BuzzFeed (BZFD) Risk Factors

We may seek to incorporate AI solutions into our products, services and applications. As with many innovations, AI presents risks, challenges, and unintended consequences that could impact our successful ability to incorporate the use of AI in our business. For example, our AI algorithms may be flawed and not achieve sufficient levels of accuracy or contain biased information. In addition, our competitors or other third parties may incorporate AI solutions into their products more quickly or more successfully than us, and their AI solutions may achieve higher market acceptance than ours, which may result in us failing to recoup our investments in developing AI-powered applications. Our ability to employ AI, or the ability of our competitors to do so better, may impair our ability to compete effectively, result in reputational harm and have a material adverse impact on our operating results. Moreover, AI may give rise to litigation risk, including potential intellectual property or privacy liability. Because AI is an emerging technology, there is not a mature body of case law construing the appropriateness of certain of its uses of data - whether through the employment of large language models or other models leveraging data found on the Internet - and the evolution of this law may limit our ability to exploit AI tools, or expose us to litigation. Further, AI presents emerging ethical issues and if our use of AI algorithms draws controversy due to their perceived or actual impact on society, we may experience brand or reputational harm, competitive harm or legal liability.

Our operations involve the collection, storage, use, and transmission of personal and proprietary information of certain of our users, advertisers, and partners on our equipment, networks, and corporate systems. Our efforts to protect our sensitive information, including information that our users, advertisers, and partners have shared with us, may be unsuccessful due to the actions of third parties, including traditional "black hat" hackers, nation states, nation-state supported groups, organized criminal enterprises, hacktivists, and our personnel and contractors (through theft, misuse, or other risk). We and the third parties on which we rely may be subject to a variety of evolving threats, including social-engineering attacks, malware, malicious code, hacking, credential stuffing and denial of service. Security breaches expose us to a risk of loss of this information, operational disruptions, litigation, remediation costs, increased costs for security measures, ransomware, loss of revenue, damage to our reputation, and potential liability. Any system failure or compromise of our security that results in the unauthorized access to or release of our traffic's or advertisers' data, could significantly limit our content delivery and traffic engagement, as well as harm our reputation and brands and, therefore, our business. Our security measures may also be breached due to employee error, malfeasance, or otherwise. In particular, severe ransomware attacks are becoming increasingly prevalent. To alleviate the financial, operational, and reputational impact of these attacks, it may be preferable to make extortion payments, but we may be unwilling or unable to do so, including, for example, if applicable laws or regulations prohibit such payments. And, even if we make such payments, cyber threat actors may still disclose data, engage in further extortion, or otherwise harm our systems or data. Moreover, for certain employees, we permit a remote working environment, which has increased risks to our IT systems and data, as our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations. In addition, cyber threat actors have also increased the complexity of their attempts to compromise user accounts, despite our defenses and detection mechanisms to prevent these account takeovers. User credentials may be obtained off-platform, including through breaches of third-party platforms and services, password stealing malware, social engineering, or other tactics and techniques like credential harvesting, and used to launch coordinated attacks. Some of these attacks may be hard to detect at scale and may result in cyber threat actors using our service to spam or abuse other users, access user personal data, further compromise additional user accounts, or to compromise employee account credentials or social engineer employees into granting further access to systems. In addition, we rely on the technology and systems provided by third-party vendors (including cloud-based service providers) for a variety of operations, including encryption and authentication technology, employee email, domain name registration, content delivery to customers, administrative functions (including payroll processing and certain finance and accounting functions), and other operations. Our ability to monitor the information security practices of these third parties is limited, and these third parties may not have adequate information security measures in place despite their contractual representations to implement such measures and our third-party service provider vetting process. If these third parties fail to implement adequate data security practices or fail to comply with our terms, policies, or contractual obligations, our sensitive information may be improperly accessed or disclosed, and we may experience adverse consequences. Even if these third parties take all of these steps, their networks may still suffer a breach, which could compromise our sensitive information. We or our third-party providers may also experience failures or malfunctions of hardware or software, the loss of technology assets, or the loss of data that, while not caused by threat actors, may have a similar impact and risk to our business. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, or cause the loss of our data or prolonged downtime, any award may be insufficient to cover our damages, or we may be unable to recover such award. Additionally, hardware, software or applications we procure from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise network and data security. We also currently use open-source software and anticipate possibly using open-source software in the future. The use of certain open-source software can lead to greater risks than use of third-party commercial software, as open-source licensors generally do not provide warranties or controls on the origin of software. Additionally, outside parties may attempt to fraudulently induce our employees, traffic or advertisers to disclose sensitive information in order to gain access to our data or our traffic's or advertisers' data or accounts, or may otherwise obtain access to such data or accounts. Further, our systems, and those of third parties upon which our business relies, may be vulnerable to interruption or damage that can result from natural disasters or the effects of climate change (such as increased storm severity and flooding), fires, power or Internet outages, acts of terrorism or other similar events. If any of these or similar events occur, our or our third-party partners' sensitive information and IT systems could be compromised, resulting in a security incident or other interruption. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect and remediate vulnerabilities in our information systems (such as our hardware and software, including that of third parties upon which we rely), and we work with security researchers through our bug bounty program to help us identify vulnerabilities. We may not, however, detect, become aware of, and remediate all such vulnerabilities including on a timely basis, and there is no guarantee security researchers will disclose all vulnerabilities they become aware of or do so responsibly. Further, we may experience delays in developing or deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security or privacy incident. Information security threats are constantly evolving, increasing the difficulty of detecting and successfully defending against them. To date, no incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. However, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. If a perceived breach of our security occurs or an actual breach of our security that results in degraded website or application performance, unauthorized access, availability problems, or the loss or unauthorized disclosure of confidential information occurs, the market perception of the effectiveness of our security measures could be harmed, our traffic, advertisers, and partners may lose trust and confidence in us or decrease the use of our websites, applications or services or stop using our services in their entirety; and we may incur significant legal and financial exposure, including legal claims, higher transaction fees, and regulatory fines and penalties. Despite our implementation of network security measures, our servers are vulnerable to computer viruses, malware, worms, hacking, physical and electronic break-ins, router disruption, sabotage or espionage, and other disruptions from unauthorized access and tampering, as well as coordinated denial-of-service attacks. We may not be in a position to promptly address attacks or to implement adequate preventative measures if we are unable to immediately detect such attacks. Any of these actions could have a material adverse effect on our business, reputation, and operating results. Such events could result in large expenditures to investigate or remediate, to recover data, to repair or replace networks or information systems, including changes to security measures, to deploy additional personnel, to defend litigation or to protect against similar future events, and may cause damage to our reputation or loss of revenue. Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our systems and sensitive information. Any security incident experienced by us or our third-party partners could damage our reputation and our brand, and diminish our competitive position. Applicable privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents. Such disclosures are costly and the failure to comply with these legal requirements could lead to adverse consequences. Governments and regulatory agencies (including the SEC) have and may continue to enact new disclosure requirements for cybersecurity events. In addition, affected users or government authorities could initiate legal or regulatory action against us, including class-action claims, mass arbitration demands, investigations, penalties, and audits, which could be time-consuming and cause us to incur significant expenses or liabilities or result in orders or consent decrees forcing us to modify our business practices. We could also experience loss of user or advertiser confidence in the security of our platform, additional reporting requirements or oversight, restrictions on processing sensitive information, claims by our partners or other relevant parties that we have failed to comply with contractual obligations or our policies, and indemnification obligations. We could also spend material resources to investigate or correct the incident and to prevent future incidents. Maintaining the trust of our users is important to sustain our growth, retention, and user engagement. Concerns over our privacy and security practices, whether actual or unfounded, could damage our reputation and brand and deter users, advertisers, and partners from using our products and services. Any of these occurrences could seriously harm our business.

