CuriosityStream (CURI) Risk Factors

We rely on the continued service of our senior management and other key individuals, our Chairman and the founder of our predecessor CuriosityStream LLC, John Hendricks, and our President and Chief Executive Officer, Clint Stinchcomb, members of our executive team and other key employees and the hiring of new qualified employees. In our industry, there is substantial and continuous competition for highly skilled business, product development, technical and other personnel. We may not be successful in recruiting new personnel and in retaining and motivating existing personnel, which may be disruptive to our operations. Our effort to retain and develop personnel may also result in significant additional expenses, which could affect our profitability. In addition, there may be changes in our management team that may be disruptive to our business. In 2022, we experienced the turnover of our Chief Financial Officer and Chief Strategy Officer. If our management team, including any new hires we make, fails to work together effectively and to execute our plans and strategies on a timely basis, our business could be harmed. If we experience high executive turnover, fail to adapt our business practices to industry expectations, fail to implement succession plans for key employees, encounter difficulties associated with the transition of members of our management team, are not successful in recruiting new personnel or in retaining and motivating existing personnel, in instilling our culture in new employees, or maintaining and improving our culture as we grow, our operations may be disrupted, which could adversely affect our results of operations. During 2023, we initiated a plan to eliminate 20 full time positions or about 30% of our December 31, 2022, workforce. These reductions may negatively affect our culture or create uncertainty regarding our future operations or employment needs, and may therefore limit our ability to retain or hire qualified personnel or may contribute to the unplanned loss of highly skilled employees through attrition.

We are a U.S.-based company potentially subject to tax in multiple U.S. and non-U.S. tax jurisdictions. Significant judgment will be required in determining our global provision for income taxes, deferred tax assets or liabilities and in evaluating our tax positions on a worldwide basis. While we believe our tax positions are consistent with the tax laws in the jurisdictions in which we conduct our business, it is possible that these positions may be overturned by jurisdictional tax authorities, which may have a significant impact on our global provision for income taxes. Tax laws are dynamic and subject to change as new laws are passed and new interpretations of the law are issued or applied. Proposals to reform U.S. tax laws could significantly impact how U.S. companies are taxed and may increase our U.S. corporate effective tax rate. Although we cannot predict whether or in what form any such proposals will pass, certain proposals under consideration, if enacted into law, could have an adverse impact on our effective tax rate, income tax expense, and cash flows. In addition, governmental tax authorities are increasingly scrutinizing the tax positions of companies. Many countries in the EU, as well as a number of other countries and organizations such as the Organization for Economic Cooperation and Development, are actively considering changes to existing tax laws that, if enacted, could increase our tax obligations in countries where we do business. If U.S. or non-U.S. tax authorities change applicable tax laws, our overall taxes could increase, and our business, financial condition or results of operations may be adversely impacted. In particular, taxing authorities in many jurisdictions have targeted online platforms as a means to collect indirect taxes in connection with transactions taking place over the internet. An increasing number of jurisdictions are considering or have adopted new tax measures, such as digital services taxes or online sales taxes, targeting online commerce. Such taxes generally are imposed on digital transactions executed by a non-resident entity with a local end-user or local end-consumer. If enacted and applicable, such taxes may increase our worldwide effective tax rate, create tax and compliance obligations in jurisdictions in which we previously had none and adversely affect our financial position. Proliferation of these or similar unilateral tax measures may continue unless broader international tax reform is implemented.

In the ordinary course of business and in particular in connection with content acquisition and merchandising our service to our users, we collect and utilize personal data supplied by or obtained from our users. We are subject to laws, rules and regulations in the United States and in other jurisdictions relating to the privacy and security of personal information, including, but not limited to, the EU's General Data Protection Regulation or the "GDPR," the United Kingdom's GDPR, the U.S. Video Privacy Protection Act ("VPPA"), the U.S. Children's Online Privacy Protection Act ("COPPA"), the California Consumer Privacy Act ("CCPA") (as amended by the California Privacy Rights Act ("CPRA")) and other state laws designed primarily to protect consumer's personal data as collected online. Credit card networks may also require us to employ certain security and privacy controls, and failure to comply with these obligations may lead to significant liabilities. The GDPR imposes strict requirements for processing personal data of individuals within the European Economic Area ("EEA"). Companies subject to the GDPR have substantial data protection obligations and face significant risk, including potential fines for noncompliance. In addition, the transfer of personal data from the EU and the UK to countries such as the United States, which have not been granted "adequacy" status for EU or UK GDPR purposes, are impermissible absent commitments by the receiving party to protect the data on terms substantially equivalent to those prescribed by the GDPR, generally made in contracts between the data transferring entity in the EU/UK and the data recipient in the "inadequate" jurisdiction. Given our receipt of personal data in United States, these requirements complicate our operations and make them more expensive to implement. Within the United States, we and several of our competitors have been sued and/or threatened with arbitration under the VPPA, a statute enacted in 1988 to prohibit video rental stores from disclosing customers' video rental records without the customers' consent. We cannot reliably predict the courts' or arbitrators' views of the theories asserted in the cases brought against online streaming services under the VPPA, and thus we cannot predict the likely outcome of the claims against ourselves and other streaming services that are defendants in these cases. The plaintiffs in these cases are seeking damages for class members, including statutory damages of up to $2,500 per violation, as well as other potential relief. The U.S. Federal Trade Commission (the "FTC") has in recent years increased its focus on data privacy and security and used its broad authority under Section 5 of the Federal Trade Commission Act to sue companies for allegedly unfair and/or deceptive practices involving personally identifiable data. Among other claims, the FTC has asserted that the sharing of website and mobile application users' IP addresses or browsing history without user consent constitutes an unfair and/or deceptive practice. The FTC has imposed consent orders on defendants in such cases that include prohibitions on sharing any personal information with third parties for advertising purposes, and as part of one recent consent order, obtained a fine from the defendant for $7.8 million. With respect to state law in the United States, the CCPA's amendment by the CPRA has resulted in significant new compliance obligations for companies that collect personal information about California residents. The CCPA provides for civil penalties for violations, as well as a private right of action with statutory damages for certain data security breaches, which may increase the frequency and likelihood of data breach litigation. The statute is now enforceable by a new California data protection agency, the California Privacy Protection Agency, which has issued detailed implementing regulations and signaled intent to use its enforcement authority aggressively. The Agency's latest set of regulations are detailed and complex, and create significant administrative and operational burdens for our Company. Since the enactment of the CCPA in 2018, more than a dozen other U.S. states have enacted similar laws to protect consumers' personal information. Although these laws have common objectives, they also have many differences and apply based on specific, state-by-state, jurisdictional parameters. Compliance with these various laws is and will continue to be a challenge, which will be exacerbated as additional states adopt their own data privacy laws and regulations. Both within and outside of the United States, the data protection regulatory landscape is rapidly evolving. Given the rapid expansion of state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security of personal data, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. We cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. Among the possible impacts could be: limitations on our ability to operate in certain jurisdictions; restrictions on our practices that involve collecting and using personal information, contractual requirements, liability exposure, and the need for investments in data protection measures.. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any actual or perceived failure to comply with data privacy laws or regulations, or related contractual or other obligations, or any perceived privacy rights violation, could lead to investigations, claims, and proceedings by governmental entities and private parties, damages for contract breach, and other significant costs, penalties, and other liabilities, as well as harm to our reputation and market position. Other businesses have been criticized by privacy groups and governmental bodies for attempts to link personal identities and other information to data collected on the internet regarding users' browsing and other habits. Increased regulation of data utilization practices, including new and evolving laws globally, self-regulation, or findings under existing laws that limit our ability to collect, transfer and use information and other data, could have an adverse effect on our business. In addition, if we were to disclose information and other data about our users in a manner that was objectionable to them, our business reputation could be adversely affected, and we could face potential legal claims, reputational loss, or enforcement actions that could impact our operating results. Internationally, we may become subject to additional and/or more stringent legal obligations concerning our treatment of customer and other personal information, and data generally, such as laws regarding data localization and/or restrictions on data export. Failure to comply with these obligations could subject us to liability, and to the extent that we need to alter our business model or practices to adapt to these obligations, we could incur additional expenses.

Operating in international markets requires significant resources and management attention and will subject us to regulatory, economic and political risks that may be different from or incremental to those in the U.S. In addition to the risks that we face in the U.S., our international operations involve risks that could adversely affect our business, including: - new and different sources of competition;- different and more stringent user protection, data protection, privacy and other laws, including data localization requirements;- adverse tax consequences such as those related to changes in tax laws or tax rates or their interpretations, and the related application of judgment in determining our global provision for income taxes, deferred tax assets or liabilities or other tax liabilities given the ultimate tax determination is uncertain;- different or more onerous or costly rights society collection royalties and charges;- the need to adapt our content and user interfaces for specific cultural and language differences, including in-licensing a certain portion of our content assets before we have developed a full appreciation for its performance within a given territory;- difficulties in complying with territorial licenses;- difficulties and costs associated with staffing and managing foreign operations;- management distraction;- political or social unrest, global hostilities and economic instability, including the Israel-Hamas war, as well as the military invasion of Ukraine by Russian forces and the economic sanctions imposed by the U.S. and other nations on Russia, Belarus and certain Russian organizations and individuals;- compliance with U.S. laws such as the Foreign Corrupt Practices Act, export controls and economic sanctions, and local laws prohibiting corrupt payments to government officials;- difficulties in understanding and complying with local laws, regulations and customs in foreign jurisdictions;- regulatory requirements or government action against our service, whether in response to enforcement of actual or purported legal and regulatory requirements or otherwise, that results in disruption or non-availability of our service or particular content in the applicable jurisdiction;- foreign intellectual property laws, such as the EU copyright directive, or changes to such laws, which may be less favorable than U.S. law and, among other issues, may impact the economics of creating or distributing content, anti-piracy efforts, or our ability to protect or exploit intellectual property rights;- fluctuations in currency exchange rates, which have and may continue to impact revenues and expenses of our international operations and expose us to foreign currency exchange rate risk, which we do not currently hedge against but may do so in the future;- profit repatriation and other restrictions on the transfer of funds;- differing payment processing systems as well as consumer use and acceptance of electronic payment methods, such as payment cards;- censorship requirements that cause us to remove or edit content or make other accommodations that lead to consumer disappointment or dissatisfaction with our service;- low usage and/or penetration of internet-connected consumer electronic devices;- availability of reliable broadband connectivity and wide area networks in targeted areas for expansion;- integration and operational challenges as well as potential unknown liabilities in connection with companies we may acquire or control;- differing, and often more lenient, laws and consumer understanding/attitudes regarding the illegality of piracy;- negative impacts from trade disputes; and - implementation of regulations designed to stimulate the local production of film and television series in order to promote and preserve local culture and economic activity, including local content quotas, investment obligations, and levies to support local film funds. For example, the EU recently revised its Audio Visual Media Services Directive to require that European works comprise at least thirty (30) percent of media service providers' catalogs, and to require prominence of those works. These and other factors may cause us to adjust our business plans, including expanding or ceasing certain operations in certain countries, and the execution of our strategies. Our failure to manage any of these risks successfully could harm our international operations and could have an adverse effect on our overall business and results of operations.