Booking Holdings (BKNG) Risk Analysis

There are several privacy-driven initiatives that are changing the collection and use of consumer data in the digital marketing ecosystem. These include: requirements by browsers such as Safari and Google Chrome to require opt-in consent for third-party cookies; restrictions on the use of the identifier for advertisers (such as the Apple "IDFA") by mobile device manufacturers; Apple's iCloud+ Private Relay (which hides a user's IP address from websites that the user accesses in favor of other IP addresses provided by Apple's partners); and the adoption of regulations that govern the use of cookies. For example, in the EU, the ePrivacy Directive regulates the use of cookies and similar technologies, including limitations on the use of data and guidelines for enabling users to accept or reject cookies. Authorities may assert, and in some cases are likely to determine, that our collection, use, or management of customer and other data is inconsistent with laws and regulations, including laws that apply to cookies or similar technology, and there may be significant penalties for non-compliance. In the EU, the ePrivacy Directive is implemented in national laws as a result of which different interpretations and requirements apply on a country by country basis. EU regulators continue to issue guidance concerning the ePrivacy Directive's requirements regarding the use of cookies and similar technologies and may impose specific measures which could impact our use of such technologies. In addition, the ePrivacy Directive and national implementation laws impose additional limitations on the use of data across messaging products and include significant penalties for non-compliance. In the U.S., disclosure requirements and limitations may apply to the use of certain cookies and other online tracking technologies deemed to be sales of personal information under the CCPA or other state laws. If these initiatives or regulations impair our ability to serve customers or if we are less effective than our competitors in addressing these issues, our ability to improve performance on our platforms, business, competitive position, and results of operations could be adversely affected. Further, failure or perceived failure to comply with evolving privacy regulations, guidance, and interpretations could result in significant fines, government enforcement actions, private litigation, and harm to our business, results of operations, or reputation.

The Netherlands corporate income tax law provides that income generated from qualifying innovative activities is taxed at the rate of 9% ("Innovation Box Tax") rather than the Dutch statutory rate of 25.8%. A portion of Booking.com's earnings historically qualified for Innovation Box Tax treatment. Should this benefit be reduced or eliminated, it could substantially increase our effective tax rate and adversely impact our results of operations and cash flows.

We depend on software and computing infrastructure (including open source software) for the operation of our business. If threat actors are able to circumvent, interrupt, or adversely affect our security measures, including as a result of our own acts or omissions, it could result in a compromise or breach of consumer, partner, or employee data. Data security is essential to maintaining consumer and partner confidence in our services and the uninterrupted availability of our web and mobile platforms is essential for our business. With cyberattacks evolving and increasing in frequency and sophistication, we may not be able to successfully defend against determined adversaries. In addition, our security policies and controls may not keep pace with the innovation of our offerings and technological advances of threat actors. Threat actors may exploit AI-based technologies to breach systems and weaponize AI to target our employees to gain unauthorized access to systems and data. Furthermore, the emergence of quantum technologies may enable threat actors to overcome traditional encryption protocols and launch more sophisticated AI-enabled attacks at scale. We have experienced and responded to cyberattacks, which we believe have not had a material impact on the integrity of our systems or the security of data we maintain. Vulnerabilities in our consumer and partner systems could and have resulted in unauthorized access to personal and confidential data. These risks are likely to increase as we expand our offerings, integrate our products and services, continue to incorporate AI, and store and process more data. The disclosure of sensitive Company, consumer, or other information through our systems or by our workforce or other parties could lead to information loss, reputational harm, monetary damages, regulatory penalties, or worse competitive positioning. We expend significant resources to protect against security breaches and to maintain or increase our security capabilities. Security breaches could result in damage to our reputation, expose us to risk of litigation and liability, subject us to regulatory penalties and sanctions, or cause consumers to lose confidence in us, any of which could have an adverse effect on our brands, competitive positioning, results of operations, and financial condition. Our