What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-06-29 compared with 2021-06-30 · 89 added, 69 removed, 286 unchanged (36% of the section changed)

3 unchanged sentences

Risks Relating to the COVID-19 Pandemic

The impact of the COVID-19 pandemic, or the impact of any future pandemic, is uncertain and difficult to predict, but the COVID-19 pandemic and the measures taken to contain it has had a material adverse effect on our business and revenues to date and may have a material adverse effect on our business, financial condition, results of operations, stock price, and liquidity in the future.

The impact of public health crises, epidemics, and pandemics, such as the COVID-19 pandemic, including the duration, spread, severity, and any recurrences thereof, and the impact such public health crises have on the overall demand for BNED products and services, our operations, and the operations of our suppliers and other business partners is uncertain and difficult to predict, but the COVID-19 pandemic and the measures taken to contain it has had a material adverse effect on our business and revenues to date and may have a material adverse effect on our business, financial condition, results of operations, stock price, and liquidity in the future.

The COVID-19 pandemic has materially and adversely impacted the U.S.

3 unchanged sentences

Many colleges and K-12 schools were required or opted to cease or limit in-person classes in an attempt to limit the spread of COVID-19 and ensure the safety of their students and faculty.

Although some academic institutions have reopened, most are still utilizing online learning as an alternative to traditional in-person instruction.

An increase in the spread of COVID-19 or variants could force schools to close again.

Although most academic institutions have reopened, some are still utilizing online learning as an alternative to traditional in-person instruction.

An increase in the spread of COVID-19 variants or other public health crises could force schools to close again.

In addition, as a result of individual health concerns or financial difficulties, enrollment could be negatively impacted.

If colleges and schools are required to close or significantly fewer students are on campus, we may experience lower customer engagement with our products and services, which could lead to a materially adverse impact on our business and result of operations.

COVID-19, related governmental reactions and economic conditions may have a negative impact on our business, liquidity, results of operations, and stock price due to the occurrence of some, or all, of the following events or circumstances:

If colleges and schools are required to or choose to close or significantly fewer students and visitors are on campus, we may experience lower customer engagement with our products and services, which could lead to a materially adverse impact on our business and result of operations.

Public health crises, epidemics, and pandemics, such as COVID-19, related governmental reactions and economic conditions may have a negative impact on our business, liquidity, results of operations, and stock price due to the occurrence of some, or all, of the following events or circumstances:

• the closing or limited operations of our campus retail stores;

• reductions in government funding of education could negatively impact the budgets of colleges and K-12 schools public colleges, which could impact the demand for our products and services;

• reductions in government funding of education could negatively impact the budgets of public educational institutions and K-12 schools, which could impact the demand for our products and services;

• our inability to realize our expected return on textbooks in our print textbook library as educators transition to online curriculums and the lack of supply of used textbooks as a result of limited on-campus buyback opportunities;

5 unchanged sentences

• the potential negative impact on the health of our employees, particularly if a significant number of them are impacted, could affect our ability to ensure business continuity during the period of disruption related to the pandemic;

• governmental orders have forced many of our on-site and management office employees to work remotely, which may adversely impact our ability to effectively manage our business and maintain our financial reporting processes and related controls, as well as introduce operational risk, including an increased vulnerability to potential cyber security attacks;

Index to Form 10-K Index to FS

related controls, as well as introduce operational risk, including an increased vulnerability to potential cyber security attacks;

• actions we have taken and may take in the future in response to the COVID-19 pandemic, including significantly reducing our non-essential capital expenditures, reducing our workforce, and other cost reduction efforts, may negatively impact our operations.

Taken individually, or together in any combination, the above could cause a material adverse effect on our business, financial condition, results of operations, and liquidity, although the extent of the potential effect will depend on future actions and outcomes, which are highly uncertain and cannot be predicted with confidence, including the scope, severity and duration of the outbreak, the short-term and long-term economic impact of the outbreak, the actions taken to mitigate the impact of the virus, the availability of vaccinations and the pace of economic and financial market recovery when the COVID-19 pandemic subsides, among others.

Taken individually, or together in any combination, the above could cause a material adverse effect on our business, financial condition, results of operations, and liquidity, although the extent of the potential effect will depend on future actions and outcomes, which are highly uncertain and cannot be predicted with confidence, including the scope, severity and duration of the public health crisis, the short-term and long-term economic impact of the public health crisis, the actions taken to mitigate the impact of the public health crisis, the availability of vaccinations and the pace of economic and financial market recovery when the public health crisis subsides, among others.

