Meta Platforms (META) Risk Factors

We are engaged in ongoing privacy compliance and oversight efforts, including in connection with our modified consent order with the FTC, requirements of the GDPR, and other current and anticipated regulatory and legislative requirements around the world, such as U.S. state privacy laws, youth social media laws, the ePrivacy Directive, DMA, DSA, EU AI Act, the Korean Personal Information Protection Act, and the Indian Digital Personal Data Protection Act. In particular, we are maintaining a comprehensive privacy program in connection with the FTC consent order that includes substantial management and board of directors oversight, stringent operational requirements and reporting obligations, prohibitions against making misrepresentations relating to user data, a process to regularly certify our compliance with the privacy program to the FTC, and regular assessments of our privacy program by an independent third-party assessor, which has been and will continue to be challenging and costly to maintain and enhance. These compliance and oversight efforts are increasing demand on our systems and resources, and require significant new and ongoing investments, including investments in compliance processes, personnel, and technical infrastructure. We continually reallocate resources internally to assist with these efforts, and this has had, and will continue to have, an adverse impact on our other business initiatives. In addition, these efforts require substantial modifications to our business practices and make some practices such as product and ads development more difficult, time-consuming, and costly. As a result, we believe our ability to develop and launch new features, products, and services in a timely manner has been and will continue to be adversely affected. Further, our privacy compliance and oversight efforts have required, and we expect will continue to require, significant time and attention from our management and board of directors. The requirements of the FTC consent order and other privacy-related laws and regulations are complex and apply broadly to our business, and from time to time we notify relevant authorities of instances where we are not in full compliance with these requirements or otherwise discover privacy issues, and we expect to continue to do so as any such issues arise in the future. In addition, regulatory and legislative privacy requirements are constantly evolving and can be subject to significant change and uncertain interpretation. For example, we are subject to restrictions and requirements under the DMA, including in areas such as the combination of data across services and product design, which will likely be subject to further interpretation and regulatory engagement. The FTC initiated an administrative proceeding against us alleging, among other things, deficient compliance with the FTC consent order and seeking substantial modifications to the requirements of the consent order, including a prohibition on our use of minors' data for any commercial purposes, changes to the composition of our board of directors, and significant limitations on our ability to modify and launch new products. We are challenging the FTC's administrative proceeding. If the challenge is unsuccessful and the FTC is able to impose the proposed order in its current form, it would limit our ability to provide certain features and services, engage in certain business practices, require us to further increase the time, resources, and costs we spend on compliance and oversight efforts, and would adversely affect our business and financial results. If we are unable to successfully implement and comply with the mandates of the FTC consent order (including any future modifications to the order), GDPR, U.S. state privacy laws, youth social media laws, ePrivacy Directive, DMA, DSA, or other regulatory or legislative requirements, or if any relevant authority believes that we are in violation of the consent order or other applicable requirements, we may be subject to regulatory or governmental investigations or lawsuits, which may result in significant monetary fines, judgments, penalties, or other remedies, and we may also be required to make additional changes to our business practices. Any of these events could have a material adverse effect on our business, reputation, and financial results.

