Lendingtree (TREE) Risk Factors

In the processing of consumer transactions, our businesses collect, use, store, disclose, transfer, and otherwise process a large volume of personal information and other confidential, proprietary and sensitive data. Breaches or failures of security involving our systems or website or those of any of our affiliates, Network Partners or external service providers have occurred in the past and may occur in the future, and have in the past resulted in, and could in the future result in, the theft, unauthorized access, acquisition, use, disclosure, modification or misappropriation of personal information of our consumers, employees or third parties with whom we conduct business, or other confidential, proprietary and sensitive data, fraudulent activity, or system disruptions or shutdowns. The occurrence of any actual or attempted breach, failure of security or fraudulent activity, the reporting of such an incident, whether accurate or not, or our failure to make adequate or timely disclosures to the public or law enforcement agencies following any such event, whether due to delayed discovery or a failure to follow existing protocols, could result in claims made against us or our affiliates, Network Partners or external service providers. Such claims could result in state and/or federal litigation and related financial liabilities, as well as criminal penalties or civil liabilities, regulatory actions from state and/or federal governmental authorities, and significant fines, orders, sanctions, litigation and claims against us by consumers or third parties and related indemnification obligations. Actual or perceived security breaches or failures also have in the past caused, and may in the future cause, financial losses, increased costs, interruptions in the operations of our business, misappropriation of assets, significant damage to our brand and reputation with consumers and third parties with whom we do business and result in adverse publicity, loss of consumer confidence, distraction to our management, and reduced sales and profits, any or all of which could have a material and adverse impact on our business, financial condition and results of operations. Such breaches, failures and fraudulent activity may take many forms, including check fraud, fraudulent inducement, electronic fraud, wire fraud, computer viruses, phishing, social engineering, denial or degradation of service attacks, malware, ransomware or other cyber-attacks, and other dishonest acts, any of which could be the result of a circumvention or failure of our data security processes, procedures, tools, and controls. Our systems are also subject to compromise from internal threats, such as theft, misuse, unauthorized access or other improper actions by employees, external service providers and other third parties with otherwise legitimate access to our systems and website. Data security-related incidents and fraudulent activity are increasing in frequency and evolving in nature. We rely on a framework of security, processes, procedures, tools, and controls designed to protect our information and assets but, given the unpredictability of the timing, nature and scope of data security-related incidents and fraudulent activity, there can be no assurance that any security procedures and controls that we or our external service providers have implemented will be sufficient to prevent data security-related incidents or other fraudulent activity from occurring. Furthermore, because the methods of attack and deception change frequently, are increasingly complex and sophisticated, and can originate from a wide variety of sources, including third parties such as external service providers and even nation-state actors, despite our reasonable efforts to ensure the integrity of our systems and website, it is possible that we may not be able to anticipate, detect, appropriately react and respond to, or implement effective preventative measures against, all security breaches and failures and fraudulent activity. As a result, our business, financial condition or results of operations could be materially and adversely affected. We also face risks associated with security breaches affecting third parties and their suppliers or partners (fourth parties) with whom we are affiliated or otherwise conduct business. Due to applicable laws and regulations or contractual obligations, we may be held responsible for any breach, failure or fraudulent activity attributed to our affiliates, Network Partners or external service providers as they relate to the information we share with them. In addition, because we do not control our Network Partners or external service providers and our ability to monitor their data security is limited, we cannot ensure the security measures they take will be sufficient to protect our information. We may be required to expend significant capital and other resources to protect against, respond to, and recover from any potential, attempted, or existing security breaches or failures and their consequences. As data security-related threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. In addition, our remediation efforts may not be successful. The inability to implement, maintain and upgrade adequate safeguards could have a material and adverse impact on our business, financial condition and results of operations. Moreover, there could be public announcements regarding any data security-related incidents and any steps we take to respond to or remediate such incidents. If securities analysts or investors perceive these announcements to be negative, it could, among other things, have a substantial adverse effect on the price of our common stock. Consumers are generally concerned with security and privacy of the internet and any publicized security problems affecting our businesses or those of third parties with whom we are affiliated or otherwise conduct business may discourage consumers from doing business with us, which could have a material and adverse effect on our business, financial condition and results of operations. While we currently maintain cybersecurity insurance, such insurance may not be sufficient in type or amount to cover us against claims related to breaches, failures or other data security-related incidents, and we cannot be certain that cyber insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material and adverse effect on our business, financial condition and results of operations.

We have, in the past, launched a number of new products and may, in the future, launch new products. We do not have as much experience with new products as with the other more mature products. Accordingly, new products may be subject to greater risks than our more mature products. The success of our new products will depend on a number of factors, including, but not limited to: - implementing, at an acceptable cost, product features offered by our competitors and/or expected by consumers, lenders and lead purchasers;- market acceptance by consumers, lenders and lead purchasers;- offerings by current and future competitors;- our ability to attract and retain management and other skilled personnel for these businesses;- our ability to collect amounts owed to us from third parties;- our ability to develop successful and cost-effective marketing campaigns; and - our ability to timely adjust marketing expenditures in relation to changes in demand for the underlying products and services offered by our Network Partners. Our results of operations may suffer if we fail to successfully anticipate and manage these issues associated with new products.

In order to attract visitors to our websites, convert these visitors into loan or other financial product requests for our Network Partners and lead purchasers and generate repeat visits from consumers, our businesses must promote and maintain their reputations and various brands. Brand promotion and maintenance requires the expenditure of considerable money and resources for online and offline advertising, marketing and related efforts, as well as the continued provision and introduction of high-quality products and services that meet the needs of consumers at competitive prices, the ability to maintain consumers' trust, and the ability to successfully differentiate our brand, products and services from those of our competitors. Brand recognition is a key differentiating factor among providers of online services. We believe that continuing to build and maintain the recognition of our various brands is critical to achieving increased demand for the services provided by our businesses. Accordingly, we have spent, and expect to continue to spend, significant amounts on, and devote significant resources to, branding, advertising and other marketing initiatives, which may not be successful or cost-effective. Our brand promotion activities may not generate consumer awareness or yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand. Adverse publicity and the potential corresponding impact on our reputation may be accelerated and amplified by the widespread use of social media platforms. Furthermore, adverse publicity, from legal proceedings against us or our businesses, including governmental proceedings and consumer class action or other litigation, or the disclosure of information from security breaches or other incidents, could negatively impact our reputation and our various brands, which could materially and adversely affect our business and financial condition and results of operations. In addition, the actions of our third-party marketing partners who engage in advertising on our behalf could negatively impact our reputation and our various brands. The failure of our businesses to maintain or enhance the reputation and recognition of their respective brands and attract and retain consumers in a cost-effective manner could materially and adversely affect our business, financial condition and results of operations.

Our operations in India may subject us to compliance with various laws and regulations, including the FCPA and similar anti-bribery and anti-corruption laws, which generally prohibit companies and their intermediaries from engaging in bribery or making other improper payments to private or public parties for the purpose of obtaining or retaining business or gaining an unfair business advantage. The FCPA also requires proper record keeping and characterization of such payments in our reports filed with the SEC. Violations of these laws could result in severe criminal or civil sanctions and financial penalties and other consequences that may have a material adverse effect on our business, reputation, financial condition or results of operations.

The impact of the changes in tax legislation on future years may be material to our consolidated financial statements. Similarly, changes in tax laws and regulations that impact our Network Partners or the economy generally may also impact our financial condition and results of operations. In addition, tax laws and regulations are complex and subject to varying interpretations and any significant failure to comply with applicable tax laws and regulations in all relevant jurisdictions could give rise to substantial penalties and liabilities. Any changes in enacted tax laws, rules or regulatory or judicial interpretations (including any attempt to tax online services such as those offered by us); any adverse outcome in connection with tax audits in any jurisdiction; or any change in the pronouncements relating to accounting for income taxes could materially and adversely impact our effective tax rate, tax payments, financial condition and results of operations.