In addition, our results of operations significantly impact our determination of whether we will record a valuation allowance against certain deferred tax assets.

If economic conditions caused by the pandemic do not recover as currently estimated by management or market factors currently in place change, there could be a further impact on our results of operations and it is possible we will conclude, in future periods, that a higher valuation allowance, than has currently been recorded, will be appropriate.

If economic conditions caused by the COVID-19 pandemic specifically do not recover as currently estimated by management or current market factors change, there could be a further impact on our results of operations.

It is possible we will conclude, in future periods that a higher valuation allowance, than has currently been recorded, will be appropriate.

Further, many of the Risk Factors described in this report may be more likely to occur and be further intensified as a result of the impact of the COVID-19 pandemic.

9 unchanged sentences

publishers, including Cengage Learning, Pearson Education and McGraw-Hill Education, which bypass the traditional retail distribution channel by selling directly to students and institutions.

We face competition from eTextbooks/digital content providers, VitalSource Technologies, Inc., and Red Shelf.

We face competition from e-Textbook/digital content providers, VitalSource Technologies, Inc., and Red Shelf.

Our wholesale business competes with Amazon, BBA Solutions, Nebraska Book Company, and Texas Book Company.

5 unchanged sentences

Furthermore, the market for course materials is diluted from counterfeiting and piracy of digital and print copies or illegal copies of selected chapters made by students or others;

user and faculty created content;

user-generated and faculty-created content;

and sharing or non-purchase of required course materials by students.

Our Digital Student Solutions business faces competition from other providers of online instruction platforms and other direct-to-student writing skills, study tools and tutor services, such as Chegg.com, CourseHero, Grammarly, Quizlet, Noodle Tools, and Turnitin (iParadigms).

As we develop a wider range of products and services, our competitive landscape will change and include other competitors in the broader student services market.

16 unchanged sentences

In addition, we may face significant competition in retaining existing physical and virtual store contracts and when renewing those contracts as they expire.

Our physical bookstore contracts are typically for five years with renewal options, and most contracts are cancelable by either party without penalty with 90 to 120 days' notice.

Our virtual bookstore contracts are typically for three to five years and most are cancelable without penalty with notice.

Our physical bookstore contracts are typically for five years with renewal options, and most contracts are cancellable by either party without penalty with 90 to 120 days' notice.

Our virtual bookstore contracts are typically for three to five years, and most are cancellable without penalty with notice.

Despite the lower startup and ongoing operating expense associated with virtual stores, the loss of such contracts could impact revenue and profitability.

8 unchanged sentences

Furthermore, certain of our merchandise is sourced indirectly from outside the United States.

Political or financial instability, merchandise quality issues, product safety concerns, trade restrictions, work stoppages, tariffs, foreign currency exchange rates, transportation capacity and costs, inflation, civil unrest, natural disasters, outbreaks of pandemics and other factors relating to foreign trade are beyond our control and could disrupt our supply of foreign-sourced merchandise.

Political or financial instability, merchandise quality issues, product safety concerns, trade restrictions, work stoppages, tariffs, foreign currency exchange rates, transportation capacity and costs, inflation, civil unrest, natural disasters, public health crises, epidemics, and pandemics, and other factors relating to foreign trade are beyond our control and could disrupt our supply of foreign-sourced merchandise.

We face the risk of fluctuating inventory supplies as a consequence of changes in the way publishers distribute course materials.

5 unchanged sentences

With respect to our wholesale business, the demand for used and new textbooks is typically greater than the available supply, and our wholesale business is highly dependent upon its ability to build its textbook inventory from publishers and suppliers in advance of the selling season.

These relationships are not

These publisher and

Index to Form 10-K Index to FS

generally governed by long-term contracts and publishers and suppliers could choose not to sell to us.

supplier relationships are not generally governed by long-term contracts and publishers and suppliers could choose not to sell to us.

Any negative impact on our ability to build our textbook inventory could have an adverse impact on financial results.

10 unchanged sentences

If it is unable to appropriately manage its inventory and anticipate the release of new editions of titles, faculty’s change in choice of titles, return rate, or use of alternative educational material, our wholesale business could be exposed to risks of excess inventory and less marketable or obsolete inventory.

This may lead to excess or obsolete inventory which might have to be sold at a deep discount impacting its revenues and profit margin and may have a negative impact on our financial condition and results of operations.

This may lead to excess or obsolete inventory that might have to be sold at a deep discount, which may impact its revenues and profit margin and may have a negative impact on our financial condition and results of operations.

Our business is dependent on the overall economic environment, college enrollment and consumer spending patterns.

16 unchanged sentences

Our operations are substantially limited to the United States;

however, we have operations in India, offer services and products to students and other customers internationally, contract with service providers outside the United States and may continue to expand internationally.

Such international expansion may result in additional risks that are not present domestically and which could adversely affect our business or our results of operations, including compliance with additional United States regulations and those of other nations applicable to international operations;

Such international expansion may result in additional risks that are not present domestically and could adversely affect our business or our results of operations, including compliance with additional United States laws and regulations and those of other nations applicable to international operations;

cultural and language differences;

3 unchanged sentences

potentially adverse tax consequences and limitations on our ability to utilize losses generated in our foreign operations;

different regulatory requirements and other barriers to conducting business;

different legal and regulatory requirements and other barriers to conducting business;

and different or less stable political and economic environments.

Further, conducting business abroad subjects us to increased regulatory compliance and oversight.

Further, conducting business abroad subjects us to increased legal and regulatory compliance and oversight.

For example, in connection with our international operations, we are subject to laws prohibiting certain payments to governmental officials, such as the Foreign Corrupt Practices Act.

A failure to comply with applicable regulations could result in regulatory enforcement actions, as well as substantial civil and criminal penalties assessed against us and our employees.

A failure to comply with applicable laws and regulations could result in regulatory enforcement actions, as well as substantial civil and criminal penalties assessed against us and our employees.

We are dependent upon access to the capital markets, bank credit facilities, and short-term vendor financing for liquidity needs.

33 unchanged sentences

If our efforts are not successful, our business and financial results would be adversely affected.

Our ability to attract and retain students and increase their engagement with our learning platform depends on our ability to connect them with the product, person or service they need to save time, save money, and get smarter.

For example, in Fiscal 2019, we launched bartleby textbook solutions and expert question and answers, our first internally-developed product within DSS, on bartleby.com .

3 unchanged sentences

In the future, we may invest in new products and services and other initiatives to generate revenues, but there is no guarantee these approaches will be successful.

Acquisitions of new companies, products and services create integration risk, while development of new products and services and enhancements to existing products and services involve significant time, labor and expense and are subject to risks and challenges, including managing the length of the development cycle, entry into new markets, integration into our existing business, regulatory compliance, evolution in sales and marketing methods and maintenance and protection of intellectual property and proprietary rights.

Acquisitions of new companies, products and services create integration risk, while development of new products and services and enhancements to existing products and services involve significant time, labor and expense, and are also subject to risks and challenges, including managing the length of the development cycle, entry into new markets, integration into our existing business, legal and regulatory compliance, evolution in sales and marketing methods, and maintenance and protection of intellectual property and proprietary rights.

If we are not successful with our new products and services, we may not be able to maintain or increase our revenues as anticipated or recover any associated acquisition or development costs, and our financial results could be adversely affected.

Risks relating to Data Privacy, Information Technology and Cybersecurity

We face data security risks with respect to personal information.

We face potential data privacy and information security risks with respect to unencrypted, non-deidentified personal information.

Our business involves the receipt, storage, processing and transmission of personal information about customers and employees.

We may share information about such persons with vendors and third parties that assist with certain aspects of our business.

Also, in connection with our student financial aid platform and the processing of university debit cards, we secure and have access to certain student personal information that has been provided to us by the universities we serve.

Our handling and use of personal information is regulated at the international, federal and state levels and by industry standards, such as the Payment Card Industry Data Security Standard.

In accordance with our published privacy policies, we may share non-deidentified personal information about such persons between our affiliates and with vendors and third parties that assist with certain aspects of our business pursuant to written agreements.

Also, in connection with our student financial aid platform and the processing of college and university debit cards, we have access to certain student personal information that has been provided to us by the colleges and universities we serve.

Our handling and use of personal information is subject to applicable international, federal and state privacy and information security laws and regulations and industry standards, such as the Payment Card Industry Data Security Standard.

As an entity that provides services to institutions of higher education, we are contractually bound to handle certain personal information from student education records in accordance with the requirements of Family Educational Rights and Privacy Act (“FERPA”).

Privacy and information security laws, regulations, and industry standards change from time to time, and compliance with them may result in cost increases due to necessary systems changes and the development of new processes and may be difficult to achieve.

If we fail to comply with these laws, regulations and standards, we could be subjected to legal risk.

In addition, even if we fully comply with all laws, regulations and standards, and even though we have taken significant steps to protect personal information, we could experience a data security breach, and our reputation could be damaged, possibly resulting in a material breach of contract with one or more of our clients, lost future sales or decreased usage of credit and debit card products.

Further, in the event that we disclose student information in violation of FERPA, the U.S.

Privacy and information security laws, regulations, and applicable industry standards are evolving rapidly, and our on-going compliance with them may result in cost increases due to necessary systems changes and the development of new processes, which may be difficult to timely implement.

If we fail to materially comply with these applicable laws, regulations and industry standards, we could be subject to increased legal risk.

In addition, even if we materially comply with all applicable laws, regulations and industry standards, and even though we have taken significant steps to protect non-deidentified personal information, e.g., encrypting such personal information in transit and at rest, we could experience a data security breach, and our reputation could be damaged, possibly resulting in a material breach of contract with one or more of our clients, litigation, and/or lost future sales or decreased usage of credit and debit card products.

Further, in the event that we disclose unencrypted, deidentified student information in violation of our contractual FERPA obligations, the U.S.

Department of Education could require a client to suspend our access to their student information for at least five years.

Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

A party that is able to circumvent our security measures could misappropriate our or our users’ proprietary information and cause interruption in our operations.

Any compromise of our data security could result in a violation of applicable privacy and other laws or standards, significant legal and financial exposure beyond the scope or limits of insurance coverage, increased operating costs associated with remediation, equipment acquisitions or disposal and added personnel, and a loss of confidence in our security measures, which could harm our business or affect investor confidence.

Data security breaches may also result from non-technical means, for example, actions by an employee.

Our business is subject to a variety of domestic and international laws, rules, policies and other obligations regarding data protection.

A party that is able to circumvent our security measures could misappropriate our proprietary information or our customers' and employees' personal information, and cause interruption in our operations.

Any compromise of our data security could result in a violation of applicable laws, regulations or industry standards, significant legal and financial exposure beyond the scope or limits of insurance coverage, increased operating costs associated with remediation, equipment acquisitions or disposal, and added personnel, and a loss of confidence in our security measures, which could harm our business or affect investor

Index to Form 10-K Index to FS

Although most of our operations are in the United States, we do have some operations and offer services and products internationally.

Our international operations subject us to a complex array of federal, state and international laws relating to the collection, use, retention, disclosure, security and transfer of personally identifiable data.

Data security breaches may also result from non-malicious and non-technical means (for example, inadvertent actions by an employee).

Our business is subject to a variety of domestic and international laws, rules, policies and other obligations regarding data protection.

Although most of our operations are in the United States, we do have some operations and offer some services and products internationally.

Our international operations subject us to a complex array of international laws and regulations relating to the collection, use, retention, disclosure, security and transfer of personally identifiable data.

Many jurisdictions have passed laws in this area, and other jurisdictions are considering imposing additional restrictions.

The interpretation and application of data protection laws in the United States, Europe, including but not limited to the GDPR, and elsewhere are uncertain and evolving.

It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our data practices.

Complying with these various laws is difficult and could cause us to incur substantial costs or require us to change our business practices in a manner adverse to our business.

Further, although we are implementing internal controls and procedures designed to protect sensitive information and confidential and personal data and comply with the GDPR and other privacy-related laws, rules and regulations, our facilities, and systems may be vulnerable to security breaches and other data loss, including cyber-attacks.

Such a security breach or data loss could lead to negative publicity, damage to our reputation, exposure to litigation and liability, theft, modification or destruction of proprietary information or key information, damage to or inaccessibility of critical systems, manufacture of defective products, production downtimes, operational disruptions and remediation and other significant costs, which could adversely affect our reputation, financial condition and results of operations.

The interpretation and application of data protection laws in the United States, Europe, and elsewhere are rapidly evolving.

It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our current data practices.

Complying with applicable international laws and regulations could cause us to incur substantial costs or require us to change our business practices in a manner adverse to our business.