efforts to protect information from unauthorized access have and could in the future result in the rejection or delay of legitimate attempts to book reservations through our services, which could result in lost business. Additionally, our consumers' personal data has in the past and could in the future be affected by inadvertent disclosure to, or security breaches at, our partners or other third parties upon which we rely. We receive and store a large volume of personally identifiable data and payment information. The handling and storage of such data, as well as privacy rights of consumers, are subject to complex and evolving laws and regulations. While we invest significant resources to comply with regulations such as the EU's General Data Protection Regulation ( "GDPR"), the California Consumer Privacy Act ("CCPA"), the Personal Information Protection Law in the People's Republic of China, the Digital Personal Data Protection Act in India, and the EU Digital Markets Act ("DMA"), they are complex, subject to uncertain interpretation, and impose significant compliance obligations and costs on us. For example, under the GDPR violations could result in fines of up to 20 million Euros or up to 4% of the annual global revenues of the infringer, whichever is greater. In many cases, these laws apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information. These laws and their interpretations continue to develop and may be inconsistent from jurisdiction to jurisdiction. Some of these regulations give consumers a private right of action against companies for certain alleged violations of cybersecurity requirements. Non-compliance with these laws could result in damage to our reputation, significant penalties, or other liability. If laws or regulations are expanded to require changes in our business practices, or interpreted in ways that negatively affect our business, our results of operations, financial condition, or competitive position could be adversely affected.

We compete in markets characterized by rapidly changing technology, evolving industry standards, consolidation, frequent product developments, and changing consumer preferences. These characteristics are heightened by the progress of technology adoption, including the continuing adoption of online commerce, growth of mobile transactions and payment, and the development of Gen AI capabilities. We may not be able to keep up with these rapid changes. Our long-term strategy to commercialize the Connected Trip will require increased investments that could have an adverse impact on our results of operations until we achieve the expected return on these investments. The development of the Connected Trip is subject to uncertainties, including further development of the verticals and technological capabilities (including integrating Gen AI) necessary for the Connected Trip experience, the ability to collect, store, and use customer data in a compliant and integrated fashion, and the attraction and retention of employees dedicated to this effort. It may take longer than we expect to realize the Connected Trip vision or it may not achieve the expected return on investment. Our ability to offer a variety of appropriate payment solutions is an important part of our Connected Trip vision. These efforts may also be unsuccessful in improving the travel experience or retaining and attracting new customers. Further, regulatory restrictions may impact the ongoing commercialization of the Connected Trip or increase our costs of compliance. With any technical innovation such as the Connected Trip effort, there could be vulnerabilities and other technical failures, which could result in lost business, harm to our brand or reputation, consumer complaints, or other adverse consequences, any of which could adversely affect our business and results of operations. We may not be able to keep pace with the competitive pressure to innovate. Other companies, including emerging start-ups and large technology companies utilizing proprietary Gen AI or similar capabilities, may innovate or develop new services and technologies faster than we can or may foresee consumer need for new services or technologies before we do. Gen AI and other new technologies could influence how consumers search for and book travel, diminish the relevance or competitiveness of our existing technology and service offerings, or require us to modify or adapt our services or infrastructure, any of which could adversely affect our results of operations and financial condition. Consumers increasingly use mobile devices and apps to make online travel bookings, and may in the future use Gen AI-enabled devices to make bookings. The revenues earned on a mobile transaction may be less than a desktop transaction due to different purchasing patterns. To the extent mobile devices or platforms enable users to block advertising content, our advertising revenue and ability to market our brands may also be negatively affected. If we are unable to attract consumers to our mobile platforms, or app store providers like Google and Apple use their app distribution, mobile operating, or payment platforms to favor competing services, our business, competitive position, future growth, and results of operations could be adversely affected.

