What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-03-03 compared with 2022-03-07 · 358 added, 281 removed, 763 unchanged (46% of the section changed)

5 unchanged sentences

Risks Related to Our Business and Our Industry

Our business depends on our ability to attract new customers and hosts, retain and upsell additional products to existing customers, and upgrade free hosts to our paid offerings.

Any decline in new customers and hosts, renewals, or upgrades would harm our business.

Our business depends upon our ability to attract new customers and hosts, and maintain and expand our relationships with our customers and hosts, including upselling additional products to our existing customers and upgrading hosts to a paid Zoom Meeting plan.

A host is any user of our unified communications platform who initiates a Zoom Meeting and invites one or more participants to join that meeting.

Our business depends on our ability to attract new customers, retain and upsell additional products and new product categories to existing customers, and upgrade free hosts to our paid offerings.

Any decline in new customers, renewals, or upgrades would harm our business.

Our business depends upon our ability to attract new customers, and maintain and expand our relationships with our existing customers, including upselling additional products and new product categories to our existing customers and upgrading hosts to a paid Zoom Meeting plan.

A host is any user of our unified communications and collaboration platform who initiates a Zoom Meeting and invites one or more participants to join that meeting.

We refer to hosts who subscribe to a paid Zoom Meeting plan as “paid hosts.”

Our business is subscription based, and customers are not obligated to, and may choose not to, renew their subscriptions after their existing subscriptions expire.

As a result, we cannot provide assurance that customers will renew their subscriptions utilizing the same tier of their Zoom Meeting plan, upgrade to a higher-priced tier, or purchase additional products, if they

renew at all.

Renewals of subscriptions to our platform may decline or fluctuate because of several factors, such as dissatisfaction with our products and support, a customer or host no longer having a need for our products, including any new customers or hosts that have subscribed to our services during the COVID-19 pandemic that may subsequently reduce or discontinue their use after the impact of the pandemic have tapered, a reduction in customer information technology spending budgets, or a consolidation of spending budgets on our competitors' platforms, during periods of high inflation or recessionary or uncertain economic environments or the perception that competitive products provide better, more secure, or less expensive options.

In addition, some customers downgrade their Zoom Meeting plan or do not renew their subscriptions.

4 unchanged sentences

We encourage customers to purchase additional products and encourage hosts to upgrade to our paid offerings by recommending additional features and through in-product prompts and notifications.

Additionally, we seek to expand within organizations by adding new hosts, having workplaces purchase additional products, or expanding the use of Zoom into other teams and departments within an organization.

At the same time, we strive to demonstrate the value of our platform and various product offerings to those hosts that subscribe to our free Zoom Meeting plan, thereby encouraging them to upgrade to a paid Zoom Meeting plan.

However, a majority of these hosts, including those that subscribed to our free plan during the COVID-19 pandemic as a result of shelter-in-place and work-from-home mandates, may never upgrade to a paid Zoom Meeting plan.

Additionally, we seek to expand within organizations by adding new hosts, having workplaces purchase additional products, or expanding the use of our platform into other teams and departments within an organization.

At the same time, we encourage hosts that subscribe to our free Zoom

Meeting plan to upgrade to a paid Zoom Meeting plan.

However, a majority of these hosts, including those that initially subscribed to our free plan during the COVID-19 pandemic as a result of shelter-in-place and work-from-home mandates, may never upgrade to a paid Zoom Meeting plan.

If we fail to upsell our customers or upgrade hosts of our free Zoom Meeting plan to paid subscriptions or expand the number of paid hosts within organizations, our business would be harmed.

In addition, our user growth rate may slow or decline in the future as our market penetration rates increase and we turn our focus to upgrading our free hosts to a paid Zoom Meeting plan rather than growing the total number of users.

In addition, our user growth rate may slow or decline in the future as our market penetration rates increase.

If we are not able to continue to expand our user base, our revenue may grow more slowly than expected or decline.

While we continue to add paid users to our customer base, we expect our user growth rate to continue to slow or decline as the impact of the COVID-19 pandemic continues to taper, particularly as vaccines become widely available and distributed, and users return to work or school or are otherwise no longer subject to limitations on in-person meetings.

Our revenue growth rate has begun to decline and we expect our revenue growth rate to generally decline in future periods.

We have experienced significant revenue growth in prior periods.

While we continue to add paid users to our customer base, we expect our user growth rate to continue to slow or decline during the COVID-19 pandemic recovery, particularly as users return to work or school or are otherwise no longer subject to limitations on in-person meetings.

Our revenue growth rate has fluctuated in prior periods, and may decline in future periods.

Our revenue growth has fluctuated in prior periods.

We have previously experienced periods of significant revenue growth.

You should not rely on the revenue growth of any prior quarterly or annual period as an indication of our future performance.

Our revenue growth rate has begun to decline and we expect our revenue growth rate to generally decline in future periods.

Many factors may contribute to declines in our growth rate, including higher market penetration, increased competition, slowing demand for our platform, especially once the impact of the COVID-19 pandemic tapers, particularly as vaccines become widely available and distributed, and users return to work or school or are otherwise no longer subject to limitations on in-person meetings, a failure by us to continue capitalizing on growth opportunities, and the maturation of our business, among others.

Declines in our growth rate could adversely affect investors’ perceptions of our business and the trading price of our Class A common stock could be adversely affected.

Interruptions, delays, or outages in service from our co-located data centers and a variety of other factors, including increased usage stemming from the COVID-19 pandemic, would impair the delivery of our services, require us to issue credits or pay penalties, and harm our business.

Our revenue growth rate over the past year has stabilized but there are no assurances we will be able to sustain or increase it in future periods, and our revenue growth rate may decline in future periods.

Many factors may contribute to declines in our growth rate, including higher market penetration, increased competition, macroeconomic conditions, such as high inflation, recessionary or uncertain environments and fluctuating foreign currency exchange rates, slowing demand for our platform, especially during the COVID-19 pandemic recovery, which has led to users returning to work or school or are otherwise no longer being subject to limitations on in-person meetings, a lower than anticipated capitalization on growth opportunities, and the maturation of our business, among others.

Our growth rate could adversely affect investors’ perceptions of our business and the trading price of our Class A common stock could be adversely affected.

Interruptions, delays, or outages in service from our co-located data centers and a variety of other factors, would impair the delivery of our services, require us to issue credits or pay penalties, and harm our business.

We currently serve our users from various co-located data centers located throughout the world.

We also utilize Amazon Web Services and Oracle Cloud for the hosting of certain critical aspects of our business, as well as Microsoft Azure for limited customer-specified managed services.

As part of our distributed meeting architecture, we establish private links between data centers that automatically transfer data between various data centers in order to optimize performance on our platform.

As part of our distributed meeting architecture, we establish private links between data centers that automatically transfer data between various data centers.

Damage to, or failure of, these data centers has in the past resulted in and could in the future result in interruptions or delays in our services.

In addition, we have experienced, and may in the future experience, other interruptions and delays in our services caused by a variety of other factors, including, but not limited to, infrastructure changes, vendor issues, human or software errors, viruses, security attacks, ransomware or cyber extortion, fraud, general internet availability issues, spikes in usage, and denial of service issues.

In some instances, we may not be able to identify the cause or causes of these problems within an acceptable period of time.

5 unchanged sentences

may subject us to claims and litigation;

and may cause customers and hosts to terminate their

subscriptions and adversely affect our ability to attract new customers and hosts.

and may cause customers and hosts to terminate their subscriptions and adversely affect our ability to attract new customers and hosts.

Our ability to attract and retain customers and hosts depends on our ability to provide customers and hosts with a highly reliable platform and even minor interruptions or delays in our services could harm our business.

Additionally, if our data centers are unable to keep up with our increasing needs for capacity, including increased usage stemming from the COVID-19 pandemic, customers may experience delays or interruptions in service as we seek to obtain additional capacity, which could result in the loss of customers who use our unified communications platform because of its reliability and performance.

We plan to continue our practice of opening new data centers to meet increased demand, but we may be unable to bring additional data centers online in a timely manner, including as a result of current shortages for certain parts, such as servers.

Additionally, if our data centers are unable to keep up with our increasing needs for capacity, customers may experience delays or interruptions in service as we seek to obtain additional capacity, which could result in the loss of customers who use our unified communications and collaboration platform because of its reliability and performance.

We plan to continue our practice of opening new data centers throughout the world to meet increased demand, but we may be unable to bring additional data centers online in a timely manner, including as a result of current shortages for certain parts, such as servers.

In addition, to meet short-term capacity needs, we may need to rely increasingly on public cloud providers, including Amazon Web Services and Oracle Cloud, which may result in higher variable costs, harming our business, financial condition, and operating results.

7 unchanged sentences

disease, such as the COVID-19 pandemic;

and similar events, any of which could disrupt our service.

and other public health related measures, any of which could disrupt our service.

In the event of significant physical damage to one of these data centers, it may take a significant period of time to achieve full resumption of our services and our disaster recovery planning may not account for all eventualities.

Despite precautions taken at these facilities, the occurrence of a natural disaster, an act of terrorism, or other act of malfeasance, a decision to close the facilities without adequate notice or other unanticipated problems at the facilities would harm our business.

Despite precautions taken at these

facilities, the occurrence of a natural disaster, an act of terrorism, or other act of malfeasance, a decision to close the facilities without adequate notice or other unanticipated problems at the facilities would harm our business.

We operate in competitive markets, and we must continue to compete effectively.

6 unchanged sentences

Other large established companies may also make investments in video communications tools.

In addition, as we introduce new products and services, and with the introduction of new technologies and market entrants, we expect competition to intensify in the future.

For example, we recently introduced Zoom Contact Center, an omnichannel contact center solution that is optimized for video, which, as we build out our offering, may result in increased competition against companies that offer similar services, such as Five9, Inc., Genesys and NICE inContact, and new competitors that may enter that market in the future.

Also, in connection with the travel restrictions and stay-in-place policies resulting from the COVID-19 pandemic, we saw a significant increase in usage and subscriptions from smaller customers, many of whom are consumers or small and medium sized businesses.

In addition, as we introduce new products and services into our platform, and with the introduction of new technologies and market entrants, we expect competition to intensify in the future.

In February 2022, we launched Zoom Contact Center, an omnichannel contact center solution that is optimized for video, which, as we build out our offering, may result in increased competition against companies that offer similar services, such as Five9, Inc., Genesys and NICE inContact, and new competitors that may enter that market in the future.

As we continue to build out our platform, we may face increased competition against companies that offer similar services and new competitors that may enter that market in the future.

During the COVID-19 pandemic, we saw a significant increase in usage and subscriptions from smaller customers, many of whom are consumers or small and medium sized businesses.

With respect to these smaller customers, we face competition from more consumer-oriented platforms, most of which have more experience with the consumer market than we do.

9 unchanged sentences

and greater financial, technical, and other resources.

Some of our competitors may make acquisitions or enter into strategic relationships to offer a broader range of products and services than we do.

Some of our competitors may make acquisitions or strategic investments or enter into strategic relationships to offer a broader range of products and services than we do, which may prevent us from using such third parties' technology or offering such products or services.

These combinations may make it more difficult for us to compete effectively.

6 unchanged sentences

Even if such products do not include all the features and functionality that our platform provides, we could face pricing pressure from these third parties to the extent that users find such alternative products to be sufficient to meet their video communications needs.

There can be no assurance that we will not be forced to engage in price-cutting initiatives or other discounts or to increase our marketing and other expenses to attract and retain customers in

response to competitive pressures, either of which would harm our business.

There can be no assurance that we will not be forced to engage in price-cutting initiatives or other discounts or to increase our marketing and other expenses to attract and retain customers in response to competitive pressures, either of which would harm our business.

We, on occasion, offer customers a free period of time at the beginning of the subscription term that can result in deferred billings or long-term accounts receivable and increase the risk of loss on uncollected accounts receivable.

Our quarterly results have fluctuated and may in the future fluctuate significantly and may not fully reflect the underlying performance of our business.

Our quarterly results of operations have fluctuated and may in the future fluctuate significantly, and period-to-period comparisons of our results of operations may not be meaningful.

Accordingly, the results of any one quarter should not be relied upon as an indication of future performance.

