1stdibs.com (DIBS) Risk Analysis

The rules and regulations such as the Sarbanes-Oxley Act have increased our legal and finance compliance costs and made some activities more time-consuming and costly. For example, Section 404 requires that our management report on, and our independent auditors attest to, the effectiveness of our internal control structure and procedures for financial reporting. Beginning with our second annual report following our IPO, we will be required to provide a management report on internal control over financial reporting. However, our auditors will not be required to formally attest to the effectiveness of our internal control over financial reporting pursuant to Section 404 until we are no longer an "emerging growth company," as defined in the JOBS Act. Effective internal controls are necessary for us to provide reliable financial reports and effectively prevent fraud. Section 404 compliance may divert internal resources and will take a significant amount of time and effort to complete. We may not be able to successfully complete the procedures and certification and attestation requirements of Section 404 by the time we will be required to do so. Implementing these changes may take a significant amount of time and may require specific compliance training of our personnel. In the future, we may discover areas of our internal controls that need improvement. If our auditors or we discover a material weakness or significant deficiency, the disclosure of that fact, even if quickly remedied, could reduce the market's confidence in our consolidated financial statements and harm our stock price. Any inability to provide reliable financial reports or prevent fraud would harm our business. We may not be able to effectively and timely implement necessary control changes and employee training to ensure continued compliance with the Sarbanes-Oxley Act and other regulatory and reporting requirements. If we fail to successfully complete the procedures and certification and attestation requirements of Section 404, or if in the future our Chief Executive Officer, Chief Financial Officer or independent registered public accounting firm determines that our internal controls over financial reporting are not effective as defined under Section 404, we could be subject to investigations or sanctions by Nasdaq, the SEC, FINRA or other regulatory authorities. Furthermore, investor perceptions of the Company may suffer, and this could cause a decline in the market price of our shares of common stock. We cannot assure you that we will be able to fully comply with the requirements of the Sarbanes-Oxley Act or that management or, when applicable, our auditors will conclude that our internal controls are effective in future periods. Irrespective of compliance with Section 404, any failure of our internal controls could have a material adverse effect on our stated results of operations and harm our reputation.

Despite our vetting process, we may fail to prevent the listing of stolen goods on our online marketplace. Government regulators and law enforcement officials may allege that our services violate, or aid and abet violations of certain laws, including laws restricting or prohibiting the transferability and, by extension, the resale, of stolen goods. Our form of seller agreement includes a representation that the seller has the necessary right and title to the luxury design products the seller may list, and we include such a rule and requirement in our terms of service prohibiting the listing of stolen or otherwise illegal products. In addition, we have implemented other protective measures to detect such products. If these measures prove inadequate, we may be required to spend substantial resources to take additional protective measures which could negatively impact our operations. Any costs incurred as a result of potential liability relating to the alleged or actual sale of stolen goods could harm our business. In addition, negative publicity relating to the actual or perceived listing or sale of stolen goods using our services could damage our reputation and make our sellers and buyers reluctant to use our services. We could face liability for such unlawful activities. Despite measures taken by us to detect stolen goods, to cooperate fully with law enforcement, and to respond to inquiries regarding potentially stolen goods, any resulting claims or liabilities could harm our business.

Many of the underlying laws, rules, and regulations imposing taxes and other obligations were established before the growth of the Internet and e-commerce. U.S. federal, state, and local taxing authorities are currently reviewing the appropriate treatment of companies engaged in Internet commerce and considering changes to existing tax or other laws that could levy sales, income, consumption, use, or other taxes relating to our activities, and/or impose obligations on us to collect such taxes. If such tax or other laws, rules, or regulations are amended, or if new unfavorable laws, rules or regulations are enacted, the results could increase our tax payments or other obligations, prospectively or retrospectively, subject us to interest and penalties, decrease the demand for our services if we pass on such costs to our sellers or buyers, result in increased costs to update or expand our technical or administrative infrastructure, or effectively limit the scope of our business activities if we decided not to conduct business in particular jurisdictions. As a result, these changes may have a material adverse effect on our business, results of operations, financial condition, and prospects. The Tax Cuts and Jobs Act of 2017 made a number of significant changes to the current U.S. federal income tax rules, including the reduction of the generally applicable corporate tax rate from 35% to 21%, the limitation of the tax deduction for net interest expense to 30% of adjusted taxable income (except for certain small businesses), the limitation of the deduction for net operating losses from taxable years beginning after December 31, 2017 to 80% of current year taxable income and the elimination of net operating loss carrybacks generated in taxable years ending after December 31, 2017 (though any such net operating losses may be carried forward indefinitely), and the modification or repeal of many business deductions and credits. Additionally, the Coronavirus Aid, Relief, and Economic Security Act, which, among other things, suspends the 80% limitation on the deduction for net operating losses in taxable years beginning before January 1, 2021, permits a five-year carryback of net operating losses arising in taxable years beginning after December 31, 2017 and before January 1, 2021, and generally caps the limitation on the deduction for net interest expense at 50% of adjusted taxable income for taxable years beginning in 2019 and 2020. It cannot be predicted whether, when, in what form, or with what effective dates, tax laws, regulations and rulings may be enacted, promulgated or issued, which could result in an increase in our or our stockholders' tax liability or require changes in the manner in which we operate in order to minimize or mitigate any adverse effects of changes in tax law.

Numerous state, federal and international laws, rules and regulations govern privacy, data protection and the collection, use and protection of personal information and other types of data we collect, use, disclose and otherwise process. These laws, rules and regulations are constantly evolving, and we expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU and other jurisdictions. For example, California enacted legislation in June 2018, the California Consumer Privacy Act (the "CCPA") that, among other things, requires covered companies to provide new disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. California also adopted the California Privacy Rights Act in November 2020 (the "CPRA"), which would amend provisions of the CCPA, to be effective January 1, 2023. Similarly, the European Commission adopted a General Data Protection Regulation that became fully effective on May 25, 2018, imposing stringent EU data protection requirements. We cannot yet fully determine the impact these or future laws, rules, and regulations may have on our business or operations. These laws, rules and regulations may be inconsistent from one jurisdiction to another, subject to differing interpretations and may be interpreted to conflict with our practices. The CCPA and CPRA could mark the beginning of a trend toward more stringent privacy legislation in the United States. For example, Colorado and Virginia adopted individual state privacy laws in 2021 and other states are also considering privacy legislation. The CCPA has prompted a number of additional proposals for federal and state privacy legislation that, if passed, could increase our potential liability, add layers of complexity to compliance in the U.S. market, increase our compliance costs, and adversely affect our business. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing and disclosure of various types of data,including personal information, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters. Any failure or perceived failure by us or any third parties with which we do business to comply with these laws, rules and regulations, or with other obligations to which we or such third parties are or may become subject, may result in actions against us by governmental entities, private claims and litigation, the expenditure of legal and other costs and of substantial time and resources, and fines, penalties or other liabilities. Any such action would be expensive to defend, may require the expenditure of substantial legal and other costs and substantial time and resources, and likely would damage our reputation and adversely affect our business and results of operations. Further, in view of new or modified federal, state or foreign laws and regulations, industry standards, contractual obligations and other legal obligations, or any changes in their interpretation, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend significant resources to modify our product and otherwise adapt to these changes. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited. Privacy, data protection and information security concerns, whether valid or not valid, may inhibit the use and growth of our online marketplace, particularly in certain foreign countries.

Although we do not create or take possession of the items listed on our online marketplace, we have from time to time received, and may in the future receive, communications alleging that items listed on our online marketplace infringe third-party copyrights, trademarks, patents, or other intellectual property rights, or that items we list from our sellers contain materials such as fur, python, ivory, and other exotic animal product components, that are subject to regulation or cultural patrimony considerations, or that may be deemed hazardous or illegal. We have complaint and take-down procedures in place to address these communications and listings, and we believe such procedures are important to promote confidence in our online marketplace. We follow these procedures to review complaints and relevant facts to determine the appropriate action to take, which may include removal of the item from our online marketplace and, in certain cases, removing the sellers who repeatedly violate our policies. Our procedures may not effectively reduce or eliminate our liability. In particular, we may be subject to civil or criminal liability for activities carried out by sellers on our online marketplace, especially outside the United States where we may be less protected under local laws than we are in the United States. Under current U.S. copyright law and the Communications Decency Act, we may benefit from statutory safe harbor provisions that protect us from liability for content posted by our sellers and buyers. However, trademark and patent laws do not include similar statutory provisions and liability for these forms of intellectual property is often determined by court decisions. These safe harbors and court rulings may change unfavorably. In that event, we may be held secondarily liable for the intellectual property infringement of sellers. Regardless of the validity of any claims made against us, we may incur significant costs and efforts to defend against or settle them. If a governmental authority determines that we have aided and abetted the infringement of third-party intellectual property rights or the sale of counterfeit goods or if legal changes result in us potentially being liable for actions by sellers on our online marketplace, we could face regulatory, civil, or criminal penalties. Successful claims by third-party rights owners could require us to pay substantial damages or refrain from permitting any further listing of the relevant items. These types of claims could force us to modify our business practices, which could lower our revenue, increase our costs, or make our platform less user-friendly. Moreover, public perception that counterfeit or other unauthorized items are common on our online marketplace, even if factually incorrect, could result in negative publicity and damage to our reputation.

We use social media, emails, and push notifications as part of our omni-channel approach to marketing and communications with sellers and buyers. As laws and regulations evolve to govern the use of these channels, the failure by us, our employees or third parties acting at our direction to comply with applicable laws and regulations in the use of these channels could adversely affect our reputation or subject us to fines or other penalties. In addition, our employees or third parties acting at our direction may knowingly or inadvertently make use of social media in ways that could lead to the loss or infringement of intellectual property, as well as the public disclosure of proprietary, confidential, or sensitive personal information of our business, employees, consumers, or others. Information concerning us or our sellers and buyers, whether accurate or not, may be posted on social media platforms at any time and may have an adverse impact on our brand, reputation, or business. The harm may be immediate without affording us an opportunity for redress or correction and could have a material adverse effect on our reputation, business, results of operations, financial condition, and prospects.

We intend to deepen our penetration in our existing verticals for luxury design products and continue to explore additional verticals to serve existing, and attract new, sellers and buyers. If these additional verticals do not attract new sellers or buyers, our revenue may fall short of expectations, our brand and reputation could suffer, and we may incur expenses that are not offset by revenue. In addition, our business may suffer if we are unable to attract new and repeat sellers that supply the necessary high-end, appropriately priced, and in-demand luxury design products in these additional verticals, and these verticals may also have a different range of margin profiles than the pieces currently sold through our online marketplace. Additionally, as we enter new verticals, potential sellers may demand lower commissions than our current verticals, which would adversely affect our take rate and results of operations. Expansion of our offerings may also strain our management and operational resources, specifically the need to hire and manage additional authentication and market experts. We may also face increased competition from companies that are more focused on these verticals. If any of these were to occur, it could damage our reputation, limit our growth and harm our results of operations.

The software powering our online marketplace incorporates software covered by open source licenses. The terms of many open source licenses have not been interpreted by U.S. courts and there is a risk that the licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to operate our online marketplace. If we were to combine or connect our proprietary source code or software with open source software in a certain manner, we could, under certain of the open source licenses, be required to publicly release the source code of our software or to make our software available under open source licenses. To avoid the public release of the affected portions of our source code in the event of our inappropriate use of open source software, we could be required to expend substantial time and resources to re-engineer some or all of our software. In addition, use of open source software can lead to greater risks than use of third-party commercial software because open source licensors generally do not provide warranties or controls on the origin of the software. Use of open source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to determine how to compromise our platform. We have established processes to help alleviate these risks, but we cannot be sure that all of our use of open source software is in a manner that is consistent with our current policies and procedures or will not subject us to liability.

In August 2021, we announced the launch of our non-fungible token ("NFT") platform where creators can make blockchain-encrypted design items, such as artwork, available as NFTs for digital purchase through 1stDibs, utilizing Ethereum, a blockchain technology. NFTs are digital assets recorded on a blockchain ledger for verification of authenticity and ownership of a unique digital asset, such as artwork. Given the increased scrutiny of digital assets as well as cryptocurrencies for regulatory and anti-money laundering purposes, it is possible that the United States and other jurisdictions will engage in increased scrutiny and regulation of NFTs and our business. While NFTs and cryptocurrencies are similar in that both are based on blockchain technology, unlike cryptocurrency units, which are fungible, NFTs have unique identification codes and represent content on the blockchain. The record of ownership of the NFT, which establishes authenticity and may also carry other rights, cannot be duplicated. As NFTs are a relatively new and emerging type of digital asset, the regulatory, commercial, and legal framework governing NFTs (as well as cryptocurrencies) is likely to evolve both in the United States and internationally and implicates issues regarding a range of matters, including, but not limited to, intellectual property rights, privacy and cybersecurity, fraud, anti-money laundering, sanctions, and currency, commodity, and securities law implications. For example, NFTs raise various intellectual property law considerations, including adequacy and scope of assignment, licensing, transfer, copyright, and other right of use issues. The creator of an NFT will often have all rights to the content of the NFT and can determine what rights to assign to a buyer, such as the right to display, modify, or copy the content. To the extent we are directly or indirectly involved in a dispute between creators and buyers on our NFT platform, it could materially and adversely affect the success of our NFT platform and harm our business and reputation. NFTs, and our NFT platform, may also be an attractive target for cybersecurity attacks. For example, a perpetrator could seek to obtain the private key associated with a digital wallet holding an NFT to access and sell the NFT without valid authorization, and the owner of the NFT may have limited recourse due to the nature of blockchain transactions and of cybercrimes generally. NFT marketplaces, including our NFT platform, may also be vulnerable to attacks where an unauthorized party acquires the necessary credentials to access user accounts. The safeguards we have implemented or may implement in the future to protect against cybersecurity threats may be insufficient. If our NFT platform were to experience any cyberattacks, it could negatively impact our reputation and market acceptance of our platform. NFTs, and our NFT platform (including our facilitation of transactions in Ether, a cryptocurrency generated using the Ethereum protocol), may also be subject to regulations of the Financial Crimes Enforcement Network ("FinCEN") of the U.S. Department of Treasury and the Bank Secrecy Act. Further, the Office of Foreign Assets Controls ("OFAC") has signaled sanctions could apply to digital transactions and has pursued enforcement actions involving cryptocurrencies and digital asset accounts. The nature of many NFT transactions also involve circumstances which present higher risks for potential violations, such as anonymity, subjective valuation, use of intermediaries, lack of transparency, and decentralization associated with blockchain technology. In addition, the Commodity Futures Trading Commission has stated that cryptocurrencies, with which NFTs have some similarities, fall within the definition of "commodities." If NFTs were deemed to be a commodity, NFT transactions could be subject to prohibitions on deceptive and manipulative trading or restrictions on manner of trading (e.g., on a registered derivatives exchange), depending on how the transaction is conducted. Moreover, if NFTs were deemed to be a "security," it could raise federal and state securities law implications, including exemption or registration requirements for marketplaces for NFT transactions, sellers of NFTs, and the NFT transactions themselves, as well as liability issues, such as insider trading or material omissions or misstatements, among others. NFT transactions may also be subject to laws governing virtual currency or money transmission. For example, New York has legislation regarding the operation of virtual currency businesses. NFT transactions also raise issues regarding compliance with laws of foreign jurisdictions, many of which present complex compliance issues and may conflict with one another. Our launch and operation of our NFT platform (including our facilitation of transactions in Ether, a cryptocurrency, in connection therewith) expose us to the foregoing risks, among others, any of which could materially and adversely affect the success of our NFT platform and harm our business, financial condition, results of operations, reputation, and prospects. As the market for NFTs is relatively nascent, it is difficult to predict how the legal and regulatory framework around NFTs will develop and how such developments will impact our business and our NFT platform. Further, market acceptance of NFTs is uncertain as buyers may be unfamiliar or uncomfortable with digital assets generally, how to transact in digital assets, or how to assess the value of NFTs. The launch of our NFT platform also subjects us to risks similar to those associated with any new platform offering, including, but not limited to, our ability to accurately anticipate market demand and acceptance, our ability to successfully launch our new NFT platform offering, creator and buyer acceptance, technical issues with the operation of our new NFT platform, and legal and regulatory risks as discussed above. We believe these risks may be heightened with respect to our NFT platform, as NFTs are still considered a relatively novel concept. If we fail to accurately anticipate or manage the risks associated with our NFT platform or with our facilitation of cryptocurrency transactions, or if we directly or indirectly become subject to disputes, liability, or other legal or regulatory issues in connection with our NFT platform or cryptocurrency transactions, our NFT platform may not be successful and our business, financial condition, results of operations, reputation, and prospects could be materially harmed. See "If we fail to successfully expand the features, services, and offerings on our online marketplace, our ability to grow our business may suffer."

Our success depends in part on our ability to attract and retain key personnel on our executive team, including our Chief Executive Officer, David S. Rosenblatt. Senior employees have left our company in the past and others may in the future. We often cannot anticipate such departures, and may not be able to promptly replace key leadership personnel. The loss of one or more of our key personnel or the inability to promptly identify a suitable successor to a key role could have an adverse effect on our business. Our key personnel are generally employed on an "at-will" basis.

Our brand and ability to attract and retain sellers and buyers depends in part on the reliable performance of our cloud-hosted servers, network infrastructure and content delivery process. If the services provided by third parties are disrupted or if we are unable to maintain and scale the technology underlying our platform, our operations and business could suffer. The volume of traffic and activity on our online marketplace spikes on certain days and during certain periods of the year, such as during the fourth quarter due to the seasonality of our business, and any interruption would be particularly problematic if it were to occur at such a high volume time. The software and operation of the technology underlying our platform is expensive and complex, and we could experience operational failures. If we fail to accurately predict the rate or timing of the growth of our platform, we may be required to incur significant additional costs to maintain reliability. These costs could include, but are not limited to, adding additional hosting capacity or platforms, additional network providers, web application firewalls or other bot-mitigation technologies or additional content distribution networks. Additionally, as we rely on a fast, secure, and stable Internet, we could be required to adapt to any changes to global standards. We have experienced, and expect that in the future we will experience, interruptions, delays, and outages in service and availability from time to time due to a variety of factors, including infrastructure changes, human or software errors, website hosting disruptions, and capacity constraints which could affect the availability of services on our platform and prevent or inhibit the ability of buyers to access our online marketplace or complete purchases on our online marketplace and app. Third-party providers host much of our technology infrastructure. Any disruption in their services, or any failure of our providers to handle the demands of our online marketplace could significantly harm our business and damage our reputation. Third-party providers also have systems that are constantly evolving, it is difficult to predict the challenges that we may encounter in developing our platform for use in conjunction with such third-party systems, and we may not be able to modify our integrations to assure its compatibility with the systems of other third parties following any of their changes to their systems. Further, if we experience failures in our technology infrastructure or do not expand our technology infrastructure successfully, then our ability to attract and retain sellers and buyers and our growth prospects and our business would suffer. We do not have control over the operations of the facilities of these third-party providers that we use. These facilities may be vulnerable to damage or interruption from natural disasters, cybersecurity attacks, terrorist attacks, power outages and similar events or acts of misconduct.

Our business and results of operations are subject to global economic conditions and their impact on consumer discretionary spending, particularly in the market for luxury design products. If general economic conditions deteriorate in the United States or in other markets where we operate, consumer discretionary spending may decline and demand for the luxury design products available on our online marketplace may be reduced. This would cause sales through our online marketplace to decline and adversely impact our business. Exchange rates may also impact sales, with a strong U.S. dollar dampening demand for goods denominated in dollars from buyers outside the United States. Consumer purchases of luxury design products have generally declined during periods of economic uncertainty, when disposable income is reduced or when there is a reduction in consumer confidence. Other factors that may negatively influence consumer spending on luxury design products include unemployment levels, higher consumer debt levels, reductions in net worth, declines in asset values, market uncertainty, home foreclosures and reductions in home values, fluctuating interest rates and credit availability, fluctuating fuel and other energy costs, fluctuating commodity prices and general uncertainty regarding the overall future political and economic environment. Economic conditions may also be affected by global health crises such as the COVID-19 pandemic, and natural disasters, such as earthquakes, hurricanes, and wildfires. Such economic uncertainty and decrease in the rate of purchases of luxury design products may slow the rate at which sellers choose to list their items with us, which could result in a decrease of items available through our online marketplace. Even without changes in economic conditions, the demand for the items listed on our online marketplace is dependent on consumer preferences. Consumer preferences can change quickly and may differ across generations and cultures. If demand for the luxury design products that sellers offer through our online marketplace declines, our business would be harmed.