Eventbrite (EB) Risk Analysis

Global laws and regulations that govern payment methods and processing are complex, and we may be required to expend considerable time and effort to determine if such laws and regulations apply to our business. There can be no assurance that we will be able to meet all compliance obligations under applicable law, including obtaining any such licenses in all of the jurisdictions we operate in or offer a service in, and, even if we were able to do so, there could be substantial costs and potential product changes involved in complying with such laws, which could have a material and adverse effect on our business, financial condition and results of operations. Any noncompliance by us in relation to existing or new laws and regulations, or any alleged noncompliance, could result in reputational damage, litigation, penalties, fines, increased costs or liabilities, damages, or require us to stop offering payment services in certain markets. For example, if we are deemed to be a money transmitter or money services business as defined by applicable regulation, we could be subject to certain laws, rules and regulations enforced by multiple authorities and governing bodies in the United States and numerous state and local agencies who may define money transmitter and money services business differently. If we were required to be licensed or registered as a money transmitter or money services business (or otherwise determined that obtaining state money transmission licenses or that registration under Federal money services business or anti-money laundering laws would further our business purposes), we would be subject to anti-money laundering requirements, recordkeeping and reporting requirements, as well as bonding requirements, restrictions on the use of customer funds and other obligations. We would also be subject to examination and oversight by applicable state licensing regulatory authorities. Additionally, outside of the United States, we could be subject to additional laws, rules and regulations related to the provision of payments and financial services, and as we expand into new jurisdictions, the foreign regulations and regulators governing our business that we are subject to will expand as well. If we are found to be a money transmitter or money services business under any applicable regulation and we are not in compliance with such regulations, we may be subject to investigations by regulators and to fines or other penalties in one or more jurisdictions levied by federal or state or local regulators, including state Attorneys General, as well as those levied by foreign regulators and governmental bodies. In addition to investigations and fines, penalties we may be subject to civil or criminal actions, fines, penalties, forfeiture, remedial measures, costs, legal fees, reputational damage, or other negative consequences for failing to comply with applicable rules and regulations could include criminal and civil proceedings, forfeiture of significant assets or other enforcement actions, all of which may harm our business, financial condition and results of operations. We could also be required to make changes to our business practices or compliance programs as a result of regulatory scrutiny or if we are deemed to be a money transmitter or money services business. Additionally, the laws and regulations related to payments are subject to change, and vary across different jurisdictions in the United States and globally. Changes in laws, rules and regulations, including in their interpretation and application, have occurred and may occur in the future, which may impact our business practices. Given the complex and constantly evolving nature of these laws and regulations, we are required to spend significant time, resources, and effort to assess their application and any compliance measures needed. Failure to predict how a U.S. law or regulation or a law or regulation from another jurisdiction in which we operate with respect to money transmission, money services business or similar requirements apply or will be applied to us could result in licensure or registration requirements, administrative enforcement actions, penalties, fines and costs, and could materially interfere with our ability to offer certain payment methods or to conduct our business in particular jurisdictions. The factors identified here could impose substantial additional costs, involve considerable delay to the development or provision of our solutions, require significant and costly operational changes, or prevent us from providing our products or solutions in any given market.

Our platform uses payment services for ticket purchases and to make payments to event organizers. We accept payments using a variety of methods, including credit and debit cards. As we offer new payment options to our creators and consumers, we may be subject to additional rules, regulations, compliance requirements and higher fraud losses. We rely upon third-party payment services providers to provide key aspects of these payment services. Our utilization of such payment services may be impacted by factors outside of our control, including disruptions in the payment processing industry generally. If these service providers do not perform adequately or experience a data security incident or fail to comply with applicable laws, payment network rules, and industry standards or if our relationships with these service providers were to change or terminate (or if they become willing or unable to provide services to us), it could disrupt our business and negatively affect our ability to receive payments and our creators' and consumers' ability to complete purchases. This could decrease revenue, increase costs, lead to potential legal liability, and negatively impact our brand and business. Any noncompliance with anti-money laundering or payments regulations or laws by our payment services providers or other partners in performing services for us could impact our reputation, divert substantial resources, result in liabilities, force us to restructure, or require changes in payments options, which may harm our business, financial condition and results of operations. Under current credit, debit and payment card practices and network rules, we are liable for fraudulent activity on our credit and debit card transactions. We may incur losses if we fail to prevent the use of fraudulent payment information on transactions. Fraud schemes are becoming increasingly sophisticated and common, and our ability to detect and combat fraudulent schemes may be negatively impacted by the adoption of new payment methods and new technology platforms. If we or our providers fail to identify fraudulent activity or are unable to effectively combat the use of fraudulent payments on our platform or if we otherwise experience increased levels of disputed payments or transactions, our results of operations and financial positions could be materially adversely affected. In addition, our failure to adequately mitigate this risk could damage our reputation and brand and substantially harm our business, financial condition, results of operations, prospects and our ability to accept payments. For certain payment methods, we pay interchange and other related acceptance fees, along with additional transaction processing fees. Payment card networks and our third-party payment services providers could increase the fees or interchange they charge us for their services or to accept or process card transactions, which would increase our operating costs and reduce our margins. Any such increase in fees could harm our business, financial condition and results of operations. Additionally, we and our third-party payment service providers are subject to the Payment Card Industry Data ("PCI") Data Security Standard ("PCI-DSS"), issued by the PCI Council. PCI DSS is a multifaceted security standard that contains compliance guidelines and standards with regard to our security surrounding the physical administrative and technical storage, processing and transmission of individual cardholder data. Failure to be PCI-compliant or to meet other payment card standards may result in the imposition of financial penalties or the allocation by the card network of the costs of fraudulent charges to us. Additionally, if we or they experience substantial losses related to payment card transactions or in the event of noncompliance with PCI-DSS, we may choose to, or be required to, cease accepting certain payment cards for payment. Card associations and payment networks and their member financial institutions regularly update and generally expand security expectations and requirements related to the security of cardholder data and environments, which could make it difficult or impossible for us to comply and could require a change in our business operations. We are also subject to rules governing electronic funds transfers and payment card association rules, which could change over time, and must comply with evolving payment card association and network operating rules. Any change in these rules and requirements could make it difficult or impossible for us to comply and could require a change in our business operations. In addition, similar to a potential increase in costs from third-party providers described above, any increased costs associated with compliance with payment card association rules or payment card provider rules could lead to increased fees for us or our creators and consumers.

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended (FCPA), the United Kingdom Bribery Act 2010 (Bribery Act), and other anti-corruption and anti-bribery laws in various jurisdictions, both domestic and abroad, where we conduct business. The FCPA and the Bribery Act prohibit us and our officers, directors, employees and business partners acting on our behalf, including agents, from, directly or indirectly, corruptly offering, promising, authorizing or providing anything of value to a "foreign official" for the purposes of influencing official decisions to obtain or retain business or otherwise secure an improper advantage. The FCPA further requires us to make and keep books, records and accounts that accurately reflect transactions and dispositions of assets and to maintain a system of adequate internal accounting controls. The Bribery Act also prohibits private-sector bribery, and accepting bribes. Our sales team sells use of our platform abroad, and we face significant risks if we fail to comply with the FCPA and other applicable anti-corruption laws. We operate in many jurisdictions around the world and may also have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and we may be held liable for the corrupt or other illegal activities of third-party intermediaries, our employees, representatives, contractors, partners, service providers and agents, even if we do not authorize such activities. While we have policies and procedures to address compliance with such laws, we cannot ensure that all of our employees and agents, as well as those contractors to which we outsource certain of our business operations, will not take actions in violation of our policies or agreements and applicable law, for which we may be ultimately held responsible. Any violation of the FCPA, the Bribery Act or other applicable anti-corruption and anti-bribery laws could subject us to significant sanctions, including civil or criminal fines and penalties, disgorgement of profits, injunctions and debarment from government contracts, as well as related stockholder lawsuits and other remedial measures, all of which could harm our reputation, business, financial condition and results of operations. Responding to any investigation may result in a significant diversion of management's attention and resources and significant defense costs and other professional fees.

We are subject to a number of U.S. federal and state and foreign laws and regulations that involve matters central to our business. For example, our platform is subject to an increasingly strict set of legal and regulatory requirements intended to help detect and prevent money laundering, terrorist financing, fraud and other illicit activity. The interpretation of those requirements by judges, regulatory bodies and enforcement agencies is changing, often quickly and with little notice. Changes in laws and regulations could impose more stringent requirements on us to detect and prevent illegal and improper activity by creators, which can increase our operating costs and reduce our margins. For example, in the United States, platforms like ours generally are immune from content generated by users or other third parties under Section 230 of the Communications Act of 1934, as amended by the Communications Decency Act (Section 230). If Section 230 is interpreted by courts or amended by Congress in a manner that reduces the scope of liability protection available to platforms like ours, we will need to increase our content moderation operations, which may harm our business, financial condition and results of operations. In addition, the ticketing business is subject to many laws and regulations, both foreign and domestic. These laws and regulations vary from jurisdiction to jurisdiction and may sometimes conflict. For example, in November 2022, the EU Digital Services Act ("DSA") came into force, and the majority of the DSA's substantive provisions relating to content moderation and transparency take effect and apply to us from and including February 17, 2024. The extent of regulatory enforcement and the additional obligations that may be imposed upon us under the DSA and similar pending legislation is not clear yet. The DSA may increase our compliance costs and require changes to our user interfaces and content moderation processes and operations, which may adversely affect our ability to attract and provide our services to creators and consumers, and may otherwise affect our business, financial condition and results of operations. Failure to comply with the DSA can result in fines of up to 6% of total annual worldwide turnover, and recipients of services have the right to seek compensation from providers in respect of damage or loss suffered due to infringement by the provider to comply with the DSA. We collaborate closely with members of Congress and fellow stakeholders toward bipartisan, comprehensive, live event ticketing reform. For example, we have supported both the Senate's Fans First Act (S. 3457) and the House's TICKET Act (H.R. 3950), which mandate ticket pricing transparency, ban deceptive advertising and websites, and ban fake tickets. Our goal is to help improve the live event ecosystem by fostering ticketing marketplace integrity, restoring the faith of consumers and the ability of artists and event creators to host successful events. Outside of ticketing regulations, creators are often subject to regulations of their own, such as permitting and crowd control requirements. Regulatory agencies or courts may claim or hold that we are responsible for ensuring that creators comply with these laws and regulations, which could greatly increase our compliance costs, expose us to litigation, subject us to fines and penalties and otherwise harm our business.

We generally conduct our international operations through wholly owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions. Because of these international operations, we may be subject to adverse tax changes or interpretation, increased taxes due to increased international expansion, and tax charges due to complex intercompany agreements. We may be subject to income or other indirect taxation in several jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles, including increased tax rates, new tax laws or revised interpretations of existing tax laws and precedents, which could have an adverse effect on our liquidity and results of operations. In addition, the authorities in these jurisdictions could review our tax returns and impose additional tax, interest and penalties, and the authorities could claim that various withholding requirements apply to us or assert that benefits of tax treaties are not available to us, any of which could have a negative impact on us or our results of operations. As we earn an increasing portion of our revenue and accumulate a greater portion of our cash flow in foreign jurisdictions, we could face a higher effective tax rate and incremental cash tax payments. Additionally, our intercompany relationships are subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions. The relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates and reduced cash flows and may harm our business, financial condition and results of operations.

As an online platform, we rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. Despite the implementation of security measures, we and our third-party providers are vulnerable to power outages, telecommunications failures, interruptions or shutdowns of our platform and catastrophic events, as well as cybersecurity risks that threaten the confidentiality, integrity and availability of our and third party providers' information systems and confidential information (including information about our creators, consumers, employees and others, intellectual property and proprietary information such as trade secrets), including through computer viruses, break-ins, intentional or accidental actions or inaction by employees or others with authorized access to our or our providers' networks, social engineering/phishing attacks, denial-of-service attacks, malicious or destructive code, malware, ransomware attacks, and other cyber attacks, data breaches and cybersecurity incidents. Cyber attacks and security incidents (including through security breaches, computer malware and computer hacking attacks) upon information systems are increasing in their frequency, levels of persistence, intensity and sophistication, and threat actors are using rapidly changing techniques and tools – including artificial intelligence – that circumvent security controls, evade detection and remove forensic evidence, and are being conducted by diverse threat actors, including sophisticated and organized groups, state-sponsored organizations and individuals with a wide range of motives and expertise. A successful cyber attack or cybersecurity incident could occur and persist for an extended period of time before being detected. As we continue to grow our business, expand to new geographical locations, and gain greater public visibility, we may continue to face a higher risk of being targeted by cyber attacks. As a result of our (and some of our providers') transition to a primarily remote workforce, we face increased cybersecurity risks due to our reliance on Internet technology and the number of our employees who are working remotely, which may create additional opportunities for threat actors to exploit vulnerabilities. Moreover, we have acquired and may continue to acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to significant cybersecurity, operational and financial risks. In addition to unauthorized access to or acquisition of confidential information (including personal data, intellectual property or other sensitive information), attacks against us or our third party providers could include the deployment of malicious or destructive code, malware or ransomware, and may use a variety of methods, including denial-of-service attacks, social engineering/phishing and other means, to attain such unauthorized access or acquisition or otherwise affect service reliability and threaten the availability, integrity and confidentiality of our information systems and information stored thereon. For example, we have experienced in the past, and could experience in the future, credential stuffing attacks in which malicious third parties used or attempted to use credentials compromised in data breaches suffered by other companies to access accounts on our platform. These credential stuffing attacks have in the past, and may in the future, result in the unauthorized takeover of a customer's account and the illegal abuse of account privileges to misdirect funds to bank accounts owned or controlled by such criminal actors, which may subject us to liability for illegal transactions. It is possible that incidents of account takeover fraud could increase in the future. The misuse of our products or services for illegal or improper purposes could subject us to claims, individual and class action lawsuits, and government and regulatory investigations, prosecutions, enforcement actions, inquiries, or requests that could result in liability and reputational harm for us. While we employ security measures intended to prevent, detect, and mitigate potential for harm to our users from the theft of or misuse of credentials on our network, these security measures may not be effective in every instance and may require significant costs. Furthermore, the prevalent use of mobile devices increases the risk of cybersecurity incidents. Misplaced, stolen or compromised mobile devices used at events for ticket scanning, or otherwise, could lead to unauthorized access to the device and data stored on or accessible through such device. We have in the past experienced breaches of our security measures, and our platform and systems are at risk for future breaches and incidents as a result of third-party action or employee, service provider, partner or contractor error or malfeasance. We may be subject to litigation and experience reputational harm, and have been subject to claims and suffered customer loss, related to cybersecurity incidents. In the future, our financial performance may be impacted further if we face additional costs and expenses from customer compensation and retention incentives, creator loss, regulatory inquiries, litigation and further remediation and upgrades to our security infrastructure. Although we have insurance coverage, our policy may not cover all financial expenses related to cybersecurity incidents, and there is no guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all. In addition, our platform involves the storage and transmission of personal information of our creators and consumers in our facilities and on our third-party equipment, computer systems, hardware, software, technology infrastructure and online sites and networks. Cybersecurity incidents expose us to litigation, remediation costs, increased costs for security measures, loss of revenue, damage to our reputation and potential liability. Information and corporate information systems and security measures may be breached or adversely impacted due to the actions of outside parties, employee error or misconduct, malfeasance, a combination of these or otherwise, and, as a result, an unauthorized party may obtain access to our information systems and confidential information, including information relating to our creators and consumers. Additionally, outside parties may attempt to fraudulently induce employees, creators or consumers to disclose sensitive information in order to gain access to creator or consumer data. We must continuously examine and modify our security controls and business policies to address the use of new devices and technologies, and the increasing focus by consumers and regulators on controlling and protecting personal data. We may need to expend significant resources to protect against and remedy any potential cybersecurity incidents and their consequences, including making notifications to governmental authorities and affected individuals. For example, laws in the EU and UK and all 50 U.S. states may require businesses to provide notice to individuals whose personal information has been disclosed as a result of a data security breach. Any cybersecurity incident or adverse impact to the availability, integrity or confidentiality of our platform or information systems, the systems or networks of our third-party service providers or partners, or any unauthorized access to information we or our providers and partners process or maintain, could harm our business, financial condition and results of operations. As any investigation of a cybersecurity incident is inherently unpredictable, the extent of a particular cybersecurity incident and the path of investigating, remediating or recovering from the incident may not be immediately clear. It may take a significant amount of time and resources before an investigation can be completed and full and reliable information about the incident is known. While an investigation is ongoing, we may not necessarily know the extent of the harm or how best to remediate or recover from the incident, certain vulnerabilities could remain and errors or actions could be repeated or compounded before they are discovered and remediated, and communication to the public, regulators, creators, consumers and other stakeholders may be delayed, inaccurate or incomplete, any or all of which could further increase the costs and consequences of a cybersecurity incident. Additionally, applicable rules requirements regarding how to respond, required notices to users, and reporting obligations to creators, consumers, regulators and others vary by jurisdiction. While we have a cybersecurity risk management program and have implemented security policies and controls intended to protect our information systems, infrastructure and confidential information, there can be no assurance that such measures or our third-party service providers' and partners' security measures will successfully anticipate new or existing techniques used by threat actors, protect our systems and information, prevent service interruptions, software or hardware vulnerabilities or other security incidents. Further, if our employees or employees of our third-party service providers fail to comply with our internal security policies and practices, or fully implement our cybersecurity risk management program, our information systems and creator, consumer, employee and other confidential information stored thereon may be improperly accessed, used or disclosed. Although it is difficult to determine what harm may directly result from any specific interruption or incident, any actual or perceived failure to maintain performance, reliability, security and availability of our network infrastructure, or of any third-party networks or systems used or supplied by our third-party service providers or partners, to the satisfaction of creators and consumers may harm our reputation and our ability to retain existing creators and consumers and attract new creators and consumers. Examples of situations which have in the past and may in the future lead to unauthorized access to or an adverse impact on the availability, integrity or confidentiality of our information systems or information include, but are not limited to the following: - employees inadvertently sending financial information of one creator, consumer or employee to another creator, consumer or employee;- employee malfeasance;- creators' failure to properly password protect their leased ticket scanning and site operations devices leaving the data available to anyone using the device;- a device stolen from an event and data access, alteration or acquisition occurring prior to our remote wiping of the data;- an employee losing their computer or mobile device or otherwise, allowing for access to our email and/or administrative access, including access to guest lists to events;- external breaches leading to the circulation of "dark web" lists of user name and password combinations openly vulnerable to attack without immediate detection;- a hack of one of our databases;- account takeovers;- a hack of a third-party service provider's or partner's database; and - unauthorized access to our offices or other properties. If an actual or perceived breach of our security or other cybersecurity incident occurs, the market perception of the effectiveness of our cybersecurity risk management program and measures could be harmed, we could lose existing or future creators and consumers, face lawsuits (including class actions), regulatory investigations and enforcement actions, other legal or regulatory proceedings, damage to our reputation, suffer financial exposure due to such events or in connection with regulatory fines and penalties, incident response, remediation or system restoration efforts, investigation costs, changes or augmentation of our security measures, the expense of taking additional protection measures and future compliance costs. Any or all of the foregoing could materially adversely affect our business, financial condition and results of operations.

We make our platform available across a variety of operating systems and web browsers. We are dependent on the interoperability of our platform with popular devices, mobile operating systems and web browsers that we do not control, such as Android, iOS, Chrome and Firefox. In addition, we are dependent on protocols like email and push notification to communicate with our creators and consumers. Any changes, bugs or technical issues in such systems, devices, protocols or web browsers that degrade the functionality of our platform, make it difficult for creators or consumers to access or use our platform, impose fees related to our platform or give preferential treatment to competitive products or services could adversely affect usage of our platform. In the event that it is difficult for creators or consumers to access and use our platform, our business and results of operations could be harmed.

Our ability to attract and retain creators depends on the reliable performance of our technology, including our websites, applications, information and related systems. System interruptions, slow-downs and a lack of integration and redundancy in our information systems and infrastructure may adversely affect our ability to operate our technology, handle sales for high-demand events, process and fulfill transactions, respond to creator and consumer inquiries and generally maintain cost-efficient operations. We also rely on affiliate and third-party computer systems, broadband and other communications systems and service providers in connection with the provision of services generally, as well as to facilitate, process and fulfill transactions. Any interruptions, outages or delays in our systems and infrastructures, our businesses, our affiliates' and/or third-party systems we use, or deterioration in the performance of these systems and infrastructures, could impair our ability to provide services, fulfill orders and/or process transactions. From time to time we experience system interruptions caused by outages by our partners that make some or all systems or data unavailable or prevent us from efficiently providing services or fulfilling orders. For example, in August 2022, most of our website experienced a 1.9 hour outage due to a failure of internal infrastructure running Eventbrite's primary analytics platform. While this event did not have a material impact on our business, such events may reduce consumer trust in our platform. On February 27, 2024, we experienced an approximate 1 hour outage of our website. We outsource our cloud infrastructure to Amazon Web Services (AWS), which hosts our platform, and therefore we are vulnerable to service interruptions at AWS, which could impact the ability of creators and consumers to access our platform at any time, without interruption or degradation of performance. Our customer agreement with AWS will remain in effect until July 31, 2025. In the event that our AWS service agreements are terminated, or there is a lapse of service, interruption of Internet service provider connectivity or damage to AWS facilities, we could experience interruptions in access to our platform as well as delays and additional expense in arranging new facilities and services. For example, we previously experienced interruptions in the performance of our platform because of a hardware error that AWS experienced. We may also incur significant costs for using an alternative cloud infrastructure provider or taking other actions in preparation for, or in reaction to, events that damage the AWS services we use. In addition, fire, flood, power loss, telecommunications failure, hurricanes, tornadoes, earthquakes, acts of war or terrorism, natural disasters and similar events or disruptions may damage or interrupt computer, broadband or other communications systems and infrastructures at any time. Climate change is expected to continue to cause adverse weather conditions, increased weather variability and natural disasters to become more frequent and less predictable. Any of these events could cause system interruptions, outages, delays and loss of critical data, and could prevent us from providing services, fulfilling orders and/or processing transactions. While we have backup systems for certain aspects of our operations, disaster recovery planning by its nature cannot be sufficient for all eventualities. In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption. In some instances, we may not be able to identify the cause or causes of these performance problems within a period of time acceptable to creators. It may become increasingly difficult to maintain and improve our platform performance, especially during peak usage times, as the features of our platform become more complex and the usage of our platform increases. Any of the above circumstances or events may harm our reputation, cause creators to stop using our platform, impair our ability to increase revenue, impair our ability to grow our business, subject us to financial penalties and liabilities under our service level agreements and otherwise harm our business, financial condition and results of operations. Our platform and solutions are accessed by a large number of creators and consumers often at the same time. As we continue to expand the volume of creators and consumers using the platform and the solutions available to those creators and consumers, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in service. Furthermore, capacity constraints could be due to a number of potential causes including technical failures, natural disasters, fraud or security attacks. In addition, the failure of AWS cloud infrastructure or other third-party Internet service providers to meet our capacity requirements could result in interruptions or delays in access to our platform or impede our ability to scale our operations. The occurrence of any of these events could harm our business, financial condition and results of operations.

The software underlying our platform is highly complex and we have in the past, and may in the future, detect previously undetected programming errors, failures, bugs or other vulnerabilities. Any real or perceived errors, failures, bugs or other vulnerabilities discovered in our code could result in negative publicity and damage to our reputation, loss of creators and consumers, loss of or delay in market acceptance of our platform, loss of competitive position, loss of revenue or liability for damages, overpayments and/or underpayments, any of which could harm the confidence of creators and consumers on our platform, our business, financial condition and results of operations. In such an event, we may be required or may choose to expend additional resources in order to help correct the problem which may divert engineering staff from building new solutions or product enhancements. Because creators use our platform for processes that are critical to their businesses, errors, failures or bugs in our code, or the underlying infrastructure, have resulted, and could in the future result, in creators seeking significant compensation from us for any losses they suffer and/or ceasing conducting business with us altogether. There can be no assurance that provisions typically included in our agreements with creators that attempt to limit our exposure to claims would be enforceable or adequate or would otherwise protect us from liabilities or damages with respect to any particular claim. Even if unsuccessful, a claim brought against us by any creators would likely be time-consuming and costly to defend and could harm our business, financial condition and results of operations. In addition, our platform relies on third-party partners for the development tool chain, managed infrastructure and platform services. These include disciplines like security, payment processing, cloud computing, data processing and storage, as well as various processes in our software development life cycle. There can be no assurance that the provisions in our agreements with our partners that attempt to limit our exposure to events like downtime, data breaches and malicious actors would fully protect us from liabilities or damages and could result in a similar impact that we called out in our software section above. Such disruptions in our vendor supply chain would be time-consuming and costly for multiple departments, especially engineering, and result in delays in our product delivery and business strategy. Further, we have continued to build complex code to evolve our product offerings. We are investing resources to reduce the complexity of the code underlying our software, and as a result, some of our engineering talent has been diverted from building new solutions or product enhancements. If our efforts to reduce the complexity of our code do not result in the improvement of our platform or if the diversion of our engineering staff prevents us from developing successful new solutions and enhancements, our business, financial conditions and results of operations could be harmed.

We have incorporated a number of third-party generative AI features into our products. This technology, which is a new and emerging technology that is in its early stages of commercial use, presents a number of risks inherent in its use. AI algorithms are based on machine learning and predictive analytics, which can create accuracy issues, unintended biases and discriminatory outcomes. There is a risk that third-party generative AI algorithms used in our products could produce inaccurate or misleading content or other discriminatory or unexpected results or behaviors (e.g., AI hallucinatory behavior that can generate irrelevant, nonsensical or factually incorrect results) that could harm our reputation, business, creators or consumers. Even though we have implemented measures, such as in-product disclosures, which inform creators when content is created for them by generative AI, our creators, consumers or others may rely on or use flawed content or information to their detriment, which may expose us to brand or reputational harm, competitive harm, consumer complaints, legal liability and other adverse consequences. In addition, the use of AI involves significant technical complexity and requires specialized expertise. Any disruption or failure in AI systems or infrastructure that we use could result in delays or errors in our operations, which could harm our business and financial results. Existing laws and regulations may apply to us or our vendors in new ways as a result of our use of AI technologies and new laws and regulations may be instituted, the effects of which are difficult to predict. Current and future government regulation specifically related to AI may also increase the burden and cost of research and development in this area and future laws and regulations may require us to revise our offerings powered by AI technologies. The intellectual property ownership and license rights, including copyright, surrounding AI technologies has not been fully addressed by courts or laws or regulations, and the use or adoption of AI technologies into our offerings may result in exposure to claims of copyright infringement or other intellectual property misappropriation.

Our platform enables the sale and distribution of event tickets through select third-party platforms, such as Meta, Bandsintown and TikTok. Creators are able to publicize their events and sell tickets through these third-party platforms, and these distribution partnerships enable consumers to discover Eventbrite events on other platforms where they spend time. This dynamic enables creators to reach more consumers and makes our platform more appealing to creators looking to grow their audiences. These third-party distribution partners have in the past, and may in the future, terminate their relationship with us, fail to maintain integrations, limit certain integration functionality, change their treatment of our services, restrict access to their platform by creators or consumers, or change their algorithms or consumer experience at any time, thereby impacting the business performance of Eventbrite and its creators. For example, in late 2023, Meta discontinued its Facebook native ticketing product. This means that consumers are no longer able to buy tickets to Eventbrite events directly on Facebook, rather they can continue buying Eventbrite tickets through a clickout experience. If any such third-party services become incompatible with our platform or the use of our platform and solutions on such third-party platforms are restricted in the future, our business may be harmed. In addition, to the extent that Google, or other leading large technology companies that have a significant presence in our key markets disintermediate ticketing or event management providers, whether by offering their own comprehensive event-focused or shopping capabilities, or by referring leads to suppliers, other favored partners or themselves directly, there could be harm to our business, financial condition and results of operations.

Components of our platform include various types of software and services licensed from unaffiliated third parties. Our business would be disrupted if any of the software or services we license from others or functional equivalents thereof were either no longer available to us or no longer offered on commercially reasonable terms. In either case, we would be required to either redesign our platform to function with software or services available from other parties or develop these components ourselves, which would result in increased costs and could result in delays in the release of new solutions and services on our platform. Furthermore, we might be forced to limit the features available in our platform due to changes by our third-party software and service providers. In addition, if we fail to maintain or renegotiate any of these software or service licenses, we could face significant delays and diversion of resources in attempting to license and integrate functional equivalents.

We have limited experience and operating history offering advertising services on our platform and our advertising revenue may not grow as we expect. Our ability to generate advertising revenue is subject to various risks and will depend on a number of factors, including our ability to attract and retain creators willing to advertise on our platform, the quantity and quality of ads shown to our consumers, the cost of advertising, the return on ad spend, our ability to compete effectively for advertising spend and our ability to demonstrate the value of our ads to creator marketers.

Maintaining and promoting awareness of our marketplace and services is important to our ability to attract and retain creators and consumers. One of the key parts of our strategy is to build a consumer brand that brings consumers to Eventbrite and create more habitual consumers by positioning ourselves as the destination to help people disrupt their old routine and make life more eventful. As we focus on engaging consumers to scale our platform, we plan to continue to increase our marketing spend to help drive consumer demand. We may also need to increase our marketing spend in response to increased spend on marketing from our competitors. We invest in brand and performance advertising through various channels, including search engine optimization (SEO), search engine marketing, affiliate marketing and display marketing, as well as social media, email marketing and digital video advertising. Prominently displaying listings in response to key search terms is a critical factor for attracting creators and consumers to our platform, and we face increased costs for relevant keywords, including our brand name, due to competitive bidding. Search engines frequently change the algorithms that determine the ranking and display of results of a user's search, alter analytics or SEO data available to us or make other changes to the way results are displayed, which can negatively affect the placement of links to our platform and reduce the number of visits or otherwise negatively impact our marketing efforts. in addition, search engines, social networks and other third parties typically require compliance with their policies and procedures, which may be subject to change or new interpretation with limited ability to negotiate, which could negatively impact our marketing capabilities (including marketing services for creators). Further, the growing use of online ad-blocking software and technological changes to browsers and mobile operating systems that, for example, limit access to usage information for platforms like Eventbrite, impact the effectiveness of, or our visibility and insights into, our marketing efforts. As a result, we may fail to bring more consumers, or fail to increase the frequency of visits to our platform. In addition, ongoing legal and regulatory changes in the data privacy sphere in U.S. states and countries throughout the world – and the interpretation of these laws by major search, social and operating system providers – may impact the scope and effectiveness of marketing and advertising services generally, including those used on our platforms. Certain laws require us and our marketing partners to provide consumers the ability to opt-out of this collection of processing of their information for online advertising, and some providers of consumer devices, mobile or desktop operating systems and web browsers have implemented, or have announced plans to implement, ways to block tracking technologies. These developments could result in online tracking methods and our marketing efforts becoming significantly less effective. Similarly, our vendors, particularly those providing advertising and analytics products and services have, and may continue to, modify their products and services based on legal and technical changes relating to privacy in ways that could reduce the efficiency of our marketing efforts and our access to data about use of our platforms. Any reduction in our ability to make effective use of such technologies could harm our ability to personalize the experience of consumers, increase our costs, and limit our ability to attract and retain creators and consumers on cost-effective terms. As a result, our business, financial condition and results of operations could be adversely affected. In addition to the marketing strategies described above, we also engage with celebrities and influencers and partner with aligned brands as part of our marketing efforts, and our perceived affiliation with these individuals and brands could cause us brand or reputational damage in the event they undertake actions inconsistent with our brand and values.

We pay recoupable advances and/or non-recoupable payments to certain creators when entering into exclusive ticketing or services agreements or when we are otherwise contractually obligated to do so. We also make advance payouts to certain creators. We pay recoupable advances (also referred to as creator advances) and non-recoupable payments (also referred to as creator signing fees) to certain creators in order to incentivize them to organize certain events on our platform or obtain exclusive rights to ticket their events. Non-recoupable payments and recoupable advances (together, upfront payments) involve the provision of Eventbrite's own capital from our operating accounts. In contrast, advance payouts involve an advance payment to creators of event proceeds from our merchant accounts prior to the completion of the events. Upfront payments are common practice in certain segments of the ticketing industry and are typically made to a creator upon entering into or renewing a multi-year exclusive ticketing or services contract with us, or upon meeting annual contractual requirements. A creator who has received a non-recoupable payment keeps the entire upfront payment, so long as the creator complies with the terms of the creator's contract with us, including, but not limited to, performance of an event and achievement of certain ticket sale minimums. For recoupable advances we are entitled to recoup the entire advance by withholding all or a portion of the ticket sales sold by the creator to whom the advance was previously paid until we have fully recouped the advance. A creator is generally obligated to repay all or a portion of the upfront payment to us if such creator does not comply with the terms of the contract or perform an event, although there is no guarantee that we will be able to collect such repayment. When we provide advance payouts, we assume significant risk that the event may be cancelled, postponed, fraudulent, materially not as described or removed from our platform due to its failure to comply with our terms of service, merchant agreement or community guidelines, resulting in significant chargebacks, refund requests and/or disputes between consumers and creators. If the creator is insolvent, has spent the proceeds of the ticket sales for event-related costs, has cancelled the event, or has engaged in fraudulent activity, we may not be able to recover our losses from these events. These losses could be many multiples of the fees we collected from such transactions. As of December 31, 2023 and December 31, 2022, advance payouts outstanding were $115.3 million and $193.1 million, respectively. In an effort to attract a catalog of highly popular events to our marketplace, we make upfront payments available to qualifying creators who accept our standard or negotiated terms and conditions. We believe that upfront payments are an important financing option for certain creators, and that failure to make upfront payments available to high-value qualified creators or in insufficiently compelling dollar amounts will put us at a competitive disadvantage to ticketing solutions that offer cash incentives more broadly and in higher amounts to newly acquired or renewing creators. Non-recoupable payments, net, including noncurrent balances, were $1.9 million and $1.7 million as of December 31, 2023 and 2022, respectively, and, as of December 31, 2023, these payments were being amortized over a weighted-average remaining life of 2.4 years on a straight-line basis. Creator advances, net, including noncurrent balances, were $2.8 million and $0.7 million as of December 31, 2023 and December 31, 2022, respectively. We pay these advances based on the expectations of future ticket sales on our platform by such creators. We make the decision to make these payments based on our assessment of the past success of the creator, past event data, future events the creator is producing and other financial information. However, event performance may vary greatly from year-to-year and from event to event. If our assumptions and expectations with respect to event performance prove wrong or if a counterparty defaults or an event is not successful or is cancelled, our return on these advances will not be realized and our business, financial condition and results of operations could be harmed.