which would have a negative effect on the value of our brands, market share, business, and results of operations.

We use both internally-developed and third-party systems to operate our services, including transaction processing, order management, and financial and accounting systems. If the number of consumers using our services increases substantially, or if critical third-party systems stop operating as designed, we may need to repair, expand, replace, or upgrade our systems or infrastructure. If we are unable to meet demand in a timely manner, it could have a negative impact on our business. Many of our processes and systems are highly automated and involve multiple inputs from various IT systems, which can mitigate the risk of human error but can also make testing, troubleshooting, and auditing more difficult. As a result, it may be difficult to quickly detect and correct errors embedded in these processes or systems.

We rely on third-party computer systems and third-party service providers, including GDSs and computerized central reservation systems of the accommodation, rental car, and airline industries in connection with providing some of our services. Any damage to, breach of, or interruption in these third-party services and systems or deterioration in their performance could prevent us from booking related reservations and have an adverse effect on our business, brands, and results of operations. Third party business partners, service providers, and consultants may be given access to our computer networks. A cyberattack against one of these third parties that compromises their credentials may result in unauthorized access to our systems and data, resulting in a cyberattack against us.

Furthermore, our agreements with some third-party service providers do not provide recourse for service interruptions, and such service interruptions could have a negative impact on our business and results of operations.

Any publicized privacy and security problems could negatively affect consumers' willingness to use our services. Some of our business is conducted with third-party marketing affiliates, which may generate travel reservations through our infrastructure or through other systems. A security breach at any third party that we conduct business with could be perceived by consumers as a security breach of our systems and could result in negative publicity, subject us to notification requirements, damage our reputation, expose us to risk of loss or litigation, and subject us to regulatory penalties and sanctions, even if we had no direct involvement in the breach. In addition, such third parties may not comply with applicable disclosure or confidentiality requirements, or with parameters within which we permit them to process data, which could expose us to liability.

We depend upon various third parties to process payments, including credit cards, or to provide credit card numbers for payment for our merchant transactions. If any such third party were compromised or ceased or suspended operations, our cash flows could be disrupted or we may not be able to generate merchant transactions (and related revenues) for a period of time and this could have a negative effect on our revenues, business, reputation, and results of operations and, in certain cases (such as insolvency of a partner), the loss of the total transaction value.

As an international business providing services around the world, we are subject to various taxes. Although we believe that our tax filing positions are reasonable and comply with applicable law, we regularly review them and we may change our positions or determine that previous positions should be amended, either of which could result in additional tax liabilities. The final determination of tax audits or disputes may be different from what is reflected in our historical tax provisions and accruals. We have been audited in many taxing jurisdictions. If audits find that additional taxes are due, we may be subject to incremental tax liabilities, possibly including interest and penalties, which could have a material adverse effect on our results of operations, financial condition, and cash flows. An unfavorable outcome or settlement of pending litigation or audit proceedings could encourage the commencement of additional litigation, audit proceedings, or other regulatory inquiries.

Governments have sought to increase tax revenues, which has contributed to an increase in audit activity, more aggressive positions taken by tax authorities, more time and difficulty to resolve audits or disputes, and an increase in new tax legislation. Additional taxes or other assessments may be in excess of our current tax provisions or may require us to modify our business practices in order to reduce our exposure to additional taxes going forward, any of which could have a material adverse effect on our business, results of operations, and financial condition.

The U.S.'s Tax Cuts and Jobs Act (the "Tax Act") introduced a tax on 50% of global intangible low-taxed income ("GILTI"), which is income determined to be in excess of a specified routine rate of return on qualifying business assets. The Tax Act further introduced a base erosion and anti-abuse tax ("BEAT") aimed at preventing the erosion of the U.S. tax base and a new tax deduction with respect to certain foreign-derived intangible income. If we are unable to operate our business so that BEAT does not impact us, our effective tax rate, results of operations and cash flows would be adversely affected. The interpretation and implementation of the Tax Act have had and could have a negative impact on our results of operations and cash flows.

In addition, the U.S.'s Inflation Reduction Act includes a 15% corporate minimum tax on book income and a 1% excise tax on stock repurchases. The interpretation and implementation of these provisions could have a negative impact on our results of operations and cash flows. Increases in the U.S. corporate income tax rate, increasing the percentage of GILTI subject to tax in the U.S., or other changes to U.S. federal tax laws could have a negative impact on our results of operations and cash flows.

