Booking Holdings Inc.: 10-K Risk Factor Changes

Our processing, storage, use, and disclosure of personal data exposes us to risks of data breaches and could give rise to liabilities and/or damage our reputation.

We are dependent on sophisticated software applications and computing infrastructure for the operation of our business. If threat actors such as cyber-criminals, hackers, and state-sponsored organizations are able to circumvent our security measures, including as a result of our own acts or omissions, it could result in a compromise or breach of consumer, partner, or employee data. Data security is essential to maintaining consumer and partner confidence in our services and the uninterrupted availability of our web and mobile platforms is essential for our business. Consumers may provide us with their personal identity data and payment information, which in turn attracts attention from threat actors. Cyberattacks are increasing in frequency and sophistication and are constantly evolving. We may not be able to defend against sophisticated cyberattacks from determined adversaries. In addition, our security policies and controls may not keep pace with the continuous innovation of our offerings.

Vulnerabilities in our consumer and partner account security and workflow practices could and have resulted in unauthorized access to personal and confidential data. These risks are likely to increase as we expand our offerings, integrate our products and services, incorporate AI and Large Language Models, and store and process more data, including personal information and payment data. The disclosure of non-public Company-sensitive information by our workforce or other parties could lead to information loss, reputational harm, or loss of a competitive advantage. We expend significant resources to protect against security breaches and maintain or increase our systems' security. We have experienced and responded to cyberattacks, which we believe have not had a material impact on the integrity of our systems or the security of data, including personal information maintained by us. Security breaches could result in negative publicity, damage our reputation, expose us to risk of loss or litigation and possible liability, subject us to regulatory penalties and sanctions, or cause consumers to lose confidence in our security and choose to use the services of our competitors, any of which would have an adverse effect on our brands, market share, results of operations, and financial condition. See -"Cyberattacks and system vulnerabilities could lead to sustained service outages, data loss, reduced revenue, increased costs, liability claims, or harm to our competitive position." Our efforts to protect information from unauthorized access may also result in the rejection of legitimate attempts to book reservations through our services, which could result in lost business. Additionally, our consumers' personal data could be affected by security breaches at third parties upon which we rely. See - "Our business relies on a global supply chain of third party services providers and we are exposed to risks because we rely on the resilience, security, and legal compliance of their products and services."

In the operation of our business, we receive and store a large volume of personally identifiable data and payment information. The handling and storage of such data, as well as privacy rights of consumers, are subject to complex and evolving laws and regulations in numerous jurisdictions. Regulations such as the European Union's General Data Protection Regulation (the "GDPR"), the California Consumer Privacy Act (the "CCPA"), the California Privacy Rights Act, and the Digital Markets Act ("DMA") add complexity and impose significant compliance obligations and costs on us. For example, under the GDPR, violations could result in fines of up to 20 million Euros or up to 4% of the annual global revenues of the infringer, whichever is greater. Several data protection authorities have imposed significant fines on companies for violations of the GDPR. These regulations typically intend to protect the integrity and security of personal data that is collected, processed, and transmitted in or from the governing jurisdiction as well as to give individuals greater rights and/or control over how their data is processed. In many cases, these laws apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information. These laws and their interpretations continue to develop and may be inconsistent from jurisdiction to jurisdiction. Additionally, some of these regulations, such as the CCPA, give consumers a private right of action against companies for violations of these rules. While we invest significant resources to comply with a growing patchwork of privacy regulations, many of these regulations (such as the Personal Information Protection Law in the People's Republic of China and the Digital Personal Data Protection Act in India) are complex to implement and subject to uncertain interpretation. Non-compliance with these laws could result in negative publicity, damage to our reputation, significant penalties, or other legal liability. If laws or regulations are expanded to require changes in our business practices, or interpreted in ways that negatively affect our business, our results of operations, financial condition, or competitive position could be adversely affected.

Cyberattacks and system vulnerabilities could lead to sustained service outages, data loss, reduced revenue, increased costs, liability claims, or harm to our competitive position.

If our systems cannot cope with the level of demand required to service our consumers and partners, we could experience unanticipated disruptions in service, slower response times, decreased customer service and customer satisfaction, and delays in the introduction of new services. As an online business, we are dependent on the internet, connectivity, and mobile systems throughout the world. Disruptions in internet access could materially adversely affect our business and results of operations. While we maintain redundant systems and hosting services, they are not always sufficient to prevent disruption, and we do not carry business interruption insurance sufficient to compensate us for all losses that may occur.