Competition for traffic to, and engagement with, our content, products and services is intense. We compete against many companies to attract and engage traffic, including companies that have greater financial resources and larger user bases, and companies that offer a variety of Internet and mobile device-based content, products and services. As a result, our competitors may acquire and engage traffic at the expense of the growth or engagement of our traffic, which would negatively affect our business. We believe that our ability to compete effectively for traffic depends upon many factors both within and beyond our control, including: - the popularity, usefulness, and reliability of our content compared to that of our competitors;- the timing and market acceptance of our content;- the continued expansion and adoption of our content;- our ability, and the ability of our competitors, to develop new content and enhancements to existing content;- our ability, and the ability of our competitors, to attract, develop, and retain influencers and creative talent;- our ability, and the ability of our competitors, to develop measures for traffic, time spent and content engagement on emerging platforms, particularly platforms where no effective measurement tools currently exist;- the frequency, relative prominence and appeal of the advertising displayed by us or our competitors;- changes mandated by, or that we elect to make to address, legislation, regulatory constraints or litigation, including settlements and consent decrees, some of which may have a disproportionate impact on us;- our ability to attract, retain and motivate talented employees;- the costs of developing and procuring new content, relative to those of our competitors;- acquisitions or consolidation within our industry, which may result in more formidable competitors; and - our reputation and brand strength relative to our competitors. We also face significant competition for advertiser spending. We compete against online and mobile businesses and traditional media outlets, such as television, radio and print, for advertising budgets. In determining whether to buy advertising, our advertisers will consider the demand for our content, demographics of our traffic, advertising rates, results observed by advertisers, and alternative advertising options. The increasing number of digital media options available, through social networking tools and news aggregation websites, has expanded consumer choice significantly, resulting in traffic fragmentation and increased competition for advertising. In addition, some of our larger competitors have substantially broader content, product or service offerings and leverage their relationships based on other products or services to gain additional share of advertising budgets. We will need to continue to innovate and improve the monetization capabilities of our websites and our mobile products in order to remain competitive. We believe that our ability to compete effectively for advertiser spending depends upon many factors both within and beyond our control, including: - the size and composition of our user base relative to those of our competitors;- our ad targeting capabilities, and those of our competitors;- our ability, and the ability of our competitors, to adapt our model to the increasing power and significance of influencers to the advertising community;- the timing and market acceptance of our advertising content and advertising products, and those of our competitors;- our marketing and selling efforts, and those of our competitors;- the pricing for our advertising products and services relative to those of our competitors;- the return our advertisers receive from our advertising products and services, and those of our competitors; and - our reputation and the strength of our brand relative to our competitors.

Our business depends on the overall demand for advertising in the markets in which we operate and on the business condition of our current and prospective partners and advertisers. Macroeconomic factors in the U.S. and foreign markets, including adverse economic conditions, general uncertainty about economic recovery or growth, elevated interest rates, high unemployment, and rising inflation, could cause advertisers to reduce their advertising budgets. These macroeconomic factors have adversely affected our advertising and content revenues in 2023 and we expect these factors will continue to adversely impact our revenue in 2024. Additionally, because of these pressures, certain advertisers may not have the budget for marketing expenditures. Our business may also be negatively impacted by geopolitical concerns, which may result in conservative approaches by advertisers when allocating budgets and ad inventory. Reductions in overall advertising spending as a result of these factors, which are out of our control, or due to the occurrence of unanticipated events could result in a decrease in our revenue and potential profit or make it difficult to predict our future performance, any of which could adversely affect our business, results of operations, and financial condition.

From time to time, we may be subject to claims, lawsuits (including class actions), government investigations, arbitrations and other proceedings involving competition and antitrust, advertising and marketing, intellectual property (including copyright, trademark and patent), privacy, defamation, libel and slander, consumer protection, securities, tax, labor and employment, bribery and corruption, economic and trade sanctions, commercial disputes, and other matters that could adversely affect our business operations and financial condition. The foregoing list is non-exhaustive. We have faced and will continue to face claims relating to our content that is published or made available through our websites and applications, or through third-party platforms or services. In particular, the nature of our business exposes us to claims related to defamation, intellectual property rights (including copyright, trademark and patent), rights of publicity and privacy and FTC regulation. The outcome of any legal proceeding, regardless of its merits, is inherently uncertain. If we do not prevail in litigation, we could incur substantial liabilities, some or all of which may not be covered by our insurance. We may also determine in certain instances that a settlement may be a more cost-effective and efficient resolution for a dispute. Further, pending or future legal proceedings could result in a diversion of our management's attention and resources and reputational harm, and we may be required to incur significant expenses defending against these claims or pursuing claims against third parties to protect our rights. Where risk of loss is probable and we can make a reasonable estimate of the liability relating to pending litigation, we record a related liability. As additional information becomes available, we assess the potential liability and revise estimates as appropriate. However, because of uncertainties relating to litigation, the amount of our estimates could be wrong as determining reserves for pending legal proceedings is a complex, fact-intensive process that is subject to judgment calls. The results of legal and regulatory proceedings cannot be predicted with certainty. There can be no assurance that our expectations will prove correct, and even if these matters are resolved in our favor or without significant cash settlements, these matters, and the time and resources necessary to litigate or resolve them, could harm our business. If we incur costs or liability as a result of these events occurring, our business, financial condition and operating results could be adversely affected. Liability may also impact our insurance premiums as well as our ability to obtain or maintain insurance coverage. Further, any adverse determination related to legal proceedings or a settlement agreement could require us to change our technology or our business practices in costly ways, prevent us from offering certain products or services, require us to pay monetary damages, fines, or penalties, or require us to enter into royalty or licensing arrangements, and could adversely affect our operating results and cash flows, harm our reputation, or otherwise negatively impact our business.

