Vimeo (VMEO) Risk Factors

Uncertainty over or changes in laws and regulations with respect to user-generated content could adversely affect our ability to operate in some geographies. In addition, the regulatory framework for broad dissemination of user-generated content is new and evolving. Many states and foreign governments have enacted legislation designed to protect children and we expect additional legislation to be enacted. Many countries are developing regulations and policies to regulate this new space, including with respect to privacy, content generated using artificial intelligence, biometrics, data protection, data security, intellectual property, childhood protection, consumer protection, ratings, and taxes. If we are unable to comply with potentially conflicting regulations throughout the world, our ability to execute on our business model would be severely impacted, and our ability to grow our business could be harmed. Additionally, compliance with regulatory requirements throughout the world could increase our moderation and compliance related costs and expenses. These costs could be prohibitively expensive for a company of our size, which could prevent us from launching a product or require us to restrict access to a product in a particular market. This could disadvantage us relative to our competitors with more resources. Moreover, changes to these laws, regulations, standards, or obligations could require us to change our business model, take on more onerous obligations, including, but not limited to, applying for government-issued licenses to operate, establishing a local presence in certain jurisdictions, or developing localized product offerings, and impact the functionality of our product. For example, the European Union's ("EU's") Digital Services Act ("DSA") entered into force on November 16, 2022, and became fully applicable on February 17, 2024. The DSA imposes new content moderation obligations, notice and transparency obligations and other requirements on digital platforms to protect consumers and their rights online, and allows for fines of up to 6% of annual turnover. The impact of the DSA on the overall industry, business models and our operations is uncertain, and these regulations could result in changes to our subscriptions or introduce new operational requirements and administrative costs, each of which could have an adverse effect on our business, financial condition, and results of operations. Additionally, the Federal Trade Commission regulates deceptive or unfair commercial activities and can impose significant injunctive and monetary remedies for violations. Additionally, see our disclosure elsewhere in these Risk Factors regarding the EU Copyright Directive. If we are obligated to fundamentally change our business activities and practices or modify our product, we may be unable to make these required changes and modifications in a commercially reasonable manner, or at all, and our ability to further develop and enhance our product may be limited. The costs of compliance with, and other burdens imposed by, these laws, regulations, standards and obligations, or any inability to adequately address these, may limit our ability to operate our business, limit the use of our product or reduce overall demand for our product, which could harm our business, financial condition, and results of operations.

Tax reform has been a priority for governments worldwide and numerous proposals have been proposed or enacted. For example, the 2017 Tax Cuts and Jobs Act (the "Tax Act") changed how the United States imposes income tax on multinational corporations in a number of ways. The issuance of additional regulatory or accounting guidance may affect our analysis of the impact of the law on us and may harm our operating results and financial condition. Furthermore, the Tax Act eliminated the option to deduct research and development expenses in the current period and requires taxpayers to capitalize and amortize these expenses. Although Congress is considering legislation that would defer the capitalization and amortization requirement, there is no assurance that the provision will be repealed or otherwise modified. If the requirement is not repealed or modified,our net operating loss and tax credit utilization will be accelerated. Additionally, further regulatory or legislative developments may also arise from the recently enacted Inflation Reduction Act, which introduced new provisions, including a 15% corporate alternative minimum tax for certain large corporations and an excise tax on stock repurchases. These provisions were first effective in fiscal year 2023 and may materially affect our financial position and results of operations.

We are subject to a variety of existing and new laws concerning the collection, storing, processing, and transferring of user information. In the U.S., we are subject to federal laws, such as Section 5 of the Federal Trade Commission Act and the Video Privacy Protection Act, as well as a variety of state laws including the California Consumer Privacy Act and the Illinois Biometric Information Protection Act. Current or future privacy-related legislation and governmental regulations pertaining to the use of biometrics or other video analytics may affect how our business is conducted or expose us to unfavorable developments resulting from changes in the regulatory landscape. For example, laws such as the Illinois Biometric Information Privacy Act restrict the collection, use and storage of biometric information and provide a private right of action of persons who are aggrieved by violations of the act. Such legislation and regulations have exposed us to, and we expect that they will continue to expose us to, regulatory and litigation risks. Legislation and governmental regulations related to the use of biometrics and other video analytics may also influence our current and prospective customers' activities, as well as their expectations and needs in relation to our products and services. Compliance with these laws and regulations may be onerous and expensive, and may be inconsistent from jurisdiction to jurisdiction, further increasing the cost of compliance and the risk of liability. It is also not clear how existing and future laws and regulations governing issues such as biometrics and other video analytics apply or will be enforced with respect to the products and services we sell. The failure to comply with applicable privacy laws could lead to regulatory actions, including the possibility of fines, class action or traditional litigation, reputational harm and/or costly investigation and remediation efforts. Outside of the U.S., we are subject to privacy laws of the countries in which we conduct business. For example, the European Union's General Data Protection Regulation ("GDPR") imposes detailed requirements related to the collection, storage and use of personal information related to people located in the EU. The GDPR authorizes fines up to 4% of a company's annual turnover. Privacy laws have proliferated in the past several years, both in the U.S. and worldwide. Because of the speed of change in the area of privacy law, it is impossible to foresee changes in the regulatory environment and we may be forced to make sudden operational shifts in an effort to maintain compliance. New laws, or new interpretations of or stricter enforcement of existing laws, may increase our compliance costs, restrict our ability to determine how our users are using our services, and increase our potential liability in the event of non-compliance. For example, in Europe, we have had to make changes to how we use cookies and other tracking technologies and these changes have reduced our visibility into how our users are using our services. In the U.S., there are numerous federal and state laws governing the privacy and security of personal information. In particular, at the federal level, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") establishes privacy and security standards that limit the use and disclosure of individually identifiable health information and requires the implementation of administrative, physical, and technical safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity, and availability of electronic protected health information by certain institutions. We act as a "Business Associate" through our relationships with certain customers and are thus directly subject to certain provisions of HIPAA. In addition, if we are unable to protect the privacy and security of protected health information, we could be found to have breached our contracts with customers with whom we have a Business Associate relationship and may also face regulatory liability. Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA, or with contractual obligations under any Business Associate agreement may lead to significant fines, civil and criminal penalties, or liabilities.

An essential part of our strategy for attracting subscribers depends upon offering basic services for free and converting a certain portion of our free users into subscribers over time. Historically, a majority of our subscribers have started as free users, and only a small percentage of free users became paying users over time. Our ability to convert users into subscribers at this or a higher rate may not materialize if: - the number of free users we attract declines, which could occur due to, among other things, reduced visibility of our brand or services;- we overestimate the number of free users who have the propensity to pay due to issues with duplicative, fraudulent or spam accounts;- our free users do not consistently use the free product, either because they are unaware of the features we offer or because the features are not perceived as useful;- we fail to optimize the conversion of free users by communicating the value of our subscription plans;- our free users are dissatisfied with our products and support;- our users no longer have a need for our products;- a reduction in customer information technology spending budgets, which may be reduced during periods of high inflation or economic recession or the perception that competitive products provide better, more secure, or less expensive options;- we experience headwinds in our international expansion due to variety of reasons, including language and cultural barriers, as well as unfavorable regulatory environments; or - our service offerings and pricing are not competitive. Additionally, we are increasing our focus on product-led growth to attract more consumers organically, in a shift away from paid marketing efforts. Although we expect that product-led growth will lead to healthier conversion in the long-term, our shift to product-led growth and away from paid marketing may cause a near-term impact to our conversion efforts. Additionally, we may not be successful at our efforts to drive cost-effective organic traffic growth. If we are not able to effectively increase our traffic growth while decreasing in spend on performance marketing, we may need to rely more heavily on paid marketing efforts to acquire new subscribers and therefore achieve growth. Such a shift would cause us to incur higher costs in acquiring users, which would reduce our margin profile. In addition, some customers downgrade their subscription plans or do not renew their subscriptions.

Individuals and groups may upload controversial content to our platform. Removing or failing to remove such content may result in negative publicity, which could harm our efforts to attract and retain users and subscribers. We have also faced criticism from users and subscribers for removing content and terminating accounts in compliance with the DMCA.

We operate our offices in a hybrid manner, with most of our employees working on a completely remote basis. Preservation of our corporate culture may be more difficult as many of our workforce have been working from home in connection with our hybrid workplace model. Even if we return to an office setting, we may experience productivity challenges associated with having some employees remote and some in person and having employees unable to work due to illness or childcare concerns. In addition, requirements to move back to a physical office environment could adversely affect the hiring and retention of employees who prefer to work remotely.

Our ability to attract and retain employees could also be adversely affected by issues that negatively impact our image, such as incidents of actual or perceived discrimination, controversial business decisions, including decisions about user content, and issues with the quality of our products (such as bugs or interruptions in services, among other issues).

We cannot guarantee that we will be shielded from third-party copyright infringement lawsuits and related liability for hosting user and subscriber content by laws such as the online safe harbor provisions of the U.S. Digital Millennium Copyright Act of 1998 ("DMCA"), which are intended to limit the liability of online providers with respect to user- and subscriber-uploaded content. In addition, even if we ultimately succeed in demonstrating that the DMCA limits our liability, litigating these issues is costly and time-consuming. For details regarding pending lawsuits of this nature, see "Note 14-Commitments and Contingencies" to the consolidated financial statements included in Item 8-Consolidated Financial Statements and Supplementary Data. Regulators and legislators in the United States and in other countries may introduce new regulatory regimes that increase the potential liability for content available on our platform. For example, Directive (EU) 2019/790 on copyright and related rights in the Digital Single Market ("DSM Directive") creates a distinct liability regime for "online content-sharing service providers" when they give the public access to copyright works uploaded by their users. To the extent, if at all, elements of our service constitute an "online content-sharing service provider", the DSM Directive sets out certain requirements which must be met to be exempt from liability with respect to user- and subscriber- uploaded content. Meeting these requirements requires significant time and resources and compliance may therefore negatively impact our financial prospects. To the extent applicable to our services, the DSM Directive may increase our costs of operations, our liability for third-party content posted on our platform, and our litigation costs. Additionally, our efforts to date have caused, and may continue to cause, friction with our users, which in turn causes damage to our brand. Additionally, we cannot guarantee that we will be compliant with foreign requirements. For example, as described in "Note 14-Commitments and Contingencies" to the consolidated financial statements included in Item 8-Consolidated Financial Statements and Supplementary Data, we have been sued in Italy for the copyright infringement of our users. There are also a number of new laws and legislative proposals in the United States, at both the federal and state level, and in the European Union, U.K. and other countries, aimed at limiting the scope of protections available to online services and/or further imposing new obligations that may affect our business, such as liability for copyright infringement, content moderation, distributing targeted and other advertisements to minors, and other forms of unlawful content and/or online harm. These legislative and/or regulatory requirements may increase our costs of operations, our liability for content posted by users on our platform, and/or our litigation costs. If these or other additional statutory or regulatory changes reduce liability protections for content published on our platform, we may be required to make significant changes to our business model, including increasing our content moderation operations and building or removing product features or tools that may not be favorable to our business, add payment obligations or compliance costs. We could also face fines or orders restricting or blocking our service in particular countries as a result of content on our platform. For example, certain countries have implemented regulations that authorize fines or provide for throttling or blocking services for failures to comply with certain content removal and disclosure obligations, and other countries may enact similar legislation, which would impose penalties for failure to remove certain content. There can be no assurance that the tools we use for certain removal obligations or any new custom tools we develop will be sufficient to maintain compliance with the new regulations.

In order for us to succeed, our information technology systems and infrastructures must perform well on a consistent basis. We rely on information technology systems to keep financial records, facilitate our research and development initiatives, manage our manufacturing operations, maintain quality control, maintain corporate records, communicate with staff and external parties and operate other critical functions. Our information technology systems and those of our vendors and partners are potentially vulnerable to disruption due to breakdown, malicious intrusion, computer viruses, ransomware or other malicious software, or other disruptive events, including, but not limited to, natural disasters and catastrophes. In April 2023, we hired a new Chief Information Security Officer, who has undertaken a comprehensive review of our information security systems and processes. As a result, we have made significant improvements to our cybersecurity controls and procedures over the last eight months, and expect to see additional incremental improvement in our cybersecurity risk management over the next six to twelve months. We have identified vulnerabilities in our products and services as well as third-party and open-source software that we depend on in the past, and we expect that we will continue to identify vulnerabilities in the future. While we are continually working to expand and enhance the efficiency and scalability of our technology and network systems, we cannot be certain that we will be able to address any vulnerabilities in our software products and services that we may become aware of in the future, or there may be delays in developing patches that can be effectively deployed to address vulnerabilities. We will continue to make prioritization decisions to determine which vulnerabilities or security defects to fix and the timing of these fixes, which could result in an exploit that compromises security. Vulnerabilities and critical security defects, errors in remediating vulnerabilities or security defects, failure of third-party providers to remediate vulnerabilities or security defects, or customers not deploying security releases or deciding not to install software updates could result in claims of liability against us, damage our reputation, or otherwise harm our business. Any interruptions or outages, regardless of the cause, could negatively impact our users' experiences with our products, tarnish our brands' reputations and decrease demand for our products, any or all of which could materially adversely affect our business, financial condition and results of operations. Moreover, even if detected, the resolution of such interruptions may take a long time, during which customers may not be able to access, or may have limited access to, our services.

Since 2017, we have had operations in Ukraine. As of the year ended December 31, 2023, we had 69 employees based out of our Ukraine office. Our Ukraine team is primarily focused on research and development activities, with 84% of the team in engineering roles. On February 24, 2022, Russia invaded Ukraine. As a result of this war, some of our Ukraine team members have been forced to relocate to other countries and within Ukraine, with many unable to perform all or some work duties. We remain committed to supporting our Ukraine team members and are prioritizing safety over work. The ongoing conflict could cause harm to our team members and otherwise impair their ability to work for extended periods of time, as well as disrupt telecommunications systems, banks and other critical infrastructure necessary to conduct business in Ukraine. In addition, following Russia's invasion of Ukraine, the United States, European Union, and other nations announced various sanctions against Russia and export restrictions against Russia and Belarus. Such restrictions include blocking sanctions on some of the largest state-owned and private Russian financial institutions, and their removal from the Society for Worldwide Interbank Financial Telecommunication, or the SWIFT, payment system. The invasion of Ukraine and the retaliatory measures that have been taken, and could be taken in future, by the U.S., NATO, and other countries have created global security concerns that could result in a regional conflict and otherwise have a lasting impact on regional and global economies, any or all of which could adversely affect our business, including preventing us from performing existing contracts, pursuing new business opportunities, or receiving payments for services already provided to customers. Additionally, as of the year ended December 31, 2023, we had 99 employees based out of our Israel office. Our Israel team covers several areas of our business, from engineering and product to quality assurance and customer support. Due to the war between Israel and Hamas that began on October 7, 2023, some of our employees in Israel have been called to active military duty and we expect that additional employees may be called in the future, if needed. Additionally, we have been forced to close our Israel office or operate at limited capacity for several days and may need to do so again for an unknown period of time. As a result, our operations in Israel have been impacted, and may continue to be disrupted if this conflict continues for a significant period of time or if the situation further deteriorates. The safety and well-being of our employees takes precedence, and we will continue to evaluate the situation and adjust operation plans as needed.