Risk Factors Update Summary

• Increased investments in AI technology, including generative AI, pose risks and uncertainties for the company's future.
• Numerous states enacted consumer privacy laws comparable to CCPA, with Virginia enacting the Virginia Consumer Data Protection Act, effective January 1, 2023.
• The accumulated deficit decreased from $4 billion to $3 billion, indicating improved financial performance.
• Colorado and Connecticut enacted the Colorado Privacy Act and the Connecticut Personal Data Privacy and Online Monitoring Act, effective July 1, 2023.
• The European Commission issued an adequacy decision for personal data transfers from the EEA to the UK, with a sunset clause of four years.
• Net loss decreased from $378 million to $338 million, showing progress in cost management.
• The restructuring plan in June 2023 aimed to improve operational efficiencies and align workforce with business needs.
• Utah enacted the Utah Consumer Privacy Act, effective December 31, 2023, with eight other states enacting privacy legislation between July 1, 2024, and January 2024.
• The European Commission adopted the new EU-US Data Privacy Framework, allowing transfers of personal data from the EU to certified US companies without additional safeguards.
• Revenue growth is expected to slow or decline as the company matures.
• Acquisitions of companies like PingSafe and Stride may disrupt operations and dilute stockholder value.
• The UK GDPR and GDPR require compliance, with potential fines of up to €20 million or 4% of annual global turnover.
• The UK-US Data Bridge was adopted, enabling personal data transfers between the UK and US entities without additional safeguards, subject to legal challenges.
• The number of employees increased from over 1,200 to over 2,300, impacting operational efficiency.