While we seek to work with governments, we have in the past, and are likely in the future to, become involved in disputes with government agencies regarding such laws and regulations. For example, some governments have attempted to impose fines on us regarding what they contend is illegal offering of short-term accommodations in violation of applicable laws. Certain jurisdictions have adopted laws and regulations that seek to impose lodging taxes, often known as transient or occupancy taxes, on our guests, collection and remittance obligations on our hosts and/or us, and withholding obligations on us, as more fully described in our risk factor titled “— Uncertainty in the application of taxes to our hosts, guests, or platform could increase our tax liabilities and may discourage hosts and guests from conducting business on our platform.” In addition, some third parties and regulators have asserted that we, through our operations, are subject to regulations with respect to short-term rentals, host registration, licensing, and other requirements for the listing of accommodations and experiences, such as real estate broker or agent licenses, travel agency licenses, and insurance related licenses. We could be held liable and incur significant financial and potential criminal penalties if we are found to have violated any of these regulations. In certain jurisdictions, we have resolved disputes concerning the application of these laws and regulations by agreeing, among other things, to share certain data with government agencies to assist in the enforcement of limits on short-term rentals as well as the enforcement of safety regulations, and to implement measures to confirm to the government that hosts are operating in compliance with applicable law. When a government agency seeks to apply laws and regulations in a manner that limits or curtails hosts’ or guests’ ability or willingness to list and search for accommodations in that particular geography, we have attempted and may continue to attempt through litigation or other means to defend against such
37
application of laws and regulations, but have sometimes been and may continue to be unsuccessful in certain of those efforts. Further, if we or our hosts and guests were required to comply with laws and regulations, government requests, or agreements with government agencies that adversely impact our relations with hosts and guests, our business, results of operations, and financial condition would be materially adversely affected. Moreover, if we enter an agreement with a government or governmental agency to resolve a dispute, the terms of such agreement will likely be publicly available and could create a precedent that may put us in a weaker bargaining position in future disputes with other governments.
We are subject to a wide variety of complex, evolving, and sometimes inconsistent and ambiguous laws and regulations that may adversely impact our operations and discourage hosts and guests from using our platform, and that could cause us to incur significant liabilities including fines and criminal penalties, which could have a material adverse effect on our business, results of operations, and financial condition.
Hosts list, and guests search for, stays and experiences on our platform in more than 220 countries and regions, and in approximately 100,000 cities throughout the world. There are national, state, local, and foreign laws and regulations in jurisdictions that relate to or affect our business. Moreover, the laws and regulations of each jurisdiction in which we operate are distinct and may result in inconsistent or ambiguous interpretations among local, regional, or national laws or regulations applicable to our business. Compliance with laws and regulations of different jurisdictions imposing varying standards and requirements is burdensome for businesses like ours, imposes added cost and increases potential liability to our business, and makes it difficult to realize business efficiencies and economies of scale. For example, we incur significant operational costs to comply with requirements of jurisdictions and cities that have disparate requirements around tax collection, tax reporting, host registration, limits on lengths of stays, and other regulations, each of which require us to dedicate significant resources to provide the infrastructure and tools needed on our platform for our hosts to meet these legal requirements and for us to fulfill any obligations we may have. The complexity of our platform and changes required to comply with the large number of disparate requirements can lead to compliance gaps if our internal resources cannot keep up with the pace of regulatory change and new requirements imposed on our platform, or if our platform does not work as intended or has errors or bugs.
It may be difficult or impossible for us to investigate or evaluate laws or regulations in all cities, countries, and regions. The application of existing laws and regulations to our business and platform can be unclear and may be difficult for hosts, guests, and us to understand and apply, and are subject to change, as governments or government agencies seek to apply legacy systems of laws or adopt new laws to new online business models in the travel and accommodations industries, including ours. Uncertain and unclear application of such laws and regulations to host and guest activity and our platform could cause and has caused some hosts and guests to leave or choose not to use our platform, reduce supply and demand for our platform and services, increase the costs of compliance with such laws and regulations, and increase the threat of litigation or enforcement actions related to our platform, all of which would materially adversely affect our business, results of operations, and financial condition. See also our risk factor titled “— We could face liability for information or content on or accessible through our platform.”
There are laws that apply to us, and there are laws that apply to our hosts and/or guests. While we require our hosts and guests to comply with their own independent legal obligations under our terms of service, we have limited means of enforcing or ensuring the compliance of our hosts and guests with all applicable legal requirements. Sometimes governments try to hold us responsible for laws that apply to our hosts and/or guests. Whether applicable to us, our hosts, and/or our guests, the related consequences arising out of such laws and regulations, including penalties for violations of and costs to maintain compliance
38
with such laws and regulations, have had and could continue to have a material adverse effect on our reputation, business, results of operations, and financial condition.
We take certain measures to comply, and to help hosts comply, with laws and regulations, such as requiring registration numbers to be displayed on a listing profile for listings in some jurisdictions where such registration is required. These measures, changes to them, and any future measures we adopt could increase friction on our platform, and reduce the number of listings available on our platform from hosts and bookings by guests, and could reduce the activity of hosts and guests on our platform. We may be subject to additional laws and regulations which could require significant changes to our platform that discourage hosts and guests from using our platform. Our newer offerings, such as Airbnb Experiences, are subject to similar or other laws, regulations, and regulatory actions. In particular, if we become more involved in hosts’ listings and conduct related to bookings, then we are more likely to draw scrutiny and additional regulations from governments and undercut various defenses we may have to claims or attempts to regulate us, which further constrain our business and impose additional liability on us as a platform.
In addition to laws and regulations directly applicable to the short-term rental and home sharing business as discussed in our risk factor titled “— Laws, regulations, and rules that affect the short-term rental and home sharing business have limited and may continue to limit the ability or willingness of hosts to share their spaces over our platform and expose our hosts or us to significant penalties, which could have a material adverse effect on our business, results of operations, and financial condition,” we are subject to laws and regulations governing our business practices, the Internet, e-commerce, and electronic devices, including those relating to taxation, privacy, data protection, pricing, content, advertising, discrimination, consumer protection, protection of minors, copyrights, distribution, messaging, mobile communications, electronic device certification, electronic waste, electronic contracts, communications, Internet access, competition, and unfair commercial practices. We are also subject to laws and regulations governing the provision of online payment services, the design and operation of our platform, and the operations, characteristics, and quality of our platform and services.
We are also subject to federal, state, local, and foreign laws regulating employment, employee working conditions, including wage and hour laws, employment dispute and employee bargaining processes, collective and representative actions, and other employment compliance requirements.
As a result of the COVID-19 pandemic, many jurisdictions have also adopted laws, rules, regulations, and/or decrees intended to address the COVID-19 pandemic, including implementing travel restrictions or restricting access to city centers or limiting accommodation offerings in surrounding areas. In addition, many jurisdictions have limited social mobility and gatherings. As the COVID-19 pandemic develops, governments, corporations, and other authorities may continue to implement restrictions or policies that could further restrict the ability of our hosts and guests to participate on our platform.
There is increased governmental interest in regulating technology companies in areas including privacy, tax, data localization and data access, algorithm-based discrimination, and competition. In addition, climate change and greater emphasis on sustainability could lead to regulatory efforts to address the carbon impact of housing and travel. As a result, governments may enact new laws and regulations and/or view matters or interpret laws and regulations differently than they have in the past, and in a manner that could materially adversely affect our business, results of operations, and financial condition.
Any new or existing laws and regulations applicable to existing or future business areas, including amendments to or repeal of existing laws and regulations, or new interpretations, applications, or
39
enforcement of existing laws and regulations, could expose us to substantial liability, including significant expenses necessary to comply with such laws and regulations, and materially adversely impact bookings on our platform, thereby materially adversely affecting our business, results of operations, and financial condition. For example, the laws and regulations that impact our United Kingdom and European Union operations, including payment processing, privacy and data protection, legal protection for platforms, workers’ rights, and intellectual property, may change after the end of the transitional period following the United Kingdom’s departure from the European Union. In addition, the European Union’s new Platform to Business Regulation, which came into effect in July 2020, required us to make updates to the terms that apply to our business customers, introduce new dispute resolution procedures with business customers, and make changes to our community support operations. Furthermore, some of our hosts or some of our offerings may now or in the future be subject to the European Package Travel Directive, which imposes various obligations upon package providers and upon marketers of travel packages, such as disclosure obligations to consumers and liability to consumers. Our efforts to influence legislative and regulatory proposals have an uncertain chance of success, could be limited by laws regulating lobbying or advocacy activity in certain jurisdictions, and even if successful, could be expensive and time consuming, and could divert the attention of management from operations.
We are subject to regulatory inquiries, litigation, and other disputes, which have materially adversely affected and could materially adversely affect our business, results of operations, and financial condition.
We have been, and expect to continue to be, a party to various legal and regulatory claims, litigation or pre-litigation disputes, and proceedings arising in the normal course of business. The number and significance of these claims, disputes, and proceedings have increased as our company has grown larger, the number of bookings on our platform has increased, there is increased brand awareness, and the scope and complexity of our business have expanded, and we expect they will continue to increase.
We have been, and expect to continue to be, subject to various government inquiries, investigations, and proceedings related to legal and regulatory requirements such as compliance with laws related to short-term rentals and home sharing, tax, consumer protection, pricing, advertising, discrimination, data protection, data sharing, payment processing, privacy, and competition. In many cases, these inquiries, investigations, and proceedings can be complex, time consuming, costly to investigate, and require significant company and also management attention. For certain matters, we are implementing recommended changes to our products, operations, and compliance practices, including enabling tax collection, tax reporting, display of host registration numbers, and removal of noncompliant listings. We are unable to predict the outcomes and implications of such inquiries, investigations, and proceedings on our business, and such inquiries, investigations, and proceedings could result in large fines and penalties and require changes to our products and operations, and materially adversely affect our brand, reputation, business, results of operations, and financial condition. In some instances, applicable laws and regulations do not yet exist or are being adapted and implemented to address certain aspects of our business, and such adoption or change in their interpretation could further alter or impact our business and subject us to future government inquiries, investigations, and proceedings.
We have been involved in litigation with national governments, trade associations and industry bodies, municipalities, and other government authorities, including as a plaintiff and as a defendant, concerning laws seeking to limit or outlaw short-term rentals and to impose obligations or liability on us as a platform. In the United States, we have been involved in various lawsuits concerning whether our platform is responsible for alleged wrongful conduct by hosts who engage in short-term rentals. Claims in such cases have alleged illegal hotel conversions, real estate license requirements, violations of municipal law around
40
short-term occupancy or rentals, unlawful evictions, or violations of lease provisions or homeowners’ association rules. For example, a property owner sued us and other parties in Broward County for the short-term rental of units in her building in alleged violation of the building’s homeowners’ association rules. Legal claims have been asserted for alleged discriminatory conduct undertaken by hosts against certain guests, and for our own platform policies or business practices. Changes to the interpretation of the applicability of fair housing, civil rights or other statutes to our business or the conduct of our users could materially adversely impact our business, results of operations, and financial condition. We may also become more vulnerable to third-party claims as U.S. laws such as the Digital Millennium Copyright Act (“DMCA”), the Stored Communications Act, and the Communications Decency Act (“CDA”), and non-U.S. laws such as the European E-Commerce Directive are interpreted by the courts or otherwise modified or amended, as our platform and services to our hosts and guests continue to expand, and as we expand geographically into jurisdictions where the underlying laws with respect to the potential liability of online intermediaries such as ourselves are either unclear or less favorable.