Certain countries have unilaterally introduced a digital services tax to address the issue of multinational businesses carrying on business in their jurisdiction without a physical presence and therefore generally not being subject to income tax in those jurisdictions. These digital services taxes are calculated as a percentage of revenue rather than income or profits. The interpretation and implementation of the various, and at times inconsistent, digital services taxes could adversely impact our results of operations and cash flows. Further, digital services taxes may not apply to our competitors, which could harm our business and competitive position.

Additionally, there have been significant changes made and proposed to international tax laws that increase the complexity, burden, and cost of tax compliance. The Organisation for Economic Co-operation and Development ("OECD") is focused on tax reform to ensure international tax standards keep pace with changes in global business practices, which could result in tax changes. We continue to monitor the impact of the OECD's tax reform initiatives as countries implement legislation and the OECD provides additional guidance. The implementation of these rules could have a negative impact on our results of operations or cash flows.

Due to the scale of our business activities outside of the U.S., changes in U.S. or international taxation of our activities, such as new definitions of permanent establishment, new nexus and profit allocation rules, or the combined effect of tax laws in multiple jurisdictions, may increase our worldwide effective tax rate, increase the complexity and costs associated with tax compliance, and adversely affect our cash flows and results of operations.

We are also subject to other non-income-based taxes, such as value-added, payroll, sales, use, excise, net worth, property, hotel occupancy, and goods and services. We refer generally to taxes on travel transactions (e.g., value-added taxes, sales taxes, excise taxes, hotel occupancy taxes, etc.) as "travel transaction taxes." Changing value-added tax regulation such as the VAT in the digital age proposal in the EU could increase complexity and costs associated with compliance. Additionally, from time to time, we are under audit or investigation by tax authorities or involved in legal proceedings related to these non-income-based taxes or we may revise our tax positions, which may result in additional non-income-based tax liabilities.

A number of jurisdictions in the U.S. have initiated lawsuits or other proceedings against OTCs, including us, related to, among other things, the payment of certain travel transaction taxes that could include historical taxes that are claimed to be owed, interest, penalties, punitive damages, and/or attorney's fees and costs. Additional jurisdictions may assert that we are subject to travel transaction taxes and could seek to collect such taxes, either retroactively, prospectively, or both. We continue to defend against these lawsuits and, where appropriate, intend to continue to assert that we should not be subject to such taxes. Although we believe we do not owe the taxes claimed in these lawsuits, litigation is uncertain, and if there was an adverse outcome in these lawsuits or similar litigation in other jurisdictions, it could result in liabilities for past and/or future bookings, and it could have an adverse effect on our business, reputation, profit margins, and results of operations. Jurisdictions could also seek to amend their tax statutes in order to collect travel transaction taxes from us on a prospective basis.

Additionally, jurisdictions have initiated, and may in the future initiate, legal proceedings against us and other OTCs related to the payment of certain travel transaction taxes (including historical or prospective taxes, interest, penalties, punitive damages, and/or attorney's fees and costs). Although we believe we do not owe the taxes claimed, litigation is uncertain and an adverse outcome could result in liabilities for past and/or future bookings, which could adversely affect our business, profit margins, and results of operations.

The Netherlands corporate income tax law provides that income generated from qualifying innovative activities is taxed at the rate of 9% ("Innovation Box Tax") rather than the Dutch statutory rate of 25.8%. A portion of Booking.com's earnings historically has qualified for Innovation Box Tax treatment.

In order to be eligible for Innovation Box Tax treatment, Booking.com must, among other things, apply for and obtain a research and development ("R&D") certificate from a Dutch governmental agency every six months confirming that the activities that Booking.com intends to be engaged in over the subsequent six-month period are "innovative." The R&D certificate is current but should Booking.com fail to secure such a certificate in any future period - for example, because the governmental agency does not view Booking.com's new or anticipated activities as innovative, the Innovation Box Tax benefit may be reduced or eliminated. Booking.com intends to apply for continued Innovation Box Tax treatment for future periods. However, Booking.com's application may not be accepted, or, if accepted, the amount of qualifying earnings may be reduced.

The loss or reduction of the Innovation Box Tax benefit could substantially increase our effective tax rate and adversely impact our results of operations and cash flows.

We are subject to competition and consumer protection laws and regulations around the world. These laws and regulations evolve, and their interpretation, application, and enforcement can also change, be unpredictable, or be affected by changing political or social pressures. As we expand our business into new areas, including building the Connected Trip vision, we may become subject to additional laws and regulations. We have been the subject of investigations or inquiries by national competition authorities ("NCAs") and other governmental authorities. For example, we are involved in investigations related to whether certain of Booking.com's contractual parity arrangements with accommodation providers are anti-competitive because they require partners to provide Booking.com with rates, conditions, and availability at least as favorable as those offered to other OTCs or by the partner itself.

In July 2024, the Comisión Nacional de los Mercados y la Competencia (the "CNMC") in Spain notified Booking.com of its decision to impose a fine and to restrict certain business practices based on the allegation that certain practices by Booking.com may produce adverse effects for hotels and other OTCs. Booking.com does not agree with the rationale stated in the decision and certain of the restrictions imposed, and has filed an appeal. In September 2017 the Swiss Price Surveillance Office opened an investigation that may require Booking.com to reduce its commissions in Switzerland. To resolve and close certain of these investigations, we have made commitments regarding future business practices or activities, such as agreeing to narrow the scope of our parity arrangements.

While we believe that we are complying with the commitments we have made, investigating authorities or third parties may determine otherwise and decide to pursue legal action to compel compliance or seek other remedies. We cooperate with regulators but we are unable to predict what, if any, effect any investigations or their resolution, including the effect of any commitments we might make, will have on our business, industry practices, or online commerce more generally. An unfavorable outcome in an investigation could encourage additional regulatory inquiries that could become widespread over time, significantly increasing the potential financial and reputational impact on the Company. Additionally, these types of investigations can result and have resulted in the assessment of fines, private litigation, and negative publicity.

We have also been involved in investigations or inquiries involving consumer protection matters and we have previously made voluntary commitments to consumer authorities to resolve investigations or inquiries that have included showing prices inclusive of all mandatory taxes and charges, providing information about the effect of money earned on search result rankings, displaying certain sustainability-related information about accommodations, making adjustments to how discounts and statements concerning popularity or availability are shown to consumers, and displaying additional customer service details. To the extent that these or any other investigations or inquiries result in additional commitments, changes to our business practices, negative publicity, fines, damages from private litigation, or other remedies, it could have a material adverse effect on our business, financial condition, and results of operations.

There is significant legislative and public focus on the technology industry, especially as technology companies become larger. In some instances countries have passed legislation that goes further to restrict business activities than actions taken by NCAs or other regulatory authorities. The EU's Platform to Business Regulation regulates the relationship between online platforms such as Booking.com and European business users of online platforms. The DMA and DSA give regulators in the EU more instruments to investigate and regulate digital businesses and impose additional rules and requirements on platforms designated as "gatekeepers" under the DMA and online platforms more generally, with separate rules for "Very Large Online Platforms" ("VLOPs") under the DSA.

As a result of our designation as a gatekeeper under the DMA and Booking.com's designation as a VLOP under the DSA, we are subject to additional rules and regulations that may not be applicable to our competitors. For example, Booking.com has implemented changes to address the DMA prohibition on parity arrangements in the European Economic Area and the requirements regarding the usage of data across services, which could adversely impact our business. As a gatekeeper, we also established an independent compliance function to monitor compliance with the DMA. Under the DSA, as a VLOP, Booking.com is required to collect more information from partners, which could disincentivize certain partners from using our services.

Booking.com is also subject to additional scrutiny, obligations, and costs, such as payment of an annual supervisory fee, annual risk assessments and independent audits, and establishing an independent compliance function. The DMA and DSA each have significant penalties for non-compliance, and could lead to private litigation. Our compliance costs have increased in connection with becoming subject to the DMA and DSA, each of which remains subject to further interpretation and regulatory engagement, and could require additional changes to our products, business practices, and compliance activities in the future.

The EC designates VLOPs based on a platform's number of EU "monthly active recipients" ("MARs"). The EC requires counting users who display and to whom information was displayed (e.g., partners and consumers), even if a user does not make a transaction on the platform. The assessment of MARs and any other similarly published information by our brands represents an estimate based on the data available to us and limited guidance, and is subject to limitations. Any such estimate is published solely as required by applicable rules or regulations, may be inaccurate, and should not be used for any other purpose.