We are subject to a variety of laws and regulations in the United States and abroad that involve matters central to our business, including privacy, data use, data combination, data protection and personal information, the provision of our services to younger users, biometrics, encryption, rights of publicity, content, integrity, intellectual property, advertising, marketing, distribution, data security, data retention and deletion, data localization and storage, data disclosure, AI and machine learning, electronic contracts and other communications, competition, protection of minors, consumer protection, civil rights, accessibility, telecommunications, product liability, e-commerce, taxation, economic or other trade controls including sanctions, anti-corruption and political law compliance, securities law compliance, and online payment services. The introduction of new products, expansion of our activities in certain jurisdictions, or other actions that we may take may subject us to additional laws, regulations, or other government scrutiny. In addition, these U.S. and foreign laws and regulations may impose different obligations from each other and create the potential for significant fines to be imposed. These U.S. federal and state, EU, and other international laws and regulations, which in some cases can be enforced by private parties in addition to government entities, are constantly evolving and can be subject to significant change. As a result, the application, interpretation, and enforcement of these laws and regulations are often uncertain, particularly in the new and rapidly evolving industry in which we operate, and may be interpreted and applied inconsistently from jurisdiction to jurisdiction and inconsistently with our current policies and practices. For example, regulatory or legislative actions or litigation concerning the manner in which we display content to our users, moderate content, provide our services to younger users, or are able to use data in various ways, including for advertising, could adversely affect user growth and engagement. Such actions could affect the manner in which we provide our services or adversely affect our financial results, including by imposing significant fines that increasingly may be calculated based on global revenue. We are also subject to evolving laws and regulations that dictate whether, how, and under what circumstances we can transfer, process or receive certain data that is critical to our operations, including data shared between countries or regions in which we operate and data shared among our products and services. For example, in 2016, the European Union and United States agreed to a transfer framework for data transferred from the European Union to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union (CJEU). In addition, the other bases upon which Meta relies to transfer such data, such as Standard Contractual Clauses (SCCs), have been subjected to regulatory and judicial scrutiny. For example, the CJEU considered the validity of SCCs as a basis to transfer user data from the European Union to the United States following a challenge brought by the Irish Data Protection Commission (IDPC). Although the CJEU upheld the validity of SCCs in July 2020, on May 12, 2023, the IDPC issued a Final Decision concluding that Meta Platforms Ireland's reliance on SCCs in respect of certain transfers of European Economic Area (EEA) Facebook user data was not in compliance with the GDPR. The IDPC issued an administrative fine of EUR €1.2 billion as well as corrective orders requiring Meta Platforms Ireland to suspend the relevant transfers and to bring its processing operations into compliance with Chapter V GDPR by ceasing the unlawful processing, including storage, of such data in the United States. We are appealing this Final Decision and it is currently subject to an interim stay from the Irish High Court. On March 25, 2022, the European Union and United States announced that they had reached an agreement in principle on a new EU-U.S. Data Privacy Framework (EU-U.S. DPF). On October 7, 2022, President Biden signed the Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities (E.O.), and on June 30, 2023, the European Union and the three additional countries making up the EEA were designated by the United States Attorney General as a "qualifying state" under Section 3(f) of the E.O. On July 10, 2023, the European Commission adopted an adequacy decision in relation to the United States. The adequacy decision concludes that the United States ensures an adequate level of protection for personal data transferred from the European Union to organizations in the United States that are included in the "Data Privacy Framework List," maintained and made publicly available by the United States Department of Commerce pursuant to the EU-U.S. DPF. The implementation of the EU-U.S. DPF and the adequacy decision are important and welcome milestones, and we have implemented steps to comply with the above corrective orders following engagement with the IDPC. The EU-U.S. DPF replaces two prior adequacy frameworks which were invalidated by the CJEU. A further invalidation of the EU-U.S. DPF by the CJEU could create considerable uncertainty and lead to us being unable to offer a number of our most significant products and services, including Facebook and Instagram, in Europe, which would materially and adversely affect our business, financial condition, and results of operations. In addition, we have been managing investigations and lawsuits in India and other jurisdictions regarding the 2021 updates to WhatsApp's terms of service and privacy policy and its sharing of certain data with other Meta products and services, including a lawsuit currently pending before the Supreme Court of India. If we are unable to transfer data between and among countries and regions in which we operate, or if we are restricted from sharing data among our products and services, it could affect our ability to provide our services, the manner in which we provide our services or our ability to target ads, which could adversely affect our financial results. We have been subject to other significant legislative and regulatory developments, which together with proposed or new legislation and regulations could significantly affect our business in the future. For example, we have implemented a number of product changes and controls as a result of requirements under the European General Data Protection Regulation (GDPR), and may implement additional changes in the future. The GDPR also requires submission of personal data breach notifications to our lead European Union privacy regulator, the IDPC, and includes significant penalties for non-compliance with the notification obligation as well as other requirements of the regulation. The interpretation of the GDPR is still evolving, including through decisions of the CJEU, and draft decisions in investigations by the IDPC are subject to review by other European privacy regulators as part of the GDPR's consistency mechanism, which may lead to significant changes in the final outcome of such investigations. We also face potential enforcement from European privacy regulators other than the IDPC, including where those regulators consider they must act urgently or where they believe their concerns relate only to data processing undertaken in their individual jurisdiction. As a result, the interpretation and enforcement of the GDPR, as well as the imposition and amount of penalties for non-compliance, are subject to significant uncertainty, and as it evolves, could potentially have a negative impact on our business and/or our operations. In addition, Brazil, the United Kingdom, and other countries have