We are subject to competition and consumer protection laws and regulations around the world. These laws and regulations evolve, and their interpretation, application, and enforcement can also change, be unpredictable, or be affected by changing political or social pressures. As we expand our business into new areas, including building the Connected Trip vision and integrating Gen AI into our offerings, we may become subject to additional laws and regulations. We have been the subject of investigations or inquiries by national competition authorities ("Competition Authorities") and other governmental authorities regarding competition law matters, consumer protection issues, and other areas. For example, we are involved in investigations related to whether certain of Booking.com's arrangements with accommodation providers are anti-competitive, including with respect to issues like contractual parity, pricing tools or programs offered to partners, or the ranking criteria used in displaying results to consumers. See Note 16 to our Consolidated Financial Statements for information regarding certain legal proceedings in which we are involved. To resolve certain of the proceedings or investigations we have been or are involved in, we have made commitments regarding future business practices or activities including related to our parity arrangements, the information we provide about our search results ranking, and how we display prices, discounts, and popularity and availability statements. Though we have taken steps to comply with such commitments, investigating authorities or third parties may assert that our measures are insufficient and may pursue further action or seek other remedies. We cooperate with regulators but are unable to predict what, if any, effect any investigations or their resolution, including the effect of any commitments we might make, will have on our business, industry practices, or online commerce more generally. An unfavorable outcome in an investigation could encourage additional regulatory inquiries that could become widespread over time, significantly increasing the potential financial and reputational impact on us. To the extent that investigations or inquiries result in additional commitments, changes to our business practices, negative publicity, fines, damages from private litigation, or other remedies, it could have a material adverse effect on our business, financial condition, and results of operations. Competition and consumer-law-related investigations, legislation, judgments, or issues have in the past resulted in and could in the future result in private litigation. We are currently involved in such litigation and aware of such potential litigation. For example, a Dutch consumer group has filed a claim against Booking.com relating to the historical use of contractual parity provisions, as well as allegations that Booking.com and Agoda employed misleading practices, and we are aware of similar efforts to pursue potential claims in other jurisdictions. See Note 16 to our Consolidated Financial Statements for more information regarding this and other such claims or potential claims. Class action litigation can be time-consuming, costly, and unpredictable, regardless of merit, and there may be evolving jurisprudence and less experience with such matters in certain of the geographies where we are or may be involved in such litigation, making outcomes less certain and harder to forecast. If we were to be found liable, it could result in, among other things, payment of damages, commitments to change certain business practices, or reputational damage, any of which could harm our business, results of operations, brands, or competitive position. There is significant legislative and public focus on the technology industry, especially as technology companies become larger. In some instances, countries have passed legislation that goes further to restrict business activities than actions taken by Competition Authorities or other regulatory authorities. The EU's Platform to Business Regulation regulates the relationship between online platforms such as Booking.com and European business users of online platforms. The DMA and DSA give EU regulators more instruments to investigate and regulate digital businesses and impose additional rules and requirements on platforms designated as "gatekeepers" under the DMA and online platforms more generally, with separate rules for "Very Large Online Platforms" ("VLOPs") under the DSA. As a result of our designation as a gatekeeper under the DMA and Booking.com's designation as a VLOP under the DSA, we are subject to additional rules and regulations that may not be applicable to our competitors. For example, Booking.com has implemented changes to address the DMA prohibition on parity arrangements in the European Economic Area and the requirements regarding the usage of data across services, which could adversely impact our business. As a gatekeeper, we also established a compliance function to monitor compliance with the DMA. Under the DSA, as a VLOP, Booking.com is required to collect more information from partners, which could disincentivize certain partners from using our services. Booking.com is also subject to additional scrutiny, obligations, and costs, such as payment of an annual supervisory fee, annual risk assessments and independent audits, and maintaining a compliance function. The DMA and DSA each have significant penalties for non-compliance, and could lead to private litigation. Our compliance costs have increased in connection with becoming subject to the DMA and DSA, each of which remains subject to further interpretation and regulatory engagement, and could require additional changes to our products, business practices, and compliance activities. If future legislation utilizes a "gatekeeper" or VLOP designation to extend its scope, we could be subject to further