ON24 (ONTF) Risk Factors

The markets in which we compete are characterized by rapid technological change and frequent new product and service introductions. Our ability to attract new customers and retain and expand the usage of existing customers depends on our ability to continue to enhance and improve our platform, to introduce new features and solutions and to interoperate across an increasing range of devices, operating systems and third-party applications. Our customers may require features and capabilities that our current platform does not have. While we are committed to investing in research and development and are focused on improving the quality and range of our product offerings, we have recently reduced our level of investment in research and development which may impact the rate at which we are able to enhance and improve our platform or introduce new features and solutions. Furthermore, we made significant headcount reductions in 2022 and 2023 to reduce our cost structure. Reductions in our workforce could result in the loss of valuable skills and knowledge and have a negative impact on morale, which can impact our ability to innovate. Our enhancements to our platform and our new product experiences, features or capabilities may not be compelling to our existing or potential customers and may not gain market acceptance. If our research and development investments do not accurately anticipate customer demand, or if we fail to develop our platform in a manner that satisfies customer preferences in a timely and cost-effective manner, we may fail to retain our existing customers or increase demand for our platform. The introduction of competing products and services or the development of entirely new technologies to replace existing offerings could make our platform obsolete or adversely affect our business, results of operations and financial condition. We may experience difficulties with software development, design or marketing that could delay or prevent our development, introduction, or implementation of new product experiences, features, or capabilities. New product experiences, features or capabilities may not be released according to schedule. Any delays could result in adverse publicity, loss of revenue or market acceptance, or claims by customers brought against us, all of which could harm our business. If customers do not widely adopt our new product experiences, features and capabilities, we may not be able to realize a return on our investment. If we are unable to develop, license or acquire new features and capabilities to our platform on a timely and cost-effective basis, or if such enhancements do not achieve market acceptance, our business would be harmed.

We primarily rely on a combination of patents, trade secrets, domain name protections, trademarks and copyrights, as well as confidentiality, license and subscription agreements with our employees, consultants and third parties, to protect our intellectual property and proprietary rights. In the United States and abroad, as of September 30, 2024, we have 26 issued patents and 12 pending patent applications. We make business decisions about when to seek patent protection for a particular technology and when to rely upon copyright or trade secret protection, and the approach we select may ultimately prove to be inadequate. Even in cases where we seek patent protection, the resulting patents may not effectively protect every significant feature of our solutions. For example, we have received a summary judgment ruling that a patent which is immaterial to our business is invalid. It is possible that our efforts to protect our intellectual property rights are unsuccessful. In addition, we believe that the protection of our trademark rights is an important factor in product recognition, protecting our brand and maintaining goodwill. If we do not adequately protect our rights in our trademarks from infringement and unauthorized use, any goodwill that we have developed in those trademarks could be lost or impaired, which could harm our brand and our business. Third parties may knowingly or unknowingly infringe our proprietary rights, third parties may challenge our proprietary rights, pending and future patent, trademark and copyright applications may not be approved, and we may not be able to prevent infringement without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes. In order to protect our proprietary technologies and processes, we rely in part on trade secret laws and confidentiality and invention assignment agreements with our employees, consultants and third parties. These agreements may not effectively protect our proprietary rights. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights, or may develop similar technologies and processes. We may not be able to protect our source code from copying if there is an unauthorized disclosure. Source code, the detailed program commands for our operating systems and other software programs, is critical to our business. We take significant measures to protect the secrecy of our source code. If our source code leaks, we might lose future trade secret protection for that code. It may then become easier for third parties to compete with our products by copying functionality, which could adversely affect our revenue and operating margins. Unauthorized disclosure of source code also could increase the security risks described elsewhere in these risk factors. Further, laws in certain jurisdictions may afford little or no trade secret protection, and any changes in, or unexpected interpretations of, the intellectual property laws in any countries in which we operate may compromise our ability to enforce our intellectual property rights. To the extent we expand our international activities, our exposure to unauthorized copying and use of our technology and proprietary information may increase. Costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights. If the protection of our proprietary rights is inadequate to prevent use or appropriation by third parties, the value of our platform, brand and other intangible assets may be diminished, and competitors may be able to more effectively replicate our platform and its features. Any of these events would harm our business.

We use open source software in our platform, and we may use more open source software in the future. In the past, companies that have incorporated open source software into their products have faced claims challenging the ownership or use of open source software or compliance with open source license terms. Accordingly, we could be subject to suits by parties claiming ownership of what we believe to be open source software or claiming noncompliance with open source licensing terms. Some open source software licenses require users who use, distribute or make available across a network software or services that include open source software to publicly disclose all or part of the source code to such software or make available any derivative works of the open source code on terms unfavorable to the developer or at no cost. Additionally, if a third-party software provider has incorporated open source software into software that we license from such provider, we could be required to disclose any of our source code that incorporates or is a modification of our licensed software. If we were to use open source software subject to such licenses, we could be required to release our proprietary source code, pay damages, re-engineer our platform or solutions, discontinue sales, or take other remedial action, any of which could harm our business. In addition, if the license terms for updated or enhanced versions of the open source software we utilize change, we may be forced to expend substantial time and resources to re-engineer affected components in our platform. In addition, the use of third-party open source software typically exposes us to greater risks than the use of third-party commercial software because open source licensors generally do not provide warranties or controls on the functionality or origin of the software. Use of open source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to determine how to compromise our platform. Any of the foregoing could harm our business and could help our competitors develop products and services that are similar to or better than ours.

As a public company listed in the United States, we have incurred and will continue to incur significant legal, accounting and other expenses. In addition, changing laws, regulations and standards relating to corporate governance and public disclosure, including regulations implemented by the SEC and the NYSE, may increase legal and financial compliance costs and make some activities more time consuming. These laws, regulations and standards are subject to varying interpretations, and as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of management's time and attention from revenue-generating activities to compliance activities. We will also need to continue developing our investor relations function. If, notwithstanding our efforts, we fail to comply with new laws, regulations and standards, regulatory authorities may initiate legal proceedings against us and our business may be harmed. Failure to comply with these rules might also make it more difficult for us to obtain certain types of insurance, including director and officer liability insurance, and we might be forced to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. The impact of these events would also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, on committees of our board of directors or as members of senior management.

While to date we have not incurred significant income taxes in operating our business, we are subject to income taxes in the United States and various jurisdictions outside of the United States. Our effective tax rate could fluctuate due to changes in the proportion of our earnings and losses in countries with differing statutory tax rates. Some jurisdictions may seek to impose incremental or new sales, use or other tax collection obligations on us. Our tax expense could also be impacted by changes in non-deductible expenses, changes in excess tax benefits of stock-based compensation, changes in the valuation of, or our ability to use, deferred tax assets and liabilities, the applicability of withholding taxes and effects from acquisitions. The provision for taxes on our financial statements could also be impacted by changes in accounting principles, changes in U.S. federal, state or international tax laws applicable to corporate multinationals such as the recent legislation enacted in Australia, the United Kingdom and the United States, other fundamental changes in law currently being considered by many countries and changes in taxing jurisdictions' administrative interpretations, decisions, policies and positions. We are subject to review and audit by U.S. federal, state, local and foreign tax authorities. Such tax authorities may disagree with tax positions we take, and if any such tax authority were to successfully challenge any such position, our business could be harmed. We may also be subject to additional tax liabilities due to changes in non-income based taxes resulting from changes in federal, state or international tax laws, changes in taxing jurisdictions' administrative interpretations, decisions, policies and positions, results of tax examinations, settlements or judicial decisions, changes in accounting principles, changes to our business operations, including acquisitions, as well as the evaluation of new information that results in a change to a tax position taken in a prior period.

Laws and regulations related to privacy, personal data and the provision of services over the Internet are evolving in the United States and globally, with the adoption of new and amended privacy laws. The impact, requirements and enforcement risks associated with these privacy laws vary, and in some cases may even conflict, across jurisdictions. In addition, new U.S. and international privacy laws may impose new obligations on us and many of our customers. Both in the United States and globally, numerous jurisdictions have passed or are actively considering new or amended privacy laws. For example, the California Consumer Privacy Act, which took effect in January 2020 and was substantially amended by the California Privacy Rights Act effective January 1, 2023 (as amended, the "CCPA"), applies to us and to many our customers. Under the CCPA, we are both a "business," as to the ON24 business data, and a "service provider," as to the platform personal data. The CCPA introduced sweeping definitions and broad individual rights, and imposes substantial requirements and restrictions on the collection, use and disclosure of personal information. The CCPA also introduced a private right of action for certain data breaches, which gives rise to increased class action risk. Notably, since the CCPA was signed into law, it has been amended multiple times, has been subject to further implementing regulations, and may face further amendment, refinement or replacement. As the CCPA continues to evolve, several U.S. states have recently adopted new privacy laws and various other U.S. states are also actively introducing and considering so-called "omnibus" privacy legislation. In 2023, omnibus privacy laws took effect in Colorado, Connecticut, Virginia and Utah, and several other states have passed in 2023 and 2024 omnibus privacy laws. Similarly, numerous foreign jurisdictions have enacted or are actively considering legislation introducing new or amended laws and regulations addressing data privacy, cybersecurity, marketing, data protection, data localization and personal data. Further, privacy laws such as the EU's proposed e-Privacy Regulation are increasingly aimed at the use of personal information for marketing purposes and the tracking of individuals' online activities, which could expose us to additional regulatory burdens, limit our marketing, advertising, business development and sales efforts, and impact features made available to our customers through our platform. In addition, Brexit has also created additional uncertainty with regard to UK privacy laws, as well as the treatment of data transfers to and from the United Kingdom, where we have operations and customers. The ongoing development of privacy laws gives rise to uncertainty regarding the impact of privacy laws on us and our customers, and we and our customers could be exposed to additional burdens. In addition, decisions by courts and regulatory bodies relating to privacy laws can also have a significant impact on us and other businesses that operate across international jurisdictions. For example, in 2020 both the EU-U.S. and Swiss-EU privacy shield frameworks were invalidated as an "adequacy" mechanism for the transfer of personal data from the European Economic Area, or the EEA-Switzerland, to the United States in compliance with the GDPR and Swiss data protection laws, respectively. Following this, we took measures to implement alternative adequacy mechanisms by using the EU standard contractual clauses for transfers of personal data for processors established in third countries, and agreed to, additional safeguards with certain customers. In July 2023, the US and the EU agreed to the EU-US Data Privacy Framework, and the US and Switzerland agreed to the Swiss-US Data Privacy Framework, which frameworks will now replace the previous privacy shield frameworks. In October 2023, the UK extension to the EU-US Data Privacy Framework came into force. While we participate in these new frameworks, certain customers may also require that we continue to agree to alternative adequacy mechanisms, such as the EU standard contractual clauses, and additional safeguards, such as additional security controls and other contractual measures, which will need to be assessed on a case-by-case basis. We expect continued guidance from applicable authorities, as well as legal challenges to the new frameworks. Other jurisdictions have also instituted specific requirements and restrictions on the cross-border transfer of personal data, and certain countries have passed or are considering passing data localization laws and regulations, which in some cases would require personal data be maintained in the originating jurisdiction and in other cases may prohibit such personal data from being transferred outside of the originating jurisdiction. While our solutions allow customers to receive and store local copies of platform data on their or other third-party servers, we do not maintain local servers to enable customers to maintain personal data only on servers in the originating jurisdiction. As with most cloud-based solutions, restrictions on the transfer of platform data outside of the originating jurisdiction could pose particular challenges and result in additional costs or otherwise impact platform use. New and proposed marketing, advertising and other privacy laws and guidelines have recently been enacted or proposed that could impose more restrictions and give individuals more rights regarding marketing, targeting, and analytics or "profiling" activities. Some of these regulations seek, among other things, to give consumers greater control over how their personal information is processed for these purposes, or impose prior, affirmative consent obligations on companies related to these activities. For example, in the EU, cookies and similar technologies used for personalization, advertising, and analytics may not be used without affirmative consent and the proposed ePrivacy Regulation may further restrict these activities and technologies and increase restrictions. Further, in the US, privacy litigation claims related to online tracking and cookies are on this rise. These litigation and enforcement developments could require us to change one or more aspects of the way we operate our business, limit our marketing, advertising, business development and sales efforts, impact certain features made available to customers through our platform or require us to introduce changes to our platform or solutions. Although we monitor the regulatory environment and have invested in addressing these developments, including the GDPR, the EU ePrivacy Directive and the CCPA, the ongoing development of privacy laws means that we cannot predict with certainty the impact of these developments. These evolving privacy laws may require us to make additional changes to our practices and services to enable us or our customers to meet the new legal requirements, and may also increase our potential liability exposure through new or higher potential penalties for non-compliance. In addition, cyber incidents and data breaches present potential risks and could have financial, operational and reputational impacts on the Company. In addition, many of our customers and potential customers in the healthcare, financial services and other industries are subject to substantial regulation regarding their collection, use and protection of data and may be the subject of further regulation in the future. These laws or other privacy law developments may change the way these customers do business and may require us to implement additional features or offer additional contractual terms to satisfy customer and regulatory requirements. As a result of these privacy law developments, certain features of our platform and products could pose risks or need to be modified for certain jurisdictions, but not for others. They also could cause the demand for and sales of our platform to decrease and adversely impact our financial results. The costs of compliance with, and other burdens imposed by, privacy laws may limit the use and adoption of our platform, reduce overall demand for our platform, make it more difficult to meet expectations from or commitments to our customers and their users, require us to implement additional features or offer additional contractual terms to satisfy customer and regulatory requirements, lead to significant fines, penalties or liabilities for noncompliance, impact our reputation, or slow the pace at which we close sales transactions, any of which could harm our business. In addition, these laws raise additional enforcement and liability risks and penalties. For example, statutory damages available through a private right of action for certain data breaches under CCPA, and potentially other U.S. and international laws, may increase our and our customers' potential liability. In some cases, violations of privacy laws can lead to government enforcement or private litigation and could subject us to civil and criminal sanctions, including both monetary fines and injunctive action that could force us to change our business practices, all of which could adversely affect our financial performance and harm our reputation and our business.

We derive, and expect to continue to derive, a significant portion of our revenue and cash flows from sales of subscriptions to our solutions. As a result, widespread adoption and use of live engagement technologies, webinars and event software in general, and our platform in particular, are critical to our future growth and success. If this market fails to grow or grows more slowly than we currently anticipate, demand for our platform could be negatively affected. Demand for our platform is affected by a number of factors, many of which are beyond our control. Some of these potential factors include: - availability of products and services that compete, directly or indirectly, with ours;- introduction of free or "do-it-yourself" products;- awareness and adoption of the live engagement technologies category generally as a substitute for in-person events;- ease of adoption and use;- features and platform experience;- reliability of our platform, including frequency of outages;- performance and user support;- our brand and reputation;- security and privacy;- our pricing and our competitors' pricing; and - new modes of live engagement that may be developed in the future. If we fail to successfully predict and address these factors, meet customer demands or achieve more widespread market adoption of our platform, our business would be harmed.

A substantial portion of our business is with large Enterprise customers. We define a customer as a unique organization, including its subsidiaries and affiliates, that has entered into an agreement for paid access to our platform. As of September 30, 2024, we had 311 $100k Customers, which are generally large organizations, representing 67% of our ARR. The timing of our sales with our Enterprise customers and related revenue recognition is difficult to predict because of the length and uncertainty of the sales cycle for these customers. We are often required to spend significant time and resources to educate and familiarize these potential customers with the value proposition of paying for our platform. The length of our sales cycle for these customers, from initial evaluation to payment for our platform, is often around three to six months or more and can vary substantially from customer to customer. As a result, it is difficult to predict whether and when a sale will be completed. An inability to increase our Enterprise customer base could harm our business.

To execute our business strategy, we must attract and retain highly qualified personnel. Competition for executives, software developers, sales personnel and other key employees in our industry is intense. In particular, we compete with many other companies for software developers with high levels of experience in designing, developing and managing software for live engagement technologies, as well as for skilled sales and operations professionals. At times, we have experienced, and we may continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and we may not be able to fill positions. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business could be harmed. Many of the companies with which we compete for experienced personnel have greater resources than we have, and some of these companies may offer greater compensation packages. Particularly, in the San Francisco Bay Area, job candidates and existing employees carefully consider the value of the equity awards they receive in connection with their employment. If the perceived value of our equity awards declines, or if the mix of equity and cash compensation that we offer is unattractive, it may adversely affect our ability to recruit and retain highly skilled employees. Job candidates may also be threatened with legal action under agreements with their existing employers if we attempt to hire them, which could impact hiring and result in a diversion of our time and resources. Additionally, laws and regulations, such as restrictive immigration laws, may limit our ability to recruit internationally. We must also continue to retain and motivate existing employees through our compensation practices, company culture and career development opportunities. If we fail to attract new personnel or to retain our current personnel, our business would be harmed. In addition, many of our employees may be able to receive significant proceeds from sales of our equity in the public markets, which may reduce their motivation to continue to work for us. Moreover, these proceeds could create disparities in wealth among our employees, which may harm our culture and relations among employees and our business.