Groupon (GRPN) Risk Factors

Competition in our industry may increase in future periods. We compete against e-commerce sites that attempt to replicate our business model by offering other types of advertising and promotional services to local businesses and companies who address only specific verticals in the local experiences market. In addition to such competitors, we may experience increased competition from other large businesses who offer deals similar to ours as an add-on to their core business. We also compete with other companies that offer digital coupons through their websites or mobile applications. Further, we compete against other e-commerce companies that serve niche markets and interests, including within the local experiences market. In our Travel and Goods categories, we compete against much larger companies who have more resources and significantly greater scale. In addition, we compete with traditional offline coupon and discount services, as well as newspapers, magazines and other traditional media companies who provide coupons and discounts on products and services. We believe that our ability to compete successfully depends upon many factors both within and beyond our control, including the following: - the continued consequences of the macroeconomic environment, including but not limited to, inflationary pressures, higher labor costs, labor shortages, supply chain challenges and resulting changes in consumer and merchant behavior;- the size, composition and retention of our customer and merchant bases;- density and quality of our inventory;- delivery of a modern user experience for customers and modern experience and tools for merchants;- mobile penetration;- understanding local business trends;- our ability to structure deals to generate positive return on investment for merchants;- the timing and market acceptance of deals we offer, including the developments and enhancements to those deals offered by us or our competitors;- our customer and merchant service and support efforts;- our ability to maintain our current relationships with or attract new vendors, suppliers and service providers on agreeable terms;- our ability to maintain contracts that are critical to our operations;- selling and marketing efforts;- ease of use, performance, price and reliability of services offered either by us or our competitors;- our ability to improve customer purchase frequency and customer lifetime value;- our ability to drive traffic to our marketplace;- the number, quality and reliability of the digital coupons that can be accessed through our platform;- the quality and performance of our merchants;- our ability to cost-effectively manage our operations and to complete the multi-phased cost savings plan and achieve the anticipated benefits from the plan; and - our reputation and brand strength relative to our competitors. Some of our competitors have longer operating histories, greater financial, marketing and other resources and larger customer bases than we do. These factors may allow our competitors to benefit from their existing customer base with lower customer acquisition costs or to respond more quickly than we can to new or emerging technologies and changes in consumer habits. Further, the macroeconomic environment may not have had, or in the future have, a comparable impact on these competitors' businesses. In addition, our competitors may engage in more extensive research and development efforts, undertake more far-reaching marketing campaigns and adopt more aggressive pricing policies than we do, which may allow them to build larger customer and/or merchant bases or generate revenue from their customer bases more effectively than we do. Our competitors may offer deals that are similar to the deals we offer or that achieve greater market acceptance than the deals we offer. This could divert customers away from our websites and mobile applications, reduce our market share and adversely impact our gross profit. In addition, we are dependent on some of our existing or potential competitors for display advertisements and other marketing initiatives to acquire new customers. Our ability to utilize their platforms to acquire new customers may be adversely affected if they choose to compete more directly with us or prevent us from using their services.

We believe that the brand identity that we have developed has significantly contributed to the success of our business. We also believe that maintaining and enhancing the "Groupon" brand is critical to expanding our base of customers and merchants. In addition, maintaining and enhancing our brand may require us to make substantial additional investments over time and these investments may not be successful. If we fail to promote, maintain and protect the "Groupon" brand, our business, operating results and financial condition may be adversely affected. We anticipate that, as the local experiences market becomes increasingly competitive, maintaining and enhancing our brand may become more difficult and expensive. Maintaining and enhancing our brand will depend largely on our ability to continue to provide reliable, trustworthy and high quality inventory on our marketplace, which we may not do successfully. We receive a high degree of media coverage around the world. Unfavorable publicity or consumer perception of our websites, mobile applications, practices or service offerings, or the offerings of our merchants or their products, could adversely affect our reputation, resulting in difficulties in recruiting, decreased revenue and a negative impact on the number of merchants we feature and the size of our customer base, the loyalty of our customers and the number and variety of our offerings. As a result, our business, financial condition and results of operations could be materially and adversely affected.

We regard our trademarks, service marks, copyrights, patents, trade dress, trade secrets, proprietary technology, merchant lists, subscriber lists, sales methodology and similar intellectual property as critical to our success, and we rely on trademark, copyright and patent law, trade secret protection and confidentiality and/or license agreements with our employees and others to protect our proprietary rights. Effective intellectual property protection may not be available in every country in which our deals are made available. We also may not be able to acquire or maintain appropriate domain names or trademarks in all countries in which we do business. Furthermore, regulations governing domain names may not protect our trademarks and similar proprietary rights. We may be unable to prevent third parties from acquiring and using domain names or trade names that are similar to, infringe upon or diminish the value of our trademarks and other proprietary rights. We may be unable to prevent third parties from using and registering our trademarks, or trademarks that are similar to, or diminish the value of, our trademarks in some countries. We may not be able to discover or determine the extent of any unauthorized use of our proprietary rights. Third parties that license our intellectual property rights also may take actions that diminish the value of our proprietary rights or reputation. The protection of our intellectual property may require the expenditure of significant financial and managerial resources. Moreover, the steps we take to protect our intellectual property may not adequately protect our rights or prevent third parties from infringing or misappropriating our proprietary rights. We are currently subject to multiple lawsuits and disputes related to our intellectual property and service offerings. We may in the future be subject to additional litigation and disputes. The costs of engaging in such litigation and disputes are considerable, and there can be no assurances that favorable outcomes will be obtained. We are currently subject to third-party claims that we infringed upon proprietary rights or trademarks and expect to be subject to additional claims in the future. Such claims, whether or not meritorious, may result in the expenditure of significant financial and managerial resources, injunctions against us or the payment of damages by us. We may need to obtain licenses from third parties who allege that we have infringed their rights, but such licenses may not be available on terms acceptable to us or at all. These risks have been amplified by the increase in third parties whose sole or primary business is to assert such claims.

In operating a global online business, with operations in thirteen countries, we and our third-party service providers maintain significant proprietary information and maintain large amounts of personal data and confidential information about our employees, customers and merchants. We and such service providers are at constant risk of cyber-attacks or cyber intrusions via the Internet, computer viruses, break-ins, malware, ransomware, phishing attacks, hacking, denial-of-service attacks or other attacks and similar disruptions from the unauthorized use of or access to computer systems (including from internal and external sources). These types of incidents continue to be prevalent and pervasive across industries, including in our industry, and such attacks on our systems have occurred in the past and are expected to occur in the future. In addition, we expect the amount and sophistication of the perpetrators of these attacks to continue to expand, which could include state-sponsored actors. Further, we believe that our websites and mobile applications are attractive targets for such attacks as a result of the high profile of our brand and the amount and type of information we maintain relating to our customers and merchants. Any such attack could lead to interruptions, delays or website outages, causing loss of critical data or the unauthorized disclosure or use of personally identifiable or other confidential information. Further, third party service providers we utilize in our operations could be targeted by such cyber attacks, which could indirectly impact our business, by way of similar adverse consequences to a direct attack depending on the type of service. Any failure to prevent or mitigate cybersecurity breaches or other improper access to, or disclosure of, our data or confidential information, including non-public financial information, could result in: the loss or misuse of such data or information; significant reputational harm, including a negative impact on customers', merchants', employees' and third-party business partners' confidence in the security of our services which could potentially result in significant customer or merchant attrition; a decline in customer purchase frequency; litigation and/or regulatory investigations; and/or damage to our brand and reputation. Our risk and exposure to these matters remains heightened because of, among other things, the evolving nature of these threats, our prominent size and scale, the large number of transactions that we process, our geographic footprint and international presence, the complexity of our systems, our number of employees, the jurisdictions in which we operate and the various and evolving laws and regulatory schemes governing data and data protection applicable to us, the extent to which our current systems, controls, processes and practices permit us to detect, log and monitor security events, our use of cloud based technologies and the outsourcing of some of our business operations. Although cybersecurity and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage or unauthorized access are a high priority for us, our activities and investment may not be deployed quickly enough or successfully protect our systems against all vulnerabilities, including technologies developed to bypass our security measures or zero day vulnerabilities. In addition, outside parties may attempt to fraudulently induce employees, merchants or customers to disclose access credentials or other sensitive information in order to gain access to our systems and networks. We also may be subject to additional vulnerabilities as we utilize third parties to provide various services for our operations (e.g., cloud services) and integrate the systems, computers, software and data of acquired businesses and third-party business partners into our networks and separate the systems, computers, software and data of disposed businesses from our networks. As described in Item 1.C - Cybersecurity, we maintain a cybersecurity risk management program that is overseen by our IT and Information Security teams. A member of our IT and Information Security teams regularly reports to the Audit Committee on the state of our cybersecurity program and provides updates on cybersecurity matters. We also conduct an annual cybersecurity review with our Board. As part of our cybersecurity risk management program, we employ security practices to protect and maintain the systems located at our hosting providers, invest in intrusion, anomaly, and vulnerability detection tools and engage third-party security firms to test the security of our websites and systems. In addition, we regularly evaluate and assess our systems and the controls, processes and practices to protect those systems and also conduct penetration testing against our own systems. The evaluations, assessments and testing identify areas of potential weakness in, and suggested improvements to, the maturity of our systems, processes, and risk management framework as well as vulnerabilities in those systems, processes and risk management framework that could be attacked and exploited to access and acquire proprietary and confidential information, including information about our customers and merchants. There are no assurances that our cybersecurity risk mitigation program or actions and investments to improve the maturity of our systems, processes and risk management framework or remediate vulnerabilities will be sufficient or completed quickly enough to prevent or limit the impact of any cyber intrusion or related attack. In addition, in the future we may be required to expend significant additional resources to rebuild our internal systems; implement additional threat protection measures; provide modifications or enhancements to our websites, mobile applications, protective measures, controls, systems, processes, and risk management framework; or investigate or remediate any information security vulnerabilities. These improvements, modifications and enhancements may take significant time to implement. Further, the sophistication of potential attacks or the capabilities of our systems and processes may not permit us to detect the occurrence of cyber incidents until significant data loss has occurred. Moreover, because the techniques used to gain access to or sabotage systems often are not recognized until launched against a target, we may be unable to anticipate the methods necessary to defend against these types of attacks and we cannot predict the extent, frequency or impact these problems may have on us. Any actual breach, the perceived threat of a breach, or a perceived breach could cause our customers, merchants, employees and payment card processors to cease doing business with us or do business with us less frequently, subject us to lawsuits (including claims for damages), investigations, regulatory fines or other action or liability or damage to our brand and reputation, which would harm our business, financial condition and results of operations.

Our international operations require management attention and resources and also require us to localize our services to conform to a wide variety of local cultures, business practices, laws and policies. Our international operations are subject to numerous risks, including the following: - our ability to maintain merchant and customer satisfaction such that our marketplace will continue to attract high quality merchants;- our ability to successfully respond to macroeconomic challenges, including but not limited to, inflationary pressures, higher labor costs, labor shortages, supply chain challenges and resulting changes in consumer and merchant behavior and the ability to optimize our supply to take into account consumer preferences at a particular point in time;- political, economic and civil instability and uncertainty (including macroeconomic conditions impacting us, our customers, merchants, or our vendors, acts of terrorism, civil unrest, labor unrest, violence and outbreaks of war and pandemics or other disease outbreaks);- disruptions and instability in the international markets in which we operate, including Poland, as a result of the ongoing conflict in Ukraine and the Middle East;- currency exchange rate fluctuations;- strong local competitors who may better understand the local market and/or have greater resources in the local market;- different regulatory or other legal requirements (including potential fines and penalties that may be imposed for failure to comply with those requirements), such as regulation of gift cards and coupon terms, Internet services, professional selling, distance selling, bulk emailing, privacy and data protection (including GDPR), cybersecurity, business licenses and certifications, taxation (including the European Union's voucher directive, digital service tax and similar regulations and any audits), consumer protection laws including those restricting the types of services we may offer (e.g., medical-related services), banking and money transmitting, that may limit or prevent the offering of our services in some jurisdictions, cause unanticipated compliance expenses or limit our ability to enforce contractual obligations;- our ability to use a common technology platform in our North America and International segments to operate our business without significant business interruptions or delays;- difficulties in integrating with local payment providers, including banks, credit and debit card networks and electronic funds transfer systems;- the ability to quickly and effectively consult with, negotiate and seek the consent or opinion of, various employee groups, our international workers' councils and trade unions that represent our international employees on various matters including restructuring actions, strategic decisions, any changes to our activities or employee benefits and other business critical matters, which could result in the delay of executing key actions or product delivery and increase costs;- the local legal restrictions relating to employment and staffing;- difficulty in staffing, including attracting and retaining talent with an appropriate level of skill and experience, including product and technology expertise, cybersecurity expertise, GAAP knowledge and experience to create the proper control environment for effective internal control over financial reporting, developing and managing foreign operations, including through centralized shared service centers, as a result of distance, language barriers and cultural differences;- periodic reductions in business activity;- expenses associated with localizing our products; and - differing intellectual property laws. We are subject to complex laws and regulations that apply to our international operations, such as data privacy and protection requirements, including GDPR, the Foreign Corrupt Practices Act, the UK Anti-Bribery Act and similar local laws prohibiting certain payments to government officials, banking and payment processing regulations and anti-competition regulations, among others. The cost of complying with these various, and sometimes conflicting, laws and regulations is substantial. We have implemented and continue to implement policies and procedures to ensure compliance with these laws and regulations, however, we cannot ensure that our employees, contractors, or agents will not violate our policies. Changing laws, regulations and enforcement actions in the United States and throughout the world could harm our business. If commercial and regulatory constraints in our international markets restrict our ability to conduct our operations or execute our strategic plan, our business may be adversely affected.