regulations, restrictions, or compliance or other obligations that are not applicable to our competitors. The EC designates VLOPs based on a platform's number of EU "monthly active recipients" ("MARs"). The EC requires counting users who display and to whom information was displayed (e.g., partners and consumers), even if a user does not make a transaction on the platform. The assessment of MARs and any other similarly published information by our brands represents an estimate based on the data available to us and limited guidance, and is subject to limitations. Any such estimate is published solely as required by applicable rules or regulations, may be inaccurate, and should not be used for any other purpose. New laws and regulations could impact our services, require us to change our business practices, and impose additional complexity and costs. As market conditions change as a result of investigations, litigation, legislation, changing public perception of the industry, or political or social pressure, we may decide to modify our business practices beyond what is required, the full effects of which may not be known when making the decision, but which could harm our competitive position and adversely affect our business and results of operations. One area of potential regulatory inquiry, for instance, involves contractual restrictions such as online search term bidding restrictions. If these or other restrictions are held to be illegal or otherwise unenforceable, or if we remove them from our contracts, it could negatively impact our business. With additional attention on the size of travel or technology companies generally, our size and competitive position may negatively affect our ability to obtain regulatory approval of proposed acquisitions or other opportunities, our ability to expand into complementary businesses, or our latitude in dealing with travel service providers (such as by limiting our ability to provide discounts, rebates, or incentives or to exercise contractual rights), any of which could adversely affect our business, results of operations, or ability to grow and compete.

Our results have been and will likely continue to be negatively impacted by consumer purchases made using fraudulent payment cards, claims the consumer did not authorize the purchase, or consumers who have closed bank accounts or have insufficient funds in their bank accounts to satisfy payments. We may be held liable for fraudulent transactions on our platforms, as well as other payment disputes. Accordingly, we calculate and record an allowance for resulting chargebacks. If we are unable to successfully implement and evolve measures to detect and reduce the risk of fraud on our platforms, our business, profit margins, results of operations, and financial condition could be materially adversely affected. We process the majority of our transactions on a merchant basis where we facilitate payments from travelers through payment cards and other payment methods. While processing transactions on a merchant basis allows us to offer a variety of payment methods and flexible transaction terms, we incur additional payment processing costs (which are typically higher for foreign currency transactions) and other costs related to these transactions, such as costs related to managing and detecting fraudulent payments and transactions. These costs may increase as we expand our payments services to consumers and partners, and our results of operations and profit margins could be materially adversely affected. As a greater percentage of our transactions involve us processing payments, our global systems and processes must be managed on a larger scale, which adds complexity, administrative burdens and costs, and increases the demands on our systems and controls, which could adversely affect our results of operations. In addition, as our payment processing activities develop or expand into different geographies, we are subject to additional regulations, including financial services and export controls regulations, which would result in increased compliance costs and complexities, including those associated with the implementation of new or advanced internal controls. Compliance with and implementation of the EU's Payment Services Directive 2 and similar or successor legislation such as the EU's Payment Services Directive 3 and Payment Services Regulations may be difficult to adhere to in a timely manner or at all and may result in increased compliance costs, and be administratively burdensome, any of which could negatively impact our business and results of operations. Regulators (or we) may determine, and in some cases are likely to determine, that certain aspects of our business are subject to laws that govern payments activities, such as money transmission and online payments processing, which could require us to obtain licenses to continue to operate in certain jurisdictions or result in modification or interruption of our business plans, which would materially adversely affect our business and results of operations. We have invested and will need to continue to invest substantial resources to comply with applicable laws and regulations, and failure to maintain compliance with applicable licensing requirements, payment services, customer fund safeguarding, or related regulations could lead to fines, which could be significant, or require us to modify or interrupt our business practices, plans, or operations, any of which could negatively impact our business, results of operations, and profit margins. Certain of our subsidiaries that provide payment services in support of our brands are subject to licensing and regulations that impose notice and approval obligations on investors that seek indirect or direct ownership, in the aggregate, of 10% or more of our outstanding shares. Regulations relating to operational resilience, including the EU's Digital Operations