Booking Holdings (BKNG) Risk Analysis

Legal requirements of governments and regulatory authorities, many of which are evolving and subject to revised interpretations, impact our ability to provide our services and can result in private litigation. For example, we offer optional rental car-related insurance products to customers protecting them against accidental damage to their rental vehicles, optional room and flight cancellation insurance products, and we intend to offer additional trip-related insurance products in the future, which subjects us to insurance distribution regulations and related increased compliance costs and complexities, any of which could negatively impact our business and results of operations. Increases in the number or complexity of the laws and regulations applicable to us and our businesses could increase our compliance costs and burdens and negatively affect our business and results of operations. Laws in some countries relating to data localization, registration as a travel agent, and other local requirements could, if applicable to us, adversely affect our ability to conduct business in those countries. For example, in the EU and the United Kingdom, the Package Travel Directive and other local laws governing the sale of travel services (the "Package Directive") require local registration, certain mandatory financial guarantees and disclosure, and other rules regulating the provision of single travel sales, travel packages, and linked travel arrangements, and certain liability for performance of the services. Some parts of our business are already subject to the Package Directive, and as our offerings diversify and expand, we may become subject to additional requirements. Compliance with this directive could be costly and complex and, as a result of its requirements, we could choose to limit offerings that would otherwise be beneficial for the business. Further, the Package Directive is under legislative reform, and changes to its interpretation could be costly or complex, which may adversely affect our business, results of operations, and ability to grow and compete. The implementation of unfavorable regulations or unfavorable interpretations of existing regulations by judicial or regulatory bodies could require us to incur significant compliance costs, cause the development of the affected markets to become impractical and otherwise have an adverse effect on our business and results of operations. Compliance with requirements of multiple jurisdictions increases our cost of doing business. Global laws, regulations, and changing social, political and public policies, which sometimes conflict, impact a wide range of subjects, including the digital marketplace regulations, and laws prohibiting corrupt payments to governmental officials or third parties, data privacy requirements, emerging regulations governing the development, marketing, and use of AI, labor relations laws, non-discrimination, human rights or anti-human trafficking laws, tax laws, competition laws, export controls, sanctioned country or sanctioned persons mandates, sustainability, and consumer protection laws. Violations of these laws and regulations have resulted and in the future could result in fines, penalties, and criminal sanctions against us, our officers, or our employees and prohibitions on how or where we conduct business. In certain jurisdictions the basis of assessing damages is changing, which may make it difficult to estimate what such fines and penalties would amount to if successfully asserted against us. Violations could delay or prevent potential acquisitions and could materially damage our reputation, brands, global expansion efforts, ability to attract and retain employees and business partners, business, and operating results. Even if we comply with these laws and regulations, doing business in certain jurisdictions or violations of these laws and regulations by the parties with which we conduct business could harm our reputation and brands, which could adversely affect our results of operations. We could also face difficulties transferring funds from or converting currencies in certain countries. In addition, if these restrictions are not applicable to competitors, it may provide them a competitive advantage. Additionally, our employees in certain countries are represented by works councils and/or trade unions. We are required to consult with works councils on certain matters (such as our Transformation Program), acquisitions and divestitures, and other matters that could impact our labor force. Consultation may not be completed on terms satisfactory to us and could result in increases in our cost of labor, diversion of management's attention away from operating our business, delays in certain initiatives, and expose us to claims and litigation. We have made efforts and expect to make further efforts to integrate access to travel services across our various brands. These changes add complexity to legal and tax compliance and our internal controls, and our size and operating history may increase the likelihood that we will be subject to regulatory scrutiny or audits by tax authorities.

The Netherlands corporate income tax law provides that income generated from qualifying innovative activities is taxed at the rate of 9% ("Innovation Box Tax") rather than the Dutch statutory rate of 25.8%. A portion of Booking.com's earnings historically qualified for Innovation Box Tax treatment. Should this benefit be reduced or eliminated, it could substantially increase our effective tax rate and adversely impact our results of operations and cash flows.

We depend on software and computing infrastructure (including open source software) for the operation of our business. If threat actors are able to circumvent, interrupt, or adversely affect our security measures, including as a result of our own acts or omissions, it could result in a compromise or breach of consumer, partner, or employee data. Data security is essential to maintaining consumer and partner confidence in our services and the uninterrupted availability of our web and mobile platforms is essential for our business. With cyberattacks evolving and increasing in frequency and sophistication, we may not be able to successfully defend against determined adversaries. In addition, our security policies and controls may not keep pace with the innovation of our offerings and technological advances of threat actors. Threat actors may exploit AI-based technologies to breach systems and weaponize AI to target our employees to gain unauthorized access to systems and data. Furthermore, the emergence of quantum technologies may enable threat actors to overcome traditional encryption protocols and launch more sophisticated AI-enabled attacks at scale. We have experienced and responded to cyberattacks, which we believe have not had a material impact on the integrity of our systems or the security of data we maintain. Vulnerabilities in our consumer and partner systems could and have resulted in unauthorized access to personal and confidential data. These risks are likely to increase as we expand our offerings, integrate our products and services, continue to incorporate AI, and store and process more data. The disclosure of sensitive Company, consumer, or other information through our systems or by our workforce or other parties could lead to information loss, reputational harm, monetary damages, regulatory penalties, or worse competitive positioning. We expend significant resources to protect against security breaches and to maintain or increase our security capabilities. Security breaches could result in damage to our reputation, expose us to risk of litigation and liability, subject us to regulatory penalties and sanctions, or cause consumers to lose confidence in us, any of which could have an adverse effect on our brands, competitive positioning, results of operations, and financial condition. Our efforts to protect information from unauthorized access have and could in the future result in the rejection or delay of legitimate attempts to book reservations through our services, which could result in lost business. Additionally, our consumers' personal data has in the past and could in the future be affected by inadvertent disclosure to, or security breaches at, our partners or other third parties upon which we rely. We receive and store a large volume of personally identifiable data and payment information. The handling and storage of such data, as well as privacy rights of consumers, are subject to complex and evolving laws and regulations. While we invest significant resources to comply with regulations such as the EU's General Data Protection Regulation ( "GDPR"), the California Consumer Privacy Act ("CCPA"), the Personal Information Protection Law in the People's Republic of China, the Digital Personal Data Protection Act in India, and the EU Digital Markets Act ("DMA"), they are complex, subject to uncertain interpretation, and impose significant compliance obligations and costs on us. For example, under the GDPR violations could result in fines of up to 20 million Euros or up to 4% of the annual global revenues of the infringer, whichever is greater. In many cases, these laws apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information. These laws and their interpretations continue to develop and may be inconsistent from jurisdiction to jurisdiction. Some of these regulations give consumers a private right of action against companies for certain alleged violations of cybersecurity requirements. Non-compliance with these laws could result in damage to our reputation, significant penalties, or other liability. If laws or regulations are expanded to require changes in our business practices, or interpreted in ways that negatively affect our business, our results of operations, financial condition, or competitive position could be adversely affected.

We compete in markets characterized by rapidly changing technology, evolving industry standards, consolidation, frequent product developments, and changing consumer preferences. These characteristics are heightened by the progress of technology adoption, including the continuing adoption of online commerce, growth of mobile transactions and payment, and the development of Gen AI capabilities. We may not be able to keep up with these rapid changes. Our long-term strategy to commercialize the Connected Trip will require increased investments that could have an adverse impact on our results of operations until we achieve the expected return on these investments. The development of the Connected Trip is subject to uncertainties, including further development of the verticals and technological capabilities (including integrating Gen AI) necessary for the Connected Trip experience, the ability to collect, store, and use customer data in a compliant and integrated fashion, and the attraction and retention of employees dedicated to this effort. It may take longer than we expect to realize the Connected Trip vision or it may not achieve the expected return on investment. Our ability to offer a variety of appropriate payment solutions is an important part of our Connected Trip vision. These efforts may also be unsuccessful in improving the travel experience or retaining and attracting new customers. Further, regulatory restrictions may impact the ongoing commercialization of the Connected Trip or increase our costs of compliance. With any technical innovation such as the Connected Trip effort, there could be vulnerabilities and other technical failures, which could result in lost business, harm to our brand or reputation, consumer complaints, or other adverse consequences, any of which could adversely affect our business and results of operations. We may not be able to keep pace with the competitive pressure to innovate. Other companies, including emerging start-ups and large technology companies utilizing proprietary Gen AI or similar capabilities, may innovate or develop new services and technologies faster than we can or may foresee consumer need for new services or technologies before we do. Gen AI and other new technologies could influence how consumers search for and book travel, diminish the relevance or competitiveness of our existing technology and service offerings, or require us to modify or adapt our services or infrastructure, any of which could adversely affect our results of operations and financial condition. Consumers increasingly use mobile devices and apps to make online travel bookings, and may in the future use Gen AI-enabled devices to make bookings. The revenues earned on a mobile transaction may be less than a desktop transaction due to different purchasing patterns. To the extent mobile devices or platforms enable users to block advertising content, our advertising revenue and ability to market our brands may also be negatively affected. If we are unable to attract consumers to our mobile platforms, or app store providers like Google and Apple use their app distribution, mobile operating, or payment platforms to favor competing services, our business, competitive position, future growth, and results of operations could be adversely affected.

We are subject to competition and consumer protection laws and regulations around the world. These laws and regulations evolve, and their interpretation, application, and enforcement can also change, be unpredictable, or be affected by changing political or social pressures. As we expand our business into new areas, including building the Connected Trip vision and integrating Gen AI into our offerings, we may become subject to additional laws and regulations. We have been the subject of investigations or inquiries by national competition authorities ("Competition Authorities") and other governmental authorities regarding competition law matters, consumer protection issues, and other areas. For example, we are involved in investigations related to whether certain of Booking.com's arrangements with accommodation providers are anti-competitive, including with respect to issues like contractual parity, pricing tools or programs offered to partners, or the ranking criteria used in displaying results to consumers. See Note 16 to our Consolidated Financial Statements for information regarding certain legal proceedings in which we are involved. To resolve certain of the proceedings or investigations we have been or are involved in, we have made commitments regarding future business practices or activities including related to our parity arrangements, the information we provide about our search results ranking, and how we display prices, discounts, and popularity and availability statements. Though we have taken steps to comply with such commitments, investigating authorities or third parties may assert that our measures are insufficient and may pursue further action or seek other remedies. We cooperate with regulators but are unable to predict what, if any, effect any investigations or their resolution, including the effect of any commitments we might make, will have on our business, industry practices, or online commerce more generally. An unfavorable outcome in an investigation could encourage additional regulatory inquiries that could become widespread over time, significantly increasing the potential financial and reputational impact on us. To the extent that investigations or inquiries result in additional commitments, changes to our business practices, negative publicity, fines, damages from private litigation, or other remedies, it could have a material adverse effect on our business, financial condition, and results of operations. Competition and consumer-law-related investigations, legislation, judgments, or issues have in the past resulted in and could in the future result in private litigation. We are currently involved in such litigation and aware of such potential litigation. For example, a Dutch consumer group has filed a claim against Booking.com relating to the historical use of contractual parity provisions, as well as allegations that Booking.com and Agoda employed misleading practices, and we are aware of similar efforts to pursue potential claims in other jurisdictions. See Note 16 to our Consolidated Financial Statements for more information regarding this and other such claims or potential claims. Class action litigation can be time-consuming, costly, and unpredictable, regardless of merit, and there may be evolving jurisprudence and less experience with such matters in certain of the geographies where we are or may be involved in such litigation, making outcomes less certain and harder to forecast. If we were to be found liable, it could result in, among other things, payment of damages, commitments to change certain business practices, or reputational damage, any of which could harm our business, results of operations, brands, or competitive position. There is significant legislative and public focus on the technology industry, especially as technology companies become larger. In some instances, countries have passed legislation that goes further to restrict business activities than actions taken by Competition Authorities or other regulatory authorities. The EU's Platform to Business Regulation regulates the relationship between online platforms such as Booking.com and European business users of online platforms. The DMA and DSA give EU regulators more instruments to investigate and regulate digital businesses and impose additional rules and requirements on platforms designated as "gatekeepers" under the DMA and online platforms more generally, with separate rules for "Very Large Online Platforms" ("VLOPs") under the DSA. As a result of our designation as a gatekeeper under the DMA and Booking.com's designation as a VLOP under the DSA, we are subject to additional rules and regulations that may not be applicable to our competitors. For example, Booking.com has implemented changes to address the DMA prohibition on parity arrangements in the European Economic Area and the requirements regarding the usage of data across services, which could adversely impact our business. As a gatekeeper, we also established a compliance function to monitor compliance with the DMA. Under the DSA, as a VLOP, Booking.com is required to collect more information from partners, which could disincentivize certain partners from using our services. Booking.com is also subject to additional scrutiny, obligations, and costs, such as payment of an annual supervisory fee, annual risk assessments and independent audits, and maintaining a compliance function. The DMA and DSA each have significant penalties for non-compliance, and could lead to private litigation. Our compliance costs have increased in connection with becoming subject to the DMA and DSA, each of which remains subject to further interpretation and regulatory engagement, and could require additional changes to our products, business practices, and compliance activities. If future legislation utilizes a "gatekeeper" or VLOP designation to extend its scope, we could be subject to further regulations, restrictions, or compliance or other obligations that are not applicable to our competitors. The EC designates VLOPs based on a platform's number of EU "monthly active recipients" ("MARs"). The EC requires counting users who display and to whom information was displayed (e.g., partners and consumers), even if a user does not make a transaction on the platform. The assessment of MARs and any other similarly published information by our brands represents an estimate based on the data available to us and limited guidance, and is subject to limitations. Any such estimate is published solely as required by applicable rules or regulations, may be inaccurate, and should not be used for any other purpose. New laws and regulations could impact our services, require us to change our business practices, and impose additional complexity and costs. As market conditions change as a result of investigations, litigation, legislation, changing public perception of the industry, or political or social pressure, we may decide to modify our business practices beyond what is required, the full effects of which may not be known when making the decision, but which could harm our competitive position and adversely affect our business and results of operations. One area of potential regulatory inquiry, for instance, involves contractual restrictions such as online search term bidding restrictions. If these or other restrictions are held to be illegal or otherwise unenforceable, or if we remove them from our contracts, it could negatively impact our business. With additional attention on the size of travel or technology companies generally, our size and competitive position may negatively affect our ability to obtain regulatory approval of proposed acquisitions or other opportunities, our ability to expand into complementary businesses, or our latitude in dealing with travel service providers (such as by limiting our ability to provide discounts, rebates, or incentives or to exercise contractual rights), any of which could adversely affect our business, results of operations, or ability to grow and compete.

We invest considerable resources in the establishment and maintenance of our brands, marketing and other brand building efforts to preserve and enhance consumer awareness of our brands, and to attract and retain consumers. Performance marketing costs to grow traffic to our platforms are variable because they are dependent on others' marketing spend in the same channels. If we are unable to maintain or enhance consumer awareness and acceptance of our brands or if such efforts are not cost-effective, our business, competitive position, and results of operations could be materially adversely affected. Our marketing efficiency, expressed as marketing expense as a percentage of gross bookings, and performance marketing return on investment ("ROIs") are impacted by a number of factors that are subject to variability and are in some cases outside of our control, including ADRs, costs per click, cancellation rates, foreign currency exchange rates, our ability to convert traffic to booking consumers, and the timing and effectiveness of our brand marketing campaigns. Marketing efficiency can also be impacted by the extent to which consumers come directly to our platforms for bookings and the economics of distribution channels. If our marketing efforts are less effective at generating new bookings, our marketing efficiency could decrease and our margins, revenues, and earnings growth could be adversely affected. For example, competition for desired placement in search results including among AI-generated or AI-impacted (i.e., by bot or agent activity) results could increase our costs-per-click and negatively impact our marketing efficiency. At times we may pursue a strategy of increasing marketing ROIs, which could negatively affect our gross bookings and revenue growth rates. Pursuing a strategy of improving performance marketing ROIs along with factors such as competitors' actions in the bidding environment, the amount of marketing invested by these channels to generate demand, and overall marketing platform traffic growth trends, may also impact our gross bookings and revenue growth rates. Negative trends in our marketing efficiency, performance marketing ROIs, or consumer shopping activity could negatively impact our business, competitive position, and results of operations.

We rely on third parties to make their services available to consumers for reservation through us. Our travel service providers are generally not required to make available any specific quantity of reservations, or to make reservations available in any geographic area, for any particular route, or at any particular price. Our restaurants are generally not required to provide all of their available tables and reservations to consumers through us. Our arrangements with OTCs and travel service providers to provide information in connection with KAYAK's meta-search services are non-exclusive and terminable with little notice. A significant reduction on the part of any of our major travel service providers or restaurants for a sustained period of time or their withdrawal from our services, including due to a provider's bankruptcy or closure, could have an adverse effect on our business, advertising revenue, competitive position, and results of operations. Further, as industry consolidation, including among travel service providers, increases, the potential adverse effect of reduced usage or withdrawal from our services by a significant travel service provider also increases. A significant portion of consumer traffic to our services is derived from third-party platforms, including Google and other search engines, mobile operating systems, app marketplaces, mapping services, and other digital distribution channels. These platforms increasingly incorporate Gen AI features, such as AI-generated answers, assistants, and recommendations, that may satisfy user intent without directing users to our services or may favor the platform's own or affiliated offerings. Changes in algorithms, ranking methodologies, user interfaces, access terms, pricing, or the placement of AI-generated content by these platforms could reduce the visibility of our services, increase customer acquisition costs, or decrease traffic and bookings. In addition, platform providers may restrict data access, limit interoperability, or impose commercial terms that disadvantage us relative to competing or native AI-enabled services. If we are unable to maintain favorable placement, access, or economics across traditional digital search as well as evolving AI-mediated distribution channels, our distribution of travel and restaurant reservations through such third-party distribution channels is likely to decline and our business, competitive position, and results of operations could be adversely affected. We offer a range of insurance products related to our travel offerings, primarily through third-party insurance providers. Our business and reputation may be adversely affected if such providers no longer make such offerings available to us on economically reasonable terms or at all.