Our quarterly results of operations may fluctuate as a result of a variety of factors, many of which are outside of our control, and as a result, may not fully reflect the underlying performance of our business.

For example, beginning in the fiscal quarter ended April 30, 2020, we faced unprecedented usage of our unified communications platform largely due to the COVID-19 pandemic, a significant portion of which is attributable to free Basic accounts, which do not generate any revenue.

Our results have fluctuated and may in the future fluctuate significantly and may not fully reflect the underlying performance of our business.

Our results of operations have fluctuated and may in the future fluctuate significantly, and period-to-period comparisons of our results of operations may not be meaningful.

Accordingly, the results of any one quarter or period should not be relied upon as an indication of future performance.

Our results of operations may fluctuate as a result of a variety of factors, many of which are outside of our control, and as a result, may not fully reflect the underlying performance of our business.

For example, during fiscal year 2021, we experienced rapid growth in usage of our unified communications and collaboration platform largely due to the COVID-19 pandemic, a significant portion of which was attributable to free Basic accounts, which do not generate any revenue.

To meet this increased demand, we have incurred and expect to continue to incur significant costs associated with upgrading our infrastructure and expanding our capacity, including higher variable costs to the extent we have had to rely on public cloud providers rather than our own data centers.

Fluctuation in quarterly results may negatively impact the value of our securities.

Factors that may cause fluctuations in our quarterly results of operations include, without limitation, those listed below:

Fluctuation in our results may negatively impact the

value of our securities.

Factors that may cause fluctuations in our results of operations include, without limitation, those listed below:

• our ability to retain and upgrade customers to higher-priced tiers of Zoom Meeting plans;

5 unchanged sentences

• our ability to increase sales to large organizations;

• the length of our sales cycles, especially with respect to sales to large enterprises and highly regulated industries, including financial services and U.S.

• the length of our sales cycles and linearity of our bookings, especially with respect to sales to large enterprises and highly regulated industries, including financial services and U.S.

federal and state and foreign governmental agencies;

8 unchanged sentences

or actual, alleged, or perceived privacy violations or issues or security vulnerabilities, incidents, or breaches;

regulatory actions or investigations;

• lawsuits, regulatory actions or investigations;

legislator scrutiny;

5 unchanged sentences

• general economic and market conditions.

Failures in internet infrastructure or interference with broadband access could cause current or potential users to believe that our systems are unreliable, possibly leading our customers and hosts to switch to our competitors, or to cancel their subscriptions to our platform.

Unlike traditional communications and collaborations technologies, our services depend on our users’ high-speed broadband access to the internet, usually provided through a cable or digital subscriber line connection.

Increasing numbers of users and increasing bandwidth requirements may degrade the performance of our platform due to capacity constraints and other internet infrastructure limitations.

As our number of users grow and their usage of communications capacity increases, including increased usage stemming from the COVID-19 pandemic, we will be required to make additional investments in network capacity to maintain adequate data transmission speeds, the availability of which may be limited, or the cost of which may be on terms unacceptable to us.

If adequate capacity is not available to us as our user base grows, our network may be unable to achieve or maintain sufficiently high data transmission capacity, reliability, or performance.

In addition, if internet service providers and other third parties providing internet services have outages or deteriorations in their quality of service, our users will not have access to our platform or may experience a decrease in the quality of our platform.

Furthermore, as the rate of adoption of new technologies increases, the networks our platform relies on may not be able to sufficiently adapt to the increased demand for these services, including ours.

Frequent or persistent interruptions could cause current or potential users to believe that our systems or platform are unreliable, leading them to switch to our competitors or to avoid our platform, which could permanently harm our business.

In addition, users who access our platform through mobile devices, such as smartphones and tablets, must have a high-speed connection, such as 3G, 4G, 5G, LTE, satellite, or Wi-Fi, to use our services and applications.

Currently, this access is provided by companies that have significant and increasing market power in the broadband and internet access marketplace, including incumbent phone companies, cable companies, satellite companies, and wireless companies.

Some of these providers offer products and subscriptions that directly compete with our own offerings, which can potentially give them a competitive advantage.

Also, these providers could take measures that degrade, disrupt, or increase the cost of user access to third-party services, including our platform, by restricting or prohibiting the use of their infrastructure to support or facilitate third-party services or by charging increased fees to third parties or the users of third-party services, any of which would make our platform less attractive to users and reduce our revenue.

On January 4, 2018, the Federal Communications Commission (“FCC”) released an order reclassifying broadband internet access as an information service, subject to certain provisions of Title I of the Communications Act.

The order requires broadband providers to publicly disclose accurate information regarding network management practices, performance characteristics, and commercial terms of their broadband internet access services sufficient to enable consumers to make informed choices regarding the purchase and use of such services, and entrepreneurs and other small businesses to develop, market, and maintain internet offerings.

The new rules went into effect on June 11, 2018.

Numerous parties filed judicial challenges to the order, and on October 1, 2019, the United States Court of Appeals for the District of Columbia Circuit released a decision that rejected nearly all of the challenges to the new rules, but reversed the FCC’s decision to prohibit all state and local regulation targeted at broadband internet service, requiring case-by-case determinations as to whether state and local regulation conflicts with the FCC’s rules.

The court also required the FCC to reexamine three issues from the order but allowed the order to remain in effect, while the FCC conducts that review.

On February 6, 2020, the court denied requests for rehearing of the original decision, and the deadline for petitions requesting the Supreme Court to review the decision has passed without the filing of any such petitions.

On February 19, 2020, the FCC released a public notice asking for comment on the three issues the court required it to reexamine.

On October 27, 2020, the FCC adopted an order concluding that the three issues remanded by the court did not provide a basis to alter its conclusions in the 2018 order.

Petitions for reconsideration of this decision are pending.

Democratic control of the Executive Branch, Congress, and the FCC following the 2020 elections increases the likelihood of legislative or FCC action to reverse the 2018 decision or adopt new network neutrality rules.

In addition, a number of states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers.

A federal court judge denied a request for a preliminary injunction against California’s state-specific network neutrality law, and as a result, California began enforcing that law on March 25, 2021.

On March 10, 2021, trade associations representing internet service providers appealed the district court’s ruling denying the preliminary injunction, and the appeal was denied on January 28, 2022.

The trade associations have sought rehearing with the full court of appeal.

We cannot predict whether the FCC order or other state initiatives will be enforced, modified, overturned, or vacated by legal action of the court, federal legislation, or the FCC.

Under the FCC’s new rules, broadband internet access providers may be able to charge web-based services such as ours for priority access or favor services offered by our competitors or by the internet access providers themselves, which could result in increased costs and a loss of existing customers and hosts, impair our ability to attract new customers and hosts, and harm our business.

If there are changes to the regulatory structures in the United States or elsewhere that reduce investment in infrastructure by internet service providers, including a return of the network neutrality regulations that were repealed, any impacts of reduced investment that reduce network capacity or speed could have a negative effect on our business, operating results, and financial condition.

Our business may be significantly affected by changes in the economy, including any resulting effect on consumer or business spending.

Our business may be affected by changes in the economy, such as high inflation, recessionary or uncertain environments, fluctuations in the foreign currency exchange rates and global impacts, including the Russian invasion of Ukraine and the United States' ongoing trade disputes with China and other countries.

Some customers may view a subscription to our platform as a cost-saving purchase, decreasing the need for business travel, others may view a subscription to our platform as a discretionary purchase, and our customers may reduce their information technology spending on our platform during an economic downturn or during times of economic uncertainty.

Given current economic conditions, including inflation, we could experience a reduction in demand and loss of customers, especially if the effects of the current economic environment have a prolonged impact on various industries that our unified communications and collaboration platform addresses.

We would lose

customers as a result of customers ceasing to do business, and we could experience a material increase in longer payment cycles and greater difficulty in collecting accounts receivable from certain customers.

As we increase sales to large organizations, our sales cycles could lengthen, and we could experience greater deployment challenges.

As we continue to grow, we have begun investing more resources into sales to large organizations.

We have begun investing more resources into sales to large organizations.

Large organizations typically undertake a significant evaluation and negotiation process due to their leverage, size, organizational structure, and approval requirements, all of which can lengthen our sales cycle.

6 unchanged sentences

As a result, widespread acceptance and use of communications and collaboration technologies in general, and our platform in particular, is critical to our future growth and success.

If the communications and collaboration technologies market fails to grow, or grows more slowly than we currently anticipate, or if any new customers or hosts that have subscribed to our services during the COVID-19 pandemic subsequently reduce or discontinue their use after the impact of the pandemic has tapered, demand for our platform could be negatively affected.

If the communications and collaboration technologies market fails to grow, or grows more slowly than we currently anticipate, demand for our platform could be negatively affected.

Changes in user preferences for communications and collaboration technologies may have a disproportionately greater impact on us than if we offered multiple platforms or disparate products.

4 unchanged sentences

• new modes of communications and collaboration that may be developed in the future;

• a reduction in customer information technology spending budgets, or a consolidation of spending budgets on our competitors' platforms, during periods of high inflation or recessionary or uncertain economic environments;

• ease of adoption and use;

5 unchanged sentences

If we fail to successfully predict and address these changes and trends, meet user demands, or achieve more widespread market acceptance of our platform, our business would be harmed.

We expect to increase our expenses in the future, which could decrease our profitability or prevent us from maintaining profitability.

Although we generated net income of $1,375.6 million, $672.3 million, and $25.3 million for the fiscal years ended January 31, 2022, 2021, and 2020, respectively, we have incurred net losses in the past and could incur net losses in the future.

We intend to continue to expend significant funds to expand our direct sales force and marketing efforts to attract new customers and hosts and to develop and enhance our products and for general corporate purposes, including operations, hiring additional personnel, including through acquisitions of other businesses, upgrading our infrastructure, and addressing security and privacy issues, including those stemming from the unprecedented numbers of first-time users during the COVID-19 pandemic who may not have full IT support or established protocols like our larger customers, and expanding into new geographical markets.

We have incurred net losses in the past and there are no assurances we will be able to maintain or increase profitability in the future.

We have incurred net losses in the past and could incur net losses in the future.

To the extent we are successful in increasing our user base, we may also incur increased losses because, other than sales commissions, the costs associated with acquiring customers and hosts are generally incurred up front, while the subscription revenue is generally recognized ratably over the subscription term, which can be monthly, annual, or on a multiyear basis.

2 unchanged sentences

We may incur significant losses in the future for a number of reasons, including as a result of the other risks described herein, and unforeseen expenses, difficulties, complications, delays, and other unknown events.

For example, we have faced unprecedented usage during the COVID-19 pandemic and, to meet this increased demand, have incurred and expect to continue to incur significant costs associated with upgrading our infrastructure and expanding our capacity, including higher variable costs to the extent we have to rely on public cloud providers rather than our own data centers.

While free users continue to be a meaningful portion of the user base, we have directed marketing programs focused on converting free users to paid subscriptions.

30 unchanged sentences

Our customers may require features and capabilities that our current platform does not have.

We invest significantly in research and development, and our goal is to focus our spending on measures that improve quality and ease of adoption, enhance privacy and security, and create organic

user demand for our platform.

We invest significantly in research and development, and our goal is to focus our spending on measures that improve quality and ease of adoption, enhance privacy and security, and create organic user demand for our platform.

There is no assurance that new additions or other future enhancements to our platform or new product experiences, features, or capabilities will be compelling to our users or gain market acceptance, or that they will perform as expected.

If our research and development investments do not accurately anticipate user demand or if we fail to develop our platform in a manner that satisfies user preferences and requirements in a timely and cost-effective manner, we may fail to retain our existing users or increase demand for our platform.

If our research and development investments do not accurately anticipate user demand or if we fail to

develop our platform in a manner that satisfies user preferences and requirements in a timely and cost-effective manner, we may fail to retain our existing users or increase demand for our platform.

The introduction of new products and services by competitors or the development of entirely new technologies to replace existing offerings could make our platform obsolete or adversely affect our business, results of operations, and financial condition.

15 unchanged sentences

We will not achieve anticipated revenue growth from expanding our sales force if we are unable to hire, develop, and retain talented sales personnel, our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective.

Increasing numbers of users and increasing bandwidth requirements may degrade the performance of our platform due to capacity constraints and other internet infrastructure limitations.