New state and federal laws and regulations could impact our services, require us to change our business practices, and impose additional complexity and costs. As market conditions change as a result of investigations, litigation, legislation, changing public perception of the industry, or political or social pressure, we may decide to modify our business practices beyond what is required, the full effects of which may not be known when making the decision, but which could harm our competitive position and adversely affect our business and results of operations.

With additional attention on the size of travel or technology companies generally, our size and market share may negatively affect our ability to obtain regulatory approval of proposed acquisitions or other opportunities, our ability to expand into complementary businesses, or our latitude in dealing with travel service providers (such as by limiting our ability to provide discounts, rebates, or incentives or to exercise contractual rights), any of which could adversely affect our business, results of operations, or ability to grow and compete.

Another area of potential regulatory inquiry involves contractual online search term bidding restrictions where one contracting party agrees not to bid on certain key search terms related to the other party (e.g., such other party's name). In some of our contracts, we or the other party have agreed to bidding restrictions. If bidding restrictions are held to be illegal or otherwise unenforceable or if we remove them from all of our contracts, it could negatively impact our performance marketing efficiency, business, and results of operations.

Legal requirements of governments and regulatory authorities, many of which are evolving and subject to revised interpretations, impact our ability to provide our services and can result in private litigation. For example, we currently offer optional rental car-related insurance products to customers protecting them against accidental damage to their rental vehicles, optional room and flight cancellation insurance products, and we intend to offer additional trip-related insurance products in the future, which subjects us to insurance distribution regulations and related increased compliance costs and complexities, any of which could negatively impact our business and results of operations. Increases in the number or complexity of the laws and regulations applicable to us and our businesses could increase our compliance costs and burdens and negatively affect our business and results of operations.

Laws in some countries relating to data localization, registration as a travel agent, and other local requirements could, if applicable to us, adversely affect our ability to conduct business in those countries. For example, in the EU and the United Kingdom (the "UK"), the Package Travel Directive and other local laws governing the sale of travel services (the "Package Directive") set out broad requirements such as local registration, certain mandatory financial guarantees, disclosure requirements, and other rules regulating the provision of single travel sales, travel packages, and linked travel arrangements, and certain liability for performance of the services. Some parts of our business are already subject to the broad scope of the Package Directive, and as our offerings continue to diversify and expand, we may become subject to additional requirements.

Compliance with this directive could be costly and complex and, as a result of its requirements, we could choose to limit offerings that would otherwise be beneficial for the business. Further, the Package Directive is under legislative reform, and changes to its interpretation could be costly or complex, which may adversely affect our business, results of operations, and ability to grow and compete.

The implementation of unfavorable regulations or unfavorable interpretations of existing regulations by judicial or regulatory bodies could require us to incur significant compliance costs, cause the development of the affected markets to become impractical and otherwise have a material adverse effect on our business and results of operations. For example, Turkish courts have ruled that Booking.com is subject to certain registration requirements in order to offer domestic accommodations to Turkish residents. If the appeal of this decision is not successful, Booking.com would be subject to Turkish registration requirements in order to resume offering domestic accommodations to Turkish residents, which would continue to negatively impact our business.

Compliance with the legal requirements of multiple jurisdictions increases our cost of doing business. These laws and regulations, which sometimes conflict, include the U.S. Foreign Corrupt Practices Act, the UK Bribery Act, the DSA and DMA, and local laws prohibiting corrupt payments to governmental officials or third parties, data privacy requirements, emerging regulations governing the development, marketing, and use of AI, labor relations laws, non-discrimination, human rights or anti-human trafficking laws, tax laws, anti-trust or competition laws, U.S., EU, or U.N. sanctioned country or sanctioned persons mandates, and consumer protection laws. Violations of these laws and regulations have resulted and in the future could result in fines, penalties, and criminal sanctions against us, our officers, or our employees and prohibitions on how or where we conduct business.

Violations could delay or prevent potential acquisitions and could materially damage our reputation, brands, global expansion efforts, ability to attract and retain employees and business partners, business, and operating results. Even if we comply with these laws and regulations, doing business in certain jurisdictions or violations of these laws and regulations by the parties with which we conduct business could harm our reputation and brands, which could adversely affect our results of operations and stock price. In addition, if these restrictions are not applicable to competitors, it may provide them a competitive advantage. Additionally, our employees in certain countries in Europe are represented by works councils and/or trade unions.