Resilience Act, consumer protection, privacy, and security of our processes also apply to us. Further, our payments systems are susceptible to illegal and improper uses, including money laundering, terrorist financing, fraudulent sales of goods or services, and transactions by or with sanctioned parties. We are also subject to payment card association rules and obligations under our contracts with the card schemes and our payment card processors, and indirectly to the rules of payment systems in respect of credit (i.e., account to account) transfers. The rules of the card schemes and payment systems are often updated or interpreted in different ways, and we may need to adjust our systems and/or processes to comply with updated obligations. If we fail to comply with such obligations, we may be fined, required to pay additional processing fees, lose our ability to accept certain credit and debit card payments from our customers, or facilitate other types of online payments, any of which would negatively impact our business, operating results, and profit margins. Under card association rules, including the Payment Card Industry Data Security Standard (the "Standard"), if information is compromised, we could be liable to payment card issuers for associated expenses and penalties, and in some cases, we could be restricted in our ability to accept payment cards. Under certain circumstances in our agreements with the card schemes and in relation to the Standard, we are also subject to periodic audits, self-assessments, and other assessments of our compliance with the rules and obligations of the payment card associations and the Standard, which could result in additional expenses and administrative burdens. In addition, if we fail to follow the Standard, even if no consumer information is compromised, we could incur significant fines or experience a significant increase in payment card transaction costs. Compliance with the Standard may not prevent all security incidents. We rely on banks, card schemes, and other payment processors to execute certain components of the payments process. For inbound payments, we pay these third parties interchange and other processing and gateway fees to facilitate payments from consumers to travel service providers. If we are unable to maintain our relationships with these third parties on favorable terms, fees are increased, or if we provide security, our profit margin, business, and results of operations could be harmed. Additionally, if these third parties experience service disruptions or if they cease operations, consumers and travel service providers could have difficulty making or receiving payments, which could adversely impact our reputation, business, and results of operations. In addition, in the event that one of our major travel service providers declares bankruptcy or otherwise ceases or limits operations, we could experience an increase in chargebacks from customers with travel reservations with such travel service provider and we could experience financial loss from certain prepayments made to such travel service provider if we are not able to recover the prepayments.

We rely on third parties to make their services available to consumers for reservation through us. Our travel service providers are generally not required to make available any specific quantity of reservations, or to make reservations available in any geographic area, for any particular route, or at any particular price. Our restaurants are generally not required to provide all of their available tables and reservations to consumers through us. Our arrangements with OTCs and travel service providers to provide information in connection with KAYAK's meta-search services are non-exclusive and terminable with little notice. A significant reduction on the part of any of our major travel service providers or restaurants for a sustained period of time or their withdrawal from our services, including due to a provider's bankruptcy or closure, could have an adverse effect on our business, advertising revenue, competitive position, and results of operations. Further, as industry consolidation, including among travel service providers, increases, the potential adverse effect of reduced usage or withdrawal from our services by a significant travel service provider also increases. A significant portion of consumer traffic to our services is derived from third-party platforms, including Google and other search engines, mobile operating systems, app marketplaces, mapping services, and other digital distribution channels. These platforms increasingly incorporate Gen AI features, such as AI-generated answers, assistants, and recommendations, that may satisfy user intent without directing users to our services or may favor the platform's own or affiliated offerings. Changes in algorithms, ranking methodologies, user interfaces, access terms, pricing, or the placement of AI-generated content by these platforms could reduce the visibility of our services, increase customer acquisition costs, or decrease traffic and bookings. In addition, platform providers may restrict data access, limit interoperability, or impose commercial terms that disadvantage us relative to competing or native AI-enabled services. If we are unable to maintain favorable placement, access, or economics across traditional digital search as well as evolving AI-mediated distribution channels, our distribution of travel and restaurant reservations through such third-party distribution channels is likely to decline and our business, competitive position, and results of operations could be adversely affected. We offer a range of insurance products related to our travel offerings, primarily through third-party insurance providers. Our business and reputation may be adversely affected if such providers no longer make such offerings available to us on economically reasonable terms or at all.