In order to remain competitive and maximize the chances that audiences select our content and platforms as opposed to the various entertainment options available to them and with which our content and platforms compete, we must continuously develop new creative and relevant content. This content may not be well received by audiences, even if of high quality. Similarly, in order to maximize the chances that consumers select our content and products as opposed to other retail options available to them, we must continue to develop new products for partners and clients, and new channels through which to reach audiences, which may not be well received by consumers, even if of high quality. Audiences and consumers may be critical of our brands, content, products, services, platforms, and / or business practices for a wide variety of reasons, and such negative reactions may not be foreseeable or within our control to manage effectively. Any failure of our content or products to resonate with audiences or consumers may result in our inability to retain existing customers, clients or partners, or engage new customers, clients or partners.

Adverse macroeconomic conditions in the U.S. and globally could negatively impact our business, financial condition, results of operations, and liquidity. These macroeconomic factors include: inflation; current global supply chain disruptions; slower than expected growth or recession; changes to fiscal and monetary policy; any failure to raise the U.S. debt ceiling or to fund the federal government, leading to a shutdown; tightening of the credit markets; including as a result of bank failures and any resulting issues in the broader U.S. financial system; any higher interest rates; high unemployment; currency fluctuations; and the competitive labor market. These, and other, factors could adversely affect demand for advertising on our owned and operated sites and social media platforms or revenue generated from creating content, weakening our advertising sales and related revenue streams. Adverse economic conditions in the U.S. and globally have from time to time caused or exacerbated significant slowdowns in our industry and in the markets in which we operate, which have adversely affected our business and results of operations. Macroeconomic weakness and uncertainty also make it more difficult for us to accurately forecast revenue, gross margin and expenses, and may make it more difficult to raise or refinance debt. Further, sustained uncertainty about, or worsening of, current global economic conditions, including the ongoing conflicts between Russia and Ukraine and between Israel and Hamas and any related sanctions and geopolitical tensions, and further escalation of trade tensions between the U.S. and China, could result in a global economic slowdown and long-term changes to global trade. Any or all of these factors could adversely affect our advertising revenue, content revenue, and affiliate commerce revenue, and could materially adversely affect our business, results of operations, financial condition, and growth.

We have offices around the world and our content is available in multiple languages. Our business and the conduct of our operations internationally requires considerable management attention and resources and is subject to the particular challenges of supporting a business in an environment of multiple languages, cultures, customs, legal and regulatory systems, alternative dispute systems and commercial markets. Operating internationally subjects us to risks, and may increase risks that we currently face, including risks associated with: - recruiting, integrating and retaining talented and capable employees in foreign countries and maintaining our company culture across all of our offices;- providing our content and operating across a significant distance, in different languages and among different cultures, including the potential need to modify our products, content and services to ensure that they are culturally relevant in different countries;- increased competition from local media companies and mobile applications which have expanded and may continue to expand their geographic footprint;- differing and potentially lower levels of user growth, user engagement, and ad engagement in new and emerging geographic territories;- operating through license agreements with third parties managing certain BuzzFeed branded operations outside of the U.S.;- compliance with applicable foreign laws and regulations, including laws and regulations with respect to privacy, consumer protection, and media freedom;- operating in jurisdictions that do not protect intellectual property rights to the same extent as the U.S.;- compliance with anti-corruption laws including, without limitation, compliance with the Foreign Corrupt Practices Act and U.K. Bribery Act (and local law analogues);- compliance with economic and trade sanctions set by, among others, the Office of Foreign Assets Control against targeted foreign governments, entities and individuals;- risk of fluctuations in foreign currency exchange rates, as we transact business in various foreign currencies, including obtaining revenue and incurring costs denominated in foreign currencies, primarily the British pound, Japanese yen, and Canadian dollar and, accordingly, changes in exchange rates, could negatively affect our and results of operations as expressed in U.S. dollars, a risk we do not currently engage in hedging activities to limit;- foreign exchange controls that might require significant lead time in setting up operations in certain geographic territories and might prevent us from repatriating cash earned outside the U.S.;- double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the U.S. or the foreign jurisdictions in which we operate; and - higher costs of doing business internationally, including increased accounting, travel, infrastructure, and legal compliance costs. If we are unable to manage the complexity of our global operations successfully, our business, financial condition and operating results could be adversely affected.