CarGurus (CARG) Risk Factors

We obtain data from many third-party data providers, including inventory management systems, automotive website providers, customer relationship management systems, dealer management systems, governmental entities, and third-party data licensors. Our business relies on our ability to obtain data for the benefit of consumers and dealers using our marketplaces. For example, our success in each market is dependent in part upon our ability to obtain and maintain inventory data and other vehicle information for those markets. The loss or interruption of such inventory data or other vehicle information could decrease the number of consumers using our marketplaces. We could experience interruptions in our data access for a number of reasons, including difficulties in renewing our agreements with data providers, changes to the software used by data providers, efforts by industry participants to restrict access to data, and increased fees we may be charged by data providers. Our marketplaces could be negatively affected if any current provider terminates its relationship with us or our service from any provider is interrupted. If there is a material disruption in the data provided to us, the information that we provide to consumers and dealers using our marketplaces may be limited. In addition, the quality, accuracy, and timeliness of this information may suffer, which may lead to a less valuable or transparent shopping experience for consumers using our marketplaces and could negatively affect our business and operating results.

We rely, in part, on internet search engines such as Google, Bing, and Yahoo! to drive traffic to our websites. The number of consumers we attract to our marketplaces from search engines is due in part to how and where our websites rank in unpaid search results. These rankings can be affected by a number of factors, many of which are not under our direct control and may change frequently. For example, when a consumer searches for a vehicle in an internet search engine, we rely on a high organic search ranking of our webpages to refer the consumer to our websites. Our competitors' internet search engine optimization efforts may result in their websites receiving higher search result rankings than ours, or internet search engines could change their methodologies and/or introduce competing products in a way that would adversely affect our search result rankings. If internet search engines modify their methodologies in ways that are detrimental to us, as they have done from time to time, or if our efforts to improve our search engine optimization are unsuccessful or less successful than our competitors' efforts, our ability to attract a large consumer audience could diminish, traffic to our marketplaces could decline, and the number of leads that we send to our dealers could be adversely impacted. Additionally, competing products from internet search engine providers, such as those that provide dealer and vehicle pricing and other information directly in search results or decreases in consumer use of search engines, for example, as a result of the continued development of AI technology, could also adversely impact traffic to our websites and the number of leads that we are able to send to our dealers. Our business would also be adversely affected if internet search engine providers choose to align with our competitors. Reductions in our own search advertising spend or more aggressive spending by our competitors could also cause us to incur higher advertising costs and/or reduce our market visibility to prospective users. Our websites have experienced fluctuations in organic and paid search result rankings in the past, and we anticipate fluctuations in the future. Any reduction in the number of consumers directed to our websites through internet search engines would harm our business and operating results.

From time to time, third parties may misappropriate our data through website scraping, robots, or other means and aggregate this data with data from other sources. In addition, copycat websites may misappropriate data in our marketplaces and attempt to imitate our brands or the functionality of our websites. We may be unable to detect and remedy all such activities in a timely and adequate manner. Regardless of whether we can successfully enforce our rights against these third parties, any measures that we may take could require us to expend significant financial or other resources, which could harm our business, results of operations, and financial condition. In addition, to the extent that such activity creates confusion among consumers or advertisers, our brands and business could be harmed.

A portion of our revenue is derived from advertising revenue generated primarily through short-term advertising sales, including on-site advertising and audience targeting services, to dealers, auto manufacturers, and other auto-related brand advertisers. We compete for this advertising revenue with other online automotive marketplaces and with television, print media, and other traditional advertising channels. Our ability to attract and retain advertisers and to generate advertising revenue depends on a number of factors, including our ability to increase the number of consumers using our marketplaces; compete effectively for advertising spending with other online automotive marketplaces; continue to develop our advertising products; keep pace with changes in technology and the practices and offerings of our competitors, including the use of AI; and offer an attractive ROI to our advertisers for their advertising spend with us. As a result of the effects of the COVID-19 pandemic, some advertisers canceled or reduced their advertising with us and it is possible that advertising customers will cancel or reduce their advertising with us in the future for a variety of reasons, including macroeconomic issues, such as increased interest rates and other matters that influence consumer spending. In addition, the year-over-year decline in the number of consumer visits to our sites as a result of the COVID-19 pandemic or otherwise resulted in the delivery of fewer impressions for our advertising customers than anticipated year-over-year for the years ended December 31, 2022, 2021, and 2020, which caused, and may continue to cause, an adverse impact on our advertising revenue. We may not succeed in capturing a greater share of our advertisers' spending if we are unable to convince advertisers of the effectiveness or superiority of our advertising offerings as compared to alternative channels. If current advertisers reduce their advertising spending with us and we are unable to replace such reduced advertising spending, our advertising revenue and business and financial results would be harmed.

Some functions of our marketplaces involve the storage and transmission of consumers' information, such as IP addresses, contact information of users who connect with dealers, credit applications and other financial data, and profile information of users who create accounts on our marketplaces, as well as dealers' information. We also process and store personal and confidential information of our vendors, partners, and employees, and we employ third-party service providers, such as payment processing providers, who also regularly have access to customer and consumer data. Some of this information may be private, and security breaches, including the unauthorized acquisition or access, compromise, or loss of such information, against us or our third-party service providers could expose us to a risk of loss or exposure of this information, which could result in potential liability, litigation, and remediation costs. For example, hackers could steal our users' profile passwords, names, email addresses, phone numbers, and other personal information. We rely on encryption and authentication technology licensed from third parties to effect secure transmission of such information, and we also rely on our third-party service providers to use sufficient security measures to protect such information. Despite all of our efforts to protect this information and data, none of our security measures or those of our third-party service providers provide absolute security, and they may not be effective in preventing a future failure of our systems. Like all information systems and technology, our websites, mobile applications, and information systems, and those of our third-party service providers, are subject to computer viruses, break-ins, phishing attacks, attempts to overload the systems with denial-of-service or other attacks, ransomware, and similar incidents or disruptions from unauthorized use of our or our third-party service providers' computer systems, any of which could lead to interruptions, delays, or website shutdowns, and could cause loss of critical data and the unauthorized disclosure, access, acquisition, alteration, and use of personal or other confidential information. If we or our third-party service providers experience compromises to data security that result in website or mobile application performance or availability problems, the complete shutdown of our websites or mobile applications, or the loss or unauthorized disclosure, access, acquisition, alteration, or use of confidential information, consumers, customers, advertisers, partners, vendors, and employees may lose trust and confidence in us, and consumers may decrease the use of our websites or stop using our websites entirely, dealers may stop or decrease their subscriptions with us, and advertisers may decrease or stop advertising on our websites. Further, outside parties have attempted and will likely continue to attempt to fraudulently induce employees, consumers,or advertisers to disclose sensitive information in order to gain access to our information or our consumers', dealers', advertisers', and employees' information. As cyber-attacks increase in frequency and sophistication, our cyber-security and disaster recovery plans may not be effective in anticipating, preventing, and effectively responding to all potential cyber-risk exposures. In addition, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems constantly evolve, often are not recognized until after having been launched against a target, and may originate from less regulated and remote areas around the world, we may be unable to proactively address these techniques or to implement adequate measures for prevention and detection. For example, as AI continues to evolve, cyber-attackers could also use AI to develop malicious code and sophisticated phishing attempts. Any or all of the issues above could adversely affect our brand reputation, negatively impact our ability to attract new consumers and increase engagement by existing consumers, cause existing consumers to reduce or stop the use of our marketplaces or close their accounts, cause existing dealers and advertisers to cancel their contracts, cause employees to terminate their employment, cause employment candidates to be unwilling to pursue employment opportunities or accept employment offers, and/or subject us to governmental or third-party lawsuits, investigations, regulatory fines, or other actions or liability, thereby harming our business, results of operations, and financial condition. Although we carry privacy, data breach and network security liability insurance, we cannot be certain that our coverage will be adequate for liabilities actually incurred or sufficient to compensate us for the potentially significant losses, or that insurance will continue to be available to us on economically reasonable terms or at all. There are numerous federal, national, state, and local laws and regulations in the U.S. and around the world regarding privacy and the collection, processing, storage, sharing, disclosure, use, cross-border transfer, and protection of personal information and other data. These laws and regulations are evolving, are subject to differing interpretations, may be costly to comply with, may result in regulatory fines or penalties, may subject us to third-party lawsuits, may be inconsistent between countries and jurisdictions, and may conflict with other requirements. We seek to comply with industry standards and are subject to the terms of our privacy policies and privacy-related obligations to third parties, as well as all applicable laws and regulations relating to privacy and data protection. However, it is possible that these obligations may be interpreted and applied in new ways or in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices and that new regulations could be enacted. Several proposals have recently become effective or are pending, as applicable, before federal, state, local, and foreign legislative and regulatory bodies that could significantly affect our business, which we refer to collectively as the Privacy Regulations. The Privacy Regulations include the European Union's, or EU, General Data Protection Regulation and the California Consumer Privacy Act. Certain of the Privacy Regulations have already required, and certain others may further require, us to change our policies and procedures and may in the future require us to make changes to our marketplaces and other products. These and other requirements could reduce demand for our marketplaces and other offerings, require us to take on more onerous obligations in our contracts and restrict our ability to store, transfer, and process data, which may seriously harm our business. Similarly, Brexit and the Schrems II decision of the Court of Justice of the EU, which effectively invalided the EU-U.S. Privacy Shield Framework, may require us to change our policies and procedures and, if we are not in compliance, may also seriously harm our business. We may not be entirely successful in our efforts to comply with the evolving regulations to which we are subject due to various factors within our control, such as limited internal resource allocation, or outside our control, such as a lack of vendor cooperation, new regulatory interpretations, or lack of regulatory guidance in respect of certain Privacy Regulations and other statutory requirements. Any failure or perceived failure by us to comply with U.S. and international data protection laws and regulations, our privacy policies, or our privacy-related obligations to consumers, customers, employees, and other third parties, or any compromise of security that results in the unauthorized release or transfer of data, which could include personal information or other user data, may result in governmental investigations, enforcement actions, regulatory fines, litigation, criminal penalties, or public statements against us by consumer advocacy groups or others, and could cause consumers and dealers to lose trust in us, which could significantly impact our brand reputation and have an adverse effect on our business. Additionally, if any third party that we share information with experiences a security breach or fails to comply with its privacy-related legal obligations or commitments to us, such matters may put employee, consumer, or dealer information at risk and could, in turn, expose us to claims for damages or regulatory fines or penalties and harm our reputation, business, and operating results. For information on our cybersecurity risk management, strategy, and governance, see the "Cybersecurity" section of this Annual Report.

If paying dealers do not receive the volume of consumer connections that they expect during their subscription period, do not experience the level of car sales they expect from those connections, or fail to attribute consumer connections or sales to our platform, they may terminate their subscriptions prior to the commencement of the applicable renewal term. If we fail to maintain or increase the number of paying dealers or fail to maintain or increase the level of fees that we receive from them, our business and financial results would be materially and adversely affected. We allow dealers to list their inventory in our marketplaces for free; however, we impose certain limitations on such free listings. In the future, we may decide to impose additional restrictions on Restricted Listings or modify the services available to non-paying dealers. These changes to our Restricted Listings product may result in less inventory being displayed to consumers, which may impair our efforts to attract consumers, and cause paying and non-paying dealers to receive fewer leads and connections, which may make it more difficult for us to convert non-paying dealers to paying dealers or maintain or increase the number of paying dealers. If dealers do not subscribe to our paid offerings at the rates we expect, our business and financial results would be materially and adversely affected.