In the course of our operations and the processing of consumer transactions, our businesses collect, use, store, disclose, transfer and otherwise process a large volume of personal information, including from our consumers, employees and third parties with whom we conduct business, and other user data. The collection, use, storage, disclosure, transfer and other processing of personal information is increasingly subject to a wide array of federal and state laws and regulations regarding data privacy and security, including the GLBA, that are intended to protect the privacy of personal information that is collected, used, stored, disclosed, transferred and otherwise processed in or from the governing jurisdiction. Some countries also are considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our products and services. As we seek to expand our business, we are, and may increasingly become, subject to various laws, regulations and standards, as well as contractual obligations, relating to data use, privacy and security in the jurisdictions in which we operate. In many cases, these laws and regulations apply not only to third-party transactions, but also to transfers of information between or among us, our affiliates and other parties with whom we conduct business. These laws, regulations and standards may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that may have a material and adverse impact on our business, financial condition and results of operations. The regulatory framework for data privacy and security worldwide is continuously evolving and developing and, as a result, interpretation and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. In the United States, various federal and state regulators, including governmental agencies, like the CFPB and FTC, have adopted, or are considering adopting, laws and regulations concerning personal information and data privacy and security. This patchwork of legislation and regulation may give rise to conflicts or differing views of personal privacy rights. For example, certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information than federal, international or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts. At the federal level, we are subject to the GLBA, which restricts certain collection, storage, use, disclosure and other processing by covered companies of certain personal information, requires notice to individuals of privacy practices and provides individuals with certain rights to prevent the use and disclosure of certain non-public or otherwise legally protected personal information. The GLBA also imposes requirements regarding the safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines. In addition, many states in which we operate have laws that protect the privacy and security of personal information. For example, the California Consumer Privacy Act (the "CCPA"), as amended by the California Privacy Rights Act ("CPRA"), requires covered companies to, among other things, provide certain disclosures to California residents and provide such residents with certain data protection and privacy rights, including the ability to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of certain personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. The CCPA and the CPRA contain several exemptions, including a provision to the effect that the CCPA and CPRA do not apply where the personal information is collected, processed, sold or disclosed pursuant to the GLBA. It is possible that further amendments to the CCPA and the CPRA will be enacted, but even in their current forms it remains unclear how various provisions of the CCPA and CPRA will be interpreted and enforced. Numerous other states also have enacted or are in the process of enacting state-level data privacy and security laws and regulations and there is discussion in Congress of a new federal data protection and privacy law to which we may become subject if it is enacted. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may require us to modify our data processing practices and policies, divert resources from other initiatives and projects, and could restrict the way products and services involving data are offered, all of which may have a material and adverse impact on our business, financial condition and results of operations. Many regulatory and statutory requirements, both in the United States and abroad, include obligations for companies to notify individuals of data breaches involving certain personal information, which have in the past resulted from, and may in the future result from, breaches experienced by us or our external service providers. For example, laws in all 50 U.S. states require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. These laws are not consistent and compliance in the event of a widespread data breach is difficult and costly. Moreover, states have been frequently amending existing laws, requiring attention to changing regulatory requirements. We also may be contractually required to notify consumers or other third parties of a security breach. Although we may have contractual protections with our external service providers, actual or perceived security breaches have in the past resulted in, and may in the future result in, harm to our reputation and brand, exposure to potential liability or a need to expend significant resources on data security and in responding to any such actual or perceived breach. Any contractual protections we may have from our external service providers may not be sufficient to adequately protect us from any such liabilities and losses, and we may be unable to enforce any such contractual protections. In addition to government regulation, privacy advocates and industry groups have and may in the future propose self-regulatory standards from time to time. These and other industry standards may legally or contractually apply to us, or we may elect to comply with such standards. We expect that there will continue to be new proposed laws and regulations concerning data privacy and security and we cannot yet determine the impact such future laws, regulations and standards may have on our business. New laws, amendments to or re-interpretations of existing laws, regulations, standards and other obligations may require us to incur additional costs and restrict our business operations. Because the interpretation and application of laws, regulations, standards and other obligations relating to data privacy and security are still uncertain, it is possible that these laws, regulations, standards and other obligations may be interpreted and applied in a manner that is inconsistent with our data processing practices and policies or the features of our products and services. If so, in addition to the possibility of fines, lawsuits, regulatory investigations, public censure, other claims and penalties, and significant costs for remediation and damage to our reputation, we could be materially and adversely affected if legislation or regulations are expanded to require changes in our data processing practices and policies or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively impact our business, financial condition and results of operations. We may be unable to make such changes and modifications in a commercially reasonable manner, or at all. Any inability to adequately address data privacy or security-related concerns, even if unfounded, or to comply with applicable laws, regulations, standards and other obligations relating to data privacy and security, could result in additional cost and liability to us, harm our reputation and brand, damage our relationships with consumers and have a material and adverse impact on our business, financial condition and results of operations. We make public statements about our use and disclosure of personal information through our privacy policies, information provided on our website and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other statements that provide promises and assurances about data privacy and security can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices. Moreover, from time to time, concerns may be expressed about whether our products and services compromise the privacy of consumers and others. Any concerns about our data privacy and security practices, even if unfounded, could damage the reputation of our businesses, discourage potential users from our products and services and have a material and adverse impact on our business, financial condition and results of operations. Any failure or perceived failure by us or our Network Partners or external service providers to comply with our posted privacy policies or with any applicable federal, state or foreign laws, regulations, standards, certifications or orders relating to data privacy or security or consumer protection, or any compromise of security that results in the theft, unauthorized access, acquisition, use, disclosure, or misappropriation of personal information or other user data, could result in fines or proceedings or litigation by governmental agencies or consumers, including class action privacy litigation in certain jurisdictions, which would subject us to significant awards, penalties or judgments, one or all of which could materially and adversely affect our business, financial condition and results of operations. In addition, if our practices are not consistent, or viewed as not consistent, with legal and regulatory requirements, including changes in laws, regulations and standards or new interpretations or applications of existing laws, regulations and standards, we may also become subject to audits, inquiries, whistleblower complaints, adverse media coverage, investigations, or severe criminal or civil sanctions, all of which may affect our financial condition, operating results and our reputation.

We face various risks related to public health issues, including epidemics, pandemics, and other outbreaks, including the global outbreak of COVID-19. The COVID-19 pandemic negatively impacted the global economy, disrupted global supply chains, created significant volatility and disruption in financial markets, and, at times, increased unemployment levels. In addition, the pandemic resulted in temporary closures of many businesses and the institution of various lockdown orders and sheltering in place requirements in many states and communities. As a result, the demand for our products, in particular in our Consumer segment, was significantly impacted. The full impact of COVID-19 or any widespread public health issue on our financial condition and results of operations will depend on the duration and scope of an outbreak (including any potential future waves, the emergence or re-emergence of variants and their transmissibility, and the success of vaccination programs and treatments), its impact on our consumers and our Network Partners, how quickly normal economic conditions, operations, and the demand for our services and products can resume, and any permanent behavioral changes that the pandemic may cause. The extent to which the COVID-19 pandemic or any widespread public health issue impacts our business, financial condition and results of operations, as well as our regulatory capital and liquidity ratios, will depend on future developments, which are highly uncertain and cannot be predicted.