CarGurus (CARG) Risk Analysis

We provide consumers using our CarGurus platform and dealers using our CarGurus and CarOffer platforms with our proprietary IMV, Deal Ratings, and Dealer Ratings as well as other data insights and features to help them evaluate vehicle pricing, including New Car Price Information. Our valuation models depend on the inventory listed on our websites as well as information regarding automotive sales. If the inventory on our websites declines significantly, if the number of automotive sales declines significantly, or if used car sales prices become volatile, whether as a result of macroeconomic effects or otherwise, our valuation models may not perform as expected. Revisions to or errors in our automated valuation models, or the algorithms that underlie them, may cause the IMV, the Deal Rating, New Car Price Information, or other features to vary from our expectations regarding the accuracy of these tools. In addition, from time to time, regulators, consumers, dealers, and other industry participants may question or disagree with our IMV, Deal Rating, Dealer Rating, or New Car Price Information. Any such questions or disagreements could result in distraction from our business or potentially harm our reputation, could result in a decline in consumers' confidence in, or use of, our marketplaces, and could result in legal disputes.

The success of our on-site monetization efforts, consumer marketing, and the delivery of digital advertisements for our customers depends on our ability to leverage data, including data that we collect from our customers, data we receive from our publisher partners and third parties, and data from our operations. Using cookies and non-cookie technologies, such as mobile advertising identifiers, we collect information about the interactions of users with our customers' and publishers' digital properties (including, for example, information about the placement of advertisements and users' shopping or other interactions with our customers' websites or advertisements). Our ability to successfully leverage such data depends on our continued ability to access and use such data, which could be restricted by a number of factors, including: - increasing consumer adoption of browser preference signals as a result of legislation;- privacy restrictions imposed by web browser developers, advertising partners, or other software developers that impair our ability to understand the preferences of consumers by limiting the use of third-party cookies or other tracking technologies or data indicating or predicting consumer preferences; and - new developments in, or new interpretations of, privacy laws, regulations, and industry standards. Each of these developments could materially impact our ability to collect consumer data and deliver relevant digital advertisements to attract consumers to our websites or to deliver targeted advertising for our advertising customers. If we are unsuccessful in evolving our advertising and marketing strategies to adapt to and mitigate these evolving consumer data limitations, our business could be materially impacted.

The advertising and sale of new and used motor vehicles is highly regulated by the jurisdictions in which we do business. Regulatory authorities or third parties could take the position that some of the laws or regulations applicable to dealers or to the manner in which motor vehicles are advertised and sold generally are directly applicable to certain aspects of our business. If our marketplaces and related products are determined to not comply with relevant regulatory requirements, we or dealers could be subject to civil and criminal penalties, including fines, or the award of significant damages in class actions or other civil litigation, as well as orders interfering with our ability to continue providing our marketplaces and related products and services in certain jurisdictions. In addition, even absent such a determination, to the extent dealers are uncertain about the applicability of such laws and regulations to our business, we may lose or have difficulty increasing the number of paying dealers, which would affect our future growth. If regulators or other third parties take the position that our marketplaces or related products violate applicable dealer licensing, brokering, bird-dog, consumer protection, consumer finance, or advertising laws or regulations, responding to such allegations could be costly, could require us to pay significant sums in settlements, could require us to pay civil and criminal penalties, including fines, could interfere with our ability to continue providing our marketplaces and related products in certain jurisdictions, or could require us to make adjustments to our marketplaces and related products or the manner in which we derive revenue from dealers using our platform, any or all of which could result in substantial adverse publicity, termination of subscriptions by dealers, decreased revenue, distraction for our employees, increased expenses, and decreased profitability.

A portion of our revenue is derived from advertising revenue generated primarily through short-term advertising sales, including on-site advertising and audience targeting services, to dealers, auto manufacturers, and other auto-related brand advertisers as well as non-endemic programmatic advertisers. We compete for this advertising revenue with other online automotive marketplaces and with traditional media, such as television, radio, magazines, newspapers, automotive publications, billboards, and other offline advertising channels. Our ability to attract and retain advertisers and to generate advertising revenue depends on a number of factors, including our ability to: - increase the number of consumers using our marketplaces;- compete effectively for advertising spending with other online automotive marketplaces;- continue to develop our advertising products;- keep pace with changes in technology and the practices and offerings of our competitors, including the use of AI;- keep pace with changes to data privacy regulations as well as the implementation of consent mechanisms to support the changing regulatory landscape; and - offer an attractive ROI to our advertisers for their advertising spend with us. It is possible that advertising customers will cancel or reduce their advertising with us for a variety of reasons, including macroeconomic issues, such as increased interest rates and other matters that influence consumer spending. In addition, a decline in the number of consumer visits to our sites could have an adverse impact on our advertising revenue. We may not succeed in capturing a greater share of our advertisers' spending if we are unable to convince advertisers of the effectiveness or superiority of our advertising offerings as compared to alternative channels. If current advertisers reduce their advertising spending with us and we are unable to replace such reduced advertising spending, our advertising revenue and business and financial results would be harmed.