We are required to consult with works councils on certain matters such as restructurings (such as our Transformation Program), acquisitions and divestitures, and other matters that could impact our labor force. Consultation may not be completed on terms satisfactory to us and could result in increases in our cost of labor, diversion of management's attention away from operating our business, delays in certain initiatives, and expose us to claims and litigation. We are also subject to a variety of other regulatory, legal, and public policy risks and challenges in managing an organization operating in various countries, including:

•additional complexity to comply with regulations in multiple jurisdictions, as well as overlapping or inconsistent legal regimes, in particular with respect to tax, labor, consumer protection, AI, digital content, advertising, promotions, privacy, sustainability, and competition laws;

•difficulties in transferring funds from or converting currencies in certain countries; and •changes in social or political conditions or policies relating to a wide range of topics.

We have made efforts and expect to make further efforts to integrate access to travel services across our various brands. These changes add complexity to legal and tax compliance and our internal controls, and our size and operating history may increase the likelihood that we will be subject to regulatory scrutiny or audits by tax authorities.

Our results have been and will likely continue to be negatively impacted by consumer purchases made using fraudulent payment cards, claims the consumer did not authorize the purchase, or consumers who have closed bank accounts or have insufficient funds in their bank accounts to satisfy payments. We may be held liable for fraudulent transactions on our platforms, as well as other payment disputes. Accordingly, we calculate and record an allowance for resulting chargebacks. If we are unable to successfully implement and evolve measures to detect and reduce the risk of fraud on our platforms, our business, profit margins, results of operations, and financial condition could be materially adversely affected.

We process many of our transactions on a merchant basis where we facilitate payments from travelers through payment cards and other payment methods. While processing transactions on a merchant basis allows us to offer a variety of payment methods and flexible transaction terms, we incur additional payment processing costs (which are typically higher for foreign currency transactions) and other costs related to these transactions, such as costs related to fraudulent payments and transactions and fraud detection. These costs may increase as we expand our payments services to consumers and partners, and our results of operations and profit margins could be materially adversely affected.

As a greater percentage of our transactions involve us processing payments, our global systems and processes must be managed on a larger scale, which adds complexity, administrative burdens and costs, and increases the demands on our systems and controls, which could adversely affect our results of operations. In addition, as our payment processing activities develop or expand into different geographies, we expect to be subject to additional regulations, including financial services and export controls regulations, which we expect to result in increased compliance costs and complexities, including those associated with the implementation of new or advanced internal controls. Compliance with and implementation of the EU's Payment Services Directive 2 and similar or successor legislation such as the EU's Payment Services Directive 3 and Payment Services Regulations may be difficult to adhere to in a timely manner, result in increased compliance costs, and be administratively burdensome, any of which could negatively impact our business and results of operations.

Regulators (or we) may determine, and in some cases are likely to determine, that certain aspects of our business are subject to laws that govern payments activities, such as money transmission and online payments processing, which could require us to obtain licenses to continue to operate in certain jurisdictions or result in modification or interruption of our business plans, which would negatively impact our business and results of operations. Certain of our subsidiaries that may provide payment services in support of our brands are subject to licensing and regulations that impose notice and approval obligations on investors that seek indirect or direct ownership, in the aggregate, of 10% or more of our outstanding shares.

Regulations relating to operational resilience, including the EU's Digital Operations Resilience Act, banking (including consumer protection), privacy, and security of our processes also apply to us. Further, our payments systems are susceptible to illegal and improper uses, including money laundering, terrorist financing, fraudulent sales of goods or services, and transactions by or with sanctioned parties. We have invested and will need to continue to invest substantial resources to comply with applicable laws and regulations, and failure to maintain compliance with applicable licensing, payment services, customer fund safeguarding, or related regulations could lead to fines, which could be significant, or require us to modify or interrupt our business practices, plans, or operations, any of which could negatively impact our business, results of operations, and profit margins.