In addition, we face claims and litigation relating to fatalities, shootings, other violent acts, illness (including COVID-19), cancellations and refunds, personal injuries, property damage, carbon monoxide incidents, and privacy violations that occurred at listings or experiences during a booking made on our platform. We also have putative class action litigation and government inquiries, and could face additional litigation and government inquiries and fines relating to our business practices, cancellations and other consequences due to natural disasters or other unforeseen events beyond our control such as wars, regional hostilities, health concerns, including epidemics and pandemics such as COVID-19, or law enforcement demands and other regulatory actions.
Notwithstanding the decision of the Court of Justice of the European Union (“CJEU”) on December 19, 2019 ruling that Airbnb is a provider of information society services under the E-Commerce Directive, there continue to be new laws and government initiatives within the European Union attempting to regulate Airbnb as a platform. In several cases, national courts are evaluating whether certain local rules imposing obligations on platforms can be enforced against us. For example, we are challenging an Italian law requiring short-term rental platforms to act as withholding tax agent for host income taxes, to collect and remit tourist taxes, and to disclose user data. Adverse rulings in these national cases are possible and could result in changes to our business practices in significant ways, increased operating and compliance costs, and lead to a loss of revenue for us.
In addition, in the ordinary course of business, disputes may arise because we are alleged to have infringed third parties’ intellectual property or in which we agree to provide indemnification to third parties with respect to certain matters, including losses arising from our breach of such agreements or from intellectual property infringement claims, or where we make other contractual commitments to third parties. We also have indemnification agreements with certain of our directors, executive officers, and certain other employees that require us, among other things, to indemnify them against certain liabilities that may arise by reason of their status or service as directors or officers. We may be subject to litigation stemming from these obligations.
Adverse results in any regulatory inquiry, litigation, legal proceedings, or claims may include awards of potentially significant monetary damages, including statutory damages for certain causes of action in certain jurisdictions, penalties, fines, injunctive relief, royalty or licensing agreements, or orders preventing us from offering certain services. Moreover, many regulatory inquiries, litigation, legal proceedings, or claims are resolved by settlements that can include both monetary and nonmonetary components. Adverse results or settlements may result in changes in our business practices in significant ways, increased operating and compliance costs, and a loss of revenue. In addition, any litigation or pre-litigation
41
claims against us, whether or not meritorious, are time consuming, require substantial expense, and result in the diversion of significant operational resources. We use various software platforms that in some instances have limited functionality which may impede our ability to fully retrieve records in the context of a governmental inquiry or litigation. In addition, our insurance may not cover all potential claims to which we are exposed and may not be adequate to indemnify us for all liability that may be imposed. As we continue to grow, regulatory inquiries, litigation, legal proceedings, and other claims will continue to consume significant company resources and adverse results in future matters could materially adversely affect our business, results of operations, and financial condition.
We could face liability for information or content on or accessible through our platform.
We could face claims relating to information or content that is published or made available on our platform. Our platform relies upon content that is created and posted by hosts, guests, or other third parties. Although content on our platform is typically generated by third parties, and not by us, claims of defamation, disparagement, negligence, warranty, personal harm, intellectual property infringement, or other alleged damages could be asserted against us, in addition to our hosts and guests. While we rely on a variety of statutory and common-law frameworks and defenses, including those provided by the DMCA, the CDA, the fair-use doctrine in the United States and the E-Commerce Directive in the European Union, differences between statutes, limitations on immunity, requirements to maintain immunity, and moderation efforts in the many jurisdictions in which we operate may affect our ability to rely on these frameworks and defenses, or create uncertainty regarding liability for information or content uploaded by hosts and guests or otherwise contributed by third-parties to our platform. Moreover, regulators in the United States and in other countries may introduce new regulatory regimes that increase potential liability for information or content available on our platform. For example, in the United States, laws such as the CDA, which have previously been interpreted to provide substantial protection to interactive computer service providers, may change and become less predictable or unfavorable by legislative action or juridical interpretation. There have been various federal legislative efforts to restrict the scope of the protections available to online platforms under the CDA, in particular with regards to Section 230 of the CDA, and current protections from liability for third-party content in the United States could decrease or change. There is proposed U.S. federal legislation seeking to hold platforms liable for user-generated content, including content related to short-term rentals. We could incur significant costs investigating and defending such claims and, if we are found liable, significant damages. The European Union is also reviewing the regulation of digital services, and it has been reported that the European Union plans to introduce the Digital Services Act (“DSA”), a package of legislation intended to update the liability and safety rules for digital platforms, products, and services, which could negatively impact the scope of the limited immunity provided by the E-Commerce Directive. Some European jurisdictions have also proposed or intend to pass legislation that imposes new obligations and liabilities on platforms with respect to certain types of harmful content. In parallel, the European Commission is working on a legislative proposal to introduce new ex ante regulation of online platforms and new market investigation powers as a separate piece of legislation, the Digital Markets Act (“DMA”). If the DMA is enacted, it may contain certain regulatory requirements and/or obligations that negatively impact our business. Some European jurisdictions (such as the United Kingdom and Germany) are also reviewing their competition rules in relation to digital platforms which could lead to new regulations similar to the DMA at national level. While the scope and timing of these proposals are currently uncertain, if enacted and applied to our platform, the new rules may adversely affect our business. In countries in Asia and Latin America, generally there are not similar statutes as the CDA or E-Commerce Directive. The laws of countries in Asia and Latin America generally provide for direct liability if a platform is involved in creating such content or has actual knowledge of the content without taking action to take it down. Further, laws in some Asian countries also
42
provide for primary or secondary liability, which can include criminal liability, if a platform failed to take sufficient steps to prevent such content from being uploaded. Because liability often flows from information or content on our platform and/or services accessed through our platform, as we continue to expand our offerings, tiers, and scope of business, both in terms of the range of offerings and services and geographical operations, we may face or become subject to additional or different laws and regulations. Our potential liability for information or content created by third parties and posted to our platform could require us to implement additional measures to reduce our exposure to such liability, may require us to expend significant resources, may limit the desirability of our platform to hosts and guests, may cause damage to our brand or reputation, and may cause us to incur time and costs defending such claims in litigation, thereby materially adversely affecting our business, results of operations, and financial condition.
In the European Union, the Consumer Rights Directive and the Unfair Commercial Practices Directive harmonized consumer rights across the EU member states. In 2018, the European Commission and a group of European consumer protection authorities (through the Consumer Protection Cooperation Network) investigated our customer terms and price display practices, which required us to make certain changes to our terms and price display practices. If Consumer Protection Regulators find that we are in breach of consumer protection laws, we may be fined or required to change our terms and processes, which may result in increased operational costs. Consumers and certain Consumer Protection Associations may also bring individual claims against us if they believe that our terms and/or business practices are not in compliance with local consumer protection laws. Currently, class actions may also be brought in certain countries in the European Union, and the Collective Redress Directive will extend the right to collective redress across the European Union.
Home sharing may not achieve global acceptance.
While home sharing has grown in popularity, home sharing may not achieve global acceptance, particularly in regions where home sharing may not be deemed attractive to hosts and guests due to cultural considerations. The attractiveness of our platform for hosts and guests is impacted by a number of factors, including the willingness of individual hosts to offer their homes on our platform, the willingness of guests to book stays at homes in lieu of more traditional options, such as hotels, our ability to continue to extend our operating model internationally and offer localized services that are desirable to our hosts and guests, and our ability to offer cost-effective alternatives to traditional accommodations. Furthermore, both hosts and guests may be reluctant or unwilling to use our platform because of concerns regarding their safety or the quality of their stays. Many hosts and guests are apprehensive about or not willing to share homes due to concerns surrounding the transmission of COVID-19, and if they are willing to share homes, their ability to do so may be restricted by laws, rules, regulations, or decrees adopted in response to the COVID-19 pandemic.
This uncertainty surrounding acceptance of home sharing is exacerbated by the legacy system of laws and regulations that govern short and long-term accommodations, travel services, real estate brokerage services, and taxes, which generally does not directly address the online home sharing business model. If home sharing does not achieve global acceptance, our growth could be limited, which could materially adversely affect our business, results of operations, and financial condition.
Maintaining and enhancing our brand and reputation is critical to our growth, and negative publicity could damage our brand and thereby harm our ability to compete effectively, and could materially adversely affect our business, results of operations, and financial condition.
Our brand and our reputation are among our most important assets. Maintaining and enhancing our brand and reputation is critical to our ability to attract hosts, guests, and employees, to compete effectively, to
43
preserve and deepen the engagement of our existing hosts, guests, and employees, to maintain and improve our standing in the communities where our hosts operate, including our standing with community leaders and regulatory bodies, and to mitigate legislative or regulatory scrutiny, litigation, and government investigations. We are heavily dependent on the perceptions of hosts and guests who use our platform to help make word-of-mouth recommendations that contribute to our growth.
Any incident, whether actual or rumored to have occurred, involving the safety or security of listings, hosts, guests, or other members of the public, fraudulent transactions, or incidents that are mistakenly attributed to Airbnb, and any media coverage resulting therefrom, could create a negative public perception of our platform, which would adversely impact our ability to attract hosts and guests. In addition, when hosts cancel reservations or if we fail to provide timely refunds to guests in connection with cancellations, guest perception of the value of our platform is adversely impacted and may cause guests to not use our platform in the future. The impact of these issues may be more pronounced if we are seen to have failed to provide prompt and appropriate community support or our platform policies are perceived to be too permissive, too restrictive, or providing hosts and/or guests with unsatisfactory resolutions. We have been the subject of media reports, social media posts, blogs, and other forums that contain allegations about our business or activity on our platform that create negative publicity. As a result of these complaints and negative publicity, some hosts have refrained from, and may in the future refrain from, listing with us, and some guests have refrained from, and may in the future refrain from, using our platform, which could materially adversely affect our business, results of operations, and financial condition.
In addition, our brand and reputation could be harmed if we fail to act responsibly or are perceived as not acting responsibly, or fail to comply with regulatory requirements as interpreted by certain governments or agencies thereof, in a number of other areas, such as safety and security, data security, privacy practices, provision of information about users and activities on our platform, sustainability, human rights, diversity, non-discrimination, and support for employees and local communities. Media, legislative, or government scrutiny around our company, including the perceived impact on affordable housing and over-tourism, neighborhood nuisance, privacy practices, provision of information as requested by certain governments or agencies thereof, content on our platform, business practices and strategic plans, impact of travel on the environment, and public health policies that may cause geopolitical backlash, our business partners, private companies where we have minority investments, and our practices relating to our platform, offerings, employees, competition, litigation, and response to regulatory activity, could adversely affect our brand and our reputation with our hosts, guests and communities. Social media compounds the potential scope of the negative publicity that could be generated and the speed with which such negative publicity may spread. Any resulting damage to our brand or reputation could materially adversely affect our business, results of operations, and financial condition.
In addition, we rely on our hosts and guests to provide trustworthy reviews and ratings that our hosts or guests may rely upon to help decide whether or not to book a particular listing or accept a particular booking and that we use to enforce quality standards. We rely on these reviews to further strengthen trust among members of our community. Our hosts and guests may be less likely to rely on reviews and ratings if they believe that our review system does not generate trustworthy reviews and ratings. We have procedures in place to combat fraud or abuse of our review system, but we cannot guarantee that these procedures are or will be effective. In addition, if our hosts and guests do not leave reliable reviews and ratings, other potential hosts or guests may disregard those reviews and ratings, and our systems that use reviews and ratings to enforce quality standards would be less effective, which could reduce trust within our community and damage our brand and reputation, and could materially adversely affect our business, results of operations, and financial condition.
44
Host, guest, or third-party actions that are criminal, violent, inappropriate, or dangerous, or fraudulent activity, may undermine the safety or the perception of safety of our platform and our ability to attract and retain hosts and guests and materially adversely affect our reputation, business, results of operations, and financial condition.
We have no control over or ability to predict the actions of our users and other third parties, such as neighbors or invitees, either during the guest’s stay, experience, or otherwise, and therefore, we cannot guarantee the safety of our hosts, guests, and third parties. The actions of hosts, guests, and other third parties have resulted and can further result in fatalities, injuries, other bodily harm, fraud, invasion of privacy, property damage, discrimination, brand and reputational damage, which have created and could continue to create potential legal or other substantial liabilities for us. We do not verify the identity of all of our hosts and guests nor do we verify or screen third parties who may be present during a reservation made through our platform. Our identity verification processes rely on, among other things, information provided by hosts and guests, and our ability to validate that information and the effectiveness of third-party service providers that support our verification processes may be limited. In addition, we do not currently and may not in the future require users to re-verify their identity following their successful completion of the initial verification process. Certain verification processes, including legacy verification processes on which we previously relied, may be less reliable than others. We screen against certain regulatory, terrorist, and sanctions watch lists, conduct certain criminal background checks for U.S. hosts, U.S. guests, and hosts in India, and conduct additional screening processes to flag and investigate suspicious activities. These processes are beneficial but not exhaustive and have limitations due to a variety of factors, including laws and regulations that prohibit or limit our ability to conduct effective background checks in some jurisdictions, the unavailability of information, and the inability of our systems to detect all suspicious activity. There can be no assurances that these measures will significantly reduce criminal or fraudulent activity on our platform. The criminal background checks for U.S. hosts, U.S. guests, and hosts in India, and other screening processes rely on, among other things, information provided by hosts and guests, our ability to validate that information, the accuracy, completeness, and availability of the underlying information relating to criminal records, the digitization of certain records, the evolving regulatory landscape in this area such as in the data privacy space, and on the effectiveness of third-party service providers that may fail to conduct such background checks adequately or disclose information that could be relevant to a determination of eligibility, and we do not run criminal background checks and other screening processes on third parties who may be present during a reservation made through our platform.
In addition, we have not in the past and may not in the future undertake to independently verify the safety, suitability, location, quality, compliance with Airbnb policies or standards, and legal compliance, such as fire code compliance or the presence of carbon monoxide detectors, of all our hosts’ listings or experiences. We have not in the past and may not in the future undertake to independently verify the location, safety, or suitability of experiences for individual guests, the suitability, qualifications, or credentials of experiences hosts, or the qualifications of individual experiences guests. In the limited circumstances where we have undertaken the verification or screening of certain aspects of host qualifications, listings or experiences, the scope of such processes may be limited and rely on, among other things, information provided by hosts and guests and the ability of our internal teams or third-party vendors to adequately conduct such verification or screening practices. In addition, we have not in the past taken and may not in the future take steps to re-verify or re-screen host qualifications, listings, or experiences following initial review. We have in the past relied, and may in the future, rely on hosts and guests to disclose information relating to their listings and experiences and such information may be inaccurate or incomplete. We have created policies and standards to respond to issues reported with listings, but certain listings may pose heightened safety risks to individual users because those issues have not been reported to us or because our customer support
45
team has not taken the requisite action based on our policies. We rely, at least in part, on reports of issues from hosts and guests to investigate and enforce many of our policies and standards. In addition, our policies may not contemplate certain safety risks posed by listings or individual hosts or guests or may not sufficiently address those risks.
We have also faced civil litigation, regulatory investigations, and inquiries involving allegations of, among other things, unsafe or unsuitable listings, discriminatory policies, data processing, practices or behavior on and off our platform or by hosts, guests, and third parties, general misrepresentations regarding the safety or accuracy of offerings on our platform, and other host, guest, or third-party actions that are criminal, violent, inappropriate, dangerous, or fraudulent. While we recognize that we need to continue to build trust and invest in innovations that will support trust when it comes to our policies, tools, and procedures to protect hosts, guests, and the communities in which our hosts operate, we may not be successful in doing so. Similarly, listings that are inaccurate, of a lower than expected quality, or that do not comply with our policies may harm guests and public perception of the quality and safety of listings on our platform and materially adversely affect our reputation, business, results of operations, and financial condition.
If hosts, guests, or third parties engage in criminal activity, misconduct, fraudulent, negligent, or inappropriate conduct or use our platform as a conduit for criminal activity, consumers may not consider our platform and the listings on our platform safe, and we may receive negative media coverage, or be subject to involvement in a government investigation concerning such activity, which could adversely impact our brand and reputation, and lower the adoption rate of our platform. For example:
| • |
there have been shootings, fatalities, and other criminal or violent acts on properties booked on our platform, including as a result of unsanctioned house parties; |
| • |
there have been incidents of sexual violence against hosts, guests, and third parties, and we have seen higher incident rates of such conduct associated with private room and shared space listings; |
| • |
there have been undisclosed hidden cameras at properties; and |
| • |
there have been incidents of hosts and guests engaging in criminal, fraudulent, or unsafe behavior and other misconduct while using our platform. |
The methods used by perpetrators of fraud and other misconduct are complex and constantly evolving, and our trust and security measures have been, and may currently or in the future be, insufficient to detect and help prevent all fraudulent activity and other misconduct; for example:
| • |
there have been incidents where hosts have misrepresented both the quality and location of their properties, in some instances to send guests to different and inferior properties; |
| • |
there have been incidents where guests have caused substantial property damage to listings or misrepresented the purpose of their stay and used listings for unauthorized or inappropriate conduct including parties, sex work, drug-related activities, or to perpetrate criminal activities; |
| • |
there have been instances where users with connected or duplicate accounts have circumvented or manipulated our systems, in an effort to evade account restrictions, create false reviews, or engage in fraud or other misconduct; and |
| • |
situations have occurred where hosts or guests mistakenly or unintentionally provide malicious third parties access to their accounts, which has allowed those third parties to take advantage of our hosts and guests. |
46
In addition, certain regions where we operate have higher rates of violent crime or more relaxed safety standards, which can lead to more safety and security incidents, and may adversely impact the adoption of our platform in those regions and elsewhere.
If criminal, inappropriate, fraudulent, or other negative incidents continue to occur due to the conduct of hosts or guests or third parties, our ability to attract and retain hosts and guests would be harmed, and our business, results of operations, and financial condition would be materially adversely affected. Such incidents have prompted, and may in the future prompt, stricter home sharing regulations or regulatory inquiries into our platform policies and business practices. In the United States and other countries, we have seen listings being used for parties in violation of Airbnb’s policies which have in some cases resulted in neighborhood disruption or violence. Further, claims have been asserted against us from our hosts, guests, and third parties for compensation due to fatalities, accidents, injuries, assaults, theft, property damage, privacy and security issues, fraudulent listings, and other incidents that are caused by other hosts, guests, or third parties while using our platform. These claims subject us to potentially significant liability and increase our operating costs and could materially adversely affect our business, results of operations, and financial condition. We have obtained some third-party insurance, which is subject to certain conditions and exclusions, for claims and losses incurred based on incidents related to bookings on our platform. Even where we do have third-party insurance, such insurance may be inadequate to fully cover alleged claims of liability, investigation costs, defense costs, and/or payouts. Even if these claims do not result in liability, we could incur significant time and cost investigating and defending against them. As we expand our offerings and tiers, such as the addition of Airbnb Experiences, or if the quantity or severity of incidents increases, our insurance rates and our financial exposure will grow, which would materially adversely affect our business, results of operations, and financial condition.
Measures that we are taking to improve the trust and safety of our platform may cause us to incur significant expenditures and may not be successful.
We have taken and continue to take measures to improve the trust and safety on our platform, combat fraudulent activities and other misconduct and improve community trust, such as requiring identity and other information from hosts and guests, attempting to confirm the location of listings, removing suspected fraudulent listings or listings repeatedly reported by guests to be significantly not as described, and removing hosts and guests who fail to comply with our policies. These measures are long-term investments in our business and the trust and safety of our community; however, some of these measures increase friction on our platform by increasing the number of steps required to list or book, which reduces host and guest activity on our platform, and could materially adversely affect our business, results of operations, and financial condition. Implementing the trust and safety initiatives we have announced, which include, among other things, limited verification of hosts and listings, restrictions on “party” houses, manual screening of high-risk reservations, restrictions on certain types of bookings, and our neighbor hotline, or other initiatives, has caused and will continue to cause us to incur significant ongoing expenses and may result in fewer listings and bookings or reduced host and guest retention, which could materially adversely affect our business, results of operations, and financial condition. As we operate a global platform, the timing and implementation of these measures will vary across geographies. We have invested and plan to continue to invest significantly in the trust and safety of our platform, but there can be no assurances that these measures will be successful, significantly reduce criminal or fraudulent activity on or off our platform, or be sufficient to protect our reputation in the event of such activity.
Furthermore, we have established community standards, but those standards may not always be effectively enforced, communicated to, or consistently understood by all parts of our community. For example, while we require and communicate to hosts and guests to make certain commitments with
47
respect to diversity and belonging when they join Airbnb, these standards and requirements are not always well understood by all parts of our community. As a result, hosts and guests may be surprised or disappointed when their expectations are not met.
In response to the COVID-19 pandemic, we have instituted a number of policies and measures to address the use of our platform during the COVID-19 pandemic. In particular, we have launched cleaning programs and safety practices that are intended to help prevent transmission of COVID-19. All hosts outside of China are asked to commit to these standards, including a uniform five-step cleaning process (hosts in China maintain a separate cleaning program). We provide substantial additional resources and best practices to help hosts implement the cleaning process, including an enhanced cleaning protocol, checklists, and other written and visual materials. Each host is responsible for implementing the cleaning process. We are unable to control or verify the implementation of this process by each host, and following these programs may cause our hosts to incur significant expenditures, which may impact the attractiveness of our platform and may impact hosts’ willingness to list on our platform. Hosts who do not agree to follow these standards may also be suspended or removed from the platform, and our hosts may choose to list on other platforms instead of participating in our cleaning programs. If a significant number of hosts are removed or decide to list on other platforms as a result of our cleaning programs, our business, results of operations, and financial condition could be materially adversely affected. Hosts and guests must also agree to follow COVID-19-related safety practices, such as social distancing. If our hosts or guests do not follow the guidelines, they may suffer financial or other repercussions, which may make our platform less appealing and may impact our business. Further, such policies may not be successful in preventing the transmission of COVID-19. Cases of suspected COVID-19 exposure or infection during Airbnb reservations have been reported to us. If guests or hosts believe that booking stays or experiences on our platform poses heightened risks for contracting COVID-19 or other diseases, our reputation and business could be materially adversely affected, and it could give rise to legal claims against us.
We rely on traffic to our platform to grow revenue, and if we are unable to drive traffic cost-effectively, it would materially adversely affect our business, results of operations, and financial condition.
We believe that maintaining and strengthening our brand is an important aspect of our efforts to attract and retain hosts and guests. In particular, we rely on marketing to drive guest traffic to our platform. We have invested considerable resources into establishing and maintaining our brand. As a result of the COVID-19 pandemic, we realigned our organizational priorities to further increase our focus on individual hosts and brand marketing, while reducing performance marketing.
Our brand marketing efforts include a variety of online and offline marketing distribution channels. Our brand marketing efforts are expensive and may not be cost-effective or successful. For example, in November 2019, we announced a partnership with the International Olympic Committee for nine years to cover the next five Olympic Games. The COVID-19 pandemic has delayed the 2020 Olympics, and the continued uncertainty around COVID-19 and other geopolitical factors could undermine our ability to realize the value of the partnership. If our competitors spend increasingly more on brand marketing efforts, we may not be able to maintain and grow traffic to our platform.
We have used performance marketing products offered by search engines and social media platforms to distribute paid advertisements that drive traffic to our platform. For the year ended December 31, 2019 and the nine months ended September 30, 2020, approximately 23% and approximately 9%, respectively, of the traffic to our platform came from paid performance marketing channels. The remainder of our traffic in those periods came through direct or unpaid channels, which include brand marketing and search engine optimization (“SEO”). A critical factor in attracting hosts and guests to our platform is how prominently listings are displayed in response to search queries for key search terms. The success of home
48
sharing and our brand has led to increased costs for relevant keywords as our competitors competitively bid on our keywords, including our brand name. We have suspended substantially all performance marketing efforts as we take mitigating actions in relation to the impact of the COVID-19 pandemic. Our strategy is to increase brand marketing and use the strength of our brand to attract more guests via direct or unpaid channels and to decrease our performance marketing spend relative to 2019. However, we may not be successful at our efforts to drive traffic growth cost-effectively. If we are not able to effectively increase our traffic growth without increases in spend on performance marketing, we may need to increase our performance marketing spend in the future, including in response to increased spend on performance marketing from our competitors, and our business, results of operations, and financial condition could be materially adversely affected.
The technology that powers much of our performance marketing is increasingly subject to strict regulation, and regulatory or legislative changes could adversely impact the effectiveness of our performance marketing efforts and, as a result, our business. For example, we rely on the placement and use of “cookies” — text files stored on a host or guest’s web browser or device — to support tailored marketing to consumers. Many countries have adopted, or are in the process of adopting, regulations governing the use of cookies and similar technologies, and individuals may be required to “opt-in” to the placement of cookies used for purposes of marketing. For example, we are subject to evolving EU privacy laws on cookies and e-marketing. In the European Union, regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and current national laws that implement the ePrivacy Directive may be replaced by an EU Regulation, known as the ePrivacy Regulation, which will significantly increase fines for non-compliance. In the European Union, informed consent may be required for the placement of a cookie on a user’s device and for direct electronic marketing. The European General Data Protection Regulation 2016/679 (“GDPR”) also imposes conditions on obtaining valid consent. While the text of the ePrivacy Regulation is still under development, a recent European Court of Justice decision and regulators’ recent guidance are driving increased attention to cookies and tracking technologies under existing law. If regulators start to enforce the strict approach, this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs, and subject us to additional liabilities. Widespread adoption of regulations that significantly restrict our ability to use performance marketing technology could adversely affect our ability to market effectively to current and prospective hosts and guests, and thus materially adversely affect our business, results of operations, and financial condition.
We focus on unpaid channels such as SEO. SEO involves developing our platform in a way that enables a search engine to rank our platform prominently for search queries for which our platform’s content may be relevant. Changes to search engine algorithms or similar actions are not within our control, and could adversely affect our search-engine rankings and traffic to our platform. We believe that our SEO results have been adversely affected by the launch of Google Travel and Google Vacation Rental Ads, which reduce the prominence of our platform in organic search results for travel-related terms and placement on Google. To the extent that our brand and platform are listed less prominently or fail to appear in search results for any reason, we would need to increase our paid marketing spend which would increase our overall customer acquisition costs and materially adversely affect our business, results of operations, and financial condition. If Google or Apple uses its own mobile operating systems or app distribution channels to favor its own or other preferred travel service offerings, or impose policies that effectively disallow us to continue our full product offerings in those channels, there could be an adverse effect on our ability to engage with hosts and guests who access our platform via mobile apps or search.
Moreover, as guests increase their booking activity across multiple travel sites or compare offerings across sites, our marketing efficiency and effectiveness is adversely impacted, which could cause us to increase
49
our sales and marketing expenditures in the future, which may not be offset by additional revenue, and could materially adversely affect our business, results of operations, and financial condition. In addition, any negative publicity or public complaints, including those that impede our ability to maintain positive brand awareness through our marketing and consumer communications efforts, could harm our reputation and lead to fewer hosts and guests using our platform, and attempts to replace this traffic through other channels will require us to increase our sales and marketing expenditures.
Our debt obligations contain restrictions that impact our business and expose us to risks that could materially adversely affect our liquidity and financial condition. If we require additional funding to support our business, this additional funding may not be available on reasonable terms, or at all.
We have outstanding long-term indebtedness with a principal amount of $1,997.5 million as of September 30, 2020. The agreements governing our indebtedness (our “Credit Agreements”) contain various covenants that are operative so long as our Credit Agreements remain outstanding. The covenants, among other things, limit our and our subsidiaries’ abilities to:
| • |
incur additional indebtedness; |
| • |
create or incur additional liens; |
| • |
engage in certain fundamental changes, including mergers or consolidations; |
| • |
sell or transfer assets; |
| • |
pay dividends and distributions on our and our subsidiaries’ capital stock; |
| • |
make payments and prepayments of junior or unsecured indebtedness; |
| • |
make acquisitions, investments, loans, or advances; |
| • |
engage in certain transactions with affiliates; and |
| • |
enter into negative pledge clauses and clauses restricting subsidiary distributions. |
If we experience a decline in cash flow due to any of the factors described in these “Risk Factors” or otherwise, we could have difficulty paying interest and the principal amount of our outstanding indebtedness. If we are unable to generate sufficient cash flow or otherwise obtain the funds necessary to make required payments under our Credit Agreements, or if we fail to comply with the various requirements of our indebtedness, we could default under our Credit Agreements. Any such default that is not cured or waived could result in an acceleration of indebtedness then outstanding under our Credit Agreements, a requirement that we and our subsidiaries that have guaranteed our indebtedness pay the obligations in full, and would permit the lenders to exercise remedies with respect to all of the collateral that is securing our indebtedness, including substantially all of our and our subsidiary guarantors’ assets. We cannot be certain that our future operating results will be sufficient to ensure compliance with the covenants in our Credit Agreements or to remedy any defaults under our Credit Agreements.
Interest rates under our Credit Agreements are based partly on LIBOR, the London interbank offered rate, which is the basic rate of interest used in lending between banks on the London interbank market and is widely used as a reference for setting the interest rate on loans globally. LIBOR is currently expected to phase out by the end of 2021. It is unclear if at that time LIBOR will cease to exist or if new methods of calculating LIBOR will be established such that it continues to exist after 2021. The U.S. Federal Reserve has begun publishing a Secured Overnight Funding Rate which is currently intended to serve as an alternative
50
reference rate to LIBOR. If the method for calculation of LIBOR changes, if LIBOR is no longer available, or if lenders have increased costs due to changes in LIBOR, we may suffer from potential increases in interest rates on our borrowings. Further, we may need to renegotiate our Credit Agreements or any other borrowings that utilize LIBOR as a factor in determining the interest rate to replace LIBOR with the new standard that is established.
Since the COVID-19 pandemic, there has been increased volatility in the financial and securities markets, which has generally made access to capital less certain and increased the cost of obtaining new capital. As we manage through the slowdown in our business due to the COVID-19 pandemic, we cannot be sure that additional financing will be available to us on reasonable terms, or at all. In addition, the terms of future debt agreements could include more restrictive covenants, which could further restrict our business operations. If we cannot raise additional funds when we need them, our ability to continue to support our business and to respond to business challenges would be significantly limited, and our business, results of operations, and financial condition would be materially adversely affected.
Our substantial level of indebtedness could materially adversely affect our financial condition.
We have significant indebtedness that could materially adversely affect our business by:
| • |
increasing our vulnerability to general adverse economic and industry conditions; |
| • |
requiring us to dedicate a substantial portion of our cash flow from operations to payments on our indebtedness, thereby reducing the availability of our cash flow to fund working capital, capital expenditures, acquisitions, product development efforts, and other general corporate purposes; |
| • |
limiting our flexibility in planning for, or reacting to, changes in our business and the industry in which we operate; and |
| • |
exposing us to the risk of increased interest rates as our borrowings are, and may in the future be, at variable interest rates. |
The occurrence of any one of these events could have a material adverse effect on our business, results of operations, and financial condition, and ability to satisfy our obligations under our Credit Agreements.
If we are unable to manage the risks presented by our business model internationally, our business, results of operations, and financial condition would be materially adversely affected.
We are a global platform with hosts in more than 220 countries and regions and approximately 100,000 cities, and a global guest community. As of September 30, 2020, we had offices in 24 cities and had approximately 2,390 employees located internationally. For the year ended December 31, 2019 and the nine months ended September 30, 2020, 63% and 53% of our revenue, respectively, was generated from listings outside of the United States. We expect to continue to make investments to expand our international operations. Managing a global organization is difficult, time consuming, and expensive, and requires significant management attention and careful prioritization, and any international expansion efforts that we may undertake may not be successful. In addition, conducting international operations subjects us to risks, which include:
| • |
operational and compliance challenges caused by distance, language, and cultural differences; |
| • |
the cost and resources required to localize our platform and services, which often requires the translation of our platform into foreign languages and adaptation for local practices and regulatory requirements; |
51
| • |
unexpected, more restrictive, differing, and conflicting laws and regulations, including those laws governing Internet activities, short-term and long-term rentals (including those implemented in response to the COVID-19 pandemic), tourism, tenancy, taxes, licensing, payments processing, messaging, marketing activities, registration and/or verification of guests, ownership of intellectual property, content, data collection and privacy, security, data localization, data transfer and government access to personal information, and other activities important to our business; |
| • |
uncertainties regarding the interpretation of national and local laws and regulations, uncertainty in the enforceability of legal rights, and uneven application of laws and regulations to businesses, in particular U.S. companies; |
| • |
competition with companies that understand local markets better than we do, or that have a local presence and pre-existing relationships with potential hosts and guests in those markets; |
| • |
differing levels of social acceptance of home sharing, our brand, and offerings; |
| • |
legal uncertainty regarding our liability for the listings, the services, and content provided by hosts, guests, and other third parties; |
| • |
uncertain resolutions of litigation or regulatory inquiries; |
| • |
variations in payment forms for hosts and guests, increased operational complexity around payments, and inability to offer local payment forms like cash or country specific digital forms of payment; |
| • |
lack of familiarity and the burden of complying with a wide variety of U.S. and foreign laws, legal standards, and regulatory requirements, which are complex, sometimes inconsistent, and subject to unexpected changes; |
| • |
potentially adverse tax consequences, including resulting from the complexities of foreign corporate income tax systems, value added tax (“VAT”) regimes, tax withholding rules, lodging taxes, often known as transient or occupancy taxes, hotel taxes, and other indirect taxes, tax collection or remittance obligations, and restrictions on the repatriation of earnings; |
| • |
difficulties in managing and staffing international operations, including due to differences in legal, regulatory, and collective bargaining processes; |
| • |
fluctuations in currency exchange rates, and in particular, decreases in the value of foreign currencies relative to the U.S. dollar; |
| • |
regulations governing the control of local currencies and impacting the ability to collect and remit funds to hosts in those currencies or to repatriate cash into the United States; |
| • |
oversight by foreign government agencies whose approach to privacy or human rights may be inconsistent with that taken in other countries; |
| • |
increased financial accounting and reporting burdens, and complexities and difficulties in implementing and maintaining adequate internal controls in an international operating environment; |
| • |
political, social, and economic instability abroad, terrorist attacks, and security concerns in general; |
| • |
operating in countries that are more prone to crime or have lower safety standards; |
| • |
operating in countries that have higher risk of corruption; and |
| • |
reduced or varied protection for our intellectual property rights in some countries. |
52
Increased operating expenses, decreased revenue, negative publicity, negative reaction from our hosts and guests and other stakeholders, or other adverse impacts from any of the above factors or other risks related to our international operations could materially adversely affect our brand, reputation, business, results of operations, and financial condition.
In addition to the factors listed above, we have invested heavily to expand our operations in China, which is an intensely competitive market, both on the consumer side and from a talent perspective. We expect to continue to incur significant expenses to operate our business in China, and we may not achieve profitability in that market. As we expand our operations in China, the above factors, sentiment of the workforce in China, and China’s policy towards foreign direct investment may particularly impact our operations in China. Further, as we expand our operations in China, we expect to continue to make modifications to the way our website, mobile apps, offerings, and features function in China as compared to other countries. In addition, we need to ensure that our business practices in China are compliant with local laws and regulations, which may be interpreted and enforced in ways that are different from our interpretation, and/or create obligations on us that are costly to meet or conflict with laws in other jurisdictions.
As we disclose to our hosts and guests when they create or book a listing in China, we are subject to various requirements and requests from government agencies to share information on users who use or offer accommodation services through our platform in China. Failure to comply with such requests or other requirements as interpreted by government agencies may lead to impairment or disruption to our business and operations, including failing to obtain or losing the necessary licenses to operate in China, the blocking of our platform and services in China, and/or enforcement action against our host community, corporate entities or officers. Our failure to comply with such requests or requirements, or conversely our compliance with such requests or requirements, could materially adversely affect our brand, reputation, business, results of operations, and financial condition. Further, given that our headquarters is in the United States, any significant or prolonged deterioration in U.S.-China bilateral relations or escalation of geo-political risk in China could adversely affect our business.
In China, the Chinese government has adopted regulations that govern the dissemination of content over the Internet, and China’s first cybersecurity law (“CSL”) took effect in June 2017. The CSL and related regulations and implementation measures are continuing to develop, and it is uncertain what obligations will apply to us in the future. In particular, the CSL imposes high requirements for the operational security of facilities, including data localization requirements, for operators deemed to be part of the “critical information infrastructure.” However, the definition of “critical information infrastructure” is not precise, and there are substantial uncertainties as to its ultimate interpretation and whether it applies to us. Chinese regulators are also considering additional regulation restricting the transfer of personal data and important data outside of China, and we could become subject to data localization requirements in the future as a result of this regulation and/or newly-published industry-specific rules and regulations. If we are considered as an operator of “critical information infrastructure,” or if we become subject to restrictions under other measures or data localization requirements under other Chinese laws and regulations, we would incur substantial costs to comply or have to change our business practices in a manner that materially adversely affects our business, results of operations, and financial condition. Actions by the U.S. government could also impair our ability to effectively operate in China, including through the use of Executive Orders or trade blacklists to ban or limit the use of services provided by Chinese third parties.
We conduct our business in China through a variable interest entity (“VIE”) and a wholly-foreign owned entity. We do not own shares in our VIE and instead rely on contractual arrangements with the equity holders of our VIE to operate our business in China because foreign investment is restricted or prohibited.
53
Under our contractual arrangements, we must rely on the VIE and the VIE equity holders to perform their obligations in order to exercise our control over the VIE. The VIE equity holders may have conflicts of interest with us or our stockholders, and they may not act in our best interests or may not perform their obligations under these contracts. If our VIE or its equity holders fail to perform their respective obligations under the contractual arrangements, we may not be able to enforce our rights. In addition, if the Chinese government deems that the contractual arrangements in relation to our VIE do not comply with Chinese governmental restrictions on foreign investment, or if these regulations or their interpretation changes in the future, we could be subject to penalties, be forced to cease our operations in China, or be subject to restrictions in the future, and we may incur additional compliance costs. The contractual arrangements with our VIE may also be subject to scrutiny by the Chinese tax authorities and any adjustment of related party transaction pricing could lead to additional taxes.
We track certain operational metrics, which are subject to inherent challenges in measurement, and real or perceived inaccuracies in such metrics may harm our reputation and materially adversely affect our stock price, business, results of operations, and financial condition.
We track certain operational metrics, including metrics such as Nights and Experiences Booked, Gross Booking Value (“GBV”), active listings, active bookers, hosts, and guest arrivals, which may differ from estimates or similar metrics published by third parties due to differences in sources, methodologies, or the assumptions on which we rely. Our internal systems and tools are subject to a number of limitations, and our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our metrics, including the metrics we publicly disclose. If the internal systems and tools we use to track these metrics undercount or overcount performance or contain algorithmic or other technical errors, the data we report may not be accurate. While these numbers are based on what we believe to be reasonable estimates of our metrics for the applicable period of measurement, there are inherent challenges in measuring how our platform is used across large populations globally.
Our Nights and Experiences Booked and GBV metrics are adjusted for cancellations and alterations that happen in the reporting period. However, cancellations and alterations for bookings made in the reporting period can occur beyond the current reporting period. This results in a reported amount of Nights and Experiences Booked and GBV in the quarter of the booking for which all of the bookings may ultimately not result in check-ins, and subsequently reduces our Nights and Experiences Booked and GBV metrics in subsequent quarters when we experience cancellations. Cancellations and alterations to previously booked trips increased dramatically after the COVID-19 outbreak, as guests were either unable to travel or uncomfortable traveling. While the number of nights and experiences canceled in January 2020 was 13% of the gross nights and experiences booked that month, the number of nights and experiences canceled in March and April 2020 exceeded the number of gross nights and experiences booked during those months. If we experience high levels of cancellations in the future, our performance and related business metrics will be materially adversely affected.
The calculation of Nights and Experiences Booked, GBV, and active listings requires the ongoing collection of data on new offerings that are added to our platform over time. Our business is complex, and the methodology used to calculate Nights and Experiences Booked, GBV, and active listings may require future adjustments to accurately represent the full value of new offerings.
The number of active bookers on our platform is based on activity during a certain time period. Certain individuals may have more than one guest account and therefore may be counted more than once in our count of active bookers. We count the number of hosts on our platform based on the number of hosts with an available listing as of a certain date. Some individuals may have more than one host account and therefore may be counted more than once as hosts.
54
Our metrics, including our reported Nights and Experiences Booked, GBV, and active listings, may include fraudulent bookings, accounts, and other activities that have not been flagged by our trust and safety teams or identified by our machine learning algorithms or not yet addressed by our operational teams, which could mean these activities on our site are not identified or addressed in a timely manner or at all, reducing the accuracy of our metrics. Further, any such fraudulent activity, along with associated refunds and cancellations, would reduce our metrics, in particular Nights and Experiences Booked, GBV, and active listings, in the quarter in which it is discovered. Limitations or errors with respect to how we measure data or with respect to the data that we measure may affect our understanding of certain details of our business, which could affect our long-term strategies. If our operational metrics are not accurate representations of our business, or if investors do not perceive these metrics to be accurate, or if we discover material inaccuracies with respect to these figures, our reputation may be significantly harmed, our stock price could decline, we may be subject to stockholder litigation, and our business, results of operations, and financial condition could be materially adversely affected.
Our efforts to create new offerings and initiatives are costly, and if we are unable to successfully pursue such offerings and initiatives, we may fail to grow, and our business, results of operations, and financial condition would be materially adversely affected.
We need to continue to invest in the development of new offerings and initiatives that differentiate us from our competitors, such as Airbnb Experiences. Developing and delivering these new offerings and initiatives increase our expenses and our organizational complexity, and we may experience difficulties in developing and implementing these new offerings and initiatives.
Our new offerings and initiatives have a high degree of risk, as they may involve unproven businesses with which we have limited or no prior development or operating experience. There can be no assurance that consumer demand for such offerings and initiatives will exist or be sustained at the levels that we anticipate, that we will be able to successfully manage the development and delivery of such offerings and initiatives, or that any of these offerings or initiatives will gain sufficient market acceptance to generate sufficient revenue to offset associated expenses or liabilities. It is also possible that offerings developed by others will render our offerings and initiatives noncompetitive or obsolete. Further, these efforts entail investments in our systems and infrastructure, payments platform, and increased legal and regulatory compliance expenses, could distract management from current operations, and will divert capital and other resources from our more established offerings and geographies. Even if we are successful in developing new offerings and initiatives, regulatory authorities may subject us or our hosts and guests to new rules, taxes, or restrictions or more aggressively enforce existing rules, taxes, or restrictions, that could increase our expenses or prevent us from successfully commercializing these initiatives. If we do not realize the expected benefits of our investments, we may fail to grow and our business, results of operations, and financial condition would be materially adversely affected.
If we fail to comply with federal, state, and foreign laws relating to privacy and data protection, we may face potentially significant liability, negative publicity, an erosion of trust, and increased regulation could materially adversely affect our business, results of operations, and financial condition.
Privacy and data protection laws, rules, and regulations are complex, and their interpretation is rapidly evolving, making implementation and enforcement, and thus compliance requirements, ambiguous, uncertain, and potentially inconsistent. Compliance with such laws may require changes to our data collection, use, transfer, disclosure, other processing, and certain other related business practices and may thereby increase compliance costs or have other material adverse effects on our business. As part of host and guest registration and business processes, we collect and use personal data, such as names, dates of birth, email addresses, phone numbers, and identity verification information (for example, government
55
issued identification or passport), as well as credit card or other financial information that hosts and guests provide to us. The laws of many states and countries require businesses that maintain such personal data to implement reasonable measures to keep such information secure and otherwise restrict the ways in which such information can be collected and used.
For example, the GDPR, which became effective on May 25, 2018, has resulted and will continue to result in significantly greater compliance burdens and costs for companies like ours. The GDPR regulates our collection, control, processing, sharing, disclosure, and other use of data that can directly or indirectly identify a living individual (“personal data”), and imposes stringent data protection requirements with significant penalties, and the risk of civil litigation, for noncompliance.
Failure to comply with the GDPR may result in fines of up to 20 million Euros or up to 4% of the annual global revenue of the infringer, whichever is greater. It may also lead to civil litigation, with the risks of damages or injunctive relief, or regulatory orders adversely impacting on the ways in which our business can use personal data. Many large geographies, which are important to our success, including Australia, Brazil, Canada, China, and India, have passed or are in the process of passing comparable or other robust data privacy legislation or regulation, which may lead to additional costs and increase our overall risk exposure.
In addition, from the beginning of 2021 (when the transitional period following Brexit expires), we will be required to comply with the GDPR and also the UK equivalent, with each regime having the ability to fine up to the greater of 20 million Euros (17 million British Pounds) or 4% of global turnover. The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, for example, how data transfers between EU member states and the United Kingdom will be treated and the role of the United Kingdom’s Information Commissioner’s Office with respect to the European Union following the end of the transitional period. These changes will lead to additional costs and increase our overall risk exposure.
Additionally, we are subject to laws, rules, and regulations regarding cross-border transfers of personal data, including laws relating to transfer of personal data outside the European Economic Area (“EEA”). Recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States and other jurisdictions; for example, on July 16, 2020, the CJEU invalidated the EU-US Privacy Shield Framework (“Privacy Shield”) under which personal data could be transferred from the EEA to US entities that had self-certified under the Privacy Shield scheme. While the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it noted that reliance on them alone may not necessarily be sufficient in all circumstances; this has created uncertainty and increased the risk around our international operations.
In addition to other mechanisms (particularly standard contractual clauses), we previously relied on our own Privacy Shield certification and, in limited instances, the Privacy Shield certifications of third parties (for example, vendors and partners) for the purposes of transferring personal data from the EEA to the United States. We continue to rely on the standard contractual clauses to transfer personal data outside the EEA, including to the United States. Additionally, in certain circumstances, we rely on derogations provided for by law.
These recent developments may require us to review and amend the legal mechanisms by which we make and, or, receive personal data transfers to the United States and other jurisdictions. As our lead supervisory authorities (the Irish Data Protection Commission, the Luxembourg National Commission for Data
56
Protection and, until the end of 2020, the British ICO), the European Data Protection Board, and other data protection regulators issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.
In the United States, federal law, such as the Gramm-Leach-Bliley Act of 1999 (“GLBA”) and its implementing regulations, restricts certain collection, processing, storage, use, and disclosure of personal information, requires notice to individuals of privacy practices and provides individuals with certain rights to prevent the use and disclosure of certain nonpublic or otherwise legally protected information. These rules also impose requirements for the safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines. The U.S. government, including Congress, the Federal Trade Commission and the Department of Commerce, has announced that it is reviewing the need for greater regulation for the collection of information concerning consumer behavior on the Internet, including regulation aimed at restricting certain targeted advertising practices. Numerous states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and processing of state residents’ personal data. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020. The CCPA establishes a new privacy framework for covered businesses such as ours, and may require us to modify our data processing practices and policies and incur compliance related costs and expenses. The CCPA provides new and enhanced data privacy rights to California residents, such as affording consumers the right to access and delete their information and to opt out of certain sharing and sales of personal information. The law also prohibits covered businesses from discriminating against consumers (for example, charging more for services) for exercising any of their CCPA rights. The CCPA imposes severe statutory damages as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action is expected to increase the likelihood of, and risks associated with, data breach litigation. It remains unclear how various provisions of the CCPA will be interpreted and enforced. In November 2020, California voters passed the California Privacy Rights and Enforcement Act of 2020 (“CPRA”). The CPRA further expands the CCPA with additional data privacy compliance requirements that may impact our business, and establishes a regulatory agency dedicated to enforcing those requirements. The CPRA and the CCPA may lead other states to pass comparable legislation, with potentially greater penalties, and more rigorous compliance requirements relevant to our business. The effects of the CPRA, the CCPA, and other similar state or federal laws, are significant and may require us to modify our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation.
Various other governments and consumer agencies around the world have also called for new regulation and changes in industry practices and many have enacted different and often contradictory requirements for protecting personal information collected and maintained electronically. Compliance with numerous and contradictory requirements of different jurisdictions is particularly difficult and costly for an online business such as ours, which collects personal information from hosts, guests, and other individuals in multiple jurisdictions. If any jurisdiction in which we operate adopts news laws or changes its interpretation of its laws, rules, or regulations relating to data residency or localization such that we are unable to comply in a timely manner or at all, we could risk losing our rights to operate in such jurisdictions. While we have invested and continue to invest significant resources to comply with GDPR, GLBA, CCPA, and other privacy regulations around the world, many of these regulations expose us to the possibility of material penalties, significant legal liability, changes in how we operate or offer our products, and interruptions or cessation of
57
our ability to operate in key geographies, any of which could materially adversely affect our business, results of operations, and financial condition.
Furthermore, to improve the trust and safety on our platform, we conduct certain verification procedures aimed at our hosts, guests, and listings in certain jurisdictions. Such verification procedures may include utilizing public information on the Internet, accessing public databases such as court records, utilizing third-party vendors to analyze host or guest data, or physical inspection. These types of activities may expose us to the risk of regulatory enforcement from privacy regulators and civil litigation.
When we are required to disclose personal data pursuant to demands from government agencies, including tax authorities, state and city regulators, law enforcement agencies, and intelligence agencies, our hosts, guests, and privacy regulators could perceive such disclosure as a failure by us to comply with privacy and data protection policies, notices, and laws, which could result in proceedings or actions against us in the same or other jurisdictions. Conversely, if we do not provide the requested information to government agencies due to a disagreement on the interpretation of the law, we are likely to face enforcement action from such government, engage in litigation, face increased regulatory scrutiny, and experience an adverse impact on our relationship with governments or our ability to offer our services within certain jurisdictions. Any of the foregoing could materially adversely affect our brand, reputation, business, results of operations, and financial condition.
Our business also increasingly relies on artificial intelligence and automated decision making to improve our services and tailor our interactions with our customers. However, in recent years use of these methods has come under increased regulatory scrutiny. New laws, guidance and/or decisions in this area may limit our ability to use our artificial intelligence models, or require us to make changes to our operations that may decrease our operational efficiency, result in an increase to operating costs and/or hinder our ability to improve our services. For example, there are specific rules on the use of automated decision making under the GDPR that require the existence of automated decision making to be disclosed to the data subject with a meaningful explanation of the logic used in such decision making in certain circumstances, and safeguards must be implemented to safeguard individual rights, including the right to obtain human intervention and to contest any decision. Further, California recently introduced a law requiring disclosure of chatbot functionality.
Any failure or perceived failure by us to comply with privacy and data protection policies, notices, laws, rules, and regulations could result in proceedings or actions against us by individuals, consumer rights groups, government agencies, or others. We could incur significant costs in investigating and defending such claims and, if found liable, pay significant damages or fines or be required to make changes to our business. Further, these proceedings and any subsequent adverse outcomes may subject us to significant negative publicity, and an erosion of trust. If any of these events were to occur, our business, results of operations, and financial condition could be materially adversely affected.
If we fail to prevent data security breaches, there may be damage to our brand and reputation, material financial penalties, and legal liability, along with a decline in use of our platform, which would materially adversely affect our business, results of operations, and financial condition.
There are risks of security breaches both on and off our systems as we increase the types of technology we use to operate our platform, including mobile apps and third-party payment processing providers, and as we collaborate with third parties that may need to process our host or guest data or have access to our infrastructure. The evolution of technology systems introduces ever more complex security risks that are difficult to predict and defend against. An increasing number of companies, including those with significant online operations, have recently disclosed breaches of their security, some of which involved
58
sophisticated tactics and techniques allegedly attributable to criminal enterprises or nation-state actors. While we take significant measures to guard against the type of activity that can lead to data breaches, the techniques used by bad actors to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and often are unknown until launched against a target. As such, we may be unable to anticipate these tactics and techniques or to implement adequate preventative measures.
Further, with a large geographically disparate employee base, we are not immune from the possibility of a malicious insider compromising our information systems and infrastructure. This risk has grown in light of the greater adoption of remote work as a response to the COVID-19 pandemic. We also have a distributed community support organization including third-party providers that have access to personal information. We and other companies in our industry have dealt with incidents involving such insiders exfiltrating the personal data of customers, stealing corporate trade secrets and key financial metrics, and illegally diverting funds. No series of measures can fully safeguard against a sufficiently determined and skilled insider threat.
In addition, bad actors have targeted and will continue to target our hosts and guests directly with attempts to breach the security of their email accounts or management systems, such as through phishing attacks where a third party attempts to infiltrate our systems or acquire information by posing as a legitimate inquiry or electronic communication, which are fraudulent identity theft schemes designed to appear as legitimate emails from us or from our hosts or guests, partners, or vendors. We have seen many instances of our hosts and guests falling prey to such schemes, which result in their accounts being taken over by fraudsters intent on perpetrating fraud against them, other users, and our platform. Bad actors may also employ other schemes aimed at defrauding our hosts or guests in ways that we may not anticipate or be able to adequately guard against. Even if phishing and spamming attacks and other fraud schemes are not carried out through our systems, victims may nevertheless seek recovery from us. Because of our prominence, we believe that we are a particularly attractive target for such attacks. Though it is difficult to determine what, if any, harm may directly result from any specific scheme or attack, any failure to maintain performance, reliability, security, and availability of our offerings, services, and technical infrastructure to the satisfaction of our hosts and guests may harm our reputation and our ability to retain existing hosts and guests and attract new hosts and guests. The ability of fraudsters to directly target our hosts and guests with fraudulent communications, or cause an account takeover, exposes us to significant financial fraud risk, including costly litigation, which is difficult to fully mitigate.
Generally, our practice is to encrypt certain sensitive data when it is in transit and at rest. However, we do not know whether our current practice will be deemed sufficient under applicable laws or whether new regulatory requirements might make our current practice insufficient. Moreover, the existence of encryption, in-and-of itself, is not a completely perfect security solution. If there is a breach of our computer systems and we know or suspect that certain personal data has been exfiltrated, accessed, or used inappropriately, we may need to inform the host or guest whose data was stolen, accessed, or used, and may be subject to significant fines and penalties. Further, under certain regulatory schemes, such as the CCPA, we may be liable for statutory damages on a per breached record basis, irrespective of any actual damages or harm to the individual. This means that in the event of a breach we could face government scrutiny or consumer class actions alleging statutory damages amounting to hundreds of millions, and possibly billions of dollars.
Our information technology infrastructure may be vulnerable to computer viruses or physical or electronic intrusions that our security measures may not detect. We have experienced security incidents in the past, and we may face additional attempted security intrusions in the future. Any circumvention of our security measures could result in the misappropriation of confidential or proprietary information, interrupt our
59
operations, result in financial loss, damage our computers or those of our hosts and guests, or otherwise cause damage to our reputation and business. Further, the ability to bypass our information security controls could degrade our trust and safety programs, which could expose individuals to a risk of physical harm or violence.
We rely on third-party service providers, including financial institutions, to process some of our data and that of our hosts and guests, including payment information, and any failure by such third parties to prevent or mitigate security breaches or improper access to, or disclosure of, such information could have adverse consequences for us similar to an incident directly on our systems.
We have acquired and will continue to acquire companies that are vulnerable to security breaches, and we are responsible for any security breaches of these newly acquired companies. While we conduct due diligence of these companies, we do not have access to the full operating history of the companies and cannot be certain there have not been security breaches prior to our acquisition.
We expend, and expect to continue to expend, significant resources to protect against security related incidents and address problems caused by such incidents. Even if we were to expend more resources, regulators and complainants may not deem our efforts sufficient, and regardless of the expenditure, the risk of security related incidents cannot be fully mitigated. We have a heightened risk of security breaches due to some of our operations being located in certain international jurisdictions. Any actual or alleged security breaches or alleged violations of federal, state, or foreign laws or regulations relating to privacy and data security could result in mandated user notifications, litigation, government investigations, significant fines, and expenditures; divert management’s attention from operations; deter people from using our platform; damage our brand and reputation; force us to cease operations for some length of time; and materially adversely affect our business, results of operations, and financial condition. Defending against claims or litigation based on any security breach or incident, regardless of their merit, will be costly and may cause reputation harm. The successful assertion of one or more large claims against us that exceed available insurance coverage, denial of coverage as to any specific claim, or any change or cessation in our insurance policies and coverages, including premium increases or the imposition of large deductible requirements, could have a material adverse effect on our business, results of operations, and financial condition.
Our platform is highly complex, and any undetected errors could materially adversely affect our business, results of operations, and financial condition.
Our platform is a complex system composed of many interoperating components and software. Our business is dependent upon our ability to prevent system interruption on our platform. Our software, including open source software that is incorporated into our code, may now or in the future contain undetected errors, bugs, or vulnerabilities. Some errors in our software code have not been and may not be discovered until after the code has been released. We have, from time to time, found defects or errors in our system and software limitations that have resulted in, and may discover additional issues in the future that could result in, platform unavailability or system disruption. For example, defects or errors have resulted in and could result in the delay in making payments to hosts or overpaying or underpaying hosts, which would impact our cash position and may cause hosts to lose trust in our payment operations. Any errors, bugs, or vulnerabilities discovered in our code or systems released to production or found in third-party software, including open source software, that is incorporated into our code, any misconfigurations of our systems, or any unintended interactions between systems could result in poor system performance, an interruption in the availability of our platform, incorrect payments, negative publicity, damage to our reputation, loss of existing and potential hosts and guests, loss of revenue, liability for damages, a failure to
60
comply with certain legal or tax reporting obligations, and regulatory inquiries or other proceedings, any of which could materially adversely affect our business, results of operations, and financial condition.
System capacity constraints, system or operational failures, or denial-of-service or other attacks could materially adversely affect our business, results of operations, and financial condition.
Since our founding, we have experienced rapid growth in consumer traffic to our platform. If our systems and network infrastructure cannot be expanded or are not scaled to cope with increased demand or fail to perform, we could experience unanticipated disruptions in service, slower response times, decreased customer satisfaction, and delays in the introduction of new offerings and tiers. It may be particularly difficult for us to manage these issues during the COVID-19 pandemic and the related governmentally mandated shelter at home orders, as a result of which few, if any, of our employees are physically present in our headquarters.
Our corporate headquarters, a significant portion of our research and development activities, and certain other critical business operations are located in San Francisco, built on a high-risk liquefaction zone and is near major earthquake fault lines. Our systems and operations are vulnerable to damage or interruption from human error, computer viruses, earthquakes, floods, fires, power loss, and similar events. In addition, Northern California has recently experienced, and may continue to experience power outages during the fire season and our headquarters does not have power generator backup to maintain full business continuity. A catastrophic event that results in the destruction or disruption of our headquarters, any third-party cloud hosting facilities, or our critical business or information technology systems could severely affect our ability to conduct normal business operations and result in lengthy interruptions or delays of our platform and services.
Our systems and operations are also subject to break-ins, sabotage, intentional acts of vandalism, terrorism, and similar misconduct from external sources and malicious insiders. Our existing security measures may not be successful in preventing attacks on our systems, and any such attack could cause significant interruptions in our operations. For instance, from time to time, we have experienced denial-of-service type attacks on our systems that have made portions of our platform slow or unavailable for periods of time. There are numerous other potential forms of attack, such as phishing, account takeovers, malicious code injections, ransomware, and the attempted use of our platform to launch a denial-of-service attack against another party, each of which could cause significant interruptions in our operations or involve us in legal or regulatory proceedings. Reductions in the availability and response time of our online platform could cause loss of substantial business volumes during the occurrence of any such attack on our systems and measures we may take to divert suspect traffic in the event of such an attack could result in the diversion of bona fide customers. These issues are likely to become more difficult to manage as we expand the number of places where we operate and the variety of services we offer, and as the tools and techniques used in such attacks become more advanced and available. Successful attacks could result in negative publicity and damage to our reputation, and could prevent consumers from booking or visiting our platform during the attack, any of which could materially adversely affect our business, results of operations, and financial condition.
In the event of certain system failures, we may not be able to switch to back-up systems immediately and the time to full recovery could be prolonged. We have experienced system failures from time to time. In addition to placing increased burdens on our engineering staff, these outages create a significant amount of consumer questions and complaints that need to be addressed by our community support team. Any unscheduled interruption in our service could result in an immediate and significant loss of revenue, an increase in community support costs, and harm our reputation, and could result in some consumers switching to our competitors. If we experience frequent or persistent system failures, our brand and
61
reputation could be permanently and significantly harmed, and our business, results of operations, and financial condition could be materially adversely affected. While we have taken and continue to take steps to increase the reliability and redundancy of our systems, these steps are expensive and may not be completely effective in reducing the frequency or duration of unscheduled downtime. We do not carry business interruption insurance sufficient to compensate us for all losses that may occur.
We use both internally developed systems and third-party systems to operate our platform, including transaction and payment processing, and financial and accounting systems. If the number of consumers using our platform increases substantially, or if critical third-party systems stop operating as designed, we may need to significantly upgrade, expand, or repair our transaction and payment processing systems, financial and accounting systems, and other infrastructure. We may not be able to upgrade our systems and infrastructure to accommodate such conditions in a timely manner, and depending on the systems affected, our transaction and payment processing, and financial and accounting systems could be impacted for a meaningful amount of time, which could materially adversely affect our business, results of operations, and financial condition.
Our business depends on the performance and reliability of the Internet, mobile, telecommunications network operators, and other infrastructures that are not under our control. As consumers increasingly turn to mobile devices, we also become dependent on consumers’ access to the Internet through mobile carriers and their systems. Disruptions in Internet access, whether generally, in a specific region or otherwise, could materially adversely affect our business, results of operations, and financial condition.
Uncertainty in the application of taxes to our hosts, guests, or platform could increase our tax liabilities and may discourage hosts and guests from conducting business on our platform.
We are subject to a variety of taxes and tax collection obligations in the United States (federal, state, and local) and numerous foreign jurisdictions. We have received communications from numerous foreign, federal, state, and local governments regarding the application of tax laws or regulations to our business or demanding data about our hosts and guests to aid in threatened or actual enforcement actions against our hosts and guests. In many jurisdictions where applicable, we have agreed to collect and remit lodging taxes, often known as transient or occupancy taxes, to local governments directly on behalf of our hosts. In other jurisdictions, hosts are responsible for collecting and remitting lodging taxes to their local government. We have been subject to complaints by, and are involved in a number of lawsuits brought by, certain government entities for alleged responsibility for indirect taxes, host income withholding taxes, and other duties relating to short-term occupancy rentals and other aspects of our business. In some jurisdictions we are in the process of discussing potential agreements to resolve alleged past-due taxes, and in other jurisdictions, the regulators have held us liable for such past and future taxes. A number of jurisdictions have proposed or implemented new tax laws or interpreted existing laws to explicitly apply their hotel and hospitality taxes to businesses like ours. Laws and regulations relating to taxes as applied to our platform, and to our hosts and guests, vary greatly among jurisdictions, and it is difficult or impossible to predict how such laws and regulations will be applied.
The application of indirect taxes, such as lodging taxes, hotel, sales and use tax, privilege taxes, excise taxes, VAT, goods and services tax, harmonized sales taxes, business tax, and gross receipt taxes (together, “indirect taxes”) to e-commerce activities such as ours and to our hosts or guests is a complex and evolving issue. Some of such tax laws or regulations hold us responsible for the reporting, collection, and payment of such taxes, and such laws could be applied to us for transactions conducted in the past as well as transactions in the future. Many of the statutes and regulations that impose these taxes were established before the adoption and growth of the Internet and e-commerce. New or revised foreign, federal, state, or local tax regulations may subject us or our hosts and guests to additional indirect, income,
62
and other taxes, and depending upon the jurisdiction could subject us or our hosts and guests to significant monetary penalties and fines for non-payment of taxes. An increasing number of jurisdictions are considering adopting or have adopted laws or administrative practices that impose new tax measures, including digital platform revenue-based taxes, targeting online sharing platforms and online marketplaces, and new obligations to collect host income taxes, sales, consumption, value added, or other taxes on digital platforms. We may recognize additional tax expenses and be subject to additional tax liabilities, and our business, results of operations, and financial condition could be materially adversely affected by additional taxes of this nature or additional taxes or penalties resulting from our failure to comply with any reporting, collection, and payment obligations. We accrue a reserve for such taxes, and upon examination or audit, such reserves may be insufficient.
New or revised taxes and, in particular, the taxes described above and similar taxes would likely increase the price paid by guests, the cost of doing business for our hosts, discourage hosts and guests from using our platform, and lead to a decline in revenue, and materially adversely affect our business, results of operations, and financial condition. If we are required to disclose personal data pursuant to demands from government agencies for tax reporting purposes, our hosts, guests, and regulators could perceive such disclosure as a failure by us to comply with privacy and data protection policies, notices, and laws and commence proceedings or actions against us. If we do not provide the requested information to government agencies due to a disagreement on the interpretation of the law, we are likely to face enforcement action, engage in litigation, face increased regulatory scrutiny, and experience an adverse impact in our relationships with governments. Our competitors may arrive at different or novel solutions to the application of taxes to analogous businesses that could cause our hosts and guests to leave our platform in favor of conducting business on the platforms of our competitors. This uncertainty around the application of taxes and the impact of those taxes on the actual or perceived value of our platform may also cause guests to use OTAs, hotels, or other traditional travel services. Any of these events could materially adversely affect our brand, reputation, business, results of operations, and financial condition.
We devote significant resources, including management time, to the application and interpretation of laws and working with various jurisdictions to clarify whether taxes are applicable and the amount of taxes that apply. The application of indirect taxes to our hosts, guests, and our platform significantly increases our operational expenses as we build the infrastructure and tools to capture data and to report, collect, and remit taxes. Even if we are able to build the required infrastructure and tools, we may not be able to complete them in a timely fashion, in particular given the speed at which regulations and their interpretations can change, which could harm our relationship with governments and our reputation, and result in enforcement actions and litigation. The lack of uniformity in the laws and regulations relating to indirect taxes as applied to our platform and to our hosts and guests further increases the operational and financial complexity of our systems and processes, and introduces potential for errors or incorrect tax calculations, all of which are costly to our business and results of operations. Certain regulations may be so complex as to make it infeasible for us to be fully compliant. As our business operations expand or change, including as a result of introducing new or enhanced offerings, tiers or features, or due to acquisitions, the application of indirect taxes to our business and to our hosts and guests will further change and evolve, and could further increase our liability for taxes, discourage hosts and guests from using our platform, and materially adversely affect our business, results of operations, and financial condition.
63
We face possible risks associated with natural disasters and the physical effects of climate change, which may include more frequent or severe storms, hurricanes, flooding, rising sea levels, shortages of water, droughts and wildfires, any of which could have a material adverse effect on our business, results of operations, and financial condition.
We are subject to the risks associated with natural disasters and the physical effects of climate change, which may include more frequent or severe storms, hurricanes, flooding, rising sea levels, shortages of water, droughts, and wildfires, any of which could have a material adverse effect on our business, results of operations, and financial condition. To the extent climate change causes changes in weather patterns, our coastal destinations could experience increases in storm intensity and rising sea-levels causing damage to our hosts’ properties and result in a reduced number of listings in these areas. Climate change may also affect our business by increasing the cost of, or making unavailable, property insurance on terms our hosts find acceptable in areas most vulnerable to such events, increasing operating costs for our hosts, including the cost of water or energy, and requiring our hosts to expend funds as they seek to repair and protect their properties in connection with such events. As a result of the foregoing and other climate-related issues, our hosts may decide to remove their listings from our platform. If we are unable to provide listings in certain areas due to climate change, we may lose both guests and hosts, which could have a material adverse effect on our business, results of operations, and financial condition.
We may experience significant fluctuations in our results of operations, which make it difficult to forecast our future results.
Our results of operations may vary significantly and are not necessarily an indication of future performance. We experience seasonal fluctuations in our financial results. We experience seasonality in our GBV and Nights and Experiences Booked, and seasonality in Adjusted EBITDA that is consistent with seasonality of our revenue, which has historically been, and is expected to continue to be, highest in the third quarter when we have the most check-ins as it is the peak travel season for North America and EMEA. We recognize revenue upon the completion of a check-in. As our business matures, other seasonal trends may develop, or these existing seasonal trends may become more extreme. In addition to seasonality, our results of operations may fluctuate as a result of a variety of other factors, some of which are beyond our control, including:
| • |
reduced travel and cancellations due to other events beyond our control such as health concerns, including the COVID-19 pandemic, other epidemics and pandemics, natural disasters, wars, regional hostilities or law enforcement demands and other regulatory actions; |
| • |
periods with increased investments in our platform for existing offerings, new offerings and initiatives, marketing, and the accompanying growth in headcount; |
| • |
our ability to maintain growth and effectively manage that growth; |
| • |
increased competition; |
| • |
our ability to expand our operations in new and existing regions; |
| • |
changes in governmental or other regulations affecting our business; |
| • |
changes to our internal policies or strategies; |
| • |
harm to our brand or reputation; and |
| • |
other risks described elsewhere in this prospectus. |
64
As a result, we may not accurately forecast our results of operations. Moreover, we base our expense levels and investment plans on estimates for revenue that may turn out to be inaccurate. A significant portion of our expenses and investments are fixed, and we may not be able to adjust our spending quickly enough if our revenue is less than expected, resulting in losses that exceed our expectations. If our assumptions regarding the risks and uncertainties that we use to plan our business are incorrect or change, or if we do not address these risks successfully, our results of operations could differ materially from our expectations and our business, results of operations, and financial condition could be materially adversely affected.
We currently rely on a number of third-party service providers to host and deliver a significant portion of our platform and services, and any interruptions or delays in services from these third parties could impair the delivery of our platform and services, and our business, results of operations, and financial condition could be materially adversely affected.
We rely primarily on Amazon Web Services in the United States and abroad to host and deliver our platform. Third parties also provide services to key aspects of our operations, including Internet connections and networking, data storage and processing, trust and safety, security infrastructure, source code management, and testing and deployment. In addition, we rely on third parties for many aspects of our payments platform and a significant portion of our community support operations are conducted by third parties at their facilities. We also rely on Google Maps and other third-party services for maps and location data that are core to the functionality of our platform, and we integrate applications, content, and data from third parties to deliver our platform and services.
We do not control the operation, physical security, or data security of any of these third-party providers. Despite our efforts to use commercially reasonable diligence in the selection and retention of such third-party providers, such efforts may be insufficient or inadequate to prevent or remediate such risks. Our third-party providers, including our cloud computing providers and our payment processing partners, may be subject to intrusions, computer viruses, denial-of-service attacks, sabotage, acts of vandalism, acts of terrorism, and other misconduct. They are vulnerable to damage or interruption from power loss, telecommunications failures, fires, floods, earthquakes, hurricanes, tornadoes, and similar events; and they may be subject to financial, legal, regulatory, and labor issues, each of which may impose additional costs or requirements on us or prevent these third parties from providing services to us or our customers on our behalf. In addition, these third parties may breach their agreements with us, disagree with our interpretation of contract terms or applicable laws and regulations, refuse to continue or renew these agreements on commercially reasonable terms or at all, fail to or refuse to process transactions or provide other services adequately, take actions that degrade the functionality of our platform and services, increase prices, impose additional costs or requirements on us or our customers, or give preferential treatment to our competitors. If we are unable to procure alternatives in a timely and efficient manner and on acceptable terms, or at all, we may be subject to business disruptions, losses, or costs to remediate any of these deficiencies. Our systems currently do not provide complete redundancy of data storage or processing or payment processing. Although we are in the process of developing a comprehensive business continuity and disaster recovery plans for all of our operations, there is no guarantee that such plans will be effective. The occurrence of any of the above events could result in hosts and guests ceasing to use our platform, reputational damage, legal or regulatory proceedings, or other adverse consequences, which could materially adversely affect our business, results of operations, and financial condition.
65
We may raise additional capital in the future or otherwise issue equity, which could have a dilutive effect on existing stockholders and adversely affect the market price of our common stock.
We may from time to time issue additional shares of Class A common stock. As a result, our stockholders may experience immediate dilution. We may engage in equity or debt financings to secure additional funds. If we raise additional funds through future issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences, and privileges superior to those of holders of our Class A common stock. In addition, our stockholders will experience additional dilution when option holders exercise their right to purchase common stock under our equity incentive plans, when RSUs vest and settle, when we issue equity awards to our employees under our equity incentive plans, or when we otherwise issue additional equity.
Should we require additional funding, we cannot be sure that it will be available to us on reasonable terms, or at all. If we cannot raise additional funds when we need them, our ability to continue to support our business and to respond to business challenges would be significantly limited, and our business, results of operations, and financial condition would be materially adversely affected.
The coverage afforded under our insurance policies may be inadequate for the needs of our business or our third-party insurers may be unable or unwilling to meet our coverage requirements, which could materially adversely affect our business, results of operations, and financial condition.
We use a combination of third-party insurance and self-insurance, including a wholly-owned captive insurance subsidiary established in 2019, to manage the exposures related to our business operations. We support our host community by maintaining a variety of host protection programs, including Host Protection Insurance and Experience Protection Insurance, and our Host Guarantee Program. Our business, results of operations, and financial condition would be materially adversely affected if (i) cost per claim, premiums or the number of claims significantly exceeds our expectations; (ii) we experience a claim in excess of our coverage limits; (iii) our insurance providers become insolvent or otherwise fail to pay on our insurance claims; (iv) we experience a claim for which coverage is not provided; or (v) the number of claims under our deductibles or self-insured retentions differs from historic averages. Our overall spend on insurance has increased as our business has grown and losses from covered claims have increased. Premiums have increased as a result, and we have experienced and expect to continue to experience increased difficulty in obtaining appropriate policy limits and levels of coverage at a reasonable cost and with reasonable terms and conditions. Our costs for obtaining these policies will continue to increase as our business grows and continues to evolve. Furthermore, as our business continues to develop and diversify, we may experience difficulty in obtaining insurance coverage for new and evolving offerings and tiers, which could require us to incur greater costs and materially adversely affect our business, results of operations, and financial condition. Additionally, if we fail to comply with insurance regulatory requirements in the regions where we operate, or other regulations governing insurance coverage, our brand, reputation, business, results of operations, and financial condition could be materially adversely affected.
Host Protection Insurance and Experience Protection Insurance
In order to offset our potential exposure related to stays and experiences and to comply with certain short-term rental regulatory requirements, we have procured Host Protection and Experience Protection general liability insurance from third parties, which is subject to certain terms, conditions, and exclusions, for claims from guests and third parties for bodily injury or property damage arising from bookings of stays and experiences through our platform. We and our hosts are insured parties, and landlords, homeowners or condo-owners associations, and any other similar entities, are additional insured parties. However, these insurance programs may not provide coverage for certain types of claims, including those relating to
66
contagious diseases such as COVID-19, and may be insufficient to fully cover costs of investigation, costs of defense, and payments or judgments arising from covered claims. In addition, extensive or costly claims could lead to premium increases or difficulty securing coverage, which may result in increased financial exposure and an inability to meet insurance regulatory requirements.
Corporate Insurance