Some functions of our marketplaces involve the storage and transmission of consumers' information, such as IP addresses and site activity data, contact information of users who connect with dealers, credit applications, and other financial data and profile information of users who create accounts on our marketplaces as well as dealers' information. We also process and store personal and confidential information of our vendors, partners, and employees, and we employ third-party service providers, such as payment processing providers, who also regularly have access to customer and consumer data. Some of this information may be sensitive, and any cybersecurity attack, data breach, or other security incident impacting such information, including the unauthorized acquisition or access, compromise, or loss of such information, against us or our third-party service providers could expose us to a risk of loss or exposure of this information, which could result in potential liability, litigation (including class action litigation) or regulatory action, and remediation costs. We rely on encryption and authentication technology licensed from third parties to effect secure transmission of such information, and we also rely on our third-party service providers to use sufficient security measures to protect such information. Despite all of our efforts designed to protect this information, none of our security measures or those of our third-party service providers provide absolute security, and they may not be effective in preventing a future failure of our systems. Like all information systems and technology, our websites, mobile applications, and information systems, and those of our third-party service providers, are subject to computer viruses, break-ins, phishing attacks, attempts to overload the systems with denial-of-service or other attacks, ransomware, and similar incidents or disruptions from unauthorized use of our or our third-party service providers'systems, any of which could lead to interruptions, delays, or website shutdowns, and could cause loss of critical data and the unauthorized disclosure, access, acquisition, alteration, or use of personal or other confidential information. If we or our third-party service providers experience compromises to data security that result in website or mobile application performance or availability problems, the complete shutdown of our websites or mobile applications, or the loss or unauthorized disclosure, access, acquisition, alteration, or use of confidential information, consumers, customers, advertisers, partners, vendors, and employees may lose trust and confidence in us, and consumers may decrease the use of our websites or stop using our websites entirely, dealers may stop or decrease their subscriptions with us, and advertisers may decrease or stop advertising on our websites. Further, outside parties have attempted and will likely continue to attempt to fraudulently induce employees, consumers, or advertisers to disclose sensitive information in order to gain access to our information or our information of consumers, dealers, advertisers, and employees. As cyber-attacks increase in frequency and sophistication, our cyber-security and disaster recovery plans may not be effective in anticipating, preventing, and effectively responding to all potential cyber-risk exposures. In addition, because the techniques used to obtain unauthorized access, disable, or degrade service or sabotage systems constantly evolve, often are not recognized until after having been launched against a target, and may originate from less regulated and remote areas around the world, we may be unable to proactively address these techniques or to implement adequate measures for prevention and detection. For example, as AI continues to evolve, cybercriminals could also use AI to develop malicious code and sophisticated phishing attempts. Any or all of the issues above could adversely affect our brand reputation, negatively impact our ability to attract new consumers, and increase engagement by existing consumers, cause existing consumers to reduce or stop the use of our marketplaces or close their accounts, cause existing dealers and advertisers to cancel their contracts, cause employees to terminate their employment, cause employment candidates to be unwilling to pursue employment opportunities or accept employment offers, and/or subject us to governmental or third-party lawsuits, investigations, regulatory fines, or other actions or liability, thereby harming our business, results of operations, and financial condition. Although we carry privacy, data breach, and network security liability insurance, we cannot be certain that our coverage will be adequate for liabilities actually incurred or sufficient to compensate us for the potentially significant losses, or that insurance will continue to be available to us on economically reasonable terms or at all. There are numerous federal, national, state, and local laws and regulations in the U.S. and around the world regarding privacy and the collection, processing, storage, sharing, disclosure, use, cross-border transfer, and protection of personal information and other data. These laws and regulations are evolving, are subject to differing interpretations, may be costly to comply with, may result in regulatory fines, penalties, or on-going monitoring, may subject us to investigations and/or third-party lawsuits, may be inconsistent between countries and state-level jurisdictions, and may conflict with other requirements. We seek to comply with applicable industry standards and are subject to the terms of our privacy policies and privacy-related obligations to third parties, as well as all applicable laws and regulations relating to privacy and data protection. However, given the recency of these laws and the lack of enforcement examples so far, especially in the U.S., it is possible that these obligations may be interpreted and applied in new ways or in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices and that new regulations could be enacted. Several proposals have recently become effective or are pending, as applicable, before federal, state, local, and foreign legislative and regulatory bodies that could significantly affect our business, which we refer to collectively as the Privacy Regulations. The Privacy Regulations include the EU's General Data Protection Regulation, the California Consumer Protection Act, and an additional 18 separate U.S. state consumer privacy laws that are currently in effect or will be going into effect over the next year (Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia). Certain of the Privacy Regulations have already required, and certain others may further require, us to change our policies and procedures and may in the future require us to make changes to our marketplaces and other products. These and other requirements could reduce demand for our marketplaces and other offerings, require us to take on more onerous obligations in our contracts, and restrict our ability to store, transfer, and process data, which may seriously harm our business. Similarly, the gradual industry shift away from relying on third-party cookies may require us to change our policies and procedures and, if we are not in compliance, may also seriously harm our business. We may not be entirely successful in our efforts to effectively transition away from third-party cookies as well as comply with the evolving regulations to which we are subject due to various factors within our control, such as limited internal resource allocation, or outside our control, such as a lack of vendor cooperation, new regulatory interpretations, or lack of regulatory guidance in respect of certain Privacy Regulations and other statutory requirements. Any failure or perceived failure by us to comply with U.S. and international data protection laws and regulations, our privacy policies, or our privacy-related obligations to consumers, customers, employees, and other third parties, or any compromise of security that results in the unauthorized release or transfer of data, which could include personal information or other user data, may result in governmental investigations, enforcement actions, regulatory fines, litigation, criminal penalties, or public statements against us by consumer advocacy groups or others, and could cause consumers and dealers to lose trust in us, which could significantly impact our brand reputation and have an adverse effect on our business. Additionally, if any third party that we share information with experiences a security breach or fails to comply with its privacy-related legal obligations or commitments to us, such matters may put employee, consumer, or dealer information at risk and could, in turn, expose us to claims for damages, regulatory fines, penalties, or litigation and harm our reputation, business, and operating results.