Risk Factors Update Summary

• Several states have passed comprehensive privacy laws that will take effect over the next few years, increasing compliance costs.
• Historical growth may not be sustainable. Expect net revenues to grow more slowly or decline.
• Disclosure under state data breach notification laws can be costly, potentially leading to adverse consequences.
• Net revenues expected to grow more slowly in the near term and decline in the long term.
• Violation of data or security laws may result in substantial fines and penalties.
• Customer acquisition costs may increase over time, impacting net revenues.
• Recent legal developments in the EEA and UK have created complexity regarding data transfers.
• Slowdown in customer growth and repeat purchases may lead to decreased revenues.
• Changes in technology affecting tracking methods could decrease data quality and impact targeted advertising.
• Impact of healthcare workforce stress on customer behavior may affect demand for products.
• Non-compliance with PCI-DSS could lead to fines, penalties, restrictions, and expulsion from card programs.
• New products and innovations may not receive the same level of customer acceptance.
• Inclusion/exclusion from indices due to dual-class structure may impact investor interest and stock price.
• Expansion into international markets may expose the company to new risks and challenges.