As our number of users has grown and their usage of communications capacity has increased, we have been required to make additional investments in network capacity to maintain adequate data transmission speeds, the availability of which may be limited, or the cost of which may be on terms unacceptable to us.

If adequate capacity does not continue to be available to us as our user base grows in the future, our network may be unable to achieve or maintain sufficiently high data transmission capacity, reliability, or performance.

Some of these providers offer products and subscriptions that directly compete with our own offerings, which can potentially give them a competitive advantage.

The new rules went into effect on June 11, 2018.

The court also required the FCC to reexamine three issues from the order but allowed the order to remain in effect, while the FCC conducts that review.

On October 27, 2020, the FCC adopted an order concluding that the three issues remanded by the court did not provide a basis to alter its conclusions in the 2018 order.

Petitions for reconsideration of this decision are pending and could be reversed by the current FCC after Democrats gain control.

In addition, a number of states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers.

The appeal of that decision and a petition for rehearing were denied in January and April 2022, respectively.

A number of other states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers.

A similar law in Vermont is subject to a pending challenge, but went into effect on April 20, 2022.

We cannot predict whether the FCC order or other state initiatives will be enforced, modified, overturned, or vacated by legal action of the court, federal legislation, or the FCC.

Our security measures have been compromised in the past and may be compromised in the future.

2 unchanged sentences

This perception may result in customers and hosts curtailing or ceasing their use of our products, our incurring significant liabilities, and our business being harmed.

Our operations involve the storage and transmission of customer and user information.

Security incidents have occurred in the past and may occur in the future, resulting in unauthorized access to, loss or unauthorized disclosure of, or inadvertent disclosure of, this information, interruptions, delays, or outages in our operations and services, regulatory investigations or enforcement actions, litigation, indemnity obligations, and other possible liabilities, as well as negative publicity, which could damage our reputation, impair our sales, and harm our business.

Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of products and services have been and are expected to continue to be targeted.

In addition to traditional computer “hackers,” we face security risks from sophisticated nation-state and nation-state supported actors, and advanced persistent threat intrusions.

In the ordinary course of our business, we and the third parties upon which we rely collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share confidential, proprietary, and sensitive data, including data of ours, our customers, and our users, the data which includes personal information, customer and user content, health-related data, intellectual property, trade secrets, business plans, and financial information.

We and the third parties upon which we rely face a variety of evolving threats, including but not limited to ransomware attacks, which could cause security incidents.

Security incidents have occurred in the past and may occur in the future, resulting in unauthorized access to, loss or unauthorized disclosure of, or inadvertent disclosure of confidential, proprietary, and sensitive information.

Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our proprietary, confidential, and sensitive data and information technology systems, and those of the third parties upon which we rely.

Cloud-based platform providers of products and services have been and are expected to continue to be targeted.

Threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation-state and nation-state supported actors, and advanced persistent threat intrusions.

Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including cyberattacks, that could materially disrupt our systems and operations, supply chain, and ability to provide our services.

We may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel misconduct or error, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, and other similar threats.

Ransomware attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

Ransomware attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly

prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Additionally, our platform, products, and services are relied on by a large number of companies worldwide and as a result, if our platform, products, or solutions are compromised, a significant number or all of our customers and their data could be simultaneously affected.

The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm.

Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

In addition, our reliance on third-party service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations.

We rely on third-party service providers and technologies to operate critical business systems to process confidential, proprietary, and sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions.

We also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business.

Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.

If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences.

While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to confidential, proprietary, or sensitive data or our information technology systems, or those of the third parties upon whom we rely.

A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our services.

We may expend significant resources or modify our business activities to try to protect against security incidents.

Additionally, certain privacy, data protection, and information security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive data.

If our security measures are compromised, our reputation could be damaged;

our data, information or intellectual property, or that of our

customers, may be destroyed, stolen, or otherwise compromised;

our data, information or intellectual property, or that of our customers, may be destroyed, stolen, or otherwise compromised;

our business may be harmed;

and we could incur significant liability.

We have not always been able in the past and may be unable in the future to anticipate or prevent threats or techniques used to detect or exploit vulnerabilities in our services or software or third-party software, or obtain unauthorized access to or compromise our systems, because such threats and techniques change frequently and are generally not detected until after an incident has occurred.

We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature.

Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred.

These vulnerabilities pose material risks to our business.

Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

In addition, security researchers and other individuals have in the past and will continue in the future to actively search for and exploit actual and potential vulnerabilities in our software or services.

This activity may increase because of increased demand for our services and increased media scrutiny of our unified communications platform, and can lead to additional adverse publicity, reputational harm, extortion threats, business and operational interruptions, security incidents, additional expenses, litigation, regulatory investigations and actions, and substantial harm to our business, some of which we have experienced during the COVID-19 pandemic.

This activity may increase because of increased demand for our services and increased media scrutiny of our unified communications and collaboration platform, and can lead to additional adverse publicity, reputational harm, extortion threats, business and operational interruptions, security incidents, additional expenses, litigation, regulatory investigations and actions, and substantial harm to our business, some of which we have experienced during the COVID-19 pandemic.

For example, in July 2019, a security researcher published a blog highlighting concerns with the Zoom Meeting platform, including certain video-on features.

4 unchanged sentences

We have identified vulnerabilities in our products and services in the past, and we expect that we will continue to identify vulnerabilities in the future.

We cannot be certain that we will be able to address any vulnerabilities in our software products and services that we may become aware of in the future, or there may be delays in developing patches that can be effectively deployed to address vulnerabilities.

We expect security issues to arise in the future as our products and services are more widely adopted, and as we continue to expand the features and functionality of existing products and introduce new products.

While we have invested and expect to continue to invest significant resources in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities, we will continue to make prioritization decisions to determine which vulnerabilities or security defects to fix and the timing of these fixes, which could result in an exploit that compromises security.

We cannot be certain that we will be able to address any vulnerabilities in our software products

and services that we may become aware of in the future, or there may be delays in developing patches that can be effectively deployed to address vulnerabilities.

We will continue to make prioritization decisions to determine which vulnerabilities or security defects to fix and the timing of these fixes, which could result in an exploit that compromises security.

Further, in many cases, customers are responsible for installing our software updates, and until they do so, their service remains subject to the vulnerabilities addressed in the software update.

1 unchanged sentence

Security incidents and vulnerabilities, and concerns regarding privacy, data protection, and information security may also cause some of our customers and hosts to stop using our solutions and fail to upgrade or renew their subscriptions.

Further, as we rely on third-party and public-cloud infrastructure, we depend in part on third-party security measures to protect against unauthorized access, cyberattacks, and the mishandling of data and information.

Failures to meet customers’ and hosts’ expectations with respect to security and confidentiality of their data and information could damage our reputation and affect our ability to retain customers and hosts, attract new customers and hosts, and grow our business.

In addition, cybersecurity events or security vulnerabilities could result in breaches of our agreements with customers, lawsuits against us (including class action litigation), regulatory investigations or actions, and significant increases in costs, including costs for remediating the effects of such an event or vulnerability, lost revenue due to network downtime, and a decrease in customer, host, and user trust, increases in insurance premiums due to cybersecurity incidents, increased costs to address cybersecurity issues, and attempts to prevent future incidents, fines, penalties, judgments and settlements, and attorney fees, and harm to our business and our reputation because of any such incident.

Many governments have enacted laws requiring companies to provide notice of data security incidents involving certain types of personal data.

Many governments have enacted laws requiring companies to provide notice of data security incidents involving certain types of personal information.

Such laws are inconsistent, and compliance in the event of a widespread data breach is costly.

In addition, some of our customers require us to notify them of data security breaches.

Security compromises experienced by our competitors, our customers, or us may lead to public disclosures, which may lead to widespread negative publicity.

Actual or perceived security compromises experienced in our industry or by our competitors, our customers, a third party upon whom we rely, or us could cause us to experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections);

additional reporting requirements and/or oversight;

restrictions on processing sensitive data (including personal data);

litigation (including class claims);

indemnification obligations;

negative publicity;

reputational harm;

monetary fund diversions;

interruptions in our operations (including availability of data);

financial loss;

and other similar harms.

Security incidents and attendant consequences may cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business.

In addition, while more than half of our employees are based in the United States, like many similarly situated technology companies, we have a sizable number of research and development personnel in China, which has exposed and could continue to expose us to governmental and regulatory as well as market and media scrutiny regarding the actual or perceived integrity of our platform or data security and privacy features.

Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures;

negatively affect our ability to attract new customers and hosts;

cause existing customers to elect not to renew their subscriptions;

or subject us to third-party lawsuits, regulatory investigations, proceedings, and fines, or other action or liability, which could harm our business and reputation.

Increased usage of our services, novel uses of our services, and additional awareness of Zoom and our brand could lead to greater public scrutiny of, press related to, or a

negative perception of our information security and potential vulnerabilities associated with, our platform.

For example, in connection with the COVID-19 pandemic, we opened our platform to unprecedented numbers of first-time users, leading to challenges for users who did not have full IT support or established protocols for security and privacy like our larger customers.

Increased usage of our services, novel uses of our services, and additional awareness of Zoom and our brand could lead to greater public scrutiny of, press related to, or a negative perception of our information security and potential vulnerabilities associated with, our platform.

For example, during the COVID-19 pandemic, we opened our platform to unprecedented numbers of first-time users, leading to challenges for users who did not have full IT support or established protocols for security and privacy like our larger customers.

As a result, we have experienced negative publicity related to meeting disruptions and security and privacy issues, including on encryption.

3 unchanged sentences

The successful assertion of one or more large claims against us that are not covered or exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could harm our business.

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Our business depends on a strong brand, and if we are not able to maintain and enhance our brand, our ability to expand our base of users will be impaired and our business will be harmed.

We believe that our brand identity and awareness have contributed to our success and have helped fuel our efficient go-to-market strategy.

We connect people through frictionless and secure video, voice, chat, and content sharing.

We also believe that maintaining and enhancing the Zoom brand is critical to expanding our base of customers, hosts, and users and, in particular, conveying to users and the public that the Zoom brand consists of a broad communications platform, rather than just one distinct product.

For example, if users incorrectly view the Zoom brand primarily as a video conferencing point solution or utility rather than as a platform with multiple communications solutions, or have a negative perception of our privacy and security, then our market position may be detrimentally impacted.

We believe that maintaining and enhancing the Zoom brand is critical to expanding our base of customers, hosts, and users and, in particular, conveying to users and the public that the Zoom brand consists of a broad communications and collaboration platform, rather than just one distinct product.

For example, if users view the Zoom brand primarily as a video conferencing point solution or utility rather than as a platform that connects people through video, voice, chat and content sharing, or have a negative perception of our privacy and security, then our market position may be detrimentally impacted.

We anticipate that, as our market becomes increasingly competitive, maintaining and enhancing our brand may become increasingly difficult and expensive.

Any unfavorable publicity or perception of our platform, including any delays or interruptions in service due to capacity constraints stemming from increased usage due to the COVID-19 pandemic, or of our privacy or security features, or of the providers of communication and collaboration technologies generally, could adversely affect our reputation and our ability to attract and retain hosts.

Any unfavorable publicity or perception of our platform, including any delays or interruptions in service due to capacity constraints stemming from increased usage or of our privacy or security features, or of the providers of communication and collaboration technologies generally, could adversely affect our reputation and our ability to attract and retain hosts.

Similarly, any unfavorable perception of our company, including due to any actual or perceived violation by our employees of our policies, such as our Code of Business Conduct and Ethics, could cause us reputational harm and customer loss, impact our financial performance, expose us to litigation, and harm our business, among other things.

If we fail to promote and maintain the Zoom brand, including consumer and public perception of our platform or our company, or if we incur excessive expenses in this effort, our business will be harmed.

We may not successfully manage our growth or plan for future growth.

Since our founding in 2011, we have experienced rapid growth.

For example, our headcount has grown from 4,422 full-time employees as of January 31, 2021, to 6,787 full-time employees as of January 31, 2022, with employees located both in the United States and internationally.

We cannot assure you that we will successfully manage our growth.

Since our founding in 2011, our employee headcount, both in the United States and internationally, has increased significantly over time.

