Sweetgreen (SG) Risk Analysis

We rely on our restaurant-level employees to consistently provide high-quality food and positive experiences to our customers, which we refer to as the "sweet touch." In addition, our ability to continue to open new restaurants depends on our ability to recruit, train and retain high-quality restaurant team members to manage, lead and work in our restaurants. Maintaining appropriate staffing in our existing restaurants and hiring and training staff for our new restaurants requires precise workforce planning, which has become more complex due to recent significant staffing and hiring issues in the restaurant industry throughout the country, as well as laws related to wage and hour violations or predictive scheduling ("fair workweek") in many of our markets and New York City's "just cause" termination legislation applicable to our industry, which went into effect in July 2021. Additionally, while our employee turnover rate has recently decreased, we have historically had high turnover rates. We believe our high turnover rate is caused by a number of factors, including that our restaurants tend to be very busy during peak lunch and dinner hours, and that our restaurant employees perform a significant amount of prep work in our restaurants. We have taken, and will continue to take, a number of steps in order to reduce our turnover, but we cannot be certain that our turnover rates will continue to decrease, and they may instead increase in the future. If we fail to appropriately plan our workforce and/or fail to reduce our turnover at our restaurants, it could adversely impact guest satisfaction, operational efficiency, and restaurant profitability. Moreover, to optimize our organizational structure, including in response to the COVID-19 pandemic and recent macroeconomic conditions and their impact on our business, since the beginning of fiscal year 2020, we have undergone reductions in workforce at our Sweetgreen Support Center, including in the third quarter of fiscal year 2022 and may in the future implement other reductions in workforce or restructurings. Any reduction in workforce or restructuring may yield unintended consequences and costs, such as attrition beyond the intended reduction in workforce, delay in development of critical technology or business optimization programs due to gaps in knowledge transfer and new employee ramp up time, the distraction of employees, and reduced employee morale, and could adversely affect our reputation as an employer, which could make it more difficult for us to hire new employees in the future and increase the risk that we may not achieve the anticipated benefits from the reduction in workforce. If we fail to recruit and retain restaurant team members or corporate employees in a timely or efficient manner or experience higher employee turnover levels in either our restaurants or Sweetgreen Support Center, our ability to open new restaurants and grow sales at existing restaurants may be adversely affected, and we may experience higher than projected labor costs and otherwise impact our Restaurant Level Profit Margin.

We believe that a critical component of our success has been our corporate culture and the internal advancement of our corporate values. We have invested substantial time and resources in building our team, both at our Sweetgreen Support Center and within our restaurants. In the future, we may find it difficult to maintain the innovation, teamwork, passion, and focus on execution that we believe are important aspects of our corporate culture. For example, we have previously implemented workforce reductions, and these actions have negatively impacted and may continue to negatively impact our corporate culture and company morale. Additionally, in connection with the Plan, in the third quarter of fiscal year 2022 we made changes to certain employee benefit programs in our restaurants and in our Sweetgreen Support Center to be more in line with industry benchmarks. These changes could have an impact on our brand, corporate culture and company morale. As we have grown, we have hired leaders from a variety of different backgrounds and experiences and have historically had a significant amount of management turnover. Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel and to effectively focus on and pursue our corporate objectives. If we cannot maintain our corporate culture as we grow, it could have an adverse effect on our business, financial condition, and results of operations.

Our success depends largely upon the continued services of our key executives, and, to date, we have not implemented a robust or defined succession plan in the event of any key executive departures. We also rely on our leadership team in setting our strategic direction and culture, operating our business, identifying, recruiting and training key personnel, identifying expansion opportunities, arranging necessary financing and general and administrative functions. We have recently had significant changes in our executive management team, and from time to time, may experience additional changes in our executive management team resulting from the hiring or departure of executives. While we seek to manage these transitions carefully, these and any other such changes may result in a loss of institutional knowledge and cause disruptions to our business. The loss of one or more of our executive officers, or other key employees could seriously harm our ability to successfully implement our business strategy and could impede the achievement of our growth objectives, including with respect to scaling the number of our restaurants and expansion into new markets and restaurant formats, improving our operations, advancing technological developments of our website and mobile application, and further developing, building, deploying, and maintaining our Infinite Kitchen units, which would have an adverse effect on our business. The replacement of one or more of our executive officers or other key employees would involve significant time and expense and may significantly delay or prevent the achievement of our business objectives. To continue to execute our growth strategy, we also must identify, hire, and retain highly skilled personnel. In particular, in connection with increasing our store count as well as our expansion into new revenue channels and new restaurant formats that rely on online ordering platforms and focus on the digital customer, such as our Native Delivery, Outpost and Catering, and Marketplace Channels, we must identify, hire and retain highly skilled software engineers, the hiring of which is competitive, and for which we may not be successful. We have previously implemented workforce reductions, and we may take similar actions in the future. Failure to retain or identify, hire, and motivate necessary key personnel could have an adverse effect on our business, financial condition, and results of operations.

We use various third-party vendors to provide, support and maintain most of our management information systems and technology, including key elements of our applications, and we also outsource certain accounting, payroll and human resource functions to business process service providers. We also use third-party vendors for delivery and customer account management. The failure of any of these vendors to fulfill their obligations could disrupt our operations. For example, we use DoorDash as our preferred third-party delivery partner to power our Native Delivery Channel, and if DoorDash, or any future third-party delivery partner fails to fulfill its obligations or delivers unsatisfactory delivery service, for instance, by delivering orders late, by not having sufficient couriers to fulfill our orders, or by having a system outage, we will not be able to provide the proper delivery services to our customers through our native application, which is likely to lead to customer dissatisfaction and higher refunds or credits. We, and many of our third-party vendors, also rely on Amazon Web Services to operate our digital channels, and in the fourth quarter of fiscal year 2021, Amazon Web Services had an outage that disabled all of our digital channels for nearly an entire day, having a material impact on our business. Additionally, beginning in the fourth fiscal quarter of 2023, we started using technology from Stripe for account management for customers who have signed up on our smartphone application, including processing payments through our smartphone application. If Stripe, or any future third-party payment processing or account management partner, experiences any significant downtime, is unable to provide certain of its services or has a data security incident, it could have an adverse effect on our business, financial condition, and results of operations. Additionally, any changes we may make to the services we obtain from our vendors, or from any new vendors we employ, may disrupt our operations. These disruptions could have an adverse effect on our business, financial condition, and results of operations. Additionally, we and certain of our vendors are subject to or affected by the technical requirements, terms of service, and/or policies of the third-party operating system platforms and application stores on which our mobile application depends, including those operated by Apple and Google. The operators of these platforms and application stores have broad discretion to impose technical requirements and change or interpret their policies in a manner unfavorable to us and our vendors, such as by imposing fees associated with access to their platforms, restricting how we collect, use, and share data, and limiting our ability to track users. For example, Apple recently announced restrictions that could adversely affect our advertising and marketing strategies by requiring iOS mobile applications to obtain a user's opt-in consent to track them for advertising purposes. If we do not comply with the requirements, terms, or policies of the platforms and application stores where we offer our mobile application, we could lose access to users and our business would be harmed.

The profitability of our restaurants depends in part on our ability to anticipate and react to changes in commodity costs, including food, paper, supplies, fuel, utilities, and other operating costs. Additionally, prices in certain of the commodity markets, including markets for key items, such as chicken, kale, and avocado, will likely continue to increase over time and may also become volatile due to climate conditions and other macroeconomic and geopolitical conditions, all of which are beyond our control and, in many instances, extreme and unpredictable (such as more frequent and/or severe fires and hurricanes). We can only partially address future price risk due to climate change through hedging and other activities, and therefore increases in commodity costs, particularly due to climate change, could have an adverse impact on our ability to achieve or maintain profitability. There can be no assurance that future cost increases can be offset by increased menu prices or that current or future menu prices will be fully absorbed by our guests without any resulting change to their demand for our products. In addition, there can be no assurance that we will generate revenue growth in an amount sufficient to offset inflationary or other cost pressures, particularly with the high rates of inflation in fiscal years 2023 and 2022. The profitability of our restaurants is also adversely affected by increases in the price of utilities, such as natural gas, electricity and water, whether as a result of inflation, shortages or interruptions in supply, or otherwise. We have recently experienced an increase in freight related surcharges, an increase in food costs, and supply shortages from our vendors as a result of inflation and higher gas prices, which we expect to continue into fiscal year 2024. Our ability to respond to increased costs by increasing prices or by implementing alternative processes or products will depend on our ability to anticipate and react to such increases and other more general economic and demographic conditions, as well as the responses of our competitors and guests. All of these things may be difficult to predict and beyond our control. In this manner, increased costs could adversely affect our results of operations.

Operating our business and platform involves the collection, use, storage, and transmission of sensitive, proprietary, and confidential information, including personal information of customers, our personnel, the personnel of our business partners, and others. For example, we collect certain customers' home and/or business addresses for processing delivery orders, mobile phone numbers from users of our platform, and personal information from our personnel, including in the administration of our benefit plans. Security incidents compromising the confidentiality, integrity, and availability of our sensitive, proprietary, and confidential information and information technology systems, and those of the third parties upon which we rely could result from cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, ransomware attacks, software bugs, supply chain attacks, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and could lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Additionally, remote work has become more common in response to the COVID-19 pandemic and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit, and in public locations. Security incidents have occurred in the past, and may occur in the future, resulting in unauthorized, unlawful, or inappropriate access to, inability to access, disclosure of, or loss of the sensitive, proprietary and confidential information that we handle. We have experienced an increase in what we believe to be credential stuffing activity, in which malicious third parties try to access an online service by using credentials compromised in security incidents suffered by different services. We have security measures in place to mitigate our risk to vulnerabilities, but these measures may not be adequate to ensure that our operations are not disrupted or that security incidents do not occur. Risks relating to security incidents are likely to increase as we continue to grow and collect, process, store, and transmit increasingly large amounts of data. We also rely on a number of third parties to support and operate our critical business systems and process sensitive, proprietary, and confidential information, such as Stripe, our account management provider, the payment processors that process customer credit card payments, and other third-party providers of services including cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate security measures and could experience a security incident that compromises the confidentiality, integrity, or availability of the systems they operate for us or the information they process on our behalf. Moreover, the risk of circumvention of our security measures or those of our third parties on whom we rely has been heightened by advances in computer and software capabilities and the increasing sophistication of actors who employ complex techniques. In particular, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. Cybercrime and hacking techniques are constantly evolving, and we or third parties who we work with may be unable to anticipate attempted security incidents, react in a timely manner, or implement adequate preventative measures, particularly given increasing use of hacking techniques designed to circumvent controls, avoid detection, and remove or obfuscate forensic artifacts. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their data privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. Because of the prominence of our brand, we believe that we are an attractive target for cyberattacks, which have increased recently in the industry. We have implemented security measures designed to detect and remediate vulnerabilities in our information security systems (such as our hardware and/or software, including that of third parties upon which we rely), prevent security incidents, and to protect the confidentiality, integrity, and availability of our systems and the sensitive, proprietary, and confidential information under our control. However, despite any measures that we have taken by us to increase our cybersecurity, we cannot assure you that the measures that we or the third parties we work with have implemented will always be followed and/or be effective against current or future security threats or detect, mitigate and remediate all vulnerabilities on a timely basis. We may need to expend significant resources or modify our business activities to try to protect against security incidents. The costs to respond to a security incident and/or to mitigate any security vulnerabilities that may be identified could be significant and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. If we or the third parties we work with suffer, or are perceived to have suffered, a security incident, we may experience a loss of customer and partner confidence in the security of our platform and damage to our brand, reduced demand for our offerings, and disruption of normal business operations. Such an incident may also require us to spend resources to investigate and correct the issue and to prevent recurrence, expose us to legal liabilities, including litigation, regulatory enforcement, and indemnity obligations, which could have an adverse effect on our business, financial condition and results of operations. Additionally, our agreements with our material third-party partners, such as Stripe and DoorDash, require us to maintain adequate security measures and not subject their confidential information to a security incident. If we were to breach those contractual obligations, we could be responsible for indemnifying our partners for any losses associated with such an incident. Future acquisitions of, or utilization of, new information technology infrastructure could also expose us to additional cybersecurity risks and vulnerabilities. Laws in all states and U.S. territories require businesses to notify affected individuals, governmental entities, and/or credit reporting agencies of certain security incidents affecting personal information. Such laws are inconsistent, and compliance in the event of a widespread security incident is complex and costly and may be difficult to implement. Our existing general liability and cyber liability insurance policies may not cover, or may cover only a portion of, any potential claims related to security breaches to which we are exposed or may not be adequate to indemnify us for all or any portion of liabilities that may be imposed. We also cannot be certain that our existing insurance coverage will continue to be available on acceptable terms or in amounts sufficient to cover the potentially significant losses that may result from a security incident or breach or that the insurer will not deny coverage of any future claim. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive information of the company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees', personnel's, or vendors' use of generative artificial intelligence ("AI") technologies.

Our online and mobile ordering platforms incorporate software that is highly technical and complex. Our software may now or in the future contain undetected errors, bugs or vulnerabilities. Some errors in our software code may only be discovered after the code has been released. Any errors, bugs or vulnerabilities discovered in our code after release could result in damage to our reputation, loss of customers ordering from our online and mobile platforms, loss of revenue, or liability for damages, any of which could adversely affect our financial condition and results of operations. We also rely on multiple third-party vendors to run our mobile ordering platforms, including our delivery fulfillment services, and any errors, bugs, vulnerabilities or service outages that impact their software could have an adverse impact on our platforms. For example, several times in fiscal years 2020 and 2021, our third-party delivery fulfillment partner for orders placed through our Native Delivery Channel experienced outages that required us to temporarily shut down our Native Delivery Channel either entirely or in certain geographic markets, which adversely impacted our revenue. Further, we have a limited ability to control the remediation of such errors, bugs or vulnerabilities in a third party's software, and as such, we may not be able to remedy such errors, bugs or vulnerabilities in a timely manner, which could have an adverse effect on our business, financial condition, or results of operations.

Because our customers can access our website and mobile platform on a variety of mobile devices (including both Android and iOS), we will need to continuously modify and enhance our platform to keep pace with changes in mobile devices and other Internet-related hardware, software, communication, and browser technologies. We may not be successful in either developing these modifications and enhancements or in timely bringing them to market. For example, our customers were unable to order our delivery on our native Android smartphone application until March 2021, despite this feature being available on our iOS smartphone application for some time. Furthermore, uncertainties about the timing and nature of new mobile devices and other network platforms or technologies, or modifications to existing mobile devices, platforms or technologies, could increase our research and development expenses more than we anticipate. Any failure of our mobile platform to operate effectively with future technologies could result in dissatisfaction from customers and harm our business.

Digital innovation and growth remain important to our business. As the digital space around us continues to evolve, our technology needs to evolve concurrently to remain competitive with the industry. If we do not maintain digital systems that are competitive with the industry, our digital business may be adversely affected and could damage our sales. Certain competitors, including those with greater resources than we have, such as Chipotle, also have focused on a digital strategy and may be more successful in employing that strategy. We rely on certain third parties for, among other things, our ordering and payment processing relating to our mobile app and website. Such services performed by these third parties could be damaged or interrupted by technological issues, which could then result in a loss of sales for a period of time, and pursuant to our contractual arrangements with such third parties it is unlikely that we would be able to recover for lost profits or other consequential damages. Information processed by these third parties could also be impacted by cyber-attacks, which could not only negatively impact our sales, but also harm our brand image. If DoorDash or any future third-party delivery partner fails to fulfill its obligations or delivers unsatisfactory delivery service on our Native Delivery Channel, for instance, by delivering orders late, by not having sufficient couriers to fulfill our orders, or by having a system outage, we will not be able to provide proper delivery services to our customers through our native application. Errors in providing adequate delivery services may result in customer dissatisfaction, which could also result in loss of customers, loss in sales, increase of refunds and credits, and damage to our brand image. Additionally, as with any third party handling food, such delivery services increase the risk of food tampering while in transit. Any changes to our agreement with DoorDash, or any future third-party delivery partner, including the loss or addition of any third-party delivery partner, could also affect our ability to provide proper delivery services to our customers. We are also subject to risk if there is a shortage of delivery drivers in any of our markets for any period of time, which could result in a failure to meet our customers' expectations and have a negative impact on our sales. We partner with each of the national third-party delivery providers to provide food on their marketplaces. If any of these third-party delivery providers that we partner with experiences damage to their brand image, we may also see ramifications due to our partnership with them. Additionally, we currently compete with these third-party delivery providers through our Native Delivery Channel, and some of these providers may have greater financial resources to spend on marketing and advertising around their digital and delivery campaigns than we are able to at this time, which could adversely impact our business, financial performance, and results of operations. Additionally, over time our commission rates with any of our third-party delivery partners could increase, either for delivery services for orders through our website or native smartphone application or through third-party delivery marketplaces, which could have an adverse effect on our business, financial condition, and results of operations.

It is critical to our success, particularly with respect to our online and mobile ordering business, that our customers can access our online and mobile ordering platforms at all times. We rely heavily on information technology, including for operating our website, mobile application and online and mobile ordering platforms, point-of-sale processing in our restaurants, management of our supply chain, payment processing, collection of cash, marketing and promotions, payment card transactions, and other processes and procedures. Our ability to efficiently and effectively manage our business depends significantly on the reliability and capacity of these systems. We have previously experienced service disruptions and, in the future, we may experience service disruptions, outages or other performance problems due to a variety of factors, including infrastructure changes, human or software errors, capacity constraints due to an overwhelming number of customers accessing our platform simultaneously, downtime or outages from third-party services providers, and denial of service or fraud or security attacks. For example, several times in fiscal years 2020 and 2021, our third-party delivery fulfillment partner for orders placed through our Native Delivery Channel experienced outages that required us to temporarily shut down our Native Delivery Channel either entirely or in certain geographic markets. Additionally, we and many of our third party vendors rely on Amazon Web Services to operate our digital channels, and in the fourth quarter of fiscal year 2021, Amazon Web Services had an outage that disabled all of our digital channels for nearly an entire day. These types of outages caused by third parties result in periodic store closures, lost revenue, and customer complaints. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time, and, in cases where we rely on third-party technological infrastructure, we may not have sufficient contractual recourse against such third-party to make us whole for any loss. It may become increasingly difficult to maintain and improve the availability of our platform, especially during peak usage times and as our product offerings become more complex and our customer traffic increases. If our online and mobile ordering platforms are unavailable when customers attempt to access them or they do not load as quickly as customers expect, customers may seek other services, and may not return to our platforms as often in the future, or at all. This would harm our ability to attract customers to our restaurants and decrease the frequency with which they use our platforms. Additionally, the failure of our systems to operate effectively, maintenance problems, upgrading or transitioning to new platforms, network failures, natural disasters, terrorism, war, electrical failures, hackers, computer viruses, and other security issues could result in delays in customer service, reduce efficiency in our operations, and result in reputational harm. We expect to continue to make significant investments to maintain and improve the availability of our platforms and to enable rapid releases of new features and products for our multi-channel offerings. To the extent that we do not effectively address capacity constraints, respond adequately to service disruptions, upgrade our systems as needed or continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, our business, financial condition, and results of operations would be harmed.

We track our performance metrics with internal tools that are not independently verified by any third party. Our internal tools have a number of limitations, and our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our performance metrics, including the key metrics we report. If the internal tools we use to track these metrics over or undercount performance or contain errors, the data we report may not be accurate and our understanding of certain details of our business may be distorted, which could affect our longer-term strategies. There are also inherent challenges in measuring the order frequency of our digital and non-digital customers. For example, for digital customers, because a unique customer is determined based on the customer's login information, a single individual who places orders using different login information would be counted as multiple unique customers, and multiple individuals who place orders using the same login information would be counted as a single unique customer, and for non-digital customers, a single individual who makes purchases using multiple credit cards would be counted as multiple unique customers, and multiple individuals who make purchases using the same credit card information would be counted as a single unique customer. For these and other reasons, any calculations based on the number of unique customers may not accurately reflect the number of people actually placing orders through one of our Digital Channels or making purchases through the non-digital component of our In-Store Channel. We are continually seeking to improve our ability to measure our performance metrics, and regularly review our processes to assess potential improvements to their accuracy. However, the improvement of our tools and methodologies could cause inconsistency between current data and previously reported data, which could confuse investors or raise questions about the integrity of our data. Similarly, as both the industry in which we operate and our business continue to evolve, so too might the metrics by which we evaluate our business. We may revise or cease reporting metrics if we determine such metrics are no longer accurate or appropriate measures of our performance. If analysts or investors do not perceive our metrics to be accurate representations of our business, or if we discover material inaccuracies in our metrics, our reputation may be harmed.

We collect, use, receive, store, process, generate, transfer, make accessible, protect, secure, dispose of, transmit, share, and disclose personal information and other sensitive information about customers, personnel, business contacts, and others; proprietary and confidential business data; trade secrets; intellectual property; sensitive third-party data and financial information in the course of operating our business. These activities are or may become regulated by a variety of domestic and foreign laws, regulations, guidance, industry standards, external and internal data privacy and security policies, contractual requirements, and other obligations relating to data privacy and security, which are complex, rapidly evolving, and increasingly stringent. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). In the past few years, numerous U.S. states-including California, Virginia, Colorado, Connecticut, and Utah-have enacted comprehensive data privacy and security laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the CCPA applies to personal information of consumers, business representatives and employees who are California residents, and requires covered businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights related to their personal information. The CCPA also created restrictions on "sales" of personal information that allow California residents to opt-out of certain sharing of their personal information and may restrict the use of cookies and similar technologies for advertising purposes. Our platform relies on such technologies for advertising purposes and could be adversely affected by the CCPA's restrictions if users opt-out of certain information sharing on which our advertising relies, which would impair our ability to advertise. This could decrease the effectiveness of our marketing and adverting strategies and decrease our level of customer acquisition and/or retention, may cause us to seek new avenues to market and advertise, and may cause us to increase our marketing and advertising expenditures. The CCPA provides for civil penalties of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws have been proposed in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could complicate compliance efforts, and may increase legal risk and compliance costs for us and the third parties upon whom we rely. In addition to the risks we face under emerging privacy laws, the restrictions on text message communications imposed by the Telephone Consumer Protection Act ("TCPA") have long been a source of potential liability for our business. The TCPA imposes various consumer consent requirements and other restrictions on certain telemarketing activity and other communications with consumers by phone, fax or text message. TCPA violations can result in significant financial penalties, including penalties or criminal fines imposed by the Federal Communications Commission or fines of up to $1,500 per violation imposed through private litigation or by state authorities. We currently send text messages to guests who opt in to receive customer support communications. Claims that we have violated the TCPA could be costly to litigate and could expose us to substantial statutory damages or settlement costs. Foreign laws and regulations pertaining to data privacy and security – including in Europe, China, Brazil, and Japan – are also undergoing rapid change, have become increasingly stringent in recent years, and proposals for similar laws and regulations are being considered in several major foreign countries. Many of these countries are also beginning to impose or increase restrictions on the transfer of personal information to other countries. Restrictions relating to data privacy and security in these countries may limit the products and services we can offer in them, which in turn may limit demand for our services in such countries and our ability to enter into and operate in new geographic markets. Privacy advocates and industry groups have regularly proposed, and may propose in the future, self-regulatory standards by which we are or may become legally or contractually bound. For example, certain privacy laws, such as the CCPA, require us to impose specific contractual restrictions on our service providers. If we fail to comply with these contractual obligations or standards, we may face public and regulatory scrutiny, substantial liability, and fines. Additionally, under various data privacy and security laws and other obligations, we may be required to obtain certain consents to process personal information. Our inability or failure to do so could result in adverse consequences. We also publish privacy policies and other documentation regarding our collection, processing, use, and disclosure of personal information and/or other confidential information. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. Additionally, our business is reliant on revenue from customers acquired through behavioral, interest-based, or tailored advertising. Consumer resistance to the collection and sharing of the data used to deliver targeted advertising, increased visibility of consent or "do not track" mechanisms as a result of industry regulatory or legal developments, the adoption by consumers of browser settings or "ad-blocking" software, and the development and deployment of new technologies could impact our ability to collect data or engage in marketing and advertising, which could have an adverse effect on our business, financial condition, or results of operations. Further, we are subject to the Payment Card Industry ("PCI") Data Security Standard, a security standard applicable to companies that collect, store or transmit certain data regarding credit and debit cards, holders and transactions. We rely on vendors to handle PCI matters and to ensure PCI compliance. Despite our compliance efforts, we may become subject to claims that we have violated the PCI Data Security Standard based on past, present, and future business practices. Our actual or perceived failure to comply with the PCI Data Security Standard can subject us to fines, termination of banking relationships, and increased transaction fees. In addition, there is no guarantee that PCI Data Security Standard compliance will prevent illegal or improper use of our payment systems or the theft, loss or misuse of payment card data or transaction information. Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal information in generative AI technologies is subject to various data privacy and security laws and other obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. Obligations related to data privacy and security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources. These obligations may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal information on our behalf. Despite our efforts, we may not be successful in complying with the rapidly evolving data privacy and security requirements discussed above. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class claims); additional reporting requirements and/or oversight; bans on processing sensitive information (including personal information); orders to destroy or not use personal information; indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); and financial loss. Such occurrences could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; inability to process personal information or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

In 2010, the PPACA, which required health care coverage for many uninsured individuals and expanded the coverage of those already insured, was signed into law in the United States. The PPACA requires us to offer healthcare benefits to all full-time employees (including full-time hourly employees) that meet certain minimum requirements of coverage and affordability, or face penalties. We have incurred additional expenses due to organizing and maintaining a healthcare plan that covers the increased number of employees who have elected to obtain coverage through a healthcare plan we subsidize in part. If we fail to continue to offer such benefits, or the benefits we elect to offer do not meet the applicable requirements, we may incur penalties. It is also possible that by making changes or failing to make changes in the healthcare plans offered by us we will become less competitive in the market for our labor. The future costs and other effects of these new healthcare requirements cannot be determined with certainty, but they may significantly increase our healthcare coverage costs and could have an adverse effect on our business, financial condition, and results of operations. Additionally, there is no assurance that federal or state health care reform will not adversely affect our business, financial condition, and results of operations, and we cannot predict how future federal or state legislative, judicial, or administrative changes relating to healthcare reform will affect our business.

We are subject to various federal, state, and local regulations, including those relating to building and zoning requirements and those relating to the preparation and sale of food. The development and operation of restaurants depends to a significant extent on the selection and acquisition of suitable sites, which are subject to zoning, land use, environmental, traffic, and other regulations and requirements. Our restaurants are also subject to state and local licensing and regulation by health, sanitation, food and occupational safety, and other agencies, which regulation has increased in the wake of the COVID-19 pandemic. We may experience difficulties or failures in obtaining the necessary licenses, approvals, or permits for our restaurants, which could delay planned restaurant openings or affect the operations at our existing restaurants. In addition, stringent and varied requirements of local regulators with respect to zoning, land use, and environmental factors could delay or prevent development of new restaurants in particular locations. Our operations are subject to the U.S. Occupational Safety and Health Act, which governs worker health and safety, the U.S. Fair Labor Standards Act, which governs such matters as minimum wages and overtime, and a variety of similar federal, state and local labor and employment laws (such as predictive scheduling laws, various wage & hour laws, laws governing the employment of minors, leave laws, termination laws, and state occupational safety regulations) that govern these and other employment law matters. We may also be subject to lawsuits or investigations from our current or former employees in our restaurants or in the Sweetgreen Support Center, the U.S. Equal Employment Opportunity Commission, or others alleging violations of federal and state laws regarding workplace and employment matters, discrimination, and similar matters. We are currently a party to such matters, and we have been a party to a number of such matters in the past. These lawsuits and investigations require significant resources from our senior management and can result in fines, penalties and/or settlements, some or all of which may not be covered by insurance. These lawsuits and investigations can also result in significant remediation efforts that may be costly and time consuming, and which we may not implement effectively. We have made payments to settle these types of lawsuits and/or investigations in the past, and current and additional lawsuits or investigations could have an adverse effect on our business, brand and reputation, financial condition, and results of operations. Additional federal, state, and local proposals related to paid sick leave or similar matters, could, if implemented, also have an adverse effect on our business, financial condition, and results of operations. We are also subject to the Americans with Disabilities Act (the "ADA") and similar state laws that give civil rights protections to individuals with disabilities in the context of employment, public accommodations and other areas, including our restaurants, website, and smartphone applications. In the past, we have settled various lawsuits related to our alleged ADA non-compliance, which resulted in accommodations to our website, smartphone applications, and physical restaurants. We are currently engaged in ADA-related litigation, and we may face additional litigation in the future. We may have to further modify our websites or other digital platforms (including any digital kiosks that we may implement in our restaurants) or our restaurants by adding access ramps or redesigning certain interior layouts or architectural fixtures to provide service to or make reasonable accommodations for disabled persons. The expenses associated with these modifications could be material, and there is no guarantee that we will be able to adjust our business practices appropriately to limit additional claims in the future. We operate in a highly regulated industry, and we strive to implement industry best practices to ensure food and customer safety whether or not required by government regulation, including with respect to hand washing and sanitation of our restaurants as well as the prepping, handling, and maintaining of many of our perishable food items. In the event we fail to maintain such best practices, or do not comply with any required government regulation, it could lead to incidents related to foodborne illnesses that could have an adverse effect on their brand and operations. Local, state, and federal regulatory requirements are always evolving, and we anticipate compliance with these requirements may increase our costs and present challenges and risk to our company. The impact of current laws and regulations, the effect of future changes in laws or regulations that impose additional requirements (including the requirement to provide for reasonable accommodations for those with disabilities), and the consequences of litigation relating to current or future laws and regulations, or our inability to respond effectively to significant regulatory or public policy issues, could increase our compliance and other costs of doing business and, therefore, have an adverse effect on our business, financial condition, and results of operations. Failure to comply with the laws and regulatory requirements of federal, state, and local authorities could result in, among other things, revocation of required licenses, administrative enforcement actions, fines, and civil and criminal liability. In addition, certain laws, including the ADA, could require us to expend significant funds to make modifications to our restaurants if we failed to comply with applicable standards. Compliance with the aforementioned laws and regulations can be costly and can increase our exposure to litigation or governmental investigations or proceedings, which could have an adverse effect on our business, financial condition, and results of operations.

Although we have policies requiring that all workers provide us with government-specified documentation evidencing their employment eligibility on their first day of work, some of our employees, particularly in our restaurants, may be unauthorized workers, or provide false documentation, if our policies are not followed strictly. Our historical hiring processes in our restaurants have not always ensured that we collect and approve all required government-specified documentation evidencing employment eligibility on a timely basis in accordance with applicable laws. We have previously been subject to audit by the Department of Homeland Security in certain markets, and we may be subject to additional audits in the future. Unauthorized workers are subject to deportation and may subject us to fines or penalties, and if any of our workers are found to be unauthorized, we could experience adverse publicity that negatively impacts our brand and may make it more difficult to hire and keep qualified employees. In the past we have terminated a significant number of employees who were determined to be unauthorized workers, and if we take similar actions in the future, it may disrupt our operations, cause temporary increases in our labor costs as we train new employees, and result in additional adverse publicity. We could also become subject to fines, penalties, and other costs related to claims or governmental audits that we did not fully comply with all obligations of federal and state immigration compliance laws, including record-keeping obligations. These factors could have an adverse effect on our business, financial condition, and results of operations as well as our brand and reputation. Furthermore, in recent years immigration laws have been a topic of considerable political focus. Further changes in immigration or work authorization laws and additional enforcement programs by the Department of Homeland Security of existing immigration or work authorization laws, including at the state level, could increase our compliance and oversight obligations, which could subject us to additional costs and potential liability, impact our brand and reputation, and make our hiring process more burdensome, and could potentially reduce the availability of prospective employees.

One of our challenges is locating and securing an adequate supply of suitable new restaurant sites, both in new geographic markets and in our existing geographic markets where we may already be located at the most desirable restaurant sites. Competition for those sites is intense, and other restaurant and retail concepts that compete for those sites may have economic models that permit them to bid more aggressively for sites than we can. There is no guarantee that a sufficient number of suitable sites will be available in desirable areas or on terms that are acceptable to us in order to achieve our growth plan or meet our economic objectives in new or existing geographic markets. Our ability to identify, secure, and open new restaurant sites also depends on other factors, including: - identifying and securing an appropriate site and selecting the best restaurant format for that given site and market (including determining whether to test new restaurant formats, including any formats incorporating automation technology), which requires consideration of the likely effectiveness of our multi-channel approach at the site, the size of the site, traffic patterns, local retail and business attractions and infrastructure that may drive high levels of customer traffic and sales, proximity of the site to existing restaurants, and anticipated commercial, residential and infrastructure development near the site, all of which has become more challenging with the uncertainty of companies' return-to-office plans in various locations;- negotiating leases with acceptable terms;- receiving timely delivery of leased premises to us from our landlords and the punctual commencement of our build-out construction activities;- obtaining tenant improvement allowances from our landlords;- analyzing financial conditions affecting developers and potential landlords, such as ability of landlords and developers to receive development financing, the effects of macro-economic conditions, and the credit market, which could lead to these parties delaying or canceling development projects (or renovations of existing projects), in turn reducing the number of appropriate restaurant sites available;- managing construction and development costs of new restaurants, particularly in competitive markets;- obtaining construction materials and labor at acceptable costs, particularly with the increase in inflation;- maintaining qualified real estate and construction resources to source and manage construction of new sites;- securing required governmental approvals, permits and licenses (including construction, certificates of occupancy and other permits) in a timely manner and responding effectively to any changes in local, state or federal laws and regulations;- avoiding the impact of inclement weather, natural disasters and other calamities; and - identifying, hiring, and training qualified employees in each local market. Given the numerous factors involved, we may not be able to successfully identify and secure a sufficient number of attractive restaurant sites in existing, adjacent or new markets, which could have an adverse effect on our business, financial condition, and results of operations. For those locations where we are able to secure an attractive restaurant site, our progress in opening new restaurants may occur at an uneven rate. If we do not open new restaurants in the future according to our current plans, the delay could have an adverse effect on our business, financial condition, and results of operations.

One of the key means of achieving our growth strategy for the foreseeable future will be through opening new restaurants and operating those restaurants on a profitable basis. In fiscal year 2023, we had 35 Net New Restaurant Openings, and in fiscal year 2022 we had 36 Net New Restaurant Openings. In the past, we have experienced delays in opening restaurants due to, among other things, supply chain challenges, wage and commodity cost increases as a result of inflation, construction delays, and permitting delays in new developments. Such delays could happen again in future restaurant openings. Delays or failures in opening new restaurants, or in launching new restaurant formats (including walk-up, drive-in, or drive-thru formats or store formats incorporating automation technology), could cost significant company resources (including lost sales and additional labor and marketing costs) and have an adverse effect on our growth strategy and our business, financial condition, and results of operations. As we operate more restaurants, our rate of expansion relative to the size of our restaurant base could decline.

Our success depends in large part on our ability to persuade customers that food made with higher-quality, locally sourced ingredients is worth the prices they will pay at our restaurants relative to prices offered by some of our competitors. We may not successfully educate customers about the quality of our food, and customers may not care even if they do understand our approach. That could require us to increase our pricing, or change our advertising or promotional strategies, which could adversely affect our business, financial condition, and results of operations or the brand identity that we have tried to create. We have increased our pricing several times in the past few years (including in fiscal years 2023 and 2022) and may increase prices further in the future due to the increased costs of labor or ingredients or other factors, which could negatively affect the loyalty of our existing customers and cause them to reduce their spending with us or impact our ability to acquire new customers, particularly as we expand our footprint into new geographies where customers might have greater price sensitivity. If customers are not persuaded that we offer a good value for their money, we may not be able to grow or maintain our customer base, which would have an adverse effect on our business, financial condition, and results of operations. Current macroeconomic conditions, such as inflation and higher interest rates, which have become more challenging during 2023 and 2022 and which we expect to continue to be challenging in fiscal year 2024, increase the risk of a potential economic downturn. An economic downturn negatively impacts consumer discretionary spend and, coupled with companies' slower than expected return to office following the COVID-19 pandemic (including as a result of many workplaces adopting remote or hybrid models), has led to our revenue growth slowing. Additionally, as a result of continued inflation, we experienced an increase in wage rates and costs of goods sold during fiscal year 2023, which has had a negative impact on our Restaurant Level Profit. In order to mitigate these risks, we have gradually increased menu prices or other customer fees and have implemented and may in the future have to implement additional cost-cutting measures, as described in the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations" in this Annual Report. There can be no assurance that future cost increases, including as a result of inflation, can be offset by increased menu prices or that our current or future menu prices will be fully absorbed by our customers without any resulting change to their demand for our products.