. The failure of our businesses to comply with these laws and regulations could result in fines and/or proceedings against us by governmental agencies and/or consumers which, if material, could adversely affect our business, financial condition and results of operations.
Application of existing tax laws, rules or regulations are subject to interpretation by taxing authorities.
The application of domestic and international income and non-income tax laws, rules and regulations to our products and services is subject to interpretation by the relevant taxing authorities. The taxing authorities have become more aggressive in their interpretation and enforcement of such laws, rules and regulations, resulting in increased audit activity and audit assessments. As such, potential tax liabilities may exceed our current tax reserves.
Taxing authorities have made inquiries, filed lawsuits, and/or levied assessments asserting we are required to collect and/or remit state and local sales or use taxes, value added taxes, or other transactional taxes related to our travel facilitation services, including the legal proceedings described in Part I. Item 3. Legal Proceedings.
Judgment and estimation are required in determining our worldwide tax liabilities. In the ordinary course of our business, there are calculations and transactions for which the ultimate tax determination is uncertain or otherwise subject to interpretation. Taxing authorities may disagree with our tax calculations, including transfer pricing. We believe our tax estimates are reasonable, however the final determination of tax audits may be materially different from our historical tax provisions and accruals in which case we may be subject to additional tax liabilities, including interest and penalties, or may require payment of tax assessments prior to contesting the validity of the assessment, any of which could have a material adverse effect on our cash flows, financial condition and results of operations.
We could be subject to changes in tax rates, the adoption of new U.S. or international tax legislation, or exposure to additional tax liabilities.
Our future tax liabilities may be adversely affected by legislative and other changes to taxing regimes, as well as changes in our business operating structure and the mix of revenue and earnings in countries with differing tax rates. Due to the pace of legislative changes and the scale of our business activities, any substantial changes in tax policies or legislative initiatives may materially and adversely affect our business, the taxes we are required to pay, our financial position, and results of operations.
Taxing jurisdictions around the world have focused legislative efforts on tax reform, transparency, base erosion, and have enacted or are considering enacting digital services taxes, which could lead to inconsistent and potentially overlapping international tax regimes. The Organization for Economic Cooperation and Development ("OECD") continues to advance proposals relating to its initiative for modernizing international tax rules, with the goal of having the participant countries implement a modernized and aligned international tax framework.
Many of the current tax laws, rules, and regulations imposing taxes and other obligations were enacted before the growth of the digital economy. Certain jurisdictions have enacted legislation directed at taxing the digital economy and multi-national businesses. If existing tax laws, rules, or regulations change, by amendment or new legislation, the result could increase our tax liabilities and reporting obligations, including requirements to provide information about travel suppliers, customers, and transactions on our technology platform. The outcome of these changes may have an adverse effect on our business or financial performance, including a decrease in demand for our products and services if we pass on such costs to the consumer; an increase in the volume and cost of our tax reporting and compliance obligations; or limit the scope of our business activities if we decide not to conduct business in particular jurisdictions.
We are involved in various legal proceedings and may experience unfavorable outcomes, which could adversely affect our business and financial condition.
We are involved in various legal proceedings and disputes involving taxes, personal injury, contract, alleged infringement of third-party intellectual property rights, antitrust, consumer protection, securities laws, and other claims, including, but not limited to, the legal proceedings described in Part I, Item 3, Legal Proceedings. These matters may involve claims for substantial amounts of money or for other relief that might necessitate changes to our business or operations. While the Company maintains insurance coverage for certain types of claims, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise and the defense of these actions has been, and will likely continue to be, both time consuming and expensive and the outcomes of these actions cannot be predicted with certainty. Determining reserves for pending litigation is a complex, fact-intensive process that requires significant legal judgment. It is possible that unfavorable outcomes in one or more such proceedings could result in substantial payments that could adversely affect our business, consolidated financial position, results of operations, or cash flows in a particular period.
We cannot be sure that our intellectual property and proprietary information is protected from all forms of copying or use by others, including potential competitors.
Our websites and mobile applications rely on content, brands, trademarks, domain names and technology, much of which is proprietary. We establish and protect our intellectual property by relying on a combination of trademark, domain name, copyright, trade secret and patent laws in the U.S. and other jurisdictions, license and confidentiality agreements, and internal policies and procedures. In connection with our license agreements with third parties, we seek to control access to, and the use and distribution of, our proprietary information and intellectual property. Even with these precautions, however, third parties may copy or otherwise obtain and use our intellectual property or confusingly similar trademarks or domain names without our authorization or to develop similar intellectual property independently. Effective trademark, domain name, copyright, patent and trade secret protection may not be available in every jurisdiction in which our services are available and policing unauthorized use of our intellectual property is difficult and expensive. We cannot be sure that the steps we have taken will prevent misappropriation or infringement of intellectual property. Any misappropriation or violation of our rights could have a material adverse effect on our business. Furthermore, we may need to go to court or other tribunals to enforce our intellectual property rights, to protect our trade secrets or to determine the validity and scope of the proprietary rights of others. These proceedings might result in substantial costs and diversion of resources and management attention.
We currently license from third parties some of the technologies, content, and brands incorporated into our websites. We also license content from suppliers for our creative campaigns. As we continue to build our creative production work and introduce new services that incorporate new technologies, content and brands, we may be required to license additional technology, content, and brands. We cannot be sure that such technology, content and brand licenses will be available on commercially reasonable terms, if at all. We also cannot be sure that content obtained from suppliers won't be subject to intellectual property infringement claims by a third party.
Technology, Information Protection and Privacy Risks
We rely on information technology to operate our businesses and maintain our competitiveness, and if we fail to adequately maintain or improve our information technology systems, or to adapt them to technological developments and industry trends, our business and operations could be adversely affected.
We depend on the use of sophisticated information technologies and systems in many areas of our business including technology and systems used for website and mobile applications, reservations, customer service, supplier connectivity, marketing, communications, procurement, payments, tax collection and remittance, fraud detection and administration, which we must continuously improve and upgrade. Our future success also depends on our ability to adapt our services and infrastructure to meet rapidly evolving consumer trends and demands while continuing to improve the performance, features and reliability of our service in response to competitive service and product offerings. Cloud computing, the continued growth of alternative platforms and mobile computing devices, the emergence of niche competitors who may be able to optimize products, services or strategies that use cloud computing or for such platforms, as well as other technological changes, including new devices, services and home assistants, and developing technologies, have, and will continue to require, new and costly investments. Transitioning to these new technologies may be disruptive to resources and the services we provide and may increase our reliance on third party service providers.
Most recently, we have incorporated third-party AI technology in certain of our products, services and business operations. Our research, development and deployment of AI technologies remains ongoing. AI presents risks, challenges, and unintended consequences that could affect our and our customers' adoption and use of this technology. AI algorithms and training methodologies may be flawed. Additionally, AI technologies are complex and rapidly evolving, and we face significant competition in the market from other companies regarding the research, development and deployment of such technologies. While we aim to develop and deploy AI responsibly and attempt to identify and mitigate ethical and legal issues presented by its use, we may be unsuccessful in identifying or resolving issues before they arise. AI-related issues, deficiencies and/or failures could (i) give rise to legal and/or regulatory action as a result of new applications of existing data protection, privacy, intellectual property, and other laws, including with respect to proposed legislation regulating AI in jurisdictions in which we operate; (ii) damage our reputation; or (iii) otherwise materially harm our business.
We have been engaged in a multi-year effort to migrate products, data storage and processing, key portions of our consumer and affiliate sites, as well as back-office application functionality, to new technology platforms and significantly increase our utilization of public cloud computing services, such as
Amazon Web Services ("AWS"), to enable us to improve conversion, innovate more rapidly, achieve better search engine optimization and improve our site merchandising and transaction processing capabilities, among other anticipated benefits. Implementations and system enhancements such as these have been in the past, and may continue to be in the future, more time consuming and expensive than originally anticipated, and the resources devoted to those efforts have in the past adversely affected, and may in the future adversely affect, our ability to develop new site features. We may be unable to successfully migrate and improve our technology as planned or we may not achieve the expected benefits from any such initiatives, and as a result our business, including customer relationships, reputation and operations, could be materially adversely affected.
System interruption, security breaches and unplanned outages in our information systems may harm our businesses.
The risk of a cybersecurity-related attack by criminal organizations, hacktivists, foreign governments, and terrorists, is persistent. Due to the size and scale of our technology infrastructure and overall operations, vulnerabilities present within our systems may result in unauthorized access to confidential data including our own proprietary data, that of our partners or the personal data of our customers, including payment data. In addition, given the nature of our operations, consumer personal and payment data may also be accessed inappropriately within partner systems should those partners also experience a breach.
In addition, we continue to encounter attempted external attacks in a variety of forms, including ransomware, account takeovers, phishing, disinformation, and denial of service attacks. Additionally, some actors are using AI technology to launch more sophisticated, automated, targeted and coordinated attacks that are more difficult to detect. As these continue, there is a risk that successful attacks may cause a significant cybersecurity incident which impacts our critical operations. Successful attacks have the potential to damage our reputation, increase costs, and result in regulatory scrutiny or fines.
As we continue to migrate legacy systems to newer information technology systems, we increase the risk of system interruptions. We have experienced and may in the future experience system interruptions that make some or all of these systems unavailable or prevent us from efficiently fulfilling orders or providing services to third parties. Significant interruptions, outages or delays in our internal systems, or systems of third parties that we rely upon - including multiple co-location providers for data centers, cloud computing providers for application hosting, and network access providers - and network access, or deterioration in the performance of such systems, would impair our ability to process transactions, decrease our quality of service that we can offer to our customers, damage our reputation and brands, increase our costs and/or cause losses. We also face risks related to our ability to maintain data and hardware security with respect to remote working.
No assurance can be given that our backup systems or contingency plans will sustain critical aspects of our operations or business processes in all circumstances. Although we have put measures in place to protect certain portions of our facilities and assets, any of these events could cause system interruption, delays and loss of critical data, and could prevent us from providing services to our travelers and/or third parties for a significant period of time.
In addition, as a result of our migration of key portions of our platform functionality to AWS, we now depend on the availability of AWS's services and any incident affecting AWS's infrastructure and availability, which have occurred a number of times in the recent past, could adversely affect the availability of our platform and our ability to serve our customers, which could in turn damage our reputation with current and potential customers, expose us to liability, result in substantial costs for remediation, cause us to lose customers, or otherwise harm our business, financial condition, or results of operations. We may also incur significant costs for using alternative hosting sources or taking other actions in preparation for, or in reaction to, events that compromise the AWS services we use.
We process, store and use customer, supplier and employee personal, financial and other data, which subjects us to risks stemming from possible failure to comply with governmental regulation and other legal obligations, as well as litigation and reputational risks associated with the failure to protect such data from unauthorized use, theft or destruction.
There are numerous laws regarding the storing, sharing, use, processing, disclosure and protection of customer and employee personal, financial, and other data, the scope of which is changing, subject to differing interpretations, and may be inconsistent between countries or conflict with other rules. We strive to comply with all applicable laws, policies, legal obligations, and industry codes of conduct relating to privacy and data protection. It is possible, however, that these obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or the practices of our businesses.
Any failure or perceived failure by us, or our service providers, to comply with, privacy-related legal obligations or any compromise of security that results in the unauthorized use, theft, or destruction of such data, may result in a material loss of revenues from the potential adverse impact to our reputation and brand, our ability to retain customers or attract new customers, and the potential disruption to our business and plans. The risk of a data incident due to cybersecurity-related privacy event remains persistent. In addition, such an event could result in violations of applicable U.S. and international laws, governmental enforcement actions and consumer or securities litigation.
We are subject to privacy regulations, and compliance with these regulations could impose significant compliance burdens.
The regulatory framework for privacy issues worldwide is currently in flux and is likely to remain so for the foreseeable future. Practices regarding the collection, use, storage, transmission and security of personal information by companies operating over the internet have recently come under increased public scrutiny. Several U.S. states, including California, have passed comprehensive privacy legislation or are considering privacy legislation. In addition, the General Data Protection Regulation, or GDPR, that went into effect in the European Union in May 2018, requires companies to implement and remain compliant with regulations regarding the handling of personal data. Enforcement of GDPR regulations, and fines for non-compliance, continue to increase and a significant number of additional jurisdictions are expected to enact similar privacy regulations in the future. As additional jurisdictions enact privacy regulations and laws, we will experience increased compliance costs and uncertainty as to how such laws will be interpreted. Although we have invested, and expect to continue to invest, significant resources to comply with the GDPR and other privacy laws and regulations, the number and variety of regulations combined with our multi-product, multi-brand, global businesses, could nevertheless result in compliance failures. Failure to meet any of the requirements of these laws and regulations could result in significant penalties or legal liability, adverse publicity and/or damage to our reputation, which could negatively affect our business, results of operations and financial condition.
Environmental, Social and Governance Risks
Mr. Diller may be deemed to beneficially own shares representing approximately 30% of the outstanding voting power of Expedia Group.
As of December 31, 2023, Mr. Diller may be deemed to have beneficially owned 100% of Expedia Group's outstanding Class B common stock, representing approximately 30% of the total voting power of all shares of Expedia Group common stock and Class B common stock outstanding. In the future, Mr. Diller's ownership percentage in Expedia Group could increase if he acquires additional shares of Expedia Group common stock in open market purchases or otherwise, or if Expedia Group repurchases additional shares of its common stock.
Mr. Diller is also currently the Chairman of Expedia Group's Board of Directors and Senior Executive of Expedia Group. Expedia Group's amended and restated certificate of incorporation provides that the Chairman of the Board may only be removed without cause by the affirmative vote of at least 80% of the entire Board of Directors, which provision may not be amended, altered changed or repealed, or any provision inconsistent therewith adopted, without the approval of at least (1) 80% of the entire Board of Directors and (2) 80% of the voting power of Expedia Group's outstanding voting securities, voting together as a single class.
As a result of Mr. Diller's ownership interests and voting power, Mr. Diller is in a position to influence, and potentially control, significant corporate actions, including corporate transactions such as mergers, business combinations or dispositions of assets. Additionally, in the future, another holder of the Class B Shares might have such a position of influence by virtue of ownership interests in the Class B Shares. This concentrated ownership position could discourage others from initiating any potential merger, takeover or other change of control transaction that may otherwise be beneficial to Expedia Group stockholders.
Actual or potential conflicts of interest may develop between Expedia Group management and directors, on the one hand, and the management and directors of IAC, on the other.
Mr. Diller serves as our Chairman of the Board of Directors and Senior Executive, while retaining his role as Chairman of the Board of Directors and Senior Executive of IAC/InterActiveCorp, or IAC. Each of Ms. Clinton and Mr. von Furstenberg also serves as a member of the Board of Directors of both Expedia Group and IAC. These overlapping relationships could create, or appear to create, potential conflicts of interest for the directors or officers when facing decisions that may affect both IAC and Expedia Group. Mr. Diller in particular may also face conflicts of interest with regard to the allocation of his time between the companies.
Our amended and restated certificate of incorporation provides that no officer or director of Expedia Group who is also an officer or director of IAC will be liable to Expedia Group or its stockholders for breach of any fiduciary duty by reason of the fact that any such individual directs a corporate opportunity to IAC instead of Expedia Group, or does not communicate information regarding a corporate opportunity to Expedia Group because the officer or director has directed the corporate opportunity to IAC. This corporate opportunity provision may have the effect of exacerbating the risk of conflicts of interest between the companies because the provision effectively shields an overlapping director/executive officer from liability for breach of fiduciary duty in the event that such director or officer chooses to direct a corporate opportunity to IAC instead of Expedia Group.
Increased focus on our environmental, social, and governance ("ESG") responsibilities have and will likely continue to result in additional costs and risks, and may adversely impact our reputation, employee retention, and willingness of customers and partners to do business with us.
Institutional, individual, and other investors, proxy advisory services, regulatory authorities, consumers, employees and other stakeholders are increasingly focused on ESG practices of companies, including climate change, diversity, equity and inclusion, human capital management, data privacy and security, supply chains (including human rights issues), among other topics. These evolving stakeholder expectations and our efforts and ability to respond to and manage these issues, provide updates on them, and establish and meet appropriate goals, commitments, and targets present numerous operational, regulatory, reputational, financial, legal, and other risks and impacts, any of which may be outside of our control or could have a material adverse impact on our business, including on our reputation and stock price. Our efforts in this area may result in a significant increase in costs and may nevertheless not meet investor or other stakeholder expectations and evolving standards or regulatory requirements, which may negatively impact our financial results, our reputation, our ability to attract or retain employees, our attractiveness as a service provider, investment, or business partner, or expose us to government enforcement actions, private litigation, and actions by stockholders or stakeholders.
Moreover, we may be subject to criticism by ESG detractors for our ESG initiatives or for any revisions made to these initiatives. We may also be subject to adverse responses by government entities, like anti-ESG laws or punitive legislative actions, or from consumers, through actions like boycotts or adverse media campaigns, aimed at Expedia Group that could negatively affect our reputation, business operations, financial results, and growth.
Climate change may have an adverse impact on our business.
Our businesses may also be negatively impacted by direct and indirect impacts of climate change. Direct impacts may include disruptions to travel and to our operations due to more frequent or severe storms, hurricanes, flooding, rising sea levels, shortages of water, droughts and wildfires. Indirect impacts may include a significant shift in consumer preferences, which we may not successfully adapt to, or the general harm to our business as a result of a general perception of travel as an environmental harm. These and other climate change related impacts could have a significant adverse impact on our business in both the short, medium and long term. Further, there is uncertainty around the accounting standards and climate-related disclosures associated with emerging laws and reporting requirements and the related costs to comply with the emerging regulations could be significant.