The growth and expansion of our business places a continuous, significant strain on our management, operational, and financial resources.

Further growth of our operations to support our user base, our expanding third-party relationships, our information technology systems, and our internal controls and procedures may not be adequate to support our operations.

In addition, as we continue to grow, we face challenges integrating, developing, and motivating a rapidly growing employee base in various countries around the world.

For example, a significant number of our employees were hired in the last two years and have never been to one of our office locations.

Certain members of our management have not previously worked together for an extended period of time, and some do not have prior experience managing a public company, which may affect how they manage our growth.

Managing our growth will also require significant expenditures and allocation of valuable management resources.

In addition, our rapid growth may make it difficult to evaluate our future prospects.

In addition, as we continue to grow, we face challenges integrating, developing, and motivating our employee base in various countries around the world.

Many of our personnel work remotely, which may lead to challenges in productivity and collaboration.

In addition, from time to time, we implement organizational changes to pursue greater efficiency and realign our business and strategic priorities.

In February 2023, we commenced certain restructuring actions (the “Restructuring Plan”), designed to reduce operating costs and continue advancing our ongoing commitment to profitable growth.

We may encounter challenges in the execution of these efforts, and these challenges could impact our financial results.

Although we believe that the Restructuring Plan will reduce operating costs and improve operating margins, we cannot guarantee that the Restructuring Plan will achieve or sustain the targeted benefits, or that the benefits, even if achieved, will be adequate to meet our long-term profitability and operational expectations.

As a result of these actions, we will incur additional charges in the near term, including those related to employee transition, severance payments, employee benefits, and stock-based compensation.

Additional risks associated with the continuing impact of the Restructuring Plan include employee attrition beyond our intended reduction in force and adverse effects on employee morale (which may also be further exacerbated by actual or perceived declining value of equity awards), diversion of management attention, adverse effects to our reputation as an employer (which could make it more difficult for us to hire new employees in the future), and potential failure or delays to meet operational and growth targets due to the loss of qualified employees.

If we do not realize the expected benefits of our restructuring efforts on a timely basis or at all, our business, results of operations and financial condition could be adversely affected.

In addition, our historical rapid growth may make it difficult to evaluate our future prospects.

Our ability to forecast our future results of operations is subject to a number of uncertainties, including our ability to effectively plan for and model future growth.

1 unchanged sentence

If we fail to achieve the necessary level of efficiency in our organization as it grows, or if we are not able to accurately forecast future growth, our business would be harmed.

Our business may be significantly affected by a change in the economy, including any resulting effect on consumer or business spending.

Our business may be affected by changes in the economy generally, including as a result of the COVID-19 pandemic, any resulting effect on spending by our customers, and inflation.

While some of our customers may consider our platform to be

a cost-saving purchase, decreasing the need for business travel, others may view a subscription to our platform as a discretionary purchase, and our customers may reduce their discretionary spending on our platform during an economic downturn.

We would lose customers as a result of customers ceasing to do business, and we could experience a material increase in longer payment cycles and greater difficulty in collecting accounts receivable from certain customers.

While we have seen increased usage stemming from the COVID-19 pandemic, a significant portion of the increase in usage of our platform is attributable to free Basic accounts, which do not generate any revenue.

Moreover, while we continue to add paid users to our customer base, we expect our user growth rate to continue to slow or decline as the impact of the COVID-19 pandemic continues to taper, particularly in light of a potential economic downturn.

Our ability to sell subscriptions to our platform could be harmed by real or perceived material defects or errors in our platform.

19 unchanged sentences

Any changes in our senior management team in particular, even in the ordinary course of business, may be disruptive to our business.

While we seek to prepare for such transitions, including by establishing strong processes and procedures and succession planning, such changes may result in a loss of institutional knowledge and cause disruptions to our business.

Such changes may result in a loss of institutional knowledge and cause disruptions to our business.

If our senior management team fails to work together effectively or execute our plans and strategies on a timely basis as a result of management turnover or otherwise, our business could be harmed.

3 unchanged sentences

In particular, we compete with many other companies for software developers with high levels of experience in designing, developing, and managing software for communication and collaboration technologies, as well as for skilled sales and operations professionals.

At times, we have experienced, and we may continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and we may not be able to fill positions in a timely manner or at all, which may be exacerbated by our recent restructuring actions and any similar future actions.

In addition, our recruiting personnel, methodology, and approach may need to be altered to address a changing candidate pool and profile.

We may not be able to identify or implement

such changes in a timely manner.

In addition, we have experienced and may continue to experience employee turnover as a result of the ongoing “great resignation” occurring throughout the U.S.

We may not be able to identify or implement such changes in a timely manner.

In addition, we may experience employee turnover as a result of our recent restructuring actions.

New hires require training and take time before they achieve full productivity.

13 unchanged sentences

As we continue to grow, maintaining this culture of transparency will present its own challenges that we will need to address, including the type of information and level of detail that we share with our employees.

In addition, as our stock price has fluctuated since our IPO, employees joining us at different times could have significant disparities in proceeds from sales of our equity in the public markets, which could create disparities in wealth among our employees, which may harm our culture and relations among employees and our business.

In addition, as our stock price has fluctuated since our initial public offering (“IPO”), employees joining us at different times could have significant disparities in proceeds from sales of our equity in the public markets, which could create disparities in wealth among our employees, which may harm our culture and relations among employees and our business.

Further, the volatility of our stock price may make our equity compensation less attractive to current and potential employees, and could contribute to increased turnover or difficulties in hiring.

We have significant and expanding operations outside the United States, which may subject us to increased business, regulatory and economic risks that could harm our business.

Our platform addresses the communications needs of users worldwide, and we see international expansion as a major opportunity.

Our platform addresses the communications and collaboration needs of users worldwide, and we see international expansion as a major opportunity.

Our revenue from APAC and EMEA collectively represented 30%, 33%, and 31% of our total revenue for the fiscal years ended January 31, 2023, 2022, and 2021, respectively.

We plan to add local sales support in further select international markets over time.

Our customers include multinational corporations with global users, and we expect to continue to expand our international operations, which may include opening offices in new jurisdictions and providing our platform in additional languages to support the needs of these multinational corporations.

Our customers include multinational corporations with global users, and we expect to continue to expand our international operations, which includes opening offices in new jurisdictions and providing our platform in additional languages to support the needs of these multinational corporations.

Any new markets or countries into which we attempt to allow users to access our services or sell subscriptions to our platform may not be receptive.

For example, if we are not able to satisfy certain government- and industry-specific requirements, we may experience service outages or other adverse consequences which would impair our ability to expand further into certain markets.

In addition, our ability to manage our business and conduct our operations internationally in the future may require considerable management attention and resources and is subject to the particular challenges of supporting a rapidly growing business in an environment of multiple languages, cultures, customs, legal and regulatory systems, alternative dispute systems, and commercial markets.

If we are not able to satisfy certain government- and industry-specific requirements, we have in the past and may in the future experience service outages or other adverse consequences that would impair our ability to operate in or to expand further into certain markets.

For example, the Chinese government has at times turned off our service in China without warning and requested that we take certain steps prior to restoring our service, such as designating an in-house contact for law enforcement requests and transferring China-based user data housed in the United States to a data center in China.

In addition, our ability to manage our business and conduct our operations internationally in the future requires considerable management attention and resources and is subject to the particular challenges of supporting a rapidly growing business in an environment of multiple languages, cultures, customs, legal and regulatory systems, alternative dispute systems, and commercial markets.

Future international expansion will require investment of significant funds and other resources.

2 unchanged sentences

This may require us to offer equally compelling alternatives to supplement our compensation, such as long-term cash compensation plans or increased short-term cash compensation, in order to continue to attract and retain employees in these jurisdictions.

Operating internationally subjects us to new risks and may increase risks that we currently face, including risks associated with:

Operating internationally subjects us to new risks and increases risks that we currently face, including risks associated with:

• providing our platform and operating our business across a significant distance, in different languages and among different cultures, including the potential need to modify our platform and features to ensure that they are culturally appropriate and relevant in different countries;

and the risk of penalties to us and individual members of management or employees if our practices are deemed to be out of compliance;

• compliance with applicable international laws and regulations, including laws and regulations with respect to privacy, information security, telecommunications requirements, data protection, consumer protection, and unsolicited email, and the risk of penalties to us and individual members of management or employees if our practices are deemed to be out of compliance;

• operating in foreign jurisdictions where the government may impede or interrupt our ability to provide our services;

• management of an employee base in jurisdictions that may not give us the same employment and retention flexibility as does the United States;

• operating in jurisdictions that do not protect intellectual property rights to the same extent as does the United States and the practical enforcement of such intellectual property rights outside of the United States;

• management of an employee base in jurisdictions that may not give us the same employment and retention flexibility as the United States;

• operating in jurisdictions that do not protect intellectual property rights to the same extent as the United States and the practical enforcement of such intellectual property rights outside of the United States;

• foreign government interference with our non-core intellectual property that resides outside of the United States, such as the risk of changes in foreign laws that could restrict our ability to use our intellectual property outside of the foreign jurisdiction in which we developed it;

3 unchanged sentences

• political and economic instability, including as a result of the United Kingdom's (“U.K.”) withdrawal from the European Union (“EU”), and other political tensions between countries in which we do business;

• changes in diplomatic and trade relationships, including the imposition of new trade restrictions, trade protection measures, import or export requirements, trade embargoes, and other trade barriers;

• generally longer payment cycles and greater difficulty in collecting accounts receivable, a risk that may increase as a result of the impact of the COVID-19 pandemic on our customers' ability to pay for our service on a timely basis;

• changes in diplomatic and trade relationships, including the continuing deterioration in diplomatic relations between the United States and China and the continuing war between Russia and Ukraine, which can and has resulted in the imposition of new trade restrictions, trade protection measures, import or export requirements, trade embargoes, and other trade barriers;

• generally longer payment cycles and greater difficulty in collecting accounts receivable, a risk that may increase as a result of recent macroeconomic conditions, such as high inflation, recessionary environments, and fluctuations in foreign currency exchange rates, weighing on our customers' ability to pay for our service on a timely basis;

• double taxation of our international earnings and potentially adverse tax consequences due to changes in the income and other tax laws of the United States or the international jurisdictions in which we operate, including the imposition of digital services taxes;

• higher costs of doing business internationally, including increased accounting, travel, infrastructure, and legal compliance costs.

In addition, following Russia’s military invasion of Ukraine in February 2022, NATO deployed additional military forces to Eastern Europe, and the United States, European Union, and other nations announced various sanctions against Russia.

The invasion of Ukraine and the retaliatory measures that have been taken, and could be taken in future, by the U.S., NATO, and other countries have created global security concerns that could result in a regional conflict and otherwise have a lasting impact on regional and global economies, any or all of which could adversely affect our business.

As described above, following Russia’s military invasion of Ukraine in February 2022, the United States, European Union, and other nations announced various sanctions against Russia and export restrictions against Russia and Belarus.

Such restrictions include blocking sanctions on some of the largest state-owned and private Russian financial institutions, and their removal from the Society for Worldwide Interbank Financial Telecommunication, or the SWIFT, payment system.

The invasion of Ukraine and the retaliatory measures that have been taken, and could be taken in future, by the United States, NATO, and other countries have created global security concerns that could result in a regional conflict and otherwise have a lasting impact on regional and global economies, any or all of which could adversely affect our business, including preventing us from performing existing contracts, pursuing new business opportunities, or receiving payments for services already provided to customers.

Compliance with laws and regulations applicable to our global operations substantially increases our cost of doing business in international jurisdictions.

1 unchanged sentence

Although we have implemented policies and procedures designed to support compliance with these laws and regulations, there can be no assurance that we will always maintain compliance or that all of our employees, contractors, partners, and agents will comply.

In addition, legal requirements in the United States and other countries may come into conflict with each other making it challenging or impossible to comply with both countries’ legal requirements simultaneously.

Any violations could result in enforcement actions, fines, civil and criminal penalties, damages, injunctions, or reputational harm.

If we are unable to comply with these laws and regulations or manage the complexity of our global operations successfully, we may need to relocate or cease operations in certain foreign jurisdictions.

Additionally, while our engineering team is headquartered in the United States, we employ a product development team that has a relatively significant footprint in China today, where personnel costs are less expensive than in many other geographies.

This product development team carries out the design and architecture decisions made by our U.S.

engineering team.

We also intend to expand our research and development presence in Phoenix, Arizona and Pittsburgh, Pennsylvania, as well as in Singapore and India.

As a result of this expansion, we could experience, among other things, difficulty in attracting and retaining talent in these locations and higher operating expenses, which would adversely impact our operating margins and harm our business.

At the same time, our operations in China have caused and may in the future cause us to be subject to regulatory scrutiny both in China and in the United States.

For example, in September 2019, the Chinese government turned off our service in China without warning and requested that we take certain steps prior to restoring our service, including designating an in-house contact for law enforcement requests and transferring China-based user data housed in the United States to a data center in China.

Also, in June and July 2020, we received subpoenas from the Department of Justice’s U.S.

Attorney’s Office for the

Eastern District of New York (“EDNY”) and the Department of Justice’s U.S.

Geopolitical tension between the United States and China, or between other countries and China, may intensify and lead to increased scrutiny of our business operations in China.

We have a significant number of employees, primarily engineers, in China, where personnel costs are less expensive than in many other geographies.

The number or proportion of our employees in China has fluctuated in the past and may fluctuate in the future due to a number of factors, including macroeconomic changes and internal restructuring.

Geopolitical and national security tensions between the United States and China, or between other countries and China, have in the past, currently are and could in the future lead to increased scrutiny of our business operations in China.

In June and July 2020, we received subpoenas from the Department of Justice’s U.S.

Attorney’s Office for the Eastern District of New York (“EDNY”) and the Department of Justice’s U.S.

Attorney’s Office for the Northern District of California (“NDCA”).

The EDNY and NDCA subpoenas requested information about (among other things) our interactions with foreign governments and/or foreign political parties, including the Chinese government, as well as about storage of and access to user data, including the use of servers based overseas.

In addition, the EDNY subpoena requested information about the actions we took relating to the Tiananmen commemorations on Zoom.

In addition, the EDNY subpoena requested information about the actions we took relating to videoconference commemorations of the crackdown on the 1989 Tiananmen Square democracy protests.

The NDCA subpoena also requested documents and information about (among other things) contacts between our employees and representatives of the Chinese government, and any attempted or successful influence by any foreign government in our policies, procedures, practices, and actions as they relate to users in the United States.

13 unchanged sentences

Any failure to offer high-quality support for our customers and hosts may harm our relationships with our customers and hosts and, consequently, our business.

We have designed our platform to be easy to adopt and use with minimal to no support necessary.

However, if we experience increased user demand for support, we may face increased costs that may harm our results of operations.

Surging demand during the COVID-19 pandemic has required us to allocate additional resources to support our expanded user base, including many hosts and customers who are using our platform for the first time.

Increased user demand for support, may result in increased costs that may harm our results of operations.

For example, during the COVID-19 pandemic we saw surging demand requiring us to allocate additional resources to support our expanded user base, including many hosts and customers who are using our platform for the first time.

In addition, as we continue to grow our operations and support our global user base, we need to be able to continue to provide efficient support that meets our customers and hosts’ needs globally at scale.

Customers and hosts receive additional support features, and the number of our hosts has grown significantly, which will put additional pressure on our support organization.

If we are unable to provide efficient user support globally at scale or if we need to hire additional support personnel, including as a result of increased demand during the COVID-19 pandemic, our business may be harmed.

Our new customer and host signups are highly dependent on our business reputation and on positive recommendations from our existing customers and hosts.

As the number of our users has grown significantly, it has put additional pressure on our support organization.

If we are unable to provide efficient user support globally at scale or if we need to hire additional support personnel, our business may be harmed.

Our new customer and host signups are highly dependent on our business reputation and on recommendations from our existing customers and hosts.

Any failure to maintain high-quality support, or a market perception that we do not maintain high-quality support for our customers and hosts, would harm our business.

6 unchanged sentences

If we decide to further develop and expand our indirect sales channels, we must continue to scale and improve our processes and procedures to support these channels, including investment in systems and training.

Many resellers may not be willing to invest the time and resources required to train their staff to

effectively sell our platform.

Many resellers may not be willing to invest the time and resources required to train their staff to effectively sell our platform.

If we fail to maintain relationships with our resellers, fail to develop relationships with new resellers in new markets, or expand the number of resellers in existing markets or fail to manage, train, or provide appropriate incentives to our existing resellers, our ability to increase the number of new customers and hosts and increase sales to existing customers could be adversely impacted, which would harm our business.

2 unchanged sentences

We sell to customers globally and have international operations primarily in Australia, China, and the U.K.

As we continue to expand our international operations, we will become more exposed to the effects of fluctuations in currency exchange rates.

As we continue to expand our international operations, we have become more exposed to the effects of fluctuations in currency exchange rates.

Although the majority of our cash generated from revenue is denominated in U.S.

dollars, a small amount is denominated in foreign currencies, and our expenses are generally denominated in the currencies of the jurisdictions in which we conduct our operations.

dollars, a portion of our revenue is denominated in foreign currencies, and our expenses are generally denominated in the currencies of the jurisdictions in which we conduct our operations.

For the fiscal years ended January 31, 2023, 2022, and 2021, 20.0%, 22.6%, and 20.2% of our revenue, respectively, and 10.8%, 16.8%, and 11.9% of our expenses, respectively, were denominated in currencies other than U.S.

2 unchanged sentences

dollars, we also face remeasurement exposure to fluctuations in currency exchange rates, which could hinder our ability to predict our future results and earnings and could materially impact our results of operations.

For example, for the year ended

January 31, 2023, our total revenue was lower than anticipated in part due to the strengthening of the U.S dollar.

We do not currently maintain a program to hedge exposures to non-U.S.

1 unchanged sentence

Our sales to government entities and other government contractors are subject to a number of additional challenges and risks.

We expect to increase our sales to U.S.

We expect to continue selling our products and services to U.S.

federal and state and foreign governmental agency customers, which may occur through sales to other companies that re-sell our services to government customers and/or through direct sales to government entities.

We received authorization under the U.S.

Federal Risk and Authorization Management Program (“FedRAMP”) that allows U.S.

federal government agencies and contractors to securely use our Zoom for Government offering.

The additional risks and challenges associated with doing business with governmental entities include, but are not limited to, the following:

While we are a U.S.

Federal Risk and Authorization Management Program (“FedRAMP”) authorized SaaS service, selling to government entities and other government contractors present a number of unique challenges and risk including the following:

• selling to governmental entities can be more competitive, expensive, and time-consuming than selling to private entities, often requiring significant up-front time and expense and ongoing compliance costs without any assurance that these efforts will generate a sale;

2 unchanged sentences

• non-compliance with terms and conditions of government contracts, or with representations or certifications made in connection with government contracts, can result in significantly more adverse consequences than we typically would expect in the commercial market, including, depending on the circumstances, criminal liability, liability under the civil False Claims Act, and/or suspension or debarment from doing business with governmental entities;

• government demand and payment for our products may be influenced by public sector budgetary cycles and funding authorizations, with funding reductions or delays having an adverse impact on public sector demand for our products;

• government demand and payment for our products may be influenced, among other things, by public sector budgetary cycles and funding authorizations, with funding reductions or delays having an adverse impact on public sector demand for our products;

• government-imposed vaccine mandates could result in increased attrition and difficulties in recruiting, and non-compliance with any such mandates could restrict our ability to do business with governmental entities.

7 unchanged sentences

government may be impaired and may result in a loss of revenue.

Our current products, as well as products, features, and functionality that we may introduce in the future, may not be widely accepted by our customers and hosts or may receive negative attention or may require us to compensate or reimburse third parties, any of which may lower our margins and harm our business.

Our current platform, as well as products, features, and functionality that we may introduce in the future, may not be widely accepted by our customers and hosts or may receive negative attention or may require us to compensate or reimburse third parties, any of which may lower our margins and harm our business.

Our ability to engage, retain, and increase our base of customers and hosts and to increase our revenue will depend on our ability to successfully create new products, features, and functionality, both independently and together with third parties.

We may introduce significant changes to our existing products or develop and introduce new and unproven products, including technologies with which we have little or no prior development or operating experience.

We may introduce significant changes to our existing platform or develop and introduce new and unproven products, including technologies with which we have little or no prior development or operating experience.

These new products and updates may not perform as expected, may fail to engage, retain, and increase our base of customers and hosts or may create lag in adoption of such new products.

New products may initially suffer from performance and quality issues that may negatively impact our ability to market and sell such products to new and existing customers and hosts.

The short- and long-term impact of any major change to our products, or the introduction of new products, is particularly difficult to predict.

The short- and long-term impact of any major change to our platform, or the introduction of new products, is particularly difficult to predict.

If new or enhanced products fail to engage, retain, and increase our base of customers and hosts, or do not perform as expected, we may fail to generate sufficient revenue, operating margin, or other value to justify our investments in such products, any of which may harm our business in the short term, long term, or both.

In addition, our current products, as well as products, features, and functionality that we may introduce in the future, may require us to compensate or reimburse third parties.

In addition, our current platform as well as products, features, and functionality

that we may introduce in the future, may require us to compensate or reimburse third parties.

For example, our cloud phone system, Zoom Phone, is a PBX phone solution that requires us to compensate carriers that operate the PSTN.

17 unchanged sentences

We are subject to income taxes in the United States and various jurisdictions outside of the United States.

Our effective tax rate could fluctuate due to changes in the proportion of our earnings and losses in countries with differing statutory tax rates.

Our effective tax rate could fluctuate due to changes in the proportion of our earnings in countries with differing statutory tax rates.

Our tax expense could also be impacted by changes in non-deductible expenses;

5 unchanged sentences

changes in U.S.

federal, state, or foreign tax laws applicable to corporate multinationals;

federal, state, or foreign tax laws applicable to corporate multinationals (including provisions of the recently enacted federal tax legislation titled the Inflation Reduction Act);

other fundamental changes in tax law currently being considered by many countries;

4 unchanged sentences

The Tax Cuts and Jobs Act of 2017 requires the capitalization and amortization of research and development expenses effective for years beginning after December 31, 2021.

Absent a change in legislation, we expect it will have a material impact on our cash flows beginning in the fiscal year ending January 31, 2023.

Although Congress is considering legislation that would defer the amortization requirement to later years, we have no assurance that the provision will be deferred, repealed, or otherwise modified.

The mandatory capitalization requirement increased our cash tax liabilities but also decreased our effective tax rate due to increasing the foreign-derived intangible income deduction.

There is a possibility that Congress will defer, repeal, or otherwise modify this requirement in future periods.

Absent a change in legislation, we expect it will have a material impact on our cash flows beginning the current fiscal year ending January 31, 2023.

We may also be subject to additional tax liabilities due to changes in non-income-based taxes resulting from changes in U.S.

5 unchanged sentences

Further, the Organization for Economic Co-operation and Development (“OECD”) and the Inclusive Framework of G20 and other countries have issued proposals related to the taxation of the digital economy.

In addition, several countries have proposed or enacted Digital Services Taxes (“DST”), many of which would apply to revenue derived from digital services.

In addition, several countries have proposed or enacted Digital Services Taxes (“DST”), many of which would apply to revenue

derived from digital services.

Future developments related to such proposals, in particular any unilateral actions outside of the OECD's Inclusive Framework such as the imposition of DST rules, could have an adverse impact on our business by increasing our future tax obligations.

Our ability to use our net operating loss carryforwards and certain other tax attributes may be limited.

For state income tax purposes, there may be periods during which the use of net operating losses is suspended or otherwise limited, including a California franchise tax law change limiting the usability of California state net operating losses to offset California taxable income in taxable years beginning on or after January 1, 2020 and before January 1, 2022.

We have maintained a valuation allowance on all our U.S.

net deferred tax assets since our inception as it was determined that it was more likely than not that we would not recognize the benefits of these assets.

We continued to record a valuation allowance through the first nine months of fiscal 2022.

In the fourth quarter of fiscal 2022, management concluded that the valuation allowance related to the U.S.

federal and state deferred tax assets was no longer needed primarily due to its assessment of income/loss in recent periods and the forecast of future taxable income.

As of January 31, 2022, based on evaluation of the positive and negative evidence, management believes it is more likely than not that the net deferred tax assets will be realized for U.S.

federal and state purposes.

Accordingly, management has recognized a non-recurring tax benefit of $328.0 million related to the valuation allowance reversal.

As of January 31, 2022, we continued to maintain a valuation allowance of $12.6 million related to net deferred tax assets of our U.K.

subsidiary and will maintain this valuation allowance until there is sufficient evidence to support the reversal of all or a portion of the allowance.

We have acquired and may continue to acquire other businesses or receive offers to be acquired, which could require significant management attention, disrupt our business, or dilute stockholder value.

11 unchanged sentences

We have a limited operating history at the current scale of our business, which makes it difficult to evaluate our prospects and future results of operations.

Beginning in the fiscal quarter ended April 30, 2020, we faced unprecedented usage of our unified communications platform largely due to the COVID-19 pandemic.

During fiscal year 2021, we experienced rapid growth in usage of our unified communications and collaboration platform largely due to the COVID-19 pandemic.

This usage dramatically changed the scale of our business, and we have a limited operating history at the current scale of our business.

1 unchanged sentence

Our historical revenue growth should not be considered indicative of our future performance.

Further, in future periods, our revenue

growth could slow or our revenue could decline for a number of reasons, including any reduction in demand for our platform;

Further, in future periods, our revenue growth could continue to slow or our revenue could decline for a number of reasons, including any reduction in demand for our platform;

increased competition;

1 unchanged sentence

our inability to accurately forecast demand for our platform and plan for capacity constraints;

or our failure, for any reason, to capitalize on growth opportunities.

The COVID-19 pandemic has also made it difficult to forecast revenue, costs, and expenses, as our platform has recently faced unprecedented usage from free users and new and existing customers, requiring us to devote significant resources to bolster our capacity and infrastructure.

or our failure, for any reason, to capitalize on growth opportunities or to adapt and respond to inflationary factors affecting our business or future economic recession.

The changes the COVID-19 pandemic fostered on the way companies operate, including the shifts to remote and hybrid work have limited our ability to forecast revenue, costs, and expenses due to the uncertainty around how companies choose to operate in the future, including the impacts of a remote and hybrid workplace.

We have encountered and will encounter risks and uncertainties frequently experienced by growing companies in rapidly changing industries, such as the risks and uncertainties described herein.

8 unchanged sentences

The actual or perceived failure by us, our customers, partners, or vendors to comply with stringent and evolving privacy, data protection, and information security laws, regulations, standards, policies, and contractual obligations could harm our reputation and business or subject us to significant fines and liability.

We receive, store, process, generate, use, and share personal information and other customer and user content necessary to provide our service and ensure it is delivered effectively, to operate our business, for legal and marketing purposes, and for other business-related purposes.

There are numerous federal, state, local, and international laws and regulations regarding privacy, data protection, information security and the collection, storing, sharing, use, processing, transfer, disclosure, and protection of personal information and other content, the scope of which is changing, subject to differing applications and interpretations and may be inconsistent among countries, or conflict with other rules.

We are also subject to the terms of our privacy policies and contractual obligations to third parties related to privacy, data protection, and information security.

Although we endeavor to comply with applicable laws and our policies, publications, certifications, and documentation, and other obligations, we may at times fail to do so or may be perceived to have failed to do so.

Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, vendors or business partners do not comply with our policies, certifications, and documentation.

Any actual or perceived compliance failure, as well as greater public scrutiny of our privacy, data protection, and information security practices, could result in increased governmental and regulatory scrutiny and litigation exposure, as well as material reputational harm, a loss of customer and user confidence and business, additional expenses, and other harm to our business.

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share confidential, proprietary, and sensitive information, including personal information, customer and user content, business data, trade secrets, intellectual property, third-party data, business plans, transactions, financial information Our data processing activities may subject us to numerous privacy, data protection, and information security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements.

For example, in June 2020, we received a grand jury subpoena from the Department of Justice’s U.S.

Attorney’s Office for the EDNY, which requested information regarding our interactions with foreign governments and foreign political parties, including the Chinese government, as well as information regarding storage of and access to user data, the development and implementation of Zoom’s privacy policies, and the actions we took relating to the Tiananmen commemorations on Zoom.

In July 2020, we received subpoenas from the Department of Justice’s U.S.

6 unchanged sentences

We cannot predict the outcome of these investigations, and a negative outcome in any or all of these matters could cause us to incur substantial fines, penalties, or other financial exposure, as well as material reputational harm, a loss of customer and user confidence and business, additional expenses, and other harm to our business.

We also expect that there will continue to be new or amended laws, regulations, industry standards, guidance and contractual obligations concerning privacy, data protection, and information security proposed and enacted in various jurisdictions.

For example, in May 2018, the General Data Protection Regulation (“GDPR”) went into effect in the EU, and the United Kingdom (U.K.) implemented the U.K.

The GDPR and the U.K.

GDPR impose more stringent data protection requirements and provide greater penalties for noncompliance than previous data protection laws.

Companies that violate the GDPR can face private litigation, restrictions on data processing, and fines of up to the greater of 20 million Euros or 4% of their worldwide annual revenue.

Our or our customers’, partners’, or vendors’ failure to comply with the GDPR could lead to significant fines imposed by regulators or restrictions on our ability to process personal information as needed to provide our product and services.

We may also be obligated to assist our customers, partners, and vendors with their own compliance obligations under the GDPR, which could require expenditure of significant resources.

Certain jurisdictions have enacted data localization laws and cross-border data transfer laws.

For example, absent appropriate safeguards or other circumstances, the GDPR generally restricts the transfer of personal information to countries outside of the EEA, such as the United States, which the European Commission does not consider to provide an adequate level of data privacy and security.

The European Commission released a set of Standard Contractual Clauses that are designed to be a lawful mechanism by which entities can transfer personal information out of the EEA to jurisdictions that the European Commission has not found to provide an adequate level of protection.

The Standard Contractual Clauses require parties that rely upon them to comply with additional obligations, such as conducting transfer impact assessments to determine whether additional security measures are necessary to protect the at-issue personal information.

Moreover, due to potential legal challenges, there exists some uncertainty regarding whether the Standard Contractual Clauses will remain a valid mechanism for transfers of personal information out of the EEA.

In addition, laws in Switzerland and the U.K.

similarly restrict transfers of personal information outside of those jurisdictions to countries such as the United States that do not provide an adequate level of personal information protection.

In addition to European restrictions on cross-border transfers of personal information, other jurisdictions have enacted or are considering similar cross-border personal information transfer laws and local personal information residency laws, any of which could increase the cost and complexity of doing business.

If we cannot implement a valid compliance mechanism for cross-border transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from Europe or elsewhere.

The inability to import personal information to the United States could significantly and negatively impact our business operations;

limiting our ability to collaborate with parties that are subject to European and other privacy, data protection, and information security laws;

or requiring us to increase our personal information processing capabilities in Europe and/or elsewhere at significant expense.

We are also subject to evolving EU and U.K.

privacy laws on cookies and e-marketing.

European regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and current national laws that implement the ePrivacy Directive are likely to be replaced by the ePrivacy Regulation, which could lead to substantial costs, limit the effectiveness of our marketing and personalization activities, and subject us to additional liabilities.

States have also begun to introduce more comprehensive privacy legislation.

For example, the California Consumer Privacy Act of 2018 (“CCPA”), which went into effect on January 1, 2020, affords consumers expanded privacy protections.

The CCPA allows for statutory fines for noncompliance (up to $7,500 per violation).

The CCPA will be expanded substantially on January 1, 2023 when the California Privacy Rights Act of 2020 (the “CPRA”), which was approved by California voters in November 2020, becomes fully operative.

Aspects of the CCPA and CPRA, and their interpretation and enforcement remain uncertain.

The potential effects of the CCPA and CPRA are far-reaching and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply.

The CCPA appears to mark the beginning of a trend toward more stringent privacy legislation in the United States, as other states have followed California’s lead and increase protections for their residents.

The CCPA has already prompted a number of proposals for new federal and state privacy legislation that, if passed, could increase our potential liability, increase our compliance costs and adversely affect our business.

In the United States, federal, state, and local governments have enacted numerous privacy, data protection, and information security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws).

For example, the California Consumer Privacy Act of 2018 (“CCPA”) applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights.

The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages.

In addition, the California Privacy Rights Act of 2020 (“CPRA”) expands the CCPA’s requirements, including by adding a new right for individuals to correct their personal information and establishing a new regulatory agency to implement and enforce the law.

In addition, effective October 1, 2019, Nevada amended its existing Security of Personal Information Law (“SPI Law”) to now require, among other things, that businesses provide an online mechanism or toll-free phone number to intake requests from consumers to opt out of the sale of their personal information.

Virginia and Colorado have similarly enacted comprehensive privacy laws, the Consumer Data Protection Act and Colorado Privacy Act, respectively, both laws of which emulate the CCPA and CPRA in many respects.

The Virginia Consumer Data Protection Act takes effect on January 1, 2023, and the Colorado Privacy Act takes effect on July 1, 2023.

The Children’s Online Privacy Protection Act (“COPPA”) is a U.S.

Virginia, Colorado, Utah and Connecticut have similarly enacted comprehensive privacy, data protection and information security laws, that emulate the CCPA and CPRA in many respects and have taken or will take effect in 2023.

These developments may further complicate compliance efforts and increase legal risk and compliance costs for us and the third parties upon whom we rely.

Under various laws and other obligations related to privacy, data protection, and information security, we may be required to obtain certain consents to process personal information.

Our inability or failure to do so could result in adverse consequences.

Outside the United States, an increasing number of laws, regulations, and industry standards may govern related to privacy, data protection, and information security.

For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No.

13,709/2018), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal information.

For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions;

fines of up to 20 million Euros or 4% of annual global revenue, whichever is greater;

or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

We also target customers in Asia and have operations in Japan and Singapore, and may be subject to new and emerging privacy, data protection, and information security regimes in Asia, including Japan’s Act on the Protection of Personal Information and Singapore’s Personal Data Protection Act.

In addition, we may be unable to transfer personal information from Europe and other jurisdictions to the United States or other countries due to data localization requirements or limitations on cross-border data flows.

Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries.

In particular, the European Economic Area (“EEA”) and the United Kingdom (“UK”) have significantly restricted the transfer of personal information to the United States and other countries whose privacy laws they believe are inadequate.

Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.

Although there are currently various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States.

If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business.

Additionally, companies that transfer personal information out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activities groups.

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal information out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

Furthermore, several states and localities have enacted measures related to the use of artificial intelligence and machine learning in products and services.

For example, in Europe, there is a proposed regulation related to artificial intelligence (“AI”) that, if adopted, could impose onerous obligations related to the use of AI-related systems.

We may have to change our business practices to comply with such obligations.

Additionally, regulators are increasingly scrutinizing companies that process children’s data.

Numerous laws, regulations, and legally-binding codes, such as the Children’s Online Privacy Protection Act (“COPPA”), California’s Age Appropriate Design Code (effective in July 2024), the CCPA and CPRA, other U.S.

state comprehensive privacy laws, the EU and UK GDPR, and the UK Age Appropriate Design Code, impose various obligations on companies that process children’s data, including by requiring certain consents to process such data and extending certain rights to children and their parents with respect that data.

Some of these obligations have wide ranging applications, including for services that do not intentionally target child users (defined in some circumstances as a user under the age of 18 years old).

In particular, COPPA is a U.S.

Federal law that applies to operators of commercial websites and online services directed to U.S.

1 unchanged sentence

children under the age of 13.

We provide video communications services to schools, school districts, and school systems to support traditional, virtual, and hybrid classrooms, distance learning, educational office hours, guest lectures, and other services.

As part of these services, Zoom may be used by students, including students under the age of 13, and we collect

personal information from such students on behalf of our school subscribers.

We provide video communications and collaboration services to schools, school districts, and school systems to support traditional, virtual, and hybrid classrooms, distance learning, educational office hours, guest lectures, and other services.

As part of these services, Zoom may be used by students, including students under the age of 13, and we collect personal information from such students on behalf of our school subscribers.

School subscribers must contractually consent to Zoom’s information practices on behalf of students, prior to students using the services.

In addition, the GDPR prohibits certain processing of the personal information of children under the age of 13-16 (depending on the country) without parental consent.

If we fail to accurately anticipate the application, interpretation, or legislative expansion of COPPA, HIPAA, GDPR, and CCPA, we could be subject to governmental enforcement actions, data processing restrictions, litigation, fines and penalties, adverse publicity or loss of customers.

If we fail to accurately anticipate the application, interpretation, or legislative expansion of applicable privacy, data protection, and information security laws, we could be subject to governmental enforcement actions, data processing restrictions, litigation, fines and penalties, adverse publicity or loss of customers.

Moreover, as a result of any such failures, we could be in breach of our K-12 school customer contracts, and our customers could lose trust in us, which could harm our reputation and business.

With laws and regulations, such as the GDPR and UK GDPR in the EU as well as the CCPA, SPI Law, HIPAA, and COPPA in the United States imposing relatively burdensome obligations, and with substantial uncertainty over the interpretation and application of these and other laws and regulations, we have faced and may face additional challenges in addressing their requirements and making necessary changes to our policies and practices.

Additional uses of our services arising out of increased demand associated with the COVID-19 pandemic may require us to address additional privacy, data protection, and information security laws, regulations, standards, policies, and contractual obligations.

Individuals are increasingly resistant to the collection, use, and sharing of personal information to deliver targeted advertising.

Third-party platforms have introduced (or plan to introduce) measures to provide users with more privacy controls over targeted advertising activities, and regulators (including in the EEA/UK) are heavily scrutinizing the use of technologies used to deliver such advertisements.

Major technology platforms on which we rely to gather information about consumers have adopted or proposed measures to provide consumers with additional control over the collection, use, and sharing of their personal data for targeted advertising or other purposes.

In addition, legislative proposals and present laws and regulations regulate the use of cookies and other tracking technologies, electronic communications, and marketing.

For example, in the EEA and the UK, regulators are increasingly focusing on compliance with requirements related to the targeted advertising ecosystem.

European regulators have issued significant fines in certain circumstances where the regulators alleged that appropriate consent was not obtained in connection with targeted advertising activities.

It is anticipated that the ePrivacy Regulation and national implementing laws will replace the current national laws implementing the ePrivacy Directive, which may require us to make significant operational changes.

In the United States, the CCPA, for example, grants California residents the right to opt-out of a company’s sharing of personal data for advertising purposes in exchange for money or other valuable consideration, and requires covered businesses to honor user-enabled browser signals from the Global Privacy Control.

Partially as a result of these developments, individuals are becoming increasingly resistant to the collection, use, and sharing of personal information to deliver targeted advertising or other types of tracking.

Individuals are now more aware of options related to consent, “do not track” mechanisms (such as browser signals from the Global Privacy Control), and “ad-blocking” software to prevent the collection of their personal information for targeted advertising purposes.

As a result, we may be required to change the way we market our products, and any of these developments or changes could materially impair our ability to reach new or existing customers or otherwise negatively affect our operations.

In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future.

We are also bound by other contractual obligations related to privacy, data protection, and information security, and our efforts to comply with such obligations may not be successful.

We publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding privacy, data protection, and information security privacy, data protection, and information security.

If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.

Obligations related to privacy, data protection, and information security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty.

Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions.

Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal information on our behalf.

We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy, data protection, and information security obligations.

Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations.

If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable privacy, data protection, and information security obligations, we could face significant consequences, including but not limited to:

government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar);

litigation (including class-action claims);

additional reporting requirements and/or oversight;

bans on processing personal information;

and orders to destroy or not use personal information.

Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to:

loss of customers;

inability to process personal information or to operate in certain jurisdictions;

limited ability to develop or commercialize our products;

expenditure of time and resources to defend any claim or inquiry;

adverse publicity;

or substantial changes to our business model or operations.

We have in the past and may in the future receive inquiries or be subject to investigations by domestic and international government entities regarding, among other things, our privacy, data protection, and information security practices.

9 unchanged sentences

Furthermore, if third parties we work with, such as vendors or developers, make misrepresentations, violate applicable laws and regulations, or our policies, such misrepresentations and violations may also put our users’ content at risk and could in turn have an adverse effect on our business.

Any significant change to applicable laws, regulations, or industry practices regarding the collection, use, retention, security, or disclosure of our users’ content, or regarding the manner in which the express or implied consent of users for the collection, use, retention, or disclosure of such content is obtained, could increase our costs and require us to modify our services and features, possibly in a material manner, which we may be unable to complete and may limit our ability to store and process user data or provide or develop new services and features.

services and features, possibly in a material manner, which we may be unable to complete and may limit our ability to store and process user data or provide or develop new services and features.

Increased usage of our services and additional awareness of Zoom and our brand stemming from the COVID-19 pandemic has led to greater public scrutiny of, press related to, or a negative perception of our collection, use, storage, disclosure, and processing of personal information, and our privacy policies and practices.

49 unchanged sentences

In addition, we may have inadvertently made our software products available to some customers in potential violation of the EAR.

As a result, we have submitted and from time to time

will continue to submit as warranted initial and final voluntary self-disclosures regarding compliance with U.S.

As a result, we have submitted and from time to time will continue to submit as warranted voluntary self-disclosures regarding our compliance with U.S.

sanctions and export control laws and regulations to OFAC and the U.S.

Department of Commerce’s Bureau of Industry and Security (“BIS”).

For instance, in June 2021, we submitted an initial voluntary self-disclosure to BIS regarding compliance with certain U.S.

For instance, since March 2022, we have submitted certain reports to BIS detailing the findings from a review of our compliance with certain U.S.

export control laws and regulations.

40 unchanged sentences

Zoom Phone is provided through our wholly owned subsidiary, Zoom Voice Communications, Inc., which is regulated by the FCC as an interconnected voice over internet protocol (“VoIP”) service provider.

[As a result, Zoom Phone is subject to existing or potential FCC regulations, including, but not limited to, regulations relating to privacy, disability access, porting of numbers, federal Universal Service Fund (“USF”), contributions and other regulatory assessments, emergency calling/Enhanced 911 (“E-911”), access charges for long distance services, and law enforcement access.] Congress or the FCC may expand the scope of Zoom Phone’s regulatory obligations at any time.

As a result, Zoom Phone is subject to existing or potential FCC regulations, including, but not limited to, regulations relating to privacy, disability access, porting of numbers, federal Universal Service Fund (“USF”), contributions and other regulatory assessments, emergency calling/Enhanced 911 (“E-911”), access charges for long distance services, and law enforcement access.

Congress or the FCC may expand the scope of Zoom Phone’s regulatory obligations at any time.

In addition, FCC classification of Zoom Phone as a common carrier or telecommunications service could result in additional federal and state regulatory obligations.

If we do not comply with any current or future state regulations that apply to our business, we could be subject to substantial fines and penalties, we may have to restructure our product offerings, exit certain markets, or raise the price of our products, any of which could ultimately harm our business and results of operations.

Any enforcement action by the FCC, which may be a public process, would hurt our reputation in the industry, possibly impair our ability to sell Zoom Phone to our customers and harm our business.

Any enforcement action by the FCC, which may be a public

process, would hurt our reputation in the industry, possibly impair our ability to sell Zoom Phone to our customers and harm our business.

As described above, the FCC could reinstate its prior network neutrality regulations or adopt new regulations.

See Part 1A – Failures in internet infrastructure or interference with broadband access could cause current or potential users to believe that our systems are unreliable, possibly leading our customers and hosts to switch to our competitors, or to cancel their subscriptions to our platform.

Changes in FCC regulation of the internet and internet-based services also could impose new regulatory obligations on our other services.

On October 27, 2020, the FCC adopted an order concluding that three issues remanded by the U.S.

Court of Appeals following the appeal of its 2018 decision to eliminate its network neutrality rules did not provide a basis to alter its conclusions in that order.

Petitions for reconsideration of this decision are pending.

Such action could result in extension of common carrier regulation to internet-based communications services like the ones we offer.

2 unchanged sentences

There have been various Congressional and executive efforts to eliminate or modify Section 230 of the Communications Act of 1934, enacted as part of the Communications Decency Act of 1996.

President Biden and many Members of Congress from both parties support reform or repeal of Section 230, so the possibility of Congressional action remains.

President Biden and many Members of Congress from both parties support the reform or repeal of Section 230, so the possibility of Congressional action remains.

In addition, the FCC is considering a petition, filed by the Trump Administration, to adopt rules interpreting Section 230, which limits the liability of internet platforms for third-party content that is transmitted via those platforms and for good-faith moderation of offensive content.

4 unchanged sentences

In addition, there are pending cases before the judiciary that may result in changes to the protections afforded to internet platforms, including a lawsuit by former President Trump that, if successful, would greatly limit the scope of Section 230.

Further, on October 3, 2022, the U.S.

Supreme Court agreed to hear a case to determine whether Google should be liable for damages because YouTube’s suggestion algorithm promoted radical Islamic videos that incited a terrorist attack in France.

A decision in that case is expected by the end of June 2023.

These various efforts to limit the protections provided by Section 230 would increase the risks faced by internet-based businesses, like Zoom, that rely on third-party content.

1 unchanged sentence

If we are found liable for our customers’ or other users’ activities, we could be required to pay fines or penalties, redesign business methods or otherwise expend resources to remedy any damages caused by such actions and to avoid future liability.

The FCC has proposed to revise its rules requiring reporting of breaches of private customer information, known as CPNI.

If adopted, the proposed rules could broaden the types of CPNI breaches that must be reported, but also could limit the number of reports that must be filed by adopting a minimum threshold for the number of customers affected.

The proposed rules also would require that breach reports be provided directly to the FCC, which could increase the risk of enforcement action, including fines and behavioral remedies.

The FCC has adopted rules that prohibit Chinese companies that are deemed to be a national security risk by other federal agencies from obtaining new authorizations and placed on a list known as the Covered List to sell telecommunications equipment in the U.S.

and is considering proposed rules that would ban those companies from selling previously-authorized equipment or could prohibit use of their equipment in the U.S.

Zoom does not currently have any equipment from the companies subject to the ban in its network, but if other companies are added to the Covered List and the FCC adopts rules that ban sales or use of equipment from companies on the Covered List, we could be required to find new sources for similar equipment or replace existing equipment entirely.

State Regulation

6 unchanged sentences

Trade associations representing internet service

providers appealed the district court’s ruling denying the preliminary injunction, and the appeal was denied on January 28, 2022.

This decision could be appealed to the full court of appeals or the Supreme Court, or the parties could return to the trial court for further proceedings to determine whether a permanent injunction should be granted.

Trade associations representing internet service providers appealed the district court’s ruling denying the preliminary injunction, and the appeal was denied on January 28, 2022.

On April 20, 2022 the Ninth Circuit declined to rehear the case and the appellants have since announced that they will not

file for an appeal with the U.S.

Supreme Court.

We cannot predict whether other state initiatives will be enforced, modified, overturned, or vacated.

Legislation has been adopted in Florida and Texas and has been introduced in at least fifteen additional states that is intended to reduce or eliminate the power of businesses operating on the Internet to moderate user-generated content, implicitly eliminating the federal protections granted under Section 230.

In response to challenges from industry groups, federal courts have enjoined enforcement of the Florida and Texas laws, but appeals are pending in both cases.

Legislation has been adopted in Florida and Texas that is intended to reduce or eliminate the power of businesses operating on the Internet to moderate user-generated content, implicitly eliminating the federal protections granted under Section 230.

Similar legislation has been introduced in other states in 2022, including a bill that has passed the Georgia State Senate and is pending before the Georgia House.

Implementation of the Florida and Texas statutes has been stayed by various federal courts, including the U.S.

Supreme Court.

On August 18, the parties in the Florida case requested, and were granted, a stay of the appeals court mandate pending Supreme Court review, and on September 21, 2022, Florida requested that the Supreme Court review the case.

On September 16, the U.S.

Court of Appeals for the Fifth Circuit issued a decision upholding the Texas law.

On September 30, the parties in that case filed an unopposed motion to stay the Fifth Circuit decision pending Supreme Court review, and the Fifth Circuit granted that request on October 13, 2022.

The parties opposing the Texas law requested that the Supreme Court review the case on December 15, 2022.

The conflict between the decisions on the two laws increases the likelihood that the Supreme Court will review these statutes.

Florida recently amended its statute in an effort to address issues that led the court to issue the stay.

It is likely that any other such state legislation also would be challenged under the First Amendment to the U.S.

24 unchanged sentences

We make business decisions about when to seek patent protection for a particular technology and when to rely upon copyright or trade secret protection, and the approach we select may ultimately prove to be inadequate.

Even in cases where we seek patent protection, there is no assurance that the resulting patents will effectively protect every significant feature of our products.

Even in cases where we seek patent protection, there is no assurance

that the resulting patents will effectively protect every significant feature of our products.

In addition, we believe that the protection of our trademark rights is an important factor in product recognition, protecting our brand and maintaining goodwill.

2 unchanged sentences

third parties may challenge our proprietary right;

pending and future

patent, trademark, and copyright applications may not be approved;

our pending and future patent, trademark, and copyright applications may not be approved;

and we may not be able to prevent infringement without incurring substantial expense.

18 unchanged sentences

We may also be required to make publicly available source code (which in some circumstances could include valuable proprietary code) for modifications or derivative works we create based upon incorporating or using the open source software and/or to license such modifications or derivative works under the terms of the particular open source license.

Additionally, if a third-party software provider has incorporated open source software into software that we license from such provider, we could be required to disclose any of our source code that incorporates or is a modification of our licensed software.

Additionally, if a third-party software provider has incorporated open source software into software that we license from such provider, we could be required to disclose our source code that incorporates or is a modification of such licensed software.

While we use tools designed to help us monitor and comply with the licenses of third-party open source software and protect our valuable proprietary source code, we may inadvertently use third-party open source software in a manner that exposes us to claims of non-compliance with the terms of their licenses, including claims of intellectual property rights infringement or for breach of contract.

Furthermore, there exists today an increasing number of types of open source software licenses, almost none of which have been tested in courts of law to provide guidance of their proper legal interpretations.

If we were to receive a claim of non-compliance with the terms of any of these open source licenses, we may be required to publicly release certain portions of our proprietary source code.

If we were to receive a claim of non-compliance with the terms of any of these open source licenses, we could be required to publicly release certain portions of our proprietary source code.

We could also be required to expend substantial time and resources to re-engineer some of our software.

6 unchanged sentences

The trading price of our Class A common stock has been and will likely continue to be volatile and could be subject to fluctuations in response to various factors, some of which are beyond our control.

For example, in connection with the COVID-19 pandemic, we have experienced an increase in the usage of our unified communications platform, and as a result, the trading price of our Class A common stock has significantly increased, while at the same time, the broader market has experienced significant declines and volatility.

There are no assurances that the trading price of our Class A common stock will

continue at this level for any period of time.

Moreover, the trading price of our Class A common stock could experience a significant decrease once the scope and impact of the COVID-19 pandemic is better understood.

For example, in connection with the COVID-19 pandemic recovery and recent changes in macroeconomic conditions such as high inflation, recessionary or uncertain environments and fluctuations in our currency exchange rates have caused uncertainty in our business and as a result, the trading price of our Class A common stock has significantly decreased along with the broader market.

There are no assurances that the trading price of our Class A common stock will continue at this level for any period of time.

These fluctuations could cause you to lose all or part of your investment in our Class A common stock.

27 unchanged sentences

Yuan, together with his affiliates, held approximately 7.7% of our outstanding capital stock but controlled approximately 31.6% of the voting power of our outstanding capital stock.

Therefore, these holders have significant influence over our management and affairs and over all matters requiring stockholder approval, including election of directors and significant corporate transactions, such as a merger or other sale of Zoom or our assets, for the foreseeable future.

such as a merger or other sale of Zoom or our assets, for the foreseeable future.

Each share of Class B common stock will be automatically converted into one share of Class A common stock upon the earliest of (i) the date that is six months following the death or incapacity of Mr.

Yuan, (ii) the date that is six months following the date that Mr.

Yuan is no longer providing services to us or his employment is terminated for cause, (iii) the date specified by the holders of a majority of the then

outstanding shares of Class B common stock, voting as a separate class, and (iv) the 15-year anniversary of the closing of our IPO.

Yuan is no longer providing services to us or his employment is terminated for cause, (iii) the date specified by the holders of a majority of the then outstanding shares of Class B common stock, voting as a separate class, and (iv) the 15-year anniversary of the closing of our IPO.

In addition, the holders of Class B common stock collectively will continue to be able to control all matters submitted to our stockholders for approval even if their stock holdings represent less than a majority of the outstanding shares of our common stock.

55 unchanged sentences

We have never declared nor paid cash dividends on our capital stock.

We currently intend to retain any future earnings to finance the operation and expansion of our business, and we do not expect to declare or pay any dividends in the foreseeable

We currently intend to retain any future earnings to finance the operation and expansion of our business, and we do not expect to declare or pay any dividends in the foreseeable future.

As a result, stockholders must rely on sales of their Class A common stock after price appreciation as the only way to realize any future returns on their investment.

2 unchanged sentences

Market opportunity estimates and growth forecasts for the markets in which we compete, including those we have generated ourselves, are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate.

Not every organization covered by our market opportunity estimates will necessarily buy video communications platforms, and some or many of those organizations may choose to continue using legacy communication methods or point solutions offered by our competitors.

Not every organization covered by our market opportunity estimates will necessarily buy video communications and collaboration platforms, and some or many of those organizations may choose to continue using legacy communication methods or point solutions offered by our competitors.

It is impossible to build every product feature that every customer or host wants, and our competitors may develop and offer features that our platform does not provide.

10 unchanged sentences

If we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster and to execute successfully on those plans in the event of a disaster or emergency, our business would be harmed.

We also face risks related to health epidemics, such as the COVID-19 pandemic, which has impacted virtually every country in the world.

We also face risks related to health epidemics, such as the COVID-19 pandemic, which impacted virtually every country in the world.

An outbreak of a contagious disease, and other adverse health developments could have an adverse effect on global economic conditions and on our business.

The effects could include business and service disruptions, such as the temporary closure of our facilities, restrictions on our employees' ability to travel to support our facilities and services, and difficulties in hiring new employees.

We have removed the 40-minute time limit from our free Basic accounts for customers in K-12 schools in certain countries.

While we have seen increased usage of our service globally, a significant portion of such increase is attributable to free Basic accounts, which do not generate any revenue.

We cannot make any assurances that we will experience an increase in paid hosts or that new or existing users will continue to utilize our services at the same levels after the COVID-19 pandemic has tapered.

We cannot make any assurances that we will experience an increase in paid hosts or that new or existing users will continue to utilize our services at the same levels during the COVID-19 pandemic recovery.

Furthermore, such increased usage by free Basic account users during this time has required and will continue to require us to expand our network capacity which will increase our operating costs.

3 unchanged sentences

The financial success of our investments in any privately held company is typically dependent on a liquidity event, such as a public offering, acquisition or other favorable market event reflecting appreciation to the cost of our initial investment.

In addition, valuations of privately held companies are inherently complex due to the lack of readily available market data.

Likewise, the financial success of our investment in any publicly held company is typically dependent upon an exit in favorable market conditions, and to a lesser extent on liquidity events.

2 unchanged sentences

We record all fair value adjustments of our publicly traded and privately held non-marketable securities through the consolidated statement of operations.

As a result, we may experience additional volatility to our statements of operations due to changes in market prices of our investments in publicly held securities and the valuation and timing of observable price changes or impairments of our investments in privately held securities.

As a result, we may experience additional volatility to our statements of operations due to

changes in market prices of our investments in publicly held securities and the valuation and timing of observable price changes or impairments of our investments in privately held securities.

Our ability to mitigate this volatility in any given period may be impacted by our contractual obligations to hold securities for a set period of time.

All of our investments are subject to a risk of

a partial or total loss of investment capital.

All of our investments are subject to a risk of a partial or total loss of investment capital.

Changes in the fair value or partial or total loss of investment capital of these individual companies could be material to our financial statements and negatively impact our business and financial results.

7 unchanged sentences

We evaluate financing opportunities from time to time, and our ability to obtain financing will depend, among other things, on our development efforts, business plans, operating performance, and condition of the capital markets at the time we seek financing.

We cannot assure you that additional financing will be available to us on favorable terms when required, or at all.

We cannot assure you that additional financing will be available to us on favorable terms when required, or at all, particularly during times of market volatility and general economic instability.

If we raise additional funds through the issuance of equity or equity-linked or debt securities, those securities may have rights, preferences, or privileges senior to the rights of our Class A common stock, and our stockholders may experience dilution.

14 unchanged sentences

Further, weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future.

Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement could harm our business or cause us to fail to meet our reporting obligations and may result in a restatement of our consolidated financial statements for prior periods.

our consolidated financial statements for prior periods.

Any failure to implement and maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we will eventually be required to include in our periodic reports that will be filed with the SEC.

Ineffective disclosure

controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock.

Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock.

In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on The Nasdaq Stock Market.

16 unchanged sentences

The impact of these events would also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, on committees of our board of directors, or as members of senior management.

Investors’ and other stakeholders’ expectations of our performance relating to environmental, social and governance factors may impose additional costs and expose us to new risks.

There is an increasing focus from certain investors, customers, employees, and other stakeholders concerning environmental, social and governance matters (“ESG”).

Some investors may use these non-financial performance factors to guide their investment strategies and, in some cases, may choose not to invest in us if they believe our policies and actions relating to ESG are inadequate.

We may face reputational damage in the event that we do not meet the ESG standards set by various constituencies.

As ESG best practices and reporting standards continue to develop, we may incur increasing costs relating to ESG monitoring and reporting and complying with ESG initiatives.

For example, the SEC has recently proposed climate change and ESG reporting requirements, which, if approved, would increase our compliance costs.

We may also face greater costs to comply with new ESG standards or initiatives in the European Union.

We recently published our ESG Report for fiscal year 2022, which describes, among other things, the measurement of our greenhouse gas emissions in 2021 and our efforts to reduce emissions.

In addition, our ESG Report provides highlights of how we are supporting our workforce, including our efforts to promote diversity, equity, and inclusion.

Our disclosures on these matters, or a failure to meet evolving stakeholder expectations for ESG practices and reporting, may potentially harm our reputation and customer relationships.

regulatory standards and market standards, certain new or existing customers, particularly those in the European Union, may impose stricter ESG guidelines or mandates for, and may scrutinize relationships more closely with, their counterparties, including us, which may lengthen sales cycles or increase our costs.

Furthermore, if our competitors’ ESG performance is perceived to be better than ours, potential or current investors may elect to invest with our competitors instead.

In addition, in the event that we communicate certain initiatives or goals regarding ESG matters, we could fail, or be perceived to fail, in our achievement of such initiatives or goals, or we could be criticized for the scope of such initiatives or goals.

If we fail to satisfy the expectations of investors, customers, employees and other stakeholders or our initiatives are not executed as planned, our business, financial condition, results of operations, and prospects could be adversely affected.

Climate change may have an impact on our business.

While we seek to mitigate our business risks associated with climate change (such as drought, wildfires, hurricanes, increased storm severity and sea level rise), we recognize that there are inherent climate-related risks wherever business is conducted.

Our primary locations may be vulnerable to the adverse effects of climate change.

For example, certain of our offices have experienced, and are projected to continue to experience, climate-related events at an increasing frequency, including drought, heat waves, wildfires and resultant air quality impacts and power shutoffs associated with wildfire prevention.

Changing market dynamics, global policy developments and the increasing frequency and impact of extreme weather events on critical infrastructure in the U.S.

and elsewhere have the potential to disrupt our business, the business of our third-party suppliers and the business of our customers, and may cause us to experience losses and additional costs to maintain or resume operations.

In addition, we may be subject to increased regulations, reporting requirements, standards or expectations regarding the environmental impacts of our business.

UNRESOLVED STAFF COMMENTS

Our corporate headquarters is located in San Jose, California, where we lease approximately 103,000 square feet of commercial space pursuant to operating leases that expire in the fiscal year ending January 31, 2030.

In addition, we maintain additional offices in the United States and internationally in APAC and EMEA.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors