What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-08-01 compared with 2024-05-08 · 97 added, 86 removed, 907 unchanged (17% of the section changed)

28 unchanged sentences

Risks Related to Cybersecurity, Data Privacy and Intellectual Property

• any breaches of our networks or systems, or those of Amazon Web Services (“AWS”) or our service providers;

• any breaches of or incidents impacting our networks or systems, or those of our third-party service providers;

• our actual or perceived failure to comply with increasingly stringent laws, regulations and obligations relating to privacy, data protection and data security;

92 unchanged sentences

and the loss of institutional knowledge and expertise of departing employees.

If we experience any of these adverse consequences, our reductions in force and other restructuring efforts may not achieve or sustain their intended benefits, or the benefits, even if achieved, may not be adequate to meet our long-term profitability and operational expectations, which could adversely affect our business, results of operations and financial condition.

If we experience any of these adverse consequences, our reductions in force and other restructuring efforts may not achieve or sustain their intended benefits, or the benefits, even if achieved, may not be adequate to meet our profitability and operational expectations, which could adversely affect our business, results of operations and financial condition.

In addition, our reductions in force and other restructuring efforts could lead us to fail to meet, or cause delays in meeting, our operational and growth targets.

4 unchanged sentences

Our self-service capabilities may not be as successful as we anticipate, and similarly, our efforts to accelerate Segment sales may not be effective or may take longer than we expect to drive growth.

If we experience any of these adverse consequences, our reductions in force and other restructuring efforts may not achieve or sustain their intended benefits, or the benefits, even if achieved, may not be adequate to meet our profitability and operational expectations, which could adversely affect our business, results of operations and financial condition.

As we continue to identify areas of cost savings and operating efficiencies, we may consider implementing further measures to reduce operating costs and improve operating margins.

16 unchanged sentences

and the failure to maintain our corporate culture, employee morale and productivity, and to retain highly skilled employees due to reductions in our workforce and changes in leadership structure.

Because of these and other factors, we cannot predict whether we will realize the purpose and anticipated benefits of our business reorganizations and segment reporting changes, and any similar changes in the future, and if we do not, our business, results of operations and financial condition could be adversely affected.

Because of these and other factors,

we cannot predict whether we will realize the purpose and anticipated benefits of our business reorganizations and segment reporting changes, and any similar changes in the future, and if we do not, our business, results of operations and financial condition could be adversely affected.

In the first quarter of 2024, we conducted an operational review of Segment and developed a plan that we believe will deliver a more effective Segment business.

23 unchanged sentences

Our Dollar-Based Net Expansion Rate has recently stabilized as compared to prior periods, but it may decline in the future if customers are not satisfied with our products and related customer service experience, the value proposition of our products or our ability to meet their needs and expectations, or due to macroeconomic conditions or reductions in customers’ budgets.

If a significant number of customers cease using, or reduce their usage of our products, including due to cost-saving measures in the face of macroeconomic uncertainty or changes in the competitive landscape, then we may be required to spend significantly more on sales and marketing than we currently expect in order to maintain or increase revenue from customers.

more on sales and marketing than we currently expect in order to maintain or increase revenue from customers.

Such additional sales and marketing expenditures could adversely affect our business, results of operations and financial condition.

16 unchanged sentences

Because we do not have a long history of targeting our sales efforts at enterprises, we cannot predict whether, or to what extent, our sales will increase as we organize and train our sales force or how long it will take for sales employees to become productive.

As we seek to increase the adoption of our products by enterprises, including Segment and Engage, which are primarily aimed at complex customer data platform implementations at larger companies, we expect to incur higher costs and longer sales cycles.

As we seek to increase the adoption of our products by enterprises, including our Segment product, which is primarily aimed at complex customer data platform implementations at larger companies, we expect to incur higher costs and longer sales cycles.

In the enterprise market segment, the decision to adopt our products may require the approval of multiple technical and business decision makers, including legal, security, compliance, procurement, operations and information technology (“IT”).

22 unchanged sentences

Our platform must integrate with and leverage a variety of infrastructure, network, hardware, mobile and software platforms and technologies, and we need to continuously modify and enhance our products and platform to adapt to changes and innovation in these technologies.

example, Apple, Google, Yahoo and other cell-phone operating system providers or inbox service providers have developed, and may in the future develop, new applications or functions intended to filter spam and unwanted phone calls, messages or emails.

For example, Apple, Google, Yahoo and other cell-phone operating system providers or inbox service providers have developed, and may in the future develop, new applications or functions intended to filter spam and unwanted phone calls, messages or emails.

Third-party platforms may also implement changes to their privacy policies or practices that may adversely impact us or our customers.

5 unchanged sentences

If we are unable to respond to these changes in a cost-effective manner, our products may become less marketable and less competitive or obsolete, and our business, results of operations and financial condition could be adversely affected.

If we are unable to successfully and cost-effectively increase adoption and usage of our existing products, develop and drive adoption of new products, maintain integrations with third-party products, or anticipate and keep pace with changes in technology, customers’ needs, customers’ expectations, and industry standards, our business, results of operations and financial condition would be adversely affected.

If we are unable to successfully and cost-effectively increase adoption and usage of our existing products, develop and drive adoption of new products, maintain integrations with third-party products, or anticipate and keep pace with changes in technology, customers’ needs and expectations, and industry standards, our business, results of operations and financial condition would be adversely affected.

The markets for our products continue to evolve and may decline or experience limited growth.

24 unchanged sentences

Some of our competitors and potential competitors are larger and have greater name recognition, longer operating histories, more established customer relationships, larger budgets, lower operating costs, and significantly greater resources than we do.

As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards, customer requirements or changing economic conditions.

As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing

opportunities, technologies, standards, customer requirements or changing economic conditions.

Our competitors may also offer products or services that address one or a limited number of functions at lower prices, with greater depth than our products or in different geographies.

10 unchanged sentences

We have a history of losses and may not achieve or sustain profitability in the future.

We have incurred net losses in each year since our inception, including net losses of $55.3 million, $1.0 billion and $1.3 billion in the three months ended March 31, 2024 and the years ended December 31, 2023 and 2022, respectively.

We had an accumulated deficit of $5.5 billion as of March 31, 2024.

We have incurred net losses in each year since our inception, including net losses of $87.2 million, $1.0 billion and $1.3 billion in the six months ended June 30, 2024 and the years ended December 31, 2023 and 2022, respectively.

We had an accumulated deficit of $6.4 billion as of June 30, 2024.

We will need to generate and sustain increased revenue levels, and manage our operating expenses, in future periods to become profitable and achieve our stated profitability goals and, even if we do, we may not be able to maintain or increase our level of profitability.

16 unchanged sentences

In January 2024, our co-founder, Jeff Lawson, resigned as Chief Executive Officer and as a member of our board of directors, and Khozema Shipchandler, our former President, Twilio Communications, was appointed as Chief Executive Officer and as a member of our board of directors.

We will incur various expenses in connection with the transition and we may face challenges in connection with the transition, such as potential changes to our strategy, corporate culture, and other changes in our management structure or roles.

We have incurred

various expenses in connection with the transition and we may face challenges in connection with the transition, such as potential changes to our strategy, corporate culture, and other changes in our management structure or roles.

Any of our executive officers may terminate employment with us at any time with no advance notice.

4 unchanged sentences

Volatility in, or the actual or perceived lack of performance of, our stock price may affect our ability to attract, motivate and retain key employees.

In September 2022, February 2023 and December 2023, we implemented reductions in force, which may have an impact on our ability to hire, retain and motivate employees.

We have also implemented reductions in force, which may have an impact on our ability to hire, retain and motivate employees.

If we are unable to retain and motivate our existing employees and attract qualified employees to fill key positions, we may be unable to manage our business effectively, including the development, marketing and sale of our products, which could adversely affect our business, results of operations and financial condition.

7 unchanged sentences

To the extent that these activities increase revenue, this revenue still may not be enough to offset the increased expenses we incur.

To deliver our products, we rely on network service providers and internet service providers for our network service and connectivity, and disruption or deterioration in the quality of these services or changes in network service provider fees that we pay in connection with the delivery of communications on our platform could adversely affect our business, results of operations and financial condition.

To deliver our products, we rely on network service providers and internet service providers for our network service and connectivity, and disruption or deterioration in the quality of these services or changes in provider fees that we pay in connection with the delivery of communications on our platform could adversely affect our business, results of operations and financial condition.

We currently interconnect with fixed and mobile network service providers around the world to enable the use by our customers of our products over their networks.

8 unchanged sentences

Passing these fees through to our customers typically has the effect of increasing our Communications revenue and cost of revenue, but typically does not impact the gross profit dollars received for sending these messages and, as a result, has a negative impact on our gross margins.

Additionally, our ability to respond to any new fees may be constrained if all network service providers in a particular market impose equivalent fee structures, if the magnitude of the fees is disproportionately large when compared to the underlying prices paid by our customers, or if the market conditions limit our ability to increase the price we charge our customers.

Additionally, our ability to respond to any new fees may be constrained if all network service providers in a particular market impose equivalent fee structures, if the magnitude of the fees is

disproportionately large when compared to the underlying prices paid by our customers, or if the market conditions limit our ability to increase the price we charge our customers.

Furthermore, many of these network service providers do not have long-term committed contracts with us and may interrupt services or terminate their agreements with us without notice.

If a significant portion of our network service providers stop providing us with access to their infrastructure, fail to provide these services to us on a cost-effective basis, cease operations, or otherwise terminate these services, the delay caused by qualifying and switching to other network service providers could be time consuming and costly and could adversely affect our business, results of operations and financial condition.

Further, if problems occur with our network service providers, it may cause errors, service outages, or poor-quality communications on our products, and we could encounter difficulty identifying the source of the problem.

The occurrence of errors, service outages, or poor-quality communications on our products, whether caused by our platform or a network service provider, may result in the loss of our existing customers or the delay of adoption of our products by potential customers and may adversely affect our business, results of operations and financial condition.

Further, if problems occur with our network service providers, such problems have in the past caused, and may in the future cause, errors, service outages, security incidents, or poor-quality communications on our products, and we could encounter difficulty identifying the source of the problem.

The occurrence of errors, service outages, security incidents, or poor-quality communications on our products, whether caused by our platform or a network service provider, may result in the loss of our existing customers or the delay of adoption of our products by potential customers and may adversely affect our business, results of operations and financial condition.

Further, we sometimes access network services through intermediaries who have direct access to network service providers.

17 unchanged sentences

Our international operations expose us to risks inherent in global operations.

In each of the three months ended March 31, 2024 and the years ended December 31, 2023 and 2022, we derived 34% of our revenue from customer accounts located outside the United States.

In the six months ended June 30, 2024 and the years ended December 31, 2023 and 2022, we derived 35%, 34% and 34% of our revenue from customer accounts located outside the United States, respectively.

The future success of our business will depend, in part, on our ability to strategically maintain and expand our customer base worldwide.

29 unchanged sentences

We currently generate significant revenue from our largest customers, and the loss or decline in revenue from any of these customers could harm our business, results of operations and financial condition.

In the three months ended March 31, 2024 and the years ended December 31, 2023 and 2022, our 10 largest Active Customer Accounts generated an aggregate of 10%, 10% and 12% of our revenue, respectively.

In the six months ended June 30, 2024 and the years ended December 31, 2023 and 2022, our 10 largest Active Customer Accounts generated an aggregate of 10%, 10% and 12% of our revenue, respectively.

If any of these customers, or other large customers, do not continue to use our products, use fewer of our products, or use our products in a more limited capacity, or not at all, our business, results of operations and financial condition could be adversely affected.

21 unchanged sentences

For example, in the second quarter of 2023, we sold our Internet of Things assets and liabilities, and in the third quarter of 2023, we sold our ValueFirst business.

The sale of a business or product may require us to restructure operations and/or terminate employees, and could expose us to unanticipated ongoing obligations and liabilities, including as a result of our indemnification obligations.

Additionally, such transactions could disrupt our customer, supplier and/or employee relationships and divert management and our employees’ time and attention.

The sale of a business or product has in the past and may in the future require us to restructure operations and/or terminate employees, and could expose us to unanticipated ongoing obligations and liabilities, including as a result of our indemnification obligations.

During the pendency of a divestiture, we may be subject to risks related to a decline in the business, loss of employees, customers, or suppliers, and that the transaction may not close, which could have an adverse effect on the business to be divested and on us.

Additionally, we are winding down the software component of our Zipwhip business in 2024, which we expect will negatively impact revenue growth rates in 2024.

Divestitures or winding down businesses or products could disrupt our customer, supplier and/or employee relationships and divert the time and attention of our management and employees.

Additionally, we may experience harm to our financial results, including loss of revenue, and we may not realize the expected benefits and cost savings of these actions and our operating results may be adversely impacted.

Risks Related to Cybersecurity, Data Privacy and Intellectual Property

Breaches of or incidents impacting our networks or systems, or those of AWS or our service providers, could degrade our ability to conduct our business, compromise the integrity of our products, platform and data, result in significant loss or unavailability of data and the theft of our intellectual property, damage our reputation, expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data.

Breaches of or incidents impacting our networks or systems, or those of our third-party service providers, could degrade our ability to conduct our business, compromise the integrity of our products, platform and data, result in significant loss or unavailability of data and the theft of our intellectual property, damage our reputation, expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data.

We depend upon our IT systems to conduct virtually all of our business operations, ranging from our internal operations and research and development activities to our marketing and sales efforts and communications with our customers and business partners.

We have in the past and may in the future be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss or unavailability of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, natural disasters, and other similar threats.

Individuals or entities may attempt to penetrate the security of our platform, or of our network or systems, and to cause harm to our business operations, including by misappropriating our proprietary information or that of our customers, employees and business partners or to cause interruptions of our products and platform.

In particular, cyberattacks and other malicious internet-based activity continue to increase in frequency and in magnitude generally, and cloud-based companies have been

targeted in the past.

In addition to threats from traditional computer hackers, malicious code, software vulnerabilities, supply chain attacks and vulnerabilities through our third-party partners, employees theft or misuse, password spraying, phishing, smishing, vishing, credential stuffing and denial-of-service attacks, we also face threats from sophisticated organized crime, nation-state, and nation-state supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risk to our systems (including those hosted on AWS or other cloud services), internal networks, our customers’ systems and the information that they store and process.

We have in the past and will in the future be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel or service provider misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss or unavailability of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, natural disasters, and other similar threats.

Individuals or entities have in the past attempted and will in the future attempt to penetrate the security of our platform, or of our network or systems, and to cause harm to our business operations, including by misappropriating our proprietary information or that of our customers, employees and business partners or to cause interruptions of our products and platform.

In particular, cyberattacks and other malicious internet-based activity continue to increase in frequency and in magnitude generally, and cloud-based companies have been targeted in the past.

In addition to threats from traditional computer hackers, malicious code, software vulnerabilities, supply chain attacks and vulnerabilities through our third-party partners, employees theft or misuse, password spraying, phishing, smishing, vishing, credential stuffing and denial-of-service attacks, we also face threats from sophisticated organized crime, nation-state, and nation-state supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risk to our systems (including those hosted on cloud services), internal networks, our customers’ systems, our service providers’ networks, and the information that they store and process.

Ransomware and cyber extortion attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

Extortion payments may alleviate or reduce the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Because the techniques used to access, disrupt or sabotage devices, systems and networks change frequently and may not be recognized until launched against a target, we may be required to make further investments over time to protect data and infrastructure as cybersecurity threats develop, evolve and grow more complex over time.

Because the techniques used to access, disrupt or sabotage devices, systems and networks change frequently and may not be recognized until launched against a target, we expect to be required to make further investments over time to protect data and infrastructure as cybersecurity threats develop, evolve and grow more complex over time.

We may also be unable to anticipate these techniques, and we may not become aware in a timely manner of any security breach or incident, which could exacerbate any damage we experience.

Additionally, we depend upon our employees and contractors to appropriately handle confidential and sensitive data, including customer data, and to deploy our IT resources in a safe and secure manner that does not expose our network systems to security breaches or incidents or the loss, alteration, unavailability, or other unauthorized processing of data.

We depend upon our employees and contractors to appropriately handle confidential and sensitive data, including customer data, and to deploy our IT resources in a safe and secure manner that does not expose our network systems to security breaches or incidents or the loss, alteration, unavailability, or other unauthorized processing of data.

We have been and expect to be subject to cybersecurity threats and incidents, including denial-of-service attacks, employee errors or individual attempts to gain unauthorized access to information systems.

1 unchanged sentence

Further, AI technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents.

Any data security incidents, including internal malfeasance or inadvertent disclosures by our employees or a third party’s fraudulent inducement of our employees to disclose information, unauthorized access or usage, the introduction of viruses or other malicious code or any other breach or incident or disruption of our platform, systems, or networks or those of our service providers, such as AWS, could result in loss, corruption, unavailability, or other unauthorized processing of confidential information, and any such event, or the perception that it has occurred, may result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigations, fines, penalties and other liabilities.

Any data security incidents, including internal malfeasance or inadvertent disclosures by our employees or a third-party’s fraudulent inducement of our employees to disclose information, unauthorized access or usage, the introduction of viruses or other malicious code or any other breach or incident or disruption of our platform, systems, or networks or those of our service providers, could result in loss, corruption, unavailability, or other unauthorized processing of confidential information, and any such event, or the

perception that it has occurred, may result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigations, fines, penalties and other liabilities.

For example, in June and August 2022, we became aware that threat actors had conducted sophisticated social engineering campaigns against some of our employees after having obtained employee names and cell phone numbers from unknown sources.

4 unchanged sentences

Industry reports indicate that the threat actors also attacked other technology, telecommunication and cryptocurrency companies.

We also rely on various third-party service providers to operate our platform and deliver our products, including network service providers, internet service providers, telecommunications carriers, providers of cloud infrastructure and cloud communications, and third-party technology and intellectual property.

Our service providers (or their sub-service providers) have in the past experienced, and may in the future experience, security breaches and incidents, including unauthorized access or inadvertent disclosures, that have exposed and may expose or make available to threat actors our data or that of our customers.

Even when our systems are not compromised, if our service providers experience breaches or incidents that impact our data or our customers’ data, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected.

Furthermore, we are required to comply with laws and regulations that require us to maintain the security of personal information and we may have contractual and other legal obligations to notify customers, regulators, government agencies, impacted individuals or other relevant stakeholders of security breaches.

1 unchanged sentence

If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences.

These consequences may include:

Consequences associated with such security incidents may include:

government enforcement actions and other actions or proceedings (for example, investigations, audits, and inspections), and related fines, penalties, required remedial actions, or other obligations and liabilities;

7 unchanged sentences

Actual and perceived security incidents and attendant consequences could also lead to negative publicity and reputational harm, may cause our customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or mitigate the security incident.

Accordingly, if our cybersecurity measures or those of AWS or our service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyberattacks), or if our employees or contractors compromise or mishandle data, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected.

available, and in sufficient amounts, to cover the potentially significant losses that may result from a security incident or breach or that the insurer will not deny coverage as to any future claim.

Accordingly, if our cybersecurity measures or those of our service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyberattacks), or if our employees or contractors compromise or mishandle data, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected.

While we maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, we cannot be certain that our existing insurance coverage will continue to be available on acceptable terms or will be available, and in sufficient amounts, to cover the potentially significant losses that may result from a security incident or breach or that the insurer will not deny coverage as to any future claim.

Our actual or perceived failure to comply with increasingly stringent laws, regulations and contractual obligations relating to privacy, data protection and data security could harm our reputation and subject us to significant fines and liability or loss of business.

3 unchanged sentences

The CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies.

These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents (both consumers and employees) certain rights related to their personal information.

These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording

California residents (both consumers and employees) certain rights related to their personal information.

The CCPA allows for statutory fines for noncompliance.

Similar laws have been enacted or been proposed at the state and federal levels.

For example, Connecticut, Utah, Virginia and Colorado have each passed laws similar to but different from the CCPA that took effect in 2023;

Florida, Montana, Oregon and Texas have enacted similar legislation that becomes effective in 2024;

Tennessee, Delaware, New Jersey and Iowa have passed such a law that will take effect in 2025;

and Indiana has enacted similar legislation that will become effective in 2026.

Similar laws have been enacted in 18 other states with 6 laws currently in effect and the remainder becoming effective later in 2024, 2025 and 2026, respectively.

Numerous other states, and the U.S.

federal government, also have proposed general privacy legislation recently.

Additionally, other states have proposed, and in certain cases enacted, other laws and regulations addressing privacy and data security, such as Washington’s My Health, My Data Act, which includes a private right of action.

If we become subject to new privacy, data protection and data security laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase, including individuals, via a private right of action, and state actors.

9 unchanged sentences

Additionally, we expect an increase in the regulation of the use of AI and ML in products and services.

For example, in Europe, the proposed Artificial Intelligence Act (“AI Act”), once adopted, could impose onerous obligations related to the development, placing on the market and use of AI-related systems.

For example, in Europe, the Artificial Intelligence Act (“AI Act”), once adopted, will impose onerous obligations related to the development, placing on the market and use of AI-related systems.

We may have to change our business practices to comply with obligations under these or other new and evolving regimes.

1 unchanged sentence

For example, the EU’s Digital Services Act, Digital Markets Act and Data Act recently entered into force.

Also, the UK Parliament is currently debating the Data Protection and Digital Information (No.

Also, the UK Parliament’s on-going debate of the Data Protection and Digital Information (No.

2) Bill which, if enacted, will introduce certain changes to the UK’s data protection laws.

Similarly, with our registration as an interconnected VoIP provider for certain products with the Federal Communications Commission (“FCC”), we also must comply with privacy laws associated with customer proprietary network information rules in the United States.

If we fail or are perceived to have failed to maintain compliance with these requirements,

we could be subject to regulatory audits, civil and criminal penalties, fines and breach of contract claims, as well as reputational damage, which could impact the willingness of customers to do business with us.

If we fail or are perceived to have failed to maintain compliance with these requirements, we could be subject to regulatory audits, civil and criminal penalties, fines and breach of contract claims, as well as reputational damage, which could impact the willingness of customers to do business with us.

In addition to our legal obligations, our contractual obligations relating to privacy, data protection and data security have become increasingly stringent due to changes in laws and regulations and the expansion of our offerings.

2 unchanged sentences

Our actual or perceived failure to comply with laws, regulations, contractual commitments, or other actual or asserted obligations, including certain industry standards, regarding privacy, data protection and data security could lead to costly legal action, adverse publicity, significant liability, inability to process data, and decreased demand for our services, which could adversely affect our business, results of operations and financial condition.

As a cumulative example of these risks, because our primary data processing facilities are in the United States, we have experienced hesitancy, reluctance, or refusal by European or multinational customers to continue to use our services due to the potential risks posed as a result of the Court of Justice’s July 2020 ruling in the “Schrems II” case, as well as related guidance from regulators and the recent enforcement action against Meta by the Irish Data Protection Commission.

from regulators and enforcement action against Meta by the Irish Data Protection Commission.

For example, absent appropriate safeguards or other circumstances, the GDPR and laws in Switzerland and the UK generally restrict the transfer of personal information to countries outside of the EEA, Switzerland and the UK such as the United States.

22 unchanged sentences

While we have been issued patents in the United States and other countries and have additional patent applications pending, we may be unable to obtain patent protection for the technology covered in our patent applications.

In addition, any patents issued to us in the future may not provide us with

competitive advantages or may be successfully challenged by third parties.

In addition, any patents issued to us in the future may not provide us with competitive advantages or may be successfully challenged by third parties.

Further, the laws of some countries do not protect intellectual property or proprietary rights to the same extent as the laws of the United States, and mechanisms for enforcement of such rights in some foreign countries may be inadequate.

7 unchanged sentences

Our efforts to enforce our intellectual property or proprietary rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of such rights.

Our failure to meaningfully protect our intellectual property and proprietary rights, could have an adverse effect on our business, results of operations and financial condition.

Our failure to meaningfully

protect our intellectual property and proprietary rights, could have an adverse effect on our business, results of operations and financial condition.

We have been sued and may, in the future, be sued by third parties for alleged infringement of their intellectual or other proprietary rights, which could adversely affect our business, results of operations and financial condition.

13 unchanged sentences

Although we have implemented policies to regulate the use and incorporation of open source software into our products and platform, we cannot be certain that we have not incorporated open source software in our products or platform in a manner that is inconsistent with such policies.

derivative works we create based upon, incorporating or using the open source software and that we license such modifications or derivative works under the terms of applicable open source licenses.

If we fail to comply with open source licenses, we may be subject to certain requirements, including requirements that we offer our products that incorporate the open source software for no cost, that we make available the source code for any modifications or derivative works we create based upon, incorporating or using the open source software and that we license such modifications or derivative works under the terms of applicable open source licenses.

If an author or other third-party that distributes such open source software were to allege that we had not, or have not, complied with the terms and conditions of the license for such open source software, we could be required to incur significant legal expenses defending against such allegations and could be subject to significant damages, enjoined from generating revenue from customers using products that contained the open source software and required to comply with onerous conditions or restrictions on these products.

4 unchanged sentences

Licensed technology and intellectual property may not continue to be available on commercially reasonable terms, or at all.

The loss of the right to license and distribute third-party technology could limit the functionality of our products or platform and could require us to redesign our products or platform.

In addition, if the third-party technology and intellectual property we use has errors, security vulnerabilities, or otherwise malfunctions, the functionality of our products and platform may be negatively impacted, our customers may experience reduced service levels, and our business may be adversely affected.

For example, we outsource a substantial majority of our cloud infrastructure to AWS, which hosts our products and platform.

The loss of the right to license and distribute third-party technology could limit the functionality of our products or platform and could require us to

redesign our products or platform.

In addition, if the third-party technology and intellectual property we use has errors, service outages, security vulnerabilities, or otherwise malfunctions, the functionality of our products and platform may be negatively impacted, our customers may experience outages or reduced service levels, and our business may be adversely affected.

For example, we outsource a substantial majority of our cloud infrastructure to Amazon Web Services (“AWS”), which hosts our products and platform.

Our customers need to be able to reliably access our platform, without material interruption or degradation of performance.

23 unchanged sentences

Additionally, our offerings based on AI may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm.

For example, our business, financial condition and results of operations may be adversely affected if content or recommendations that AI solutions or features assist in producing are or are alleged to be deficient, inaccurate, or biased, or if such content, recommendations, solutions, or features or their development or deployment (including the collection, use, or other processing of data used to train or create such AI solutions or features) are found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal obligations to which we are or may become subject.

or contractual obligations to which we are or may become subject.

The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations.

24 unchanged sentences

While we do not currently expect the FCC to require more than the robocall and robotexting measures that we have started to implement, if the FCC were to implement new regulations or requirements that limited the types of customers allowed to use our platform or overly burdensome requirements for our customers, those actions could limit the customers that we are able to serve.

Similarly, in May 2021, the Biden Administration issued an Executive Order requiring federal agencies to implement additional information technology security measures, including, among other things, requiring agencies to adopt multifactor authentication and encryption for data at rest and in transit to the maximum extent consistent with Federal records laws and other applicable laws.

other applicable laws.

The National Institute of Standards and Technology issued a Secure Software Development Framework (SSDF) on September 30, 2021 and Software Supply Chain Security Guidance (incorporating the SSDF), on February 4, 2022, and on March 7, 2022, the Office of Management and Budget directed federal agencies to incorporate both documents into their software lifecycle and acquisitions practices.

26 unchanged sentences

Our future success depends in part on our ability to obtain allocations of geographical, mobile, regional, local and toll-free direct inward dialing numbers or phone numbers as well as short codes and alphanumeric sender IDs (collectively, “Numbering Resources”) in the United States and foreign countries at a reasonable cost and without overly burdensome restrictions.

Our ability to obtain allocations of, assign and retain Numbering Resources depends on factors outside of our control, such as applicable regulations, the practices of authorities that administer national numbering plans or of network service providers from whom we can provision Numbering Resources, such as offering these Numbering Resources with conditional minimum volume call level requirements, the cost of these Numbering Resources and the level of overall competitive demand for new Numbering Resources.

Our ability to obtain allocations of, assign and retain Numbering Resources depends on factors outside of our

control, such as applicable regulations, the practices of authorities that administer national numbering plans or of network service providers from whom we can provision Numbering Resources, such as offering these Numbering Resources with conditional minimum volume call level requirements, the cost of these Numbering Resources and the level of overall competitive demand for new Numbering Resources.

In addition, in order to obtain allocations of, assign and retain Numbering Resources in the EU or certain other regions, we are often required to be licensed by local telecommunications regulatory authorities, some of which have been increasingly monitoring and regulating the categories of Numbering Resources that are eligible for provisioning to our customers.

2 unchanged sentences

Also, compliance with these types of regulation may require changes in products or business practices that result in reduced revenue.

Due to our or our customers’ assignment and/or use of Numbering Resources in certain countries in a manner that violates applicable rules and regulations, we have been subjected to government inquiries and audits, and may in the future be subject to significant penalties or further governmental action, and in extreme cases, may be precluded from doing business in that particular country.

Due to our or our customers’ assignment and/or use of Numbering Resources in certain countries in a manner that may violate applicable rules and regulations, we have been subjected to government inquiries and audits, and may in the future be subject to significant penalties or further governmental action, and in extreme cases, may be precluded from doing business in that particular country.

We have also been forced to reclaim Numbering Resources from our customers as a result of certain events of non-compliance.

18 unchanged sentences

If we were found to be in violation of the CAN-SPAM Act, applicable state laws governing email not preempted by the CAN-SPAM Act or foreign laws regulating the distribution of email, whether as a result of violations by our customers or our own acts or omissions, we could be required to pay large penalties, which would adversely affect our financial condition, significantly harm our business, injure our reputation and erode customer trust.

The terms of any injunctions, judgments, consent decrees or settlement agreements entered into in connection with enforcement actions or investigations against our company in connection with any of the foregoing laws may also require us to change one or more aspects of the way we operate our business, which could impair our ability to attract and retain customers or could increase our operating costs.

The terms of any injunctions, judgments, consent decrees or settlement agreements entered into in connection with enforcement actions or investigations against our

company in connection with any of the foregoing laws may also require us to change one or more aspects of the way we operate our business, which could impair our ability to attract and retain customers or could increase our operating costs.

Our customers’ and other users’ violation of our policies or other misuse of our platform to transmit unauthorized, offensive or illegal messages, spam, phishing scams, and website links to harmful applications or for other fraudulent or illegal activity could damage our reputation, and we may face a risk of litigation and liability for illegal activities on our platform and unauthorized, inaccurate, or fraudulent information distributed via our platform.

5 unchanged sentences

The scope and interpretation of the laws that are or may be applicable to the delivery of text messages or voice calls are continuously evolving and developing.

If we do not comply with these laws or regulations or if we become liable under these laws or regulations due to the failure of our customers to comply with these laws by obtaining proper consent, we could face direct liability.

If we do not comply with these laws or regulations or if we become liable under these laws or regulations due to the failure of our customers to comply with these laws, we could face direct liability.

Moreover, certain customers may use our platform to transmit unauthorized, offensive or illegal messages, calls, spam, phishing scams, and website links to harmful applications, reproduce and distribute copyrighted material or the trademarks of others without permission, and report inaccurate or fraudulent data or information.

9 unchanged sentences

Our customers’ and other users’ promotion of their products and services through our platform might not comply with federal, state, and foreign laws or of contractual requirements imposed by carriers, such as the CTIA Shortcode Agreement, The Campaign Registry, and associated policies.

We rely on contractual representations made to us by our customers that their use

of our platform will comply with our policies and applicable law, including, without limitation, our email and messaging policies.

We rely on contractual representations made to us by our customers that their use of our platform will comply with our policies and applicable law, including, without limitation, our email and messaging policies.

Although we retain the right to verify that customers and other users are abiding by certain contractual terms, our Acceptable Use Policy and our email and messaging policies and, in certain circumstances, to review their email, messages and distribution lists, our customers and other users are ultimately responsible for compliance with our policies, and we do not systematically audit our customers or other users to confirm compliance with our policies.

6 unchanged sentences

We cannot be certain that our efforts to defeat spamming attacks will be successful in eliminating all spam messages from being sent using our platform.

In addition, a cybersecurity breach of our customers’ systems could result in exposure of their authentication credentials, unauthorized access to their accounts or fraudulent calls on their accounts, any of which could adversely affect our business, results of operations and financial condition.

In addition, a cybersecurity breach of our customers’ systems could result in exposure of their authentication credentials, unauthorized access to their accounts or

fraudulent calls on their accounts, any of which could adversely affect our business, results of operations and financial condition.

Changes in laws and regulations related to the Internet or changes in the Internet infrastructure itself may diminish the demand for our products, and could adversely affect our business, results of operations and financial condition.

7 unchanged sentences

In response to this decision California and a number of states implemented their own net neutrality rules which mirrored parts of the repealed federal regulations.

In October 2023, the FCC voted to begin the process of reinstating substantially all of the net neutrality rules that had been in place prior to the 2018 repeal.

We cannot predict the actions the FCC may take, whether any new FCC order or state initiatives regulating providers will be modified, overturned, or vacated by legal action, federal legislation, or the FCC itself, or the degree to which further regulatory action – or inaction – may adversely affect our business.

Should the FCC not reinstate net neutrality or if state initiatives codifying similar protections are modified, overturned, or vacated, internet service providers may be able to limit our users’ ability to access our platform or make our platform a less attractive alternative to our competitors’ applications.

On the other hand, if limits are imposed on the types of traffic that U.S.

domestic carriers can carry over their broadband networks, it could adversely affect the amount of carrier-originated traffic that we carry.

In April 2024, the FCC voted to reinstate substantially all of the net neutrality rules that had been in place prior to the 2018 repeal.

Those rules are under review by a federal appeals court.

In addition, the results of the 2024 presidential election may influence whether the FCC maintains, modifies or, again, repeals these net neutrality rules.

If the net neutrality rules are repealed, we cannot predict whether internet service providers may limit our users’ ability to access our platform or may make our platform a less attractive alternative compared to our competitors’ applications.

In a related regulatory context, while the EU requires equal access to internet content, under its Digital Single Market initiative the EU may impose additional requirements that could increase our costs.

20 unchanged sentences

Further, we incorporate encryption technology into certain of our products.

Various countries regulate the import of certain encryption technology, including through import permitting and licensing requirements, and have enacted laws that could limit our customers’ ability to import our products into those countries.

Various countries regulate the import of certain encryption technology, including through import permitting and licensing requirements, and have enacted laws that

could limit our customers’ ability to import our products into those countries.

Encryption products and the underlying technology may also be subject to export control restrictions.

12 unchanged sentences

For example, some of our IP addresses have become, and we expect will continue to be, listed with one or more denylisting entities due to the messaging practices of our customers and other users.

We may be at an increased risk of having our IP addresses denylisted due to our scale and volume of email processed, compared to our smaller

We may be at an increased risk of having our IP addresses denylisted due to our scale and volume of email processed, compared to our smaller competitors.

There can be no guarantee that we will be able to successfully remove ourselves from those lists.

8 unchanged sentences

We are and may in the future become subject to legal proceedings and claims that arise in the ordinary course of business, such as disputes or employment claims made by our current or former employees.

Any litigation, whether meritorious or not, could harm our reputation, will increase our costs and may divert management’s attention, time and resources, which may in turn seriously harm our business.

Any litigation, whether meritorious

or not, could harm our reputation, will increase our costs and may divert management’s attention, time and resources, which may in turn seriously harm our business.

Insurance might not cover such claims or the costs to defend such claims, might not provide sufficient payments to cover all the costs to resolve one or more such claims, and might not continue to be available on terms acceptable to us.

21 unchanged sentences

We also use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to fluctuations in foreign currency exchange rates.

The use of such hedging activities may not offset

any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place.

The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place.

Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.

We have incurred substantial indebtedness that may decrease our business flexibility, access to capital, and/or increase our borrowing costs, and we may still incur substantially more debt, which may adversely affect our operations and financial results.

As of March 31, 2024, we had $1.0 billion of indebtedness outstanding (excluding intercompany indebtedness).

As of June 30, 2024, we had $1.0 billion of indebtedness outstanding (excluding intercompany indebtedness).

Our indebtedness may:

21 unchanged sentences

If we raise additional funds through future issuances of equity or convertible debt securities, our stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock.

Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities, our ability to repurchase stock,

and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities.

Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities, our ability to repurchase stock, and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities.

We may not be able to obtain additional financing on terms favorable to us, if at all, particularly during times of market volatility and general economic instability.

24 unchanged sentences

Goodwill is required to be tested for impairment at least annually.

As of March 31, 2024, we carried a net $5.6 billion of goodwill and intangible assets.

As of June 30, 2024, we carried a net $5.5 billion of goodwill and intangible assets.

An adverse change in market conditions or significant changes in accounting conclusions, particularly if such changes have the effect of changing one of our critical assumptions or estimates, could result in a change to the estimation of fair value that could result in an impairment charge to our goodwill or intangible assets.

example, during the year ended December 31, 2023, we recorded an impairment of intangible assets related to Segment totaling approximately $285.7 million, as described in additional detail in Note 6 to our consolidated financial statements included in our Annual Report on Form 10-K filed with the SEC on February 27, 2024.

For example, during the year ended December 31, 2023, we recorded an impairment of intangible assets related to Segment totaling approximately $285.7 million, as described in additional detail in Note 6 to our consolidated financial statements included in our Annual Report on Form 10-K filed with the SEC on February 27, 2024.

Any such charges may adversely affect our results of operations.

7 unchanged sentences

Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods.

Any failure to implement and maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that will be filed with the SEC.

financial reporting that we are required to include in our periodic reports that will be filed with the SEC.

Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, and could have a material and adverse effect on our business, results of operations and financial condition and could cause a decline in the trading price of our common stock.

16 unchanged sentences

Significant judgments and estimates are required in determining our provision for income taxes and other tax liabilities.

Our tax expense may be impacted, for example, if tax laws change or are clarified to our detriment or if tax authorities

successfully challenge the tax positions that we take, such as, for example, positions relating to the arm’s-length pricing standards for our intercompany transactions and our indirect tax positions.

Our tax expense may be impacted, for example, if tax laws change or are clarified to our detriment or if tax authorities successfully challenge the tax positions that we take, such as, for example, positions relating to the arm’s-length pricing standards for our intercompany transactions and our indirect tax positions.

In determining the adequacy of our provision for income taxes, we assess the likelihood of adverse outcomes that could result if our tax positions were challenged by the Internal Revenue Service (“IRS”), and other tax authorities.

9 unchanged sentences

Historically, we have not billed or collected taxes in certain jurisdictions and, in accordance with GAAP, we have recorded a provision for our tax exposure in these jurisdictions when it is both probable that a liability has been incurred and the amount of the exposure can be reasonably estimated.

We reserved $18.2 million and $20.0 million for domestic jurisdictions and jurisdictions outside of the United States, respectively, on our March 31, 2024 balance sheet for these tax payments.

These estimates include several key assumptions, including, but not limited to, the taxability of our products, the jurisdictions in which we believe we have nexus or a permanent establishment, and the sourcing of revenues to those jurisdictions.

We reserved $18.6 million and $20.2 million for domestic jurisdictions and jurisdictions outside of the United States, respectively, on our June 30, 2024 balance sheet for these tax payments.

These estimates include several key assumptions, including, but not limited to, the taxability of our products, the jurisdictions in which

we believe we have nexus or a permanent establishment, and the sourcing of revenues to those jurisdictions.

In the event these jurisdictions challenge our assumptions and analysis, our actual exposure could differ materially from our current estimates and reserves.

17 unchanged sentences

Our effective tax rates may fluctuate significantly on a quarterly basis because of a variety of factors, including changes in the mix of earnings and losses in countries with differing statutory tax rates, changes in our business or structure, changes in tax laws that could adversely impact our income or non-income taxes or the expiration of or disputes about certain tax agreements in a particular country.

subject to audit by various tax authorities.

We are subject to audit by various tax authorities.

In accordance with U.S.

43 unchanged sentences

In March 2024, our board of directors authorized an additional $2.0 billion share repurchase program.

Through March 31, 2024, we have repurchased $1.1 billion of our common stock on the open market under this program, such that up to $1.9 billion remained available for repurchase as of March 31, 2024.

Through June 30, 2024, we have repurchased $2.0 billion of our common stock on the open market under this program, such that up to $1.0 billion remained available for repurchase as of June 30, 2024.

Under our share repurchase programs, we may make repurchases of stock through a variety of methods, including open share market purchases, privately negotiated purchases, entering into one or more confirmations or other contractual arrangements with a financial institution counterparty to effectuate one or more accelerated stock repurchase contracts, forward purchase contracts or similar derivative instruments, Dutch auction tender offers, or through a combination of any of the foregoing, in accordance with applicable federal securities laws.

Our share repurchase programs terminate at 11:59 pm Pacific Time on December 31, 2024, do not obligate us to repurchase any specific number of shares, and may be suspended at any time at our discretion and without prior notice.

The timing and amount of any repurchases, if any, will be subject to liquidity, stock price, market and economic

conditions, compliance with applicable legal requirements such as Delaware surplus and solvency tests and other relevant factors.

The timing and amount of any repurchases, if any, will be subject to liquidity, stock price, market and economic conditions, compliance with applicable legal requirements such as Delaware surplus and solvency tests and other relevant factors.

Any failure to repurchase stock after we have announced our intention to do so may negatively impact our reputation and investor confidence in us and may negatively impact our stock price.

58 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors