Zillow Group Class C (Z) Risk Analysis

We are from time to time involved in, and have in the past or may in the future be subject to claims, suits, government investigations, enforcement actions and proceedings arising from our business, including actions with respect to intellectual property, privacy, consumer protection, information security, mortgage brokering, mortgage origination, real estate, real estate brokerage, environmental, data protection, antitrust, the Real Estate Settlement Procedures Act of 1974 (RESPA), fair housing or fair lending, compliance with securities laws, or law enforcement matters, tax matters, labor and employment, and commercial claims, as well as actions involving content generated by our customers, shareholder derivative actions, purported class action lawsuits, and other matters. We are also from time to time involved in, and have in the past or may in the future be subject to claims, government investigations, enforcement actions and proceedings arising from or related to discontinued products and services, including actions with respect to the purchase, renovation and resale of properties, including homes previously held in our inventory. See Part II, Item 8 in Note 15 under the subsection titled "Legal Proceedings" in our Notes to Consolidated Financial Statements in this Annual Report on Form 10-K. Such claims, suits, government investigations, and proceedings are inherently uncertain, and their results cannot be predicted with certainty. Regardless of the outcome, any such legal proceedings can have an adverse impact on us because of legal costs, diversion of management and other personnel, and other factors. In addition, it is possible that a resolution of one or more such proceedings could result in reputational harm, liability, fines, penalties, or sanctions, as well as judgments, consent decrees, or orders preventing us from offering certain features, functionalities, products, or services, or requiring a change in our business practices, products or technologies, which could in the future materially and adversely affect our business, operating results and financial condition. In some instances, third parties may have an obligation to indemnify us for liabilities related to litigation or governmental investigations, and they may be unable to, or fail to, fulfill such obligations. If such third parties failed to indemnify us, we may be financially responsible, which could adversely affect our financial condition and cash flow.

We are subject to income taxes in the United States (federal and state) and certain foreign jurisdictions. Tax laws, regulations, and administrative practices in various jurisdictions may be subject to significant change, with or without notice, due to economic, political, and other conditions. New tax laws, regulations and administrative practices could be enacted or adopted at any time, and existing tax laws, regulations and administrative practices could be interpreted, modified or applied adversely to us, possibly with retroactive effect. These changes could require us to pay additional taxes, penalties, interest and other related costs, and also could increase our compliance, operating and other costs. Significant judgment is required in evaluating and estimating the taxes imposed under such tax laws. Our effective tax rates could be affected by numerous factors, such as entry into new businesses and geographies, changes to our existing business and operations, acquisitions and investments and how they are financed, changes in our stock price, changes in our deferred tax assets and liabilities and their valuation, and changes in the relevant tax, accounting, and other laws, regulations,administrative practices, principles, and interpretations. We are required to take positions regarding the interpretation of complex statutory and regulatory tax rules and on valuation matters that are subject to uncertainty, and the Internal Revenue Service or other tax authorities may challenge the positions we take.

Our success depends on our continued innovation to provide new, and improve upon existing, products and services that make real estate transactions faster, easier and less stressful for our customers and provide value to real estate, rental and mortgage professionals, home buyers and sellers and our other real estate partners. As a result, we must continually invest significant resources in technology and development to improve the attractiveness, competitiveness, and comprehensiveness of our products and services, enable more seamless and efficient real estate transactions, adapt to changes in technology and support new devices and operating systems. If we are unable to provide products and services that our customers want to use, on the devices they prefer, then those customers may become dissatisfied and use competitors' mobile applications, websites, products and services. If our customers begin to access more real estate information and services through other media and we fail to innovate, our business may be negatively impacted. If we are unable to continue offering high-quality, innovative products and services, we may be unable to attract additional customers and real estate partners or retain our current customers and real estate partners, which could harm our business, results of operations and financial condition.

Our products and services involve the transmission, processing, and/or storage of users' information, some of which may be private or include personally identifiable information such as social security numbers, financial account information, and credit card information. For example, our dotloop real estate transaction management software stores sensitive personal and financial information, our Mortech mortgage product and pricing software for mortgage professionals processes social security numbers, our rental applications product allows customers to obtain credit and background checks containing sensitive personal and financial information, and our mortgage origination and real estate closings operations, receive, handle and transmit highly sensitive personal and financial information about its customers. Cyber-attacks, malicious internet-based activity, online and offline fraud, administrative or technical failures and other similar activities threaten the confidentiality, integrity and availability of our information technology systems, including those of the third parties upon which we rely, and our sensitive data, including customer, employee and real estate partner data as well as intellectual property and other confidential business information, which could result in potential significant liability and litigation. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers", threat actors, "hacktivists", organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain and ability to produce, sell and distribute our services. We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, or floods, attacks enhanced or facilitated by AI, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, negative impacts on our ability to provide our products or services, loss of sensitive data and income, reputational harm and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Outside parties may attempt to fraudulently induce employees, officers, directors, customers or real estate partners to disclose sensitive information in order to gain access to our information or our customers' or real estate partners' information, and our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to user error, malfeasance or other disruptions. If we experience compromises to our security that result in the loss or unauthorized disclosure of confidential information, our customers and real estate partners may lose trust in us, customers may decrease the use of our mobile applications or websites or stop using our mobile applications, websites, or services in their entirety, real estate partners may decrease or stop advertising on our mobile applications or websites, and we may be subject to legal claims and liability, government investigation and additional state and federal legal requirements. If we experience compromises to our security that result in the loss of availability of our data, our mobile applications, websites, or services may be unable to function at a level necessary to meet our customers' needs. Our reliance on vendors could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. We engage a variety of vendors to process and store sensitive data, including certain customer information, some of which may be private or include personally identifiable information. We also depend on vendors to host many of the systems and infrastructure used to provide our products and services. Our ability to monitor these vendors' information security practices is limited and these vendors may not have adequate information security controls in place. If our vendors experience a security incident or other interruption, we could experience adverse consequences, including harm to our business, results of operations and financial condition. Further, a security breach at our vendor could be perceived by customers or our real estate partners as a breach of our systems and could result in damage to our reputation and expose us to other losses. While we may be entitled to damages if our vendors fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity and there have been high-profile incidents of third-party service providers causing widespread disruptions in their customers' infrastructures due to errors in their Software-as-a-Service ("SaaS") offerings. We cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of or access to our sensitive data of our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our services. While we have security controls designed to protect against security incidents, there can be no assurance that these measures will be effective. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently, often are not recognized until launched against a target, and may originate from less regulated and remote areas around the world, we may be unable to proactively address all these techniques or to implement adequate preventative measures. We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Unremediated high risk or critical vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive data (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss and other similar harms. Any or all of these consequences could negatively impact our ability to attract new customers and increase engagement by existing customers, prevent or cause existing customers to stop using our products or services or close their accounts, or cause existing real estate partners to cancel their contracts, thereby harming our business, results of operations and financial condition. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with the use of generative AI technologies by our employees, personnel or vendors. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages or claims related to our data privacy and information security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all or that such coverage will pay future claims.

We maintain insurance to cover costs and losses from certain risk exposures in the ordinary course of our operations, including risk exposures related to cybersecurity matters and securities litigation, but our insurance may not cover 100% of the costs and losses from all events. We are responsible for certain retentions and deductibles that vary by policy, and we may suffer losses that exceed our insurance coverage by a material amount. We may also incur costs or suffer losses arising from events against which we have no insurance coverage. In addition, large scale insurance market trends or the occurrence of adverse events in our business may raise our cost of procuring insurance or limit the amount or type of insurance we are able to secure. We may not be able to maintain our current coverage, or obtain new coverage in the future, on commercially reasonable terms or at all. Any of these occurrences could harm our financial condition.

The success of our business depends, directly and indirectly, on the health of the United States residential real estate market. The health of the United States residential real estate market is affected, in part, by general economic conditions beyond our control. Recent market factors, including low housing inventory, volatility in mortgage interest rates, home price fluctuations, inflationary conditions, and rental occupancy rate fluctuations have impacted demand for our products and services by consumers and advertisers, which in turn has impacted our financial performance. The extent to which these and additional economic factors, such as those described below, impact our operating results and financial position will depend on future developments, which are uncertain and difficult to predict: - Fluctuations in the United States residential real estate market – both seasonal and cyclical – which may be due to one or more factors, whether included in this list or not;- changes in federal monetary policy or inflationary conditions;- changes in international, national, regional, or local economic, demographic, or real estate market conditions;- slow economic growth or recessionary conditions;- increased levels of unemployment or a decrease in labor availability, and/or slowly growing or declining wages;- declines in the value of residential real estate and/or the pace of home appreciation, or the lack thereof;- illiquidity in residential real estate;- overall conditions in the housing market, including macroeconomic shifts in demand, and increases in costs for homeowners such as property taxes, homeowners association fees and availability and affordability of insurance;- low levels of customer confidence in the economy and/or the United States residential real estate industry;- low home and/or rental inventory levels or lack of affordably priced homes and rentals;- changes in interest rates, mortgage rates or down payment requirements and/or restrictions on mortgage financing availability;- changes to how real estate commissions are negotiated or paid, or changes to other industry standards and practices;- federal, state, or local legislative or regulatory changes that would negatively impact rental properties or the residential real estate industry; and/or - natural and man-made disasters and other catastrophic events, such as pandemics, hurricanes, earthquakes, wildfires, terrorist attacks and other events that disrupt local, regional, or national real estate markets.

We provide products and services to customers throughout the United States and to a lesser extent, in Canada. In addition, Zillow Home Loans originates loans in 49 states and the District of Columbia. Although the majority of our workforce has shifted to a distributed work environment, we maintain large employee populations, including those supporting our licensed operations, in cities including Seattle, Washington; New York, New York; San Francisco, California; Irvine, California; Denver, Colorado; Mexico City, Mexico and Belgrade, Serbia. The occurrence of a natural disaster, climate change or other catastrophic event such as a pandemic, health crisis, earthquake, hurricane, windstorm, fire, flood, power loss, telecommunications failure, cyber-attack, geopolitical instability, war, civil unrest, terrorist attack or other similar event in any of the markets in which we provide services or any locality in which we have a significant operational presence may disrupt our operations, impair local and regional real estate markets or economies and negatively impact our business, results of operations and financial condition. For example, while the impact was not significant, certain areas of our operations in our Enhanced Markets were affected by Hurricane Helene and Hurricane Milton in 2024. Business continuity and disaster recovery planning is important, and if we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster, catastrophic event, or other emergency, and successfully execute on those plans in the event of a disaster, catastrophic event, or other emergency, our business and reputation may be harmed.