We are also subject to payment card association rules and obligations under our contracts with the card schemes and our payment card processors, and indirectly to the rules of payment systems in respect of credit (i.e., account to account) transfers. The rules of the card schemes and payment systems are often updated or interpreted in different ways, and we may need to adjust our systems and/or processes to comply with any updated obligations. If we fail to comply with such obligations, we may be fined, required to pay additional processing fees, lose our ability to accept certain credit and debit card payments from our customers, or facilitate other types of online payments, any of which would negatively impact our business, operating results, and profit margins.

Under card association rules, including the Payment Card Industry Data Security Standard (the "Standard"), if information is compromised, we could be liable to payment card issuers for associated expenses and penalties, and in some cases, we could be restricted in our ability to accept payment cards. Under certain circumstances in our agreements with the card schemes and in relation to the Standard, we are also subject to periodic audits, self-assessments, and other assessments of our compliance with the rules and obligations of the payment card associations and the Standard, which could result in additional expenses and administrative burdens. In addition, if we fail to follow payment card industry security standards, even if no consumer information is compromised, we could incur significant fines or experience a significant increase in payment card transaction costs. Compliance with the Standard may not prevent all security incidents.

We rely on banks, card schemes, and other payment processors to execute certain components of the payments process. For inbound payments, we pay these third parties interchange and other processing and gateway fees to facilitate payments from consumers to travel service providers. If we are unable to maintain our relationships with these third parties on favorable terms, fees are increased, or if we provide security, our profit margin, business, and results of operations could be harmed. Additionally, if these third parties experience service disruptions or if they cease operations, consumers and travel service providers could have difficulty making or receiving payments, which could adversely impact our reputation, business, and results of operations.

In addition, in the event that one of our major travel service providers declares bankruptcy or otherwise ceases or limits operations, we could experience an increase in chargebacks from customers with travel reservations with such travel service provider and we could experience financial loss from certain prepayments made to such travel service provider if we are not able to recover the prepayments.

We regard our intellectual property as important to our success, and we rely on intellectual property such as trademarks, copyrights, patents, and trade secrets to support our business as well as domain names or other intangible rights or property secured through purchase, licensing or other agreements with our employees, travel service providers, partners, and other parties. We have filed applications for protection of certain aspects of our intellectual property in the U.S. and other jurisdictions, and we currently hold a number of issued patents in several jurisdictions. In the future we may acquire additional intellectual property portfolios, which could require significant cash expenditures. We have licensed in the past, and may license in the future, certain of our proprietary rights, such as trademarks or copyrighted material, to third parties, and these licensees may take actions that diminish the value of our proprietary rights or harm our reputation.

We also have procured various intellectual property licenses from third parties. Additionally, we periodically use open source software in connection with our software development, which use could subject us to claims of ownership from other parties of what we believe to be open source software or non-compliance with open source licensing terms, or require us to disclose our proprietary source code. Further, there is uncertainty about the validity and enforceability of intellectual property rights related to our use of Gen AI. Effective intellectual property protection may not be available in every country in which our services are made available, particularly in certain jurisdictions in which we operate in which theft of intellectual property may be more prevalent. We may be required to expend significant time and resources to prevent infringement or to enforce our intellectual property rights.

We endeavor to defend our intellectual property rights diligently, but intellectual property litigation is expensive and time-consuming, and may divert managerial attention and resources from our business objectives. We may not be able to successfully defend our intellectual property rights or our intellectual property rights may not be sufficient to effectively protect our business, which could adversely affect our business, brands, and results of operations.

From time to time, in the ordinary course of our business, we may be subject to legal proceedings and claims relating to the intellectual property rights of others, and we expect that third parties will continue to assert intellectual property claims against us. Successful infringement claims against us could result in a significant monetary liability and/or prevent us from operating our business, or require us to change business practices or develop non-infringing alternatives, which could require significant effort and expense. In addition, resolution of claims may require us to obtain licenses to intellectual property rights belonging to third parties, which may be expensive to procure, or require us to cease using those rights altogether. Any of these events could have an adverse effect on our business, results of operations, and financial condition.

In response to focus by our investors and other stakeholders, we made climate-related commitments and issued a Climate Action Plan. We continue to evaluate these commitments, including those related to offering more sustainable trip options as well as ESG disclosures that may be required in certain jurisdictions. Our ability to do so is subject to risks including: (1) the availability and cost of limiting or offsetting our use of carbon-based energy sources and technologies, (2) evolving regulatory requirements affecting ESG standards and disclosures, (3) our ability to work with partners and providers that can meet our sustainability and other standards, (4) the availability of vendor or other third-party data, (5) the impact of our organic growth and acquisitions or dispositions of businesses or operations on our ESG goals, and (6) customers' actual demand for ESG-oriented product offerings, which may be more expensive and less available than other options.

We may need to invest significant effort and resources relating to required ESG disclosures, and inconsistent and uncertain regulations may lead us to revise or discontinue our commitments or how we measure and report ESG data. In addition, regulatory developments regarding sustainability labeling have resulted and could result in further changes to, or the discontinuation of, ESG programs or objectives.

If our ESG practices and disclosures do not meet evolving investor or other stakeholder expectations or regulatory requirements, then our reputation, ability to attract or retain employees, and our attractiveness as an investment or business partner could be negatively impacted. Similarly, our failure or perceived failure to pursue or fulfill our ESG-related objectives or to satisfy increasingly broad reporting obligations could expose us to government enforcement actions, private litigation, and actions by stockholders or stakeholders, and adversely impact our business, brands, or reputation.

There are several privacy-driven initiatives that are changing the collection and use of consumer data in the digital marketing ecosystem. These include: requirements by browsers such as Safari and Google Chrome to require opt-in consent for third-party cookies; restrictions on the use of the identifier for advertisers (such as the Apple "IDFA") by mobile device manufacturers; Apple's iCloud+ Private Relay (which hides a user's IP address from websites that the user accesses in favor of other IP addresses provided by Apple's partners); and the adoption of regulations that govern the use of cookies. For example, in the EU, the ePrivacy Directive regulates the use of cookies and similar technologies, including limitations on the use of data and guidelines for enabling users to accept or reject cookies.

Authorities may assert, and in some cases are likely to determine, that our collection, use, or management of customer and other data is inconsistent with laws and regulations, including laws that apply to cookies or similar technology, and there may be significant penalties for non-compliance. In the EU, the ePrivacy Directive is implemented in national laws as a result of which different interpretations and requirements apply on a country by country basis. EU regulators continue to issue guidance concerning the ePrivacy Directive's requirements regarding the use of cookies and similar technologies and may impose specific measures which could impact our use of such technologies. In addition, the ePrivacy Directive and national implementation laws impose additional limitations on the use of data across messaging products and include significant penalties for non-compliance.

In the U.S., disclosure requirements and limitations may apply to the use of certain cookies and other online tracking technologies deemed to be sales of personal information under the CCPA or other state laws. If these initiatives or regulations impair our ability to serve customers or if we are less effective than our competitors in addressing these issues, our ability to improve performance on our platforms, business, market share, and results of operations could be adversely affected. Further, failure or perceived failure to comply with evolving privacy regulations, guidance, and interpretations could result in significant fines, government enforcement actions, private litigation, and harm to our business, results of operations, or reputation.

Our continued access to sources of liquidity depends on multiple factors, including global economic conditions, the condition of global financial markets, the availability of sufficient amounts of financing, our ability to meet debt covenant requirements, our operating performance, and our credit ratings. Increased volatility in financial and securities markets will generally make access to capital less certain. Further, if our credit ratings were to be downgraded or if financing sources were to ascribe higher risk to our rating levels, our industry or us, our access to capital and the cost of any financing would be negatively impacted. We currently have $2 billion available under our revolving credit facility, which contains certain financial covenants that we need to comply with in order to access such liquidity.

There can be no assurance that we will be able to meet the covenant requirements at any particular time. The lenders have the right to require repayment of any amounts borrowed under the facility if we are not in compliance.

There is no guarantee that additional debt financing will be available in the future on commercially reasonable terms or at all, in which case we may need to seek other sources of funding. In addition, the terms of future debt agreements could include more restrictive covenants, which could restrict our business operations.

We conduct a substantial majority of our business outside the U.S. but we report our results in U.S. Dollars. As a result, we face exposure to movements in foreign currency exchange rates as the financial results of our businesses outside of the U.S. are translated from local currency (principally Euros and British Pounds Sterling) into U.S. Dollars. When the U.S. Dollar strengthens against other currencies in which we transact, our foreign-currency-denominated net assets, gross bookings, revenues, operating expenses, and net income are lower as expressed in U.S. Dollars. When the U.S. Dollar weakens against other currencies in which we transact, our foreign-currency-denominated net assets, gross bookings, revenues, operating expenses, and net income are higher as expressed in U.S.

Dollars. Foreign currency exchange rate fluctuations on transactions denominated in currencies other than the functional currency result in gains and losses that are reflected in our financial results.

Significant fluctuations in foreign currency exchange rates can affect consumer travel behavior. Consumers traveling from a country whose currency has weakened against other currencies may book lower ADR accommodations, choose to shorten or cancel their international travel plans, or choose to travel domestically rather than internationally, any of which could adversely affect our gross bookings, revenues, and results of operations.

The market price of our common stock is highly volatile and subject to fluctuations in response to factors such as:

•financial or operating results that vary from expectations, changes in expectations as to our future financial or operating performance, or changes in our capital structure;

•worldwide political and economic conditions, including the effects of inflation, changes in interest rates, market volatility, or fluctuations in foreign currency exchange rates, particularly between the U.S. Dollar and the Euro;

•occurrence of a significant security breach or business interruption;

•impact of our share repurchase and dividend programs;

•changes in market valuations of other technology, e-commerce, or travel companies, or announcements of significant business or operational changes by us or our competitors;

•initiation of significant litigation or regulatory proceedings against us or adverse developments in pending proceedings;

•lack of success in expanding our business; and •additions or departures of key personnel.

Sales of a substantial number of shares of our common stock could adversely affect the market price of our common stock by introducing a large number of sellers or short sellers to the market. In addition, fluctuations in our stock price and our price-to-earnings multiple may have made or may make our stock attractive to momentum, hedge, or day-trading investors ,which could exacerbate price fluctuations.

The market for technology stocks or the stock market in general has experienced extreme price and volume fluctuations, which has caused, and may cause in the future, a decrease in the market price of our common stock due to a number of factors, many of which are out of our control. To the extent that the public's perception of the prospects of technology, e-commerce, or travel companies is negative, our stock price could decline, regardless of our operating results or financial performance.

In the past, we have been a defendant in securities class action litigation. If our stock price declines or is volatile, it could increase the chances that we become the target of securities class action litigation, which could result in substantial costs and divert management's attention and resources, either of which could adversely affect our business, financial condition, and results of operations.

We have a substantial amount of outstanding indebtedness and we may incur substantial additional indebtedness in the future. Our outstanding indebtedness and any additional indebtedness we incur may have significant consequences, which may be amplified if our cash flow and earnings decrease, and could include:

•requiring the dedication of a portion of our cash flow from operations to service our indebtedness, thereby reducing the amount of cash flow available for other purposes;

•increased vulnerability to downturns in our business, competitive pressures, and adverse changes in general economic and industry conditions, and less flexibility when planning for or reacting to changes in our business and industry; and •decreased or lost ability to obtain additional financing on terms acceptable to us.

Our ability to make payments of principal and interest on our indebtedness depends upon our future performance, which is subject to many factors beyond our control. Further, we may not have access to equity or debt markets or other sources of financing, or such financing may not be available to us on commercially reasonable terms, to repay or refinance our debt as it comes due or, in the case of our convertible notes, upon conversion. Our ability to make share repurchases and the payment of dividends rely on our access to capital, which depends on cash flow generated by our business and the availability of financing.

We maintain an investment portfolio, which typically includes marketable debt securities and equity securities of publicly-traded companies, the values of which are subject to market price volatility, and investments in private entities. Credit losses, impairments, and changes in the fair values of our investments could be volatile and they have had, and are likely to continue to have, a significant impact on our quarterly net income (or loss).

Our investments in private entities are inherently risky in that such companies are typically at an early stage of development, may have no or limited revenues, may not be or ever become profitable, may not be able to secure additional funding, or their technologies, services, or products may not be successfully developed or introduced to the market. Further, our ability to liquidate any such investments is typically dependent on a liquidity event as no public market exists for such securities. Valuations of privately-held entities are inherently complex and uncertain due to the lack of a liquid market for such securities. If we determine that any of our equity investments in such companies have experienced a decline in value, we are required to recognize the change in the Consolidated Statements of Operations.

For investments classified as debt securities, any decline in value attributed to credit losses is also recognized in the Consolidated Statements of Operations. We could lose the full amount of any of our investments, and impairment of our investments have previously and could in the future have a material adverse effect on our financial condition and results of operations.