Further, although we continue to implement internal controls and procedures designed to protect our proprietary and confidential information, and deidentified customer and employee personal data, including sensitive personal data, in order to comply with privacy and information security laws, and regulations, our facilities, and systems may be vulnerable to security breaches and other data loss, including cyber-attacks.

Such a security breach or data loss could lead to negative publicity, damage to our reputation, exposure to litigation and liability, theft, modification or destruction of proprietary information and personal data, damage to or inaccessibility of critical systems, manufacture of defective products, production downtimes, operational disruptions and remediation and other significant costs, which could adversely affect our reputation, financial condition and results of operations.

Computer malware, viruses, hacking and phishing attacks could harm our business and results of operations.

We are increasingly dependent upon information technology systems, infrastructure and data.

Our computer systems may be vulnerable to service interruption or destruction, malicious intrusion, ransomware and random attack.

Our computer systems may be vulnerable to service interruption or destruction, malicious intrusion, ransomware and cyber-attacks.

Cyber-attacks are increasing in their frequency, sophistication and intensity, and have become increasingly difficult to detect.

1 unchanged sentence

Our key business partners face similar risks, and a security breach of their systems could adversely affect our security posture.

While we continue to invest in data protection and information technology to prevent or minimize these risks and, to date, we have not experienced any material service interruptions and are not aware of any material breaches, there can be no assurance that our efforts will prevent service interruptions, or identify breaches in our systems, that could adversely affect our business and operations and/or result in the loss of critical or sensitive information, which could result in financial, legal, business or reputational harm.

While we continue to invest in data protection and information security technology to prevent or minimize these risks and, to date, we have not experienced any material service interruptions and are not aware of any material breaches, there can be no assurance that our efforts will prevent service interruptions, or identify breaches in our systems, that could adversely affect our business and operations and/or result in the loss of critical or sensitive information, which could result in financial, legal, business or reputational harm.

Defects, errors, installation difficulties or performance issues with our point-of-sales and other systems could expose us to potential liability, harm our reputation and negatively impact our business.

11 unchanged sentences

Any technical problem with, cyber-attack on, or loss of access to such third parties’ systems, servers or technologies could result in the inability of our students to rent or purchase print textbooks, interfere with access to our digital content and other online products and services or result in the theft of end-user personal information.

Index to Form 10-K Index to FS

Our reliance on AWS or other third-party providers makes us vulnerable to any errors, interruptions, or delays in their operations.

Any disruption in the services provided by AWS could harm our reputation or brand or cause us to lose students or revenues or incur substantial recovery costs and distract management from operating our business.

Any disruption in the services provided by AWS could harm our reputation or brand, adversely impact consumers, and/or cause us to lose revenues or incur substantial recovery costs and distract management from operating our business.

Any disruption of or interference with our use of AWS or other third-party service providers would impact our operations and our business would be materially and adversely impacted.

Index to Form 10-K Index to FS

AWS may terminate its agreement with us upon 30 days' notice.

Upon expiration or termination of our agreement with AWS, we may not be able to replace the services provided to us in a timely manner or on terms and conditions, including service levels and cost, that are favorable to us, and a transition from one vendor to another vendor could subject us to operational delays and inefficiencies until the transition is complete.

Risks relating to Laws and Regulations

Laws or regulations may be enacted which restrict or prohibit use of emails or similar marketing activities that we currently rely on.

Risks relating to Applicable Laws and Regulations

Laws and regulations have been and may be enacted in the future that restrict or prohibit use of emails or similar marketing activities that we currently rely on.

Our marketing and sales efforts are centered around an active digital community, which includes engaged email subscribers, text messaging, interest-based online advertising, recurring billing and our continuous dialogue with customers on our school-customized social media channels.

For example, the following laws and regulations may apply:

• the CAN-SPAM Act of 2003 and similar laws adopted by a number of states regulate unsolicited commercial emails, create civil and criminal penalties for emails containing fraudulent headers and control other abusive online marketing practices;

• the CAN-SPAM Act of 2003 and similar laws adopted by most U.S.

states pertaining directly or indirectly to commercial email regulate unsolicited commercial emails, create civil and criminal penalties for emails containing fraudulent headers and control other abusive online marketing practices;

Federal Trade Commission (the “FTC”) has guidelines that impose responsibilities on companies with respect to communications with consumers and impose fines and liability for failure to comply with rules with respect to advertising or marketing or sales practices they may deem misleading or deceptive;

7 unchanged sentences

• The Restore Online Shopper Confidence Act (“ROSCA”), and similar state laws, impose requirements and restrictions on online services that automatically charge payment cards on a periodic basis to renew a subscription service, if the consumer does not cancel the service;

• the General Data Protection Regulation (“GDPR”), became effective in May 2018.

