Zillow Group Class A (ZG) Risk Factors

Our success depends on our continued innovation to provide new, and improve upon existing, products and services that make real estate transactions faster, easier and less stressful for our customers and provide value to real estate, rental and mortgage professionals, home buyers and sellers and our other real estate partners. As a result, we must continually invest significant resources in research and development to improve the attractiveness, competitiveness, and comprehensiveness of our products and services, enable smoother and more efficient real estate transactions, adapt to changes in technology and support new devices and operating systems. If we are unable to provide products and services that our customers want to use, on the devices they prefer, then those customers may become dissatisfied and use competitors' mobile applications, websites, products and services. If our customers begin to access more real estate information and services through other media and we fail to innovate, our business may be negatively impacted. If we are unable to continue offering high-quality, innovative products and services, we may be unable to attract additional customers and real estate partners or retain our current customers and real estate partners, which could harm our business, results of operations and financial condition.

Our products and services involve the transmission, processing, and/or storage of users' information, some of which may be private or include personally identifiable information such as social security numbers, financial account information, and credit card information. For example, our dotloop real estate transaction management software stores sensitive personal and financial information, our Mortech mortgage product and pricing software for mortgage professionals processes social security numbers, our rental applications product allows customers to obtain credit and background checks containing sensitive personal and financial information, and Zillow Home Loans, our mortgage origination business, and our real estate closings business, receive, handle and transmit highly sensitive personal and financial information about its customers. Cyber-attacks, malicious internet-based activity, online and offline fraud, administrative or technical failures and other similar activities threaten the confidentiality, integrity and availability of our information technology systems, including those of the third parties upon which we rely, and our sensitive data, including customer, employee and real estate partner data as well as intellectual property and other confidential business information, which could result in potential significant liability and litigation. Such threats are prevalent and continue to rise, are increasingly difficult to detect and come from a variety of sources, including traditional computer "hackers", threat actors, "hacktivists", organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain and ability to produce, sell and distribute our services. We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential stuffing attacks, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, or floods, attacks enhanced or facilitated by AI, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, impact our ability to provide our products or services, loss of sensitive data and income, reputational harm and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Outside parties may attempt to fraudulently induce employees, officers, directors, customers or real estate partners to disclose sensitive information in order to gain access to our information or our customers' or real estate partners' information, and our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to user error, malfeasance or other disruptions. If we experience compromises to our security that result in the loss or unauthorized disclosure of confidential information, our customers and real estate partners may lose trust in us, customers may decrease the use of our mobile applications or websites or stop using our mobile applications, websites, or services in their entirety, real estate partners may decrease or stop advertising on our mobile applications or websites, and we may be subject to legal claims and liability, government investigation and additional state and federal legal requirements. If we experience compromises to our security that result in the loss of availability of our data, our mobile applications, websites, or services may be unable to function at a level necessary to meet our customers' needs. Our reliance on vendors could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. We engage a variety of vendors to process and store sensitive data, including certain customer information, some of which may be private or include personally identifiable information. We also depend on vendors to host many of the systems and infrastructure used to provide our products and services. Our ability to monitor these vendors' information security practices is limited and these vendors may not have adequate information security measures in place. If our vendors experience a security incident or other interruption, we could experience adverse consequences, including harm to our business, results of operations and financial condition. Further, a security breach at our vendor could be perceived by customers or our real estate partners as a breach of our systems and could result in damage to our reputation and expose us to other losses. While we may be entitled to damages if our vendors fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of or access to our sensitive data of our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our services. While we have security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently, often are not recognized until launched against a target, and may originate from less regulated and remote areas around the world, we may be unable to proactively address all these techniques or to implement adequate preventative measures. We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Unremediated high risk or critical vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive data (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss and other similar harms. Any or all of these consequences could negatively impact our ability to attract new customers and increase engagement by existing customers, prevent or cause existing customers to stop using our products or services or close their accounts, or cause existing real estate partners to cancel their contracts, thereby harming our business, results of operations and financial condition. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employee's', personnel's, or vendor's use of generative AI technologies. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages or claims related to our data privacy and information security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all or that such coverage will pay future claims.

We are subject to income taxes in the United States (federal and state) and certain foreign jurisdictions. Tax laws, regulations, and administrative practices in various jurisdictions may be subject to significant change, with or without notice, due to economic, political, and other conditions. New tax laws, regulations and administrative practices could be enacted or adopted at any time, and existing tax laws, regulations and administrative practices could be interpreted, modified or applied adversely to us, possibly with retroactive effect. These changes could require us to pay additional taxes, penalties, interest and other related costs, and also could increase our compliance, operating and other costs. Significant judgment is required in evaluating and estimating the taxes imposed under such tax laws. Our effective tax rates could be affected by numerous factors, such as entry into new businesses and geographies, changes to our existing business and operations, acquisitions and investments and how they are financed, changes in our stock price, changes in our deferred tax assets and liabilities and their valuation, and changes in the relevant tax, accounting, and other laws, regulations, administrative practices, principles, and interpretations. We are required to take positions regarding the interpretation of complex statutory and regulatory tax rules and on valuation matters that are subject to uncertainty, and the Internal Revenue Service or other tax authorities may challenge the positions we take.

Under various federal, state and local environmental laws, a current or previous owner or operator of real property may be liable for the cost of removing or remediating hazardous or toxic substances on such property. Such laws often impose liability whether or not the owner or operator knew of, or was responsible for, the presence of such hazardous or toxic substances. Even if more than one person may have been responsible for the contamination, each person covered by applicable environmental laws may be held responsible for all of the clean-up costs incurred. In addition, third parties may sue the owner or operator of a site for damages based on personal injury, natural resources or property damage or other costs, including investigation and clean-up costs, resulting from the environmental contamination. The presence of hazardous or toxic substances on one of our properties, including homes previously held in our inventory in connection with Zillow Offers operations, or the failure to properly remediate a contaminated property, could give rise to a lien in favor of the government for costs it may incur to address the contamination. A property owner who violates environmental laws may be subject to sanctions which may be enforced by governmental agencies or, in certain circumstances, private parties. The cost of defending against environmental claims, of compliance with environmental regulatory requirements or of remediating any contaminated property could materially and adversely affect us. Compliance with new or more stringent environmental and climate-related laws or regulations or stricter interpretation of existing laws may require material expenditures by us. We cannot assure you that future laws, ordinances or regulations will not impose any material environmental or other liability to us. In addition, we may be required to comply with various local, state and federal fire, health, life-safety and similar regulations. Failure to comply with applicable laws and regulations could result in fines and/or damages, suspension of personnel, civil liability or other sanctions.

A limited number of third-party services support essential functions of our business, including Amazon Web Services ("AWS") and certain other cloud communications platform-as-a-service ("CPaaS"), Infrastructure-as-a-Service ("IaaS") and Software-as-a-Service ("SaaS Services") technologies hosted by third parties (together with CPaaS and IaaS, "Cloud Services"). AWS provides us with a distributed computing infrastructure platform for business operations, which is commonly referred to as a "cloud" computing service. Certain of our computer systems utilize data processing, storage capabilities and other services provided by AWS, and we currently run the vast majority of computing to power our mobile applications, websites, and other technology products and services on AWS, as our preferred cloud provider. In addition, we use Cloud Services to support important functions of our business, including enterprise resource planning, accounting, including revenue recognition, real estate transaction services, customer communications, and customer relationship management. We store a significant amount of information about our customers, real estate partners, employees, and business on AWS and in the Cloud Services, and we rely on these third-party service providers to provide services on a timely and effective basis. Their failure to perform as expected or as required by contract could result in significant disruptions and costs to our operations. In light of our reliance on AWS and Cloud Services, coupled with the complexity of obtaining replacement services, any disruption of, or interference with, or change in terms that impacts our use of or the cost to use these third-party services could adversely impact our operations and business.

We maintain insurance to cover costs and losses from certain risk exposures in the ordinary course of our operations, but our insurance may not cover 100% of the costs and losses from all events. We are responsible for certain retentions and deductibles that vary by policy, and we may suffer losses that exceed our insurance coverage by a material amount. We may also incur costs or suffer losses arising from events against which we have no insurance coverage. In addition, large scale insurance market trends or the occurrence of adverse events in our business may raise our cost of procuring insurance or limit the amount or type of insurance we are able to secure. We may not be able to maintain our current coverage, or obtain new coverage in the future, on commercially reasonable terms or at all.

The success of our business depends, directly and indirectly, on the health of the United States residential real estate market. The health of the United States residential real estate market is affected, in part, by general economic conditions beyond our control. Recent market factors, including low housing inventory, fewer new for-sale listings, volatility in mortgage interest rates and home price fluctuations, inflationary conditions and rental occupancy rate fluctuations have impacted demand for our products and services by consumers and advertisers, which in turn has negatively impacted our financial performance. The extent to which these and additional economic factors, such as those described below, impact our results and financial position will depend on future developments, which are uncertain and difficult to predict: - fluctuations in the United States residential real estate market – both seasonal and cyclical – which may be due to one or more factors, whether included in this list or not;- changes in federal monetary policy or inflationary conditions;- changes in international, national, regional, or local economic, demographic, or real estate market conditions;- slow economic growth or recessionary conditions;- increased levels of unemployment or a decrease in labor availability, and/or slowly growing or declining wages;- declines in the value of residential real estate and/or the pace of home appreciation, or the lack thereof;- illiquidity in residential real estate;- overall conditions in the housing market, including macroeconomic shifts in demand, and increases in costs for homeowners such as property taxes, homeowners association fees and availability and affordability of insurance;- low levels of customer confidence in the economy and/or the United States residential real estate industry;- low home and/or rental inventory levels or lack of affordably priced homes and rentals;- changes in interest rates, mortgage rates or down payment requirements and/or restrictions on mortgage financing availability;- changes to how real estate commissions are negotiated or paid, or changes to other industry standards and practices;- federal, state, or local legislative or regulatory changes that would negatively impact rental properties or the residential real estate industry, such as the Tax Cuts and Jobs Act of 2017 (the "Tax Act"), which limited deductions of certain mortgage interest expenses and property taxes;- volatility and general declines in the stock market; and/or - natural and man-made disasters and other catastrophic events, such as pandemics, hurricanes, earthquakes, wildfires, terrorist attacks and other events that disrupt local, regional, or national real estate markets.

The occurrence of a significant natural disaster or other catastrophic event such as a pandemic, health crisis, earthquake, hurricane, windstorm, fire, flood, power loss, telecommunications failure, cyber-attack, geopolitical instability, war, civil unrest, terrorist attack or other similar event, may disrupt our operations, impair local and regional real estate markets or economies and negatively impact our business, results of operations and financial condition. For example, the COVID-19 pandemic, including the reactions of governments, markets, and the general public to the COVID-19 pandemic, caused adverse consequences for our business and results of operations. Zillow provides products and services to customers throughout the United States and to a lesser extent, in Canada. In addition, Zillow Home Loans originates loans in 49 states and the District of Columbia. The occurrence of a natural disaster or other catastrophic event in any of these localities could have a significant negative impact on those real estate markets and the success of our business in the affected regions. Although the majority of our workforce has shifted to a distributed work environment, we maintain large employee populations, including those supporting our licensed operations, in Seattle, Washington; New York, New York; Atlanta, Georgia; San Francisco, California; Irvine, California; Denver, Colorado; Mexico City, Mexico and Belgrade, Serbia. An earthquake or other natural disaster or catastrophic event in any of these cities could disrupt our engineering, sales, operations and/or mortgage origination teams and equipment critical to the operation of our business. Similarly, a significant natural disaster or other catastrophic event in any major United States city could negatively impact a large number of our real estate partners and customers and cause a decrease in our revenue or traffic. Business continuity and disaster recovery planning is important, and if we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster or catastrophic event, and successfully execute on those plans in the event of a disaster, catastrophic event, or other emergency, our business and reputation may be harmed.