enacted similar data protection regulations imposing data privacy-related requirements on products and services offered to users in their respective jurisdictions. The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), also establishes certain transparency rules and creates certain data privacy rights for users, including limitations on our use of certain sensitive personal information and more ability for users to control the purposes for which their data is shared with third parties. Other states have proposed or enacted similar comprehensive privacy laws that afford users with similar data privacy rights and controls. These laws and regulations are evolving and subject to interpretation, and resulting limitations on our advertising services, or reductions of advertising by marketers, have to some extent adversely affected, and will continue to adversely affect, our advertising business. Some states have also proposed or enacted laws specifically focused on the privacy rights and controls for users under 18 years old and their parents or guardians. Like comprehensive privacy laws, these laws are evolving and subject to interpretation, and may restrict our ability to offer certain products and services provided to all or certain cohorts of users in those states, adversely affecting our advertising business. In Europe, evolving interpretation of the ePrivacy Directive's requirements regarding the use of cookies and similar technologies may lead to regulators imposing specific measures in the future which could directly impact our use of such technologies. In addition, the ePrivacy Directive and national implementation laws impose additional limitations on the use of data across messaging products and include significant penalties for non-compliance. Changes to our products or business practices as a result of these or similar developments have adversely affected, and may in the future adversely affect, our advertising business. For example, in response to regulatory developments in Europe, we announced plans to change the legal basis for behavioral advertising on Facebook and Instagram in the EU, EEA, and Switzerland from "legitimate interests" to "consent," and in November 2023 we began offering users in the region a "subscription for no ads" alternative. We are engaging with regulators on our consent model, including regarding compliance with requirements under the GDPR, DMA, and EU consumer laws. For example, in March 2024, the European Commission opened formal proceedings regarding the compliance of our "subscription for no ads" model with requirements under the DMA, and it issued preliminary findings in July 2024. In addition, the European Data Protection Board has published an opinion on the operation of such models under GDPR and European consumer protection organizations have raised concerns regarding our compliance with consumer protection laws. These or any similar developments in the future may negatively impact our user growth and engagement, revenue, and financial results. Similarly, there are a number of legislative proposals or recently enacted laws in the European Union, the United States, at both the federal and state level, as well as other jurisdictions that could impose new obligations or limitations in areas affecting our business. For example, the DMA in the European Union imposes restrictions and requirements on companies like ours, including in areas such as the combination of data across services, mergers and acquisitions, and product design. The DMA also includes significant penalties for non-compliance, and its key requirements are enforceable against designated gatekeeper companies as of March 2024. The DMA has caused, and may in the future cause, us to incur significant compliance costs and make changes to our products or business practices. The requirements under the DMA will likely be subject to further interpretation and regulatory engagement. Pending or future proposals to modify competition laws in a number of jurisdictions could have similar effects. Further, the DSA, which started to apply to our business as of August 2023, imposes certain restrictions and requirements for our products and services and subjects us to increased compliance costs, and includes significant penalties for non-compliance. The interpretation and enforcement of the DMA and the DSA, as well as the imposition and amount of penalties for non-compliance, are subject to significant uncertainty. In addition, some countries, such as the UK, India, and Turkey, are considering or have passed legislation implementing data protection requirements, new competition requirements, or requiring local storage and processing of data or similar requirements that could require substantial changes to our products, increase the cost and complexity of delivering our services, cause us to cease the offering of our products and services in certain countries, and/or result in fines or other penalties. New legislation or regulatory decisions that restrict our ability to collect and use information about minors may also result in limitations on our advertising services or our ability to offer products and services to minors in certain jurisdictions. For example, several U.S. states, including Arkansas, Utah, Texas, California, and Florida, among others, have passed laws restricting our ability to offer services to minors without parental consent or otherwise limiting the services that we can provide to minors. While enforcement of a number of these statutes has been enjoined as a result of legal challenges to them, it is possible that the decisions to enjoin these statutes may be overturned, and certain statutes are coming into effect that may not be subject to injunctions. Should enforcement of one or more of these statutes not be enjoined, we may not be able to comply with these statutes by their respective effective dates. Legislative proposals and evolving interpretation of existing laws in Europe, Asia-Pacific, and other jurisdictions may also subject us to new requirements relating to allegedly fraudulent or illegal activities by third parties on our platform, which could cause us to incur significant compliance costs or make changes to our products or business practices, and could subject us to additional fines and penalties or liability for losses to users or other third parties in such transactions. In addition, the Province of British Columbia has considered, and may in the future consider, a bill that would permit the government to recover public health-related costs potentially associated with providing goods and services in British Columbia, including potentially social media services. We are also subject to disclosure, reporting, and diligence requirements regarding our social and environmental risks and initiatives. There has been increased focus on these initiatives by many regulators, investors, and other stakeholders and any actual or perceived failure by us to comply with applicable federal, state, local or international laws and regulations could result in legal and regulatory proceedings against us and materially and adversely affect our business, financial condition, and results of operations. These laws and regulations, as well as any associated claims, inquiries, or investigations or any government actions, have led to, and may in the future lead to, unfavorable outcomes including increased compliance costs, changes to our products, loss of revenue, delays or impediments in the development of new products, negative publicity and reputational harm, increased operating costs, diversion of management time and attention, and remedies that harm our business, including fines, damages, or orders that we modify or cease existing business practices.

Our ad targeting and measurement tools rely on data signals from user activity on websites and services that we do not control, as well as signals generated within our products, in order to deliver relevant and effective ads to our users, and any changes in our ability to use such signals will adversely affect our business. For example, legislative and regulatory developments, such as the GDPR, ePrivacy Directive, DMA, and U.S. state privacy laws, including the CCPA, have impacted, and we expect will continue to impact, our ability to use such signals in our ad products. In particular, we have seen increases in the number of users opting to control certain types of ad targeting in Europe following product changes implemented in connection with our GDPR and ePrivacy Directive compliance, and we have introduced product changes that limit data signal use for certain users in California following adoption of the CCPA. Other U.S. state privacy laws, such as the Texas Data Privacy and Security Act, the Colorado Privacy Act, and the Oregon Consumer Privacy Act, are introducing additional rights for users and could result in restrictions on our use of signals from third-party apps and websites through certain browser- and device-based universal opt-out mechanisms. Judicial and regulatory guidance, decisions, or enforcement actions, or new legislation in these or other jurisdictions may require us to make additional changes to our products in the future that further reduce our ability to use these signals, which has occurred in the past. For example, in response to regulatory developments in Europe, we announced plans to change the legal basis for behavioral advertising on Facebook and Instagram in the European Union, European Economic Area, and Switzerland from "legitimate interests" to "consent," and in November 2023 we began offering users in the region a "subscription for no ads" alternative. We are engaging with regulators on our consent model, including regarding compliance with requirements under the GDPR, DMA, and EU consumer laws. For example, in March 2024, the European Commission opened formal proceedings regarding the compliance of our "subscription for no ads" model with requirements under the DMA, and it issued preliminary findings in July 2024. In addition, the European Data Protection Board has published an opinion on the operation of such models under GDPR and European consumer protection organizations have raised concerns regarding our compliance with consumer protection laws. In addition, mobile operating system and browser providers, such as Apple and Google, have implemented product changes and/or announced future plans to limit the ability of websites and application developers to collect and use these signals to target and measure advertising. For example, in 2021, Apple made certain changes to its products and data use policies in connection with changes to its iOS operating system that reduce our and other iOS developers' ability to target and measure advertising, which has negatively impacted, and we expect will continue to negatively impact, the size of the budgets marketers are willing to commit to us and other advertising platforms. In addition, we have implemented, and may continue to implement, product changes that give users the ability to limit our use of such data signals to improve ads and other experiences on our products and services, including changes implemented in connection with the GDPR, ePrivacy Directive, DMA, and other regulatory frameworks. These developments have limited our ability to target and measure the effectiveness of ads on our platform and negatively impacted our advertising revenue. For example, our advertising revenue has been negatively impacted by marketer reaction to targeting and measurement challenges associated with iOS changes beginning in 2021. If we are unable to mitigate these developments as they take further effect in the future, our targeting and measurement capabilities will be materially and adversely affected, which would in turn significantly impact our advertising revenue.

The substantial majority of our revenue is generated from advertising on mobile devices. There is no guarantee that popular mobile devices will continue to feature our products, or that mobile device users will continue to use our products rather than competing products. We are dependent on the interoperability of our products with popular mobile operating systems, networks, technologies, products, and standards that we do not control, such as the Android and iOS operating systems and mobile browsers. Changes, bugs, or technical issues in such systems, or changes in our relationships with mobile operating system partners, handset manufacturers, browser developers, or mobile carriers, or in the content or application of their terms of service or policies (which they have made in the past and continue to seek to implement) that degrade our products' functionality, reduce or eliminate our ability to update or distribute our products, give preferential treatment to competitive products, limit our ability to deliver, target, or measure the effectiveness of ads, or charge fees related to the distribution of our products or our delivery of ads have adversely affected, and could in the future adversely affect, the usage of our products and monetization on mobile devices. For example, Apple previously released an update to its Safari browser that limits the use of third-party cookies, which reduces our ability to provide the most relevant ads to our users and impacts monetization, and also released changes to iOS that limit our ability to target and measure ads effectively, while expanding their own advertising business. In addition, in January 2024, Google began the process of phasing out third-party cookies in its Chrome browser. We expect that any similar changes to Apple's, Google's, or other browser or mobile platforms will further limit our ability to target and measure the effectiveness of ads and impact monetization. Additionally, in order to deliver high quality mobile products, it is important that our products work well with a range of mobile technologies, products, systems, networks, and standards that we do not control, and that we have good relationships with handset manufacturers, mobile carriers, and browser developers. We may not be successful in maintaining or developing relationships with key participants in the mobile ecosystem or in developing products that operate effectively with these technologies, products, systems, networks, or standards. In the event that it is more difficult for our users to access and use our products on their mobile devices, or if our users choose not to access or use our products on their mobile devices or use mobile products that do not offer access to our products, our user growth and user engagement could be harmed. From time to time, we may also take actions regarding the distribution of our products or the operation of our business based on what we believe to be in our long-term best interests. Such actions may adversely affect our users and our relationships with the operators of mobile operating systems, handset manufacturers, mobile carriers, browser developers, other business partners, or advertisers, and there is no assurance that these actions will result in the anticipated long-term benefits. In the event that our users are adversely affected by these actions or if our relationships with such third parties deteriorate, our user growth, engagement, and monetization could be adversely affected and our business could be harmed. We have experienced challenges in operating with mobile operating systems, networks, technologies, products, and standards that we do not control, and any such occurrences in the future may negatively impact our user growth, engagement, and monetization on mobile devices, which may in turn materially and adversely affect our business and financial results.

Our reputation and ability to attract, retain, and serve our users is dependent upon the reliable performance of our products and services and our underlying technical infrastructure. We have experienced, and may in the future experience, interruptions in the availability or performance of our products and services from time to time. Our systems may not be adequately designed or may not operate with the reliability and redundancy necessary to avoid performance delays or outages that could be harmful to our business. If our products or services are unavailable when users attempt to access them, or if they do not load as quickly as expected, users may not use our products or services as often in the future, or at all, and our ability to serve ads may be disrupted, any of which could adversely affect our business and financial performance. We have experienced such issues to varying degrees from time to time. In addition, as the amount and types of information shared on our products continue to grow and evolve, as the usage patterns of our global community continue to evolve, and as our internal operational demands continue to grow, especially with the deployment of AI technologies, we will need an increasing amount of technical infrastructure, including network capacity, computing power, and related energy requirements, to continue to satisfy our needs. Although we are making significant investments in our technical infrastructure, it is possible that we may fail to continue to effectively scale and grow our technical infrastructure to accommodate these increased demands or achieve our business objectives, which may adversely affect our user engagement and advertising revenue. In addition, our business may be subject to interruptions, delays, or failures resulting from earthquakes, adverse weather conditions, other natural disasters, power loss, terrorism, geopolitical conflict, other physical security threats, cyber-attacks, or other catastrophic events and crises. Global climate change could result in certain types of natural disasters occurring more frequently or with more intense effects. Any such events may result in users being subject to service disruptions or outages and we may not be able to recover our technical infrastructure and user data in a timely manner to restart or provide our services, which may adversely affect our financial results. We also have been, and may in the future be, subject to increased energy and/or other costs to maintain the availability or performance of our products and services in connection with any such events. A substantial portion of our technical infrastructure is provided by third parties. Any disruption or failure in the services we receive from these providers could harm our ability to handle existing or increased traffic and could significantly harm our business. Any financial or other difficulties these providers face may adversely affect our business, and we exercise little control over these providers, which increases our vulnerability to problems with the services they provide. We have experienced, and expect to continue to experience, various challenges with the supply chain related to supporting our technical infrastructure. As a result, we have adjusted, and may continue to adjust in the future, our procurement practices to adapt to the evolving landscape. We may not be able to secure sufficient components, equipment, or services from third parties to satisfy our needs, or we may be required to procure such components, equipment, or services on unfavorable terms. Any of these developments may result in interruptions in the availability or performance of our products or services, require unfavorable changes to existing products or services, delay the introduction of future products or services, or otherwise adversely affect our business and financial results.

The size of our active user base and our users' level of engagement across our products are critical to our success. Our financial performance has been and will continue to be significantly determined by our success in adding, retaining, and engaging active users of our products that deliver ad impressions, particularly for Facebook and Instagram. We have experienced, and expect to continue to experience, fluctuations and declines in the size of our active user base in one or more markets from time to time, particularly in markets where we have achieved higher penetration rates. User growth and engagement are also impacted by a number of other factors, including competitive products and services, such as TikTok, that have reduced some users' engagement with our products and services, as well as global and regional business, macroeconomic, and geopolitical conditions. For example, the COVID-19 pandemic led to increases and decreases in the size and engagement of our active user base from period to period at different points during the pandemic. In addition, in connection with the war in Ukraine, access to Facebook and Instagram was restricted in Russia and these services were then prohibited by the Russian government, which contributed to slight decreases in the size of our active user base following the onset of the war. Any future declines in the size of our active user base may adversely impact our ability to deliver ad impressions and, in turn, our financial performance. If people do not perceive our products to be useful, reliable, and trustworthy, we may not be able to attract or retain users or otherwise maintain or increase the frequency and duration of their engagement. A number of other social networking companies that achieved early popularity have since seen their active user bases or levels of engagement decline, in some cases precipitously. There is no guarantee that we will not experience a similar erosion of our active user base or engagement levels. Our user engagement patterns have changed over time, and user engagement can be difficult to measure, particularly as we and our competitors introduce new and different products and services. Any number of factors can negatively affect user retention, growth, and engagement, including if: - users increasingly engage with other competitive products or services;- we fail to introduce new features, products, or services that users find engaging or if we introduce new products or services, or make changes to existing products and services, that are not favorably received;- users feel that their experience is diminished as a result of the decisions we make with respect to the frequency, prominence, format, size, and quality of ads that we display;- users have difficulty installing, updating, or otherwise accessing our products on mobile devices as a result of actions by us or third parties that we rely on to distribute our products and deliver our services;- user behavior on any of our products changes, including decreases in the quality and frequency of content shared on our products and services;- we are unable to continue to develop products for mobile devices that users find engaging, that work with a variety of mobile operating systems and networks, and that achieve a high level of market acceptance;- there are decreases in user sentiment due to questions about the quality or usefulness of our products or our user data practices, concerns about the nature of content made available on our products, or concerns related to privacy, safety, security, well-being, or other factors;- we are unable to manage and prioritize information to ensure users are presented with content that is appropriate, interesting, useful, and relevant to them;- we are unable to obtain or attract engaging third-party content;- we are unable to successfully maintain or grow usage of and engagement with applications that integrate with our products;- users adopt new technologies where our products may be displaced in favor of other products or services, or may not be featured or otherwise available;- there are changes mandated by legislation, government and regulatory authorities, or litigation that adversely affect our products or users;- we are unable to offer a number of our most significant products and services, including Facebook and Instagram, in Europe, or are otherwise limited in our business operations, as a result of European courts invalidating the EU-U.S. DPF or regulators, courts, or legislative bodies determining that the legal bases we rely upon to transfer user data from the European Union to the United States are invalid;- there is decreased engagement with our products, decreased efficiency of our advertising products, or failure to accept our terms of service, as part of changes that we have implemented or may implement in the future, whether voluntarily, in connection with the GDPR, the European Union's ePrivacy Directive, the DMA, the DSA, the DMCC, U.S. state privacy laws including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), youth social media laws, or other laws, regulations, or regulatory actions, or otherwise;- technical or other problems prevent us from delivering our products in a rapid and reliable manner or otherwise affect the user experience, such as security breaches or failure to prevent or limit spam or otherwise objectionable content, or users feel their experience is diminished as a result of our efforts to protect the security and integrity of our platform;- we adopt terms, policies, or procedures related to areas such as sharing, content, user data, or advertising, or we take, or fail to take, actions to enforce our policies, that result in our removal of users from our platform or are perceived negatively by our users or the general public, including as a result of decisions or recommendations from the independent Oversight Board regarding content on our platform;- we elect to focus our product decisions on longer-term initiatives that do not prioritize near-term user growth and engagement (for example, we have announced plans to focus product decisions on optimizing the young adult experience in the long term);- we make changes in our user account login or registration processes or changes in how we promote different products and services across our family of products;- initiatives designed to attract and retain users and engagement, including the use of evolving technologies such as generative artificial intelligence, are unsuccessful or discontinued, whether as a result of actions by us, our competitors, or other third parties, or otherwise;- third-party initiatives that may enable greater use of our products, including low-cost or discounted data plans, are scaled back or discontinued, or the pricing of data plans otherwise increases;- there is decreased engagement with our products as a result of taxes imposed on the use of social media or other mobile applications in certain countries, internet shutdowns, or other actions by governments that affect the accessibility of our products in their countries (for example, beginning in the first quarter of 2022, our user growth and engagement were adversely affected by the war in Ukraine and service restrictions imposed by the Russian government);- we fail to provide adequate customer service to users, marketers, developers, or other partners;- we, developers whose products are integrated with our products, or other partners and companies in our industry are the subject of adverse media reports or other negative publicity, including as a result of our or their user data practices; or - our current or future products, such as our development tools and application programming interfaces that enable developers to build, grow, and monetize applications, reduce user activity on our products by making it easier for our users to interact and share on third-party applications. From time to time, certain of these factors have negatively affected user retention, growth, and engagement to varying degrees. If we are unable to maintain or increase our user base and user engagement, particularly for our significant revenue-generating products like Facebook and Instagram, our revenue and financial results may be adversely affected. Any significant decrease in user retention, growth, or engagement could render our products less attractive to users, marketers, and developers, which is likely to have a material and adverse impact on our ability to deliver ad impressions and, accordingly, our revenue, business, financial condition, and results of operations. As the size of our active user base fluctuates in one or more markets from time to time, we will become increasingly dependent on our ability to maintain or increase levels of user engagement and monetization in order to grow revenue.

The numbers for our key metrics, which include our DAP and average revenue per person (ARPP), are calculated using internal company data based on the activity of user accounts. While these numbers are based on what we believe to be reasonable estimates of our user base for the applicable period of measurement, there are inherent challenges in measuring usage of our products across large online and mobile populations around the world. The methodologies used to measure these metrics require significant judgment and are also susceptible to algorithm or other technical errors. In addition, we are continually seeking to improve our estimates of our user base, and such estimates may change due to improvements or changes in our methodology. We regularly review our processes for calculating these metrics, and from time to time we discover inaccuracies in our metrics or make adjustments to improve their accuracy, which can result in adjustments to our historical metrics. Our ability to recalculate our historical metrics may be impacted by data limitations or other factors that require us to apply different methodologies for such adjustments. We generally do not intend to update previously disclosed Family metrics for any such inaccuracies or adjustments that are within the error margins disclosed below. In addition, our Family metrics estimates will differ from estimates published by third parties due to differences in methodology or other factors such as data limitations or other challenges in measuring large online and mobile populations. For example, our methodologies include measurements of our user base that have in some instances exceeded estimates of addressable online and mobile populations that are based on data published by third parties. Many people in our community have user accounts on more than one of our products, and some people have multiple user accounts within an individual product. Accordingly, for our Family metrics, we do not seek to count the total number of user accounts across our products because we believe that would not reflect the actual size of our community. Rather, our Family metrics represent our estimates of the number of unique people using at least one of Facebook, Instagram, Messenger, and WhatsApp. We do not require people to use a common identifier or link their accounts to use multiple products in our Family, and therefore must seek to attribute multiple user accounts within and across products to individual people. To calculate these metrics, we rely upon complex techniques, algorithms and machine learning models that seek to count the individual people behind user accounts, including by matching multiple user accounts within an individual product and across multiple products when we believe they are attributable to a single person, and counting such group of accounts as one person. These techniques and models require significant judgment, are subject to data and other limitations discussed below, and inherently are subject to statistical variances and uncertainties. We estimate the potential error in our Family metrics primarily based on user survey data as described further below, which itself is subject to error as well. While we expect the error margin for our Family metrics to vary from period to period, we estimate that such margin generally will be approximately 3% of our worldwide DAP. At our scale, it is very difficult to attribute multiple user accounts within and across products to individual people, and it is possible that the actual numbers of unique people using our products may vary significantly from our estimates, potentially beyond our estimated error margins. As a result, it is also possible that our Family metrics may indicate changes or trends in user numbers that do not match actual changes or trends. To calculate our estimates of DAP, we currently use a series of machine learning models that are developed based on internal reviews of limited samples of user accounts and calibrated against user survey data. We apply significant judgment in designing these models and calculating these estimates. For example, to match user accounts within individual products and across multiple products, we use data signals such as similar device information, IP addresses, and user names. We also calibrate our models against data from periodic user surveys of varying sizes and frequency across our products, which survey questions are based on monthly usage, and which are inherently subject to error. The timing and results of such user surveys have in the past contributed, and may in the future contribute, to changes in our reported Family metrics from period to period. In addition, our data limitations may affect our understanding of certain details of our business and increase the risk of error for our Family metrics estimates. Our techniques and models rely on a variety of data signals from different products, and we rely on more limited data signals for some products compared to others. For example, as a result of limited visibility into encrypted products, we have fewer data signals from WhatsApp user accounts and primarily rely on phone numbers and device information to match WhatsApp user accounts with accounts on our other products. Any loss of access to data signals we use in our process for calculating Family metrics, whether as a result of our own product decisions, actions by third-party browser or mobile platforms, regulatory or legislative requirements, or other factors, also may impact the stability or accuracy of our reported Family metrics, as well as our ability to report these metrics at all. Our estimates of Family metrics also may change as our methodologies evolve, including through the application of new data signals or technologies, product changes, or other improvements in our user surveys, algorithms, or machine learning that may improve our ability to match accounts within and across our products or otherwise evaluate the broad population of our users. In addition, such evolution may allow us to identify previously undetected violating accounts (as defined below). We regularly evaluate our Family metrics to estimate the percentage of our DAP consisting solely of "violating" accounts. We define "violating" accounts as accounts which we believe are intended to be used for purposes that violate our terms of service, including bots and spam. In the first quarter of 2024, we estimated that less than 3% of our worldwide DAP consisted solely of violating accounts. Such estimation is based on an internal review of a limited sample of accounts, and we apply significant judgment in making this determination. For example, we look for account information and behaviors associated with Facebook and Instagram accounts that appear to be inauthentic to the reviewers, but we have limited visibility into WhatsApp user activity due to encryption. In addition, if we believe an individual person has one or more violating accounts, we do not include such person in our violating accounts estimation as long as we believe they have one account that does not constitute a violating account. From time to time, we disable certain user accounts, make product changes, or take other actions to reduce the number of violating accounts among our users, which may also reduce our DAP estimates in a particular period. We intend to disclose our estimates of the percentage of our DAP consisting solely of violating accounts on an annual basis in our Annual Report on Form 10-K. Violating accounts are very difficult to measure at our scale, and it is possible that the actual number of violating accounts may vary significantly from our estimates. Other data limitations also may affect our understanding of certain details of our business. For example, while user-provided data indicates a decline in usage among younger users, this age data may be unreliable because a disproportionate number of our younger users register with an inaccurate age. Accordingly, our understanding of usage by age group may not be complete. Our estimates for revenue by user location, as well as year-over-year percentage changes in ad impressions delivered and the average price per ad by user location, are also affected by data limitations and other challenges in measuring user geography. Our data regarding the geographic location of our users is estimated based on a number of factors, such as the user's IP address and self-disclosed location. These factors may not always accurately reflect the user's actual location. For example, a user may appear to be accessing our products from the location of the proxy server that the user connects to rather than from the user's actual location. The methodologies used to measure our metrics are also susceptible to algorithm or other technical errors. In addition, from time to time we provide, or rely on, certain other metrics and estimates, including those relating to the reach and effectiveness of our ads. Many of our metrics involve the use of estimations and judgments, and our metrics and estimates are subject to software bugs, inconsistencies in our systems, and human error. Such metrics and estimates also change from time to time due to improvements or changes in our terminology or methodology, including as a result of loss of access to data signals we use in calculating such metrics and estimates. We have been, and may in the future be, subject to litigation as well as marketer, regulatory, and other inquiries regarding the accuracy of such metrics and estimates. Where marketers, developers, or investors do not perceive our metrics or estimates to be accurate, or where we discover material inaccuracies in our metrics or estimates, we may be subject to liability, our reputation may be harmed, and marketers and developers may be less willing to allocate their budgets or resources to our products that deliver ad impressions, which could negatively affect our business and financial results.