This European Union (“EU”) law governing data practices and privacy which applies to certain of our activities related to products and services offered in the EU, imposes a range of new compliance obligations regarding the handling of personal data;

• the California Consumer Privacy Act of 2018 (“CCPA”), which came into effect on January 1, 2020, requires companies that process information on California residents to make new disclosures to consumers about their data collection, use and sharing practices, allows consumers to request the deletion of certain data, and allows consumers to opt out of certain data sharing with third parties and provides a new cause of action for data breaches.

The burdens imposed by the CCPA and other similar laws that may be enacted at the federal and state level may require us to modify our data processing practices and policies and how we advertise to our users and to incur substantial expenditure in order to comply.

Even if no relevant law or regulation is enacted, we may discontinue use or support of these activities if we become concerned that students or potential students deem them intrusive or they otherwise adversely affect our goodwill and brand.

If our marketing activities are curtailed, our ability to attract new students may be adversely affected.

Our business could be impacted by changes in federal, state, local or international laws, rules or regulations.

We are subject to general business regulations and laws relating to all aspects of our business.

These regulations and laws may cover taxation, privacy, data protection (including complying with GDPR), our access to student financial aid, pricing and availability of educational materials, competition and/or antitrust, content, copyrights, distribution, college distribution, mobile communications, electronic contracts and other communications, consumer protection, the provision of online payment services, unencumbered Internet access to our services, the design and operation of websites and mobile application (including complying with the Americans with Disabilities Act), digital content (including governmental investigations and litigation relating to the agency pricing model for digital content distribution), the characteristics and quality of products and services and labor and employee benefits (including the costs associated with complying with the Patient Protection and Affordable Care Act or any legislation enacted in connection with repeal of the Affordable Care Act).

Changes in federal, state, local or international laws, rules or regulations relating to these matters could increase regulatory compliance requirements in addition to increasing our costs of doing business or otherwise impact our business.

For example, changes in federal and state minimum wage laws

• The General Data Protection Regulation (“GDPR”) became effective on May 18, 2018.

This European Union (“EU”) law governing data practices and privacy applies to all of our activities conducted from an establishment in the EU or related to certain of our products and services offered in the EU, and imposes a range of new compliance obligations regarding the handling of personal data;

• The California Consumer Privacy Act (“CCPA”) became effective on January 1, 2020, with enforcement commencing on July 1, 2020.

CCPA provides consumers the right to know what personal data companies collect, how it is used, and the right to access, delete and opt out of sale of their personal information to third parties.

It also expands the definition of personal information and gives consumers increased privacy rights and protections for that information.

The CCPA also includes additional requirements for California consumers under the age of 16;

• The California Privacy Rights Act (“CPRA”) took effect on December 16, 2020, but most provisions of CPRA will not become operative until January 1, 2023.

CPRA amends and adds to CCPA by strengthening rights of California consumers, further restricting business use of consumer personal information, and establishing a new government agency for enforcement;

• The Virginia Consumer Data Protection Act (“VCDPA”), similar in scope to CCPA, will also go into effect on January 1, 2023.

VCDPA is the second U.S.

state-level consumer privacy law after CCPA, but unlike California, will not apply to employees and business contacts, nor provide for a private right of action.

VCDPA also defines the “sale” of personal information narrowly, including only exchanges for monetary consideration;

Index to Form 10-K Index to FS

could raise the wage requirements for certain of our employees at our retail locations, which would increase our selling costs and may cause us to reexamine our wage structure for such employees.

• Colorado is the third state to enact a comprehensive data privacy statute, the Colorado Privacy Act (“CPA”).

CPA takes effect on July 1, 2023.

Although similar in scope to VCDPA, CPA defines “sale” of personal information in the same manner as CCPA, which includes any exchange for monetary or any other valuable consideration;

• The fourth U.S.

state privacy law to be enacted, the Utah Consumer Privacy Act (“UCPA”), is somewhat narrower in scope than other state privacy laws, and adopts the VCDPA’s definition of “sale” of personal information.

UCPA goes into effect on December 31, 2023;

• On April 29, 2022, the Connecticut General Assembly advanced a bill that is likely to become the fifth state privacy law in the U.S.

The Connecticut bill, which resembles UCPA, CPA and VCDPA, would take effect on July 1, 2023.

In the absence of federal consumer privacy legislation, at least ten other U.S.

states have active privacy legislation bills pending.

Even if no applicable laws or regulations are further enacted, we may discontinue use or support of these activities if we become concerned that students or potential students deem them intrusive or they otherwise adversely affect our goodwill and brand.

If our marketing activities are curtailed, our ability to attract new customers may be adversely affected.

Our business could be impacted by changes in federal, state, local or international laws, rules or regulations.

We are subject to laws and regulations applicable to our business.

These laws and regulations may cover taxation, data privacy, information security, our access to student financial aid, pricing and availability of educational materials, competition and/or antitrust, content, copyrights, distribution, college distribution, mobile communications, electronic contracts and other communications, consumer protection, the provision of online payment services, unencumbered Internet access to our services, the design and operation of websites and mobile application (including complying with the Americans with Disabilities Act), digital content (including governmental investigations and litigation relating to the agency pricing model for digital content distribution), the characteristics and quality of products and services and labor and employee benefits (including the costs associated with complying with the Patient Protection and Affordable Care Act or any legislation enacted in connection with repeal of the Affordable Care Act).

Changes in applicable federal, state, local or international laws, rules or regulations relating to these matters could increase regulatory compliance requirements in addition to increasing our costs of doing business or otherwise impact our business.

For example, changes in federal and state minimum wage laws could raise the wage requirements for certain of our employees at our retail locations, which would increase our selling costs and may cause us to reexamine our wage structure for such employees.

Changes in tax laws and regulations might adversely impact our businesses or financial performance.

14 unchanged sentences

We have invested significant amounts of resources in the hardware and software to develop this system.

We rely on the expertise of our engineering and software development teams to maintain and enhance the equipment and software used for our distribution operations.

We rely on the expertise of our engineering and software development teams to maintain and enhance the equipment and software used for our distribution

Index to Form 10-K Index to FS

We cannot be sure that the maintenance and enhancements we make to our distribution operations will achieve the intended results or otherwise be of value to students.

12 unchanged sentences

The protection of our intellectual property may require the expenditure of significant financial and managerial resources.

Moreover, the steps we

Index to Form 10-K Index to FS

take to protect our intellectual property may not adequately protect our rights or prevent third parties from infringing or misappropriating our proprietary rights.

Moreover, the steps we take to protect our intellectual property may not adequately protect our rights or prevent third parties from infringing or misappropriating our proprietary rights.

We also cannot be certain that others will not independently develop or otherwise acquire equivalent or superior technology or other intellectual property rights.

17 unchanged sentences

We have in the past and may continue to receive communications from publishers alleging that certain textbooks sold or rented by us are counterfeit.

Index to Form 10-K Index to FS

When receiving such communications, we cooperate, and will continue to cooperate in the future, with such publishers in identifying fraudulent textbooks and removing them from our inventory.

16 unchanged sentences

• announcements by us or our competitors of significant acquisitions or dispositions;

Index to Form 10-K Index to FS

• changes in accounting standards, policies, guidance, interpretations or principles;

13 unchanged sentences

• authorize the issuance of “blank check” preferred stock that could be issued by our Board of Directors to increase the number of outstanding shares of capital stock, making a takeover more difficult and expensive;

• provide that special meetings of the stockholders may be called only by or at the direction of a majority of our Board or the chairman of our Board of Directors;

• provide special meetings of the stockholders may be called only by or at the direction of a majority of our Board or the chairman of our Board of Directors;

• require advance notice to be given by stockholders for any stockholder proposals or director nominations.

1 unchanged sentence

These provisions may discourage, delay or prevent certain types of transactions involving an actual or a threatened acquisition or change in control of the Company, including unsolicited takeover attempts, even though the transaction may offer our stockholders the opportunity to sell their Common Stock at a price above the prevailing market price.

Index to Form 10-K Index to FS

Our Amended and Restated By-laws designate courts in the State of Delaware as the sole and exclusive forum for certain types of actions and proceedings that may be initiated by our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers or employees.

5 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors