Life360 Shs Chess Depository Interests Repr 3 Sh (LIFX) Risk Analysis

Life360 has historically experienced member and subscription growth seasonality in the third quarter of each calendar year, which includes the return to school for many of our members. Hardware sales have historically experienced comparatively higher seasonal growth in the fourth quarter of each calendar year, which includes the important selling periods in November (Black Friday and Cyber Monday) and December (Christmas and Hanukkah) in large part to seasonal holiday demand. An unexpected decrease in sales over those traditionally high-volume selling periods may impact our revenue and could also result in surplus inventory and could have a disproportionate effect on our results of operations for the entire fiscal year. Seasonality in our business can also be affected by introductions of new or enhanced products and services, including the costs associated with such introductions.

Life360 operates under a "freemium" model in which the Life360 app is available to members at no charge, while Memberships with additional features are available via a paid monthly or annual subscription. If members using the free version of the Life360 app do not perceive additional value in a paid subscription or there is an actual or perceived reduction in the functionality, quality, reliability and cost-effectiveness of our subscription plans, our ability to retain and grow paid subscriptions would be adversely impacted. Our failure to provide successful enhancements and new features that grow paid subscriptions may have a material adverse impact on our business, financial condition and results of operations.

We seek to tailor each of our brands, products and services to meet the preferences of specific communities of members. Building a given brand, product or service is generally an iterative process that occurs over a meaningful period of time and involves considerable resources and expenditures. Although certain of our newer brands, products and services may experience significant growth over relatively short periods of time, the historical growth rates of these brands and products and services may not be an indication of their future growth rates generally. We have encountered, and may continue to encounter, risks and difficulties as we build our newer brands and products. The failure to successfully scale these brands, products and services and address these risks and difficulties could adversely affect our business, financial condition and results of operations.

In the ordinary course of business, we (and the third parties or service providers upon whom we rely) collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, "process" and its conjugates) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, business plans, transactions, and financial information (collectively, sensitive data). Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). In the past few years, numerous U.S. states - including California, Colorado, Connecticut, Utah and Virginia - have enacted comprehensive privacy laws that impose certain obligations on covered businesses. These laws impose certain data privacy and security obligations on covered businesses. Generally, these and similar laws obligate covered businesses to provide specific disclosures in privacy notices and afford relevant individuals with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain personal data processing activities, such as targeted advertising, profiling, or automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. These laws may also allow for regulators to impose statutory fines or allow private claimants to recover damages for noncompliance. For example, the California Consumer Privacy Act (CCPA) applies to personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights, such as those noted below. The CCPA provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to seek to recover potentially significant statutory damages. Other states, such as Virginia and Colorado, have also enacted comprehensive consumer privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. These state laws (including the CCPA) may provide individuals with rights to their personal data, such as the right to access, correct, or delete certain personal data, and opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. If individuals were to exercise these rights at a significant volume or pace, such actions may impact our business and ability to provide our products and services. These developments may further complicate compliance efforts and may increase legal risk and compliance costs for us and the third parties upon whom we rely. Federal, state and local privacy and consumer protection laws also govern specific technologies that we employ or how we market to, and otherwise communicate with, our members. For example, the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM) and the Telephone Consumer Protection Act (TCPA) impose specific requirements on communications with consumers. The TCPA, for instance, imposes various consumer consent requirements and other restrictions on certain telemarketing activity and other communications with consumers by phone, fax or text message. TCPA violations can result in significant financial penalties, including penalties or criminal fines imposed by the Federal Communications Commission (FCC) or fines of up to $1,500 per violation imposed through private litigation or by state authorities. We may also use parental consent and identity verification technologies (including those offered by or through service providers) that may capture biometric information or identifiers that may subject us to applicable biometric privacy requirements. For example, the Illinois Biometric Information Privacy Act (BIPA), regulates the collection, use, safeguarding, and storage of Illinois residents' biometric information or identifiers. The TCPA and BIPA provide for substantial penalties and statutory damages and have generated significant class action activity. The costs of litigating and/or settling a TCPA, BIPA or similar legal claim could be significant. Additionally, regulators are increasingly scrutinizing companies that process children's data. We are subject to COPPA, which applies to operators of certain websites and online services directed to children under the age of 13 or with actual knowledge that they collect or maintain personal information from children under the age of 13. COPPA may be enforced by state Attorneys General or the FTC, which is empowered to impose civil penalties of up to $51,744 per violation as well as injunctive and equitable relief for violations. COPPA requirements may be modified, interpreted, or applied in new manners that we may be unable to anticipate or prepare for appropriately. Additional laws and regulations that apply to children's data under certain circumstances have been adopted or proposed in recent years, including the EU GDPR and the UK GDPR, European Union Digital Services Act ("the DSA"), the UK Age-Appropriate Design Code, the CCPA and other comprehensive state privacy laws, and California's Age-Appropriate Design Code Act. These laws generally impose various obligations on companies that process children's data, such as requiring certain consents to process such data, and extending certain rights to children and their parents with respect that data. Some of these obligations have wide ranging applications, including for services that do not intentionally target child users (defined in some circumstances a user under the age of 18 years old). These laws are or may be subject to legal challenges and changing interpretations, which may further complicate our efforts to comply with these laws. In the United States, several states enacted laws regulating social media companies and platforms. These laws, such as the Utah Social Media Regulation Act and the Arkansas Social Media Safety Act, seek to limit social media companies from, among other things, displaying and targeting advertising to accounts held by minors (defined as those under 18) and provide certain rights to parents with respect to data of their children and access to social media platforms. These laws may be subject to legal challenges and the attendant heightened scrutiny associated with processing certain children's data on social media platforms may lead to increased compliance costs and obligations on us, to the extent we could be considered subject to these laws. Outside the United States, an increasing number of laws, regulations, and industry standards may govern personal data privacy and security. Without limitation, the following personal data laws may apply to our operations such as EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection (or "FADP"), Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or "LGPD") (Law No. 13,709/2018), Australia's Privacy Act, Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") (and other Canadian provincial laws), India's Information Technology Act and supplementary rules, and China's Personal Information Protection Law ("PIPL") all impose strict requirements for processing personal data. For example, local data protection authorities in both the EEA and UK may take an enforcement action against us with respect to a violation of their applicable requirements. Under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR and 17.5 million pounds sterling under the UK GDPR, or 4% of annual global revenue, whichever is greater, and private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In addition, we may be unable to transfer personal data from Europe, the UK, and other jurisdictions to the United States or other countries due to data localization requirements or limitations on cross-border data flows. Europe, the UK, and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the EEA and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EU-US Data Privacy Framework and the EEA and UK's standard contractual clauses, these mechanisms are subject to legal challenges (which may result in their invalidation). There is no assurance that we can satisfy or rely on these measures in all circumstances to transfer personal data to the United States, as they alone may not necessarily be sufficient as transfers must be assessed on a case-by-case basis and the requirements may change if they are challenged. If there is no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Some European regulators have prevented companies from transferring personal data out of Europe for allegedly violating the EU GDPR's cross-border data transfer limitations. Regulators in the US are also increasingly scrutinizing certain personal data transfers and may impose personal data localization requirements. Our personnel currently use generative artificial intelligence ("AI") technologies to perform their work for example in the context of development productivity tools and limited internal communication. The disclosure and use of personal data in generative AI technologies may be subject to various privacy laws and other obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. In addition to data privacy and security laws, we may be contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. We may also be bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or not representative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences. In addition, major technology platforms on which we rely, privacy advocates, and industry groups have regularly proposed, and may propose in the future, platform requirements or self-regulatory standards by which we are legally or contractually bound. If we fail to comply with these contractual obligations or standards, we may lose access to technology platforms on which we rely and face substantial regulatory enforcement, liability, and fines. For example, in 2021 one of our Channel Partners, Apple, began to require mobile applications using its operating system, iOS, to affirmatively (on an opt-in basis) obtain an end user's permission to "track them across apps or websites owned by other companies" or access their device's advertising identifier for advertising and advertising measurement purposes. Other technology platforms are considering similar restrictions. Such restrictions could limit the efficacy or our marketing activities. In addition, consumer resistance to the collection and sharing of the data used to deliver targeted advertising, increased visibility of consent or "do not track" mechanisms (such as browser signals from the Global Privacy Control) as a result of industry regulatory or legal developments, the adoption by consumers of browser settings or "ad-blocking" software, and the development and deployment of new technologies could materially impact our ability to collect data or reduce our ability to deliver relevant promotions or media or market our products and reach new members, which could materially impair the results of our operations. We are also subject to evolving European Union and UK privacy laws on cookies, tracking technologies and e-marketing. In the European Union and the UK, regulators are increasingly focusing on compliance with requirements related to the behavioral, interest-based, or tailored advertising ecosystem. Enforcement actions could lead to substantial costs, require significant systems and/or operational changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, and subject us to additional liabilities. In light of the complex and evolving nature of European Union, EU Member State and UK privacy laws on cookies and tracking technologies, there can be no assurances that we will be successful in our efforts to comply with such laws; violations of such laws could result in regulatory investigations, fines, orders to cease or change our use of such technologies, as well as civil claims including class actions, and reputational damage. Outside of Europe, other laws further regulate behavioral, interest-based, or tailored advertising, making certain online advertising activities more difficult and subject to additional scrutiny. For example, the CCPA grants California residents the right to opt-out of a company's sharing of personal data for advertising purposes in exchange for money or other valuable consideration. Further, because we accept debit and credit cards for payment of certain products and services, we are subject to the Payment Card Industry Data Security, or the PCI Standard, issued by the Payment Card Industry Security Standards Council, with respect to payment card information. The PCI DSS requires merchants to adopt certain measures to protect the security of cardholder information, such as using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Compliance with the PCI Standard and implementing related procedures, technology and information security measures requires ongoing attention and devotion of resources. Costs and potential problems and interruptions associated with the implementation and maintenance of systems and technology, such as those necessary to achieve compliance with the PCI Standard could also disrupt or reduce the efficiency of our operations. Noncompliance with PCI DSS, to the extent applicable to us, can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. Generally, we rely on vendors to process payment card data and those vendors may be subject to PCI DSS. Our business may be negatively affected if our vendors are fined or suffer other consequences as a result of PCI DSS noncompliance. Obligations related to data privacy and security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Our business model materially depends on our ability to process personal data, so we are particularly exposed to the risks associated with the rapidly changing legal landscape. For example, we may be at heightened risk of regulatory scrutiny, and changes in regulatory frameworks could require us to fundamentally change our business model. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, a shift in consumers' data privacy expectations or other social, economic or political developments could impact the regulatory enforcement of these obligations, which could increase the cost of and complicate our compliance with applicable obligations. Relevant stakeholders (such as government authorities and adjudicatory bodies) may determine that we have been in the past or are presently noncompliant with our data privacy and security obligations as we may at times fail (or be perceived to have failed) in our efforts to comply with such obligations. This risk will likely increase as we grow our market presence in the U.S. and outside the U.S. Moreover, despite our efforts, our personnel or third parties on whom we rely, may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties on which we rely have failed, fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims and mass arbitration demands); additional reporting requirements and/or oversight; bans on processing personal data; and orders to destroy or not use personal data. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for significant statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products or services; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations. We have in the past received inquiries and been subject to investigations, proceedings, orders, and other various inquiries and claims brought by regulators and private claimants regarding our data privacy (including in relation to children's data) and security practices and processing of personal data. We may in the future be subject to similar inquiries, claims and other proceedings.

We are a U.S.-based multinational company subject to tax in multiple U.S. and foreign tax jurisdictions. Significant judgment is required in determining our global provision for income taxes, deferred tax assets or liabilities and in evaluating our tax positions on a worldwide basis. While we believe our tax positions are consistent with the tax laws in the jurisdictions in which we conduct our business, it is possible that these positions may be challenged by jurisdictional tax authorities, which may have a significant impact on our global provision for income taxes. Tax laws are being re-examined and evaluated globally. New laws and interpretations of the law are taken into account for financial statement purposes in the quarter or year that they become applicable. Tax authorities are increasingly scrutinizing the tax positions of companies. Many countries in the European Union, as well as a number of other countries and organizations, such as the Organization for Economic Cooperation and Development ("OECD") and the European Commission, are actively considering changes to existing tax laws that, if enacted, could increase our tax obligations in countries where we do business. These proposals include changes to the existing framework to calculate income tax, as well as proposals to change or impose new types of non-income taxes, including taxes based on a percentage of revenue. For example, several countries in the European Union have proposed or enacted taxes applicable to digital services, which includes business activities on social media platforms and online marketplaces, and would likely apply to our business. Many questions remain about the enactment, form and application of these digital services taxes. The interpretation and implementation of the various digital services taxes (especially if there is inconsistency in the application of these taxes across tax jurisdictions) could have a materially adverse impact on our business, financial condition, results of operations and cash flows. Further, more than 140 countries agreed to enact the Pillar II global minimum tax. While the OECD issued a framework model, each country will enact its own laws to incorporate Pillar II. While Pillar II is a global model, the country by country enactment of different laws to incorporate the framework is complex and there is uncertainty as to how the enactment of these laws will impact us. These changes could increase our total tax burden in the future. Moreover, the U.S. government may enact significant changes to the taxation of business entities including, among others, the imposition of minimum taxes or surtaxes on certain types of income (such as the recent United States Inflation Reduction Act which, among other changes, introduced a 15% corporate minimum tax on certain United States corporations and a 1% excise tax on certain stock redemptions by the United States corporations). Furthermore, if the U.S. or other foreign tax authorities change applicable tax laws or practices, our overall taxes could increase, and our business, financial condition and results of operations may be adversely impacted.

Our employees, consultants, third-party providers, partners and competitors could engage in misconduct, including the misuse of data and intentional failures to comply with applicable laws and regulations (including those related to cybersecurity or data privacy, or those prohibiting a wide range of pricing, discounting and other business arrangements), report financial information or data accurately, or disclose unauthorized activities. Such misconduct could result in legal or regulatory sanctions and cause serious harm to their and our reputation. It is not always possible to identify and deter misconduct by employees, consultants, third-party providers or partners, and any other precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses, or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us, whether or not we are successful in defending against them, we could be exposed to legal liability (including civil, criminal and administrative penalties), incur substantial costs and damage to our reputation and brands, and we could fail to retain key employees. Additionally, any misconduct or perception of misconduct by our members that is attributed to us, our employees, consultants, third-party providers, partners or competitors could seriously harm our business or reputation. See "-If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

We generate indirect revenue from key partners through the sale of data insights derived from the personal data we collect from our members. This revenue represented approximately 8% and 7% of our total revenue for the three months ended September 30, 2024 and 2023, respectively. Termination of agreements with key partners may adversely impact our future financial performance.

Our commercial success depends in part on avoiding infringement, misappropriation or other violations of the intellectual property rights of third parties. From time to time, however, we have received and may in the future receive claims from third parties which allege that we have infringed upon their intellectual property rights, and we may not prevail in these disputes. For example, patent applications in the United States and some foreign countries are generally not publicly disclosed until the patent is issued or published and we may not be aware of currently filed patent applications that relate to our products or services. If patents later issue on these applications, we may be found liable for subsequent infringement. Companies in the internet and technology industries are subject to frequent litigation based on allegations of infringement, misappropriation or other violations of intellectual property rights. Many companies in these industries, including many of our competitors, have substantially larger intellectual property portfolios than we do, which could make us a target for litigation as we may not be able to assert counterclaims against parties that sue us for infringement, misappropriation or other violations of patent or other intellectual property rights. Furthermore, various "non-practicing entities" that own patents and other intellectual property rights often attempt to assert claims in order to extract value from technology companies and, given that these non-practicing entities typically have no relevant product revenue, our own issued or pending patents and other intellectual property rights may provide little or no deterrence to their bringing infringement claims against us. Further, from time to time we may introduce new products, product features and services, including in areas where we currently do not have an offering, which could increase our exposure to patent and other intellectual property claims from competitors and non-practicing entities. In addition, some of our agreements with third-party partners require us to indemnify them for certain intellectual property claims against them, which could require us to incur considerable costs in defending such claims and may require us to pay significant damages in the event of an adverse ruling. Such third-party partners may also discontinue their relationships with us as a result of injunctions or otherwise, which could result in loss of revenue and adversely impact our business, financial condition and results of operations. Although we try to ensure that our employees and consultants do not use the proprietary information or know-how of others in their work for us, we may be subject to claims that we or our employees or consultants have inadvertently or otherwise used or disclosed intellectual property, including trade secrets, software code or other proprietary information, of a former employer or other third parties. Litigation may be necessary to defend against these claims and if we fail in defending any such claims, in addition to paying monetary damages, we may lose valuable intellectual property rights or personnel. As we gain greater public recognition, face increasing competition and develop new products, we expect the number of patent and other intellectual property claims against us may grow. There may be intellectual property or other rights held by others, including issued or pending patents, that cover significant aspects of our products and services, and we cannot be sure that we are not infringing or violating, and have not infringed or violated, any third-party intellectual property rights or that we will not be held to have done so or be accused of doing so in the future. Companies in the technology industry, and other patent, copyright, and trademark holders seeking to profit from royalties in connection with grants of licenses, own large numbers of patents, copyrights, trademarks, domain names, and trade secrets and frequently commence litigation based on allegations of infringement, misappropriation, or other violations of intellectual property or other rights. Any claim or litigation alleging that we have infringed or otherwise violated intellectual property or other rights of third parties, with or without merit, and whether or not settled out of court or determined in our favor, could be time-consuming and costly to address and resolve, and could divert the time and attention of our management and technical personnel. Some of our competitors have substantially greater resources than we do and are able to sustain the costs of complex intellectual property litigation to a greater degree and for longer periods of time than we could. The outcome of any litigation is inherently uncertain, and there can be no assurances that favorable final outcomes will be obtained in all cases. In addition, third parties may seek, and we may become subject to, preliminary or provisional rulings in the course of any such litigation, including potential preliminary injunctions requiring us to cease some or all of our operations. During the course of such litigation matters, there may be announcements of the results of hearings and motions, and other interim developments related to the litigation matters. If securities analysts or investors regard these announcements as material and negative, the market price of our common stock may decline. We may decide to settle such lawsuits and disputes on terms that are unfavorable to us. Similarly, if any litigation to which we are a party is resolved adversely, we may be subject to an unfavorable judgment. The terms of such a settlement or judgment may require us to cease some or all of our operations, pay substantial amounts to the other party including treble damages and attorneys' fees, if we are found to have willfully infringed a party's intellectual property rights. Moreover, as part of any settlement or other compromise to avoid complex, protracted litigation, we may agree not to pursue future claims against a third party, including for claims related to alleged infringement of our intellectual property rights. Part of any settlement or other compromise with another party may resolve a potentially costly dispute but may also have future repercussions on our ability to defend and protect our intellectual property rights, which in turn could adversely affect our business, financial conditions, and results of operations. In addition, we may have to seek a license to continue practices found to be in violation of a third party's rights. However, such arrangements may not be available on reasonable or exclusive terms, or at all, and may significantly increase our operating costs and expenses. As a result, we may be forced to develop or procure alternative non-infringing technology, which could require significant effort, time and expense or discontinue use of the technology. There also can be no assurance that we would be able to develop or license suitable alternative technology to permit us to continue offering the affected products or services as currently offered. If we cannot develop or license alternative technology for any allegedly infringing aspect of our business, we would be forced to limit our products and services and may be unable to compete effectively. Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be compromised by disclosure during this type of litigation. Any of the foregoing, and any unfavorable resolution of such disputes and litigation, would materially and adversely impact our business, financial condition and results of operations.

Our products incorporate open-source software in connection with a portion of our proprietary software and we expect to continue to use open-source software in the future. Under certain circumstances, some open-source licenses require users of the licensed code to provide the user's own proprietary source code to third parties upon request, to license at no cost the user's own proprietary source code or other materials for the purpose of making derivative works, require the relicensing of the open-source software and derivatives thereof under the terms of the applicable license, or prohibit users from charging a fee to third parties in connection with the use of the user's proprietary code. While we try to insulate our proprietary code from the effects of such open-source license provisions and employ practices designed to monitor our compliance with the licenses of third-party open-source software, we cannot guarantee that we will be successful. Accordingly, we may face claims from others challenging our use of open-source software, claiming ownership of, or seeking to enforce the license terms applicable to such open-source software, including by demanding release of the open-source software, derivative works or our proprietary source code that was developed or distributed in connection with such software. Such claims could also require us to purchase a commercial license or require us to devote additional research and development resources to change our software, any of which would have a negative effect on our business, financial condition and results of operations. In addition, if the license terms for the open-source code change, we may be forced to re-engineer our software or incur additional costs. Additionally, the terms of many open-source licenses to which we are subject have not been interpreted by U.S. or foreign courts, resulting in a dearth of guidance regarding the proper legal interpretation of such licenses. There is a risk that open-source software licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market or provide our products and services. In addition, the use of open-source software may entail greater risks than the use of third-party commercial software, as open-source licensors generally do not provide warranties, support, indemnities for infringement or controls on the functionality or origin of the software. Further, the use of open-source software may also present additional security risks because the public availability of the source code of such software may make it easier for hackers and other third parties to exploit vulnerabilities in the software. To the extent that our platform depends upon the successful operation of the open-source software we use, any undetected errors or defects in this open-source software could prevent the deployment or impair the functionality of our platform, delay the introduction of new solutions, result in a failure of our platform, and injure our reputation. For example, undetected errors or defects in open-source software could render it vulnerable to breaches or security attacks and make our systems more vulnerable to data breaches. Our exposure to these risks may be increased as a result of evolving our core source code base, introducing new content and offerings, integrating acquired-company technologies, or making other business changes, including in areas where we do not currently compete. Any of the foregoing could adversely impact the value or enforceability of our intellectual property, and materially adversely affect our business, financial condition and results of operations.

As of the nine months ended September 30, 2024, international members represented approximately 45% of our total MAUs and accounted for approximately 14% of our total revenue. Offering our apps for download internationally and rolling out full-service memberships outside of the United States, particularly in countries in which we have limited experience, exposes us to a number of additional risks including, among others: - operational and compliance challenges caused by distance, language, and cultural differences;- difficulties in staffing and managing international operations and differing labor regulations for contractors and certain Tile employees working internationally;- differing levels of social and technological acceptance and adoption of our products and services or lack of acceptance of them generally and the risk that our products and services may not resonate as deeply in certain international markets;- foreign currency fluctuations;- restrictions on the transfer of funds among countries and back to the United States, as well as costs associated with repatriating funds to the United States;- differing and potentially adverse tax laws and consequences;- multiple, conflicting and changing laws, rules and regulations, and difficulties understanding and ensuring compliance with those laws by our Company, our employees and our business partners, over whom we exert no control, and other government requirements, approvals, permits and licenses;- compliance challenges due to different, overlapping and evolving requirements and processes set out in different laws and regulatory environments, particularly in the case of data privacy, data security, intermediary liability, and consumer protection;- competitive environments that favor local businesses or local knowledge of such environments;- limited or insufficient intellectual property protection, or the inability or difficulty to obtain, maintain, protect or enforce intellectual property rights or to obtain intellectual property licenses from third parties, which could make it easier for competitors to capture increased market position;- use of international data hosting platforms and other third-party platforms;- low usage and/or penetration of internet connected consumer electronic devices;- political, legal, social or economic instability;- laws and legal systems less developed or less predictable than those in the United States;- trade sanctions, political unrest, terrorism, war, pandemics and epidemics or the threat of any of these events;- breaches or violation of any export and import laws, anti-bribery or anti-corruption laws, anti-money laundering rules or other rules or regulations applicable to our business, including but not limited to the Foreign Corrupt Practices Act of 1977, as amended; and - lower prices paid by international subscribers partially offset the positive impacts to ARPPC we experienced following our price increases for existing U.S. Life360 subscriptions which took effect during 2023. ARPPC is a key performance indicator utilized by Life360 to determine our effectiveness at monetizing Paying Circles through tiered product offerings. The occurrence of any or all of the risks described above could adversely affect our international operations, which could in turn adversely affect our business, financial condition and results of operations.

Tile's products are manufactured in the PRC, making the pricing and availability of our products susceptible to international trade risks. In 2018, the United States imposed additional duties under Section 301 of the U.S. Trade Act of 1974, ranging from 10% to 25%, on a variety of goods imported from the PRC. While these tariffs initially did not affect our products, in May 2019, the United States proposed to place tariffs on essentially all remaining Chinese-origin imports. Subsequently, the Trump Administration announced that 15% tariffs would be imposed on a subset of these goods, including wearable devices, which went into effect September 1, 2019. These tariffs were reduced to 7.5% on February 14, 2020. These elevated tariffs have resulted in higher costs for Tile. There is uncertainty as to when the tariffs will ease. However, if additional tariffs are imposed, related countermeasures are taken by the PRC, or we experience setbacks in our supply chain transformation efforts, our revenue, gross margins, financial condition and results of operations may be adversely affected.