We have computer hardware for operating our services located in hosting facilities around the world. Although we have disaster recovery plans, these systems and operations are vulnerable to damage or interruption and they may not cover us in every region. If such events were to occur, we may not be able to switch to back-up systems immediately and it could result in lengthy interruptions or delays in our services. Any system failure that causes an interruption or delay in service could impair our reputation, damage our brands, increase customer service costs, or result in lost business, any of which could adversely affect our business and results of operations. We seek to increase the reliability and redundancy of our systems. These steps are expensive, may reduce our margins, and may not be successful in reducing the frequency or duration of unscheduled downtime.

We have experienced targeted and organized malware, phishing, and account takeover attacks, and may in the future experience these and other forms of attack such as ransomware, SQL injection (where a third party attempts to insert malicious code into our software through data entry fields in our websites in order to gain control of the system), and attempts to use our websites as a platform to launch a denial-of-service attack on another party. Our existing security measures may not be successful in preventing attacks on our systems. For instance, we have incurred costs related to customer reimbursement and customer service, reputational harm, and lost revenue from fictitious listings and partner account takeovers. Our existing IT business continuity and disaster recovery practices are less effective against certain types of attacks such as ransomware, which could result in interruption of our services, data exposure, and/or an extortion attempt. Reductions in the availability and response time of our online services could cause loss of substantial business volumes and measures we may take to divert suspect traffic could result in the diversion of bona fide customers. These issues are more difficult to manage during any expansion of the number of places where we operate and the variety of services we offer, and as the tools and techniques used in such attacks become more advanced. We use sophisticated technology to identify cybersecurity threats; however, a cyberattack may go undetected for a period of time resulting in harm to our computer systems and the loss of data. This could result in regulatory fines and reputational harm, among other costs. Our insurance policies have coverage limits and may not be adequate to reimburse us for all losses caused by security breaches. Successful attacks could result in significant interruptions in our operations, severe damage to our information technology infrastructure, negative publicity, reputational harm, and/or prevent consumers from using our services during the attack, any of which could cause consumers to use the services of our competitors, which would have a negative effect on the value of our brands, market share, business, and results of operations.

We use both internally-developed and third-party systems to operate our services, including transaction processing, order management, and financial and accounting systems. If the number of consumers using our services increases substantially, or if critical third-party systems stop operating as designed, we may need to repair, expand or upgrade our systems or infrastructure. If we are unable to meet the demand in a timely manner, it could have a negative impact on our business. Many of our processes and systems are highly automated and involve multiple inputs from various IT systems, which can mitigate the risk of human error but which can also make testing, troubleshooting, and auditing more difficult. As a result, it may be difficult to quickly detect and correct errors embedded in these processes or systems.

Our business relies on a global supply chain of third party services providers and we are exposed to risks because we rely on the resilience, security, and legal compliance of their products and services.

We rely on certain third-party computer systems and third-party service providers, including GDSs and computerized central reservation systems of the accommodation, rental car, and airline industries in connection with providing some of our services. Any damage to, breach of, or interruption in these third-party services and systems or deterioration in their performance could prevent us from booking related reservations and have a material adverse effect on our business, brands, and results of operations. Third party business partners, service providers, and consultants may be given access to our computer networks. A cyberattack against one of these third parties that compromises their credentials may result in unauthorized access to our systems and data, resulting in a cyberattack against us. Furthermore, our agreements with some third-party service providers do not provide recourse for service interruptions, and such service interruptions could have a negative impact on our business and results of operations.

Consumers generally are concerned with security and privacy on the internet, and any publicized privacy and security problems could negatively affect consumers' willingness to use our services. Some of our business is conducted with third-party marketing affiliates, which may generate travel reservations through our infrastructure or through other systems. A security breach at any third-party that we conduct business with, such as the security breach experienced by MGM Resorts International in 2023, could be perceived by consumers as a security breach of our systems and could result in negative publicity, subject us to notification requirements, damage our reputation, expose us to risk of loss or litigation, and subject us to regulatory penalties and sanctions, even if we had no direct involvement in the breach. In addition, such third parties may not comply with applicable disclosure requirements or with parameters within which we permit them to process data, which could expose us to liability.

We depend upon various third parties to process payments, including credit cards, or to provide credit card numbers for payment for our merchant transactions. If any such third party were compromised or ceased or suspended operations, our cash flows could be disrupted or we may not be able to generate merchant transactions (and related revenues) for a period of time and this could have a negative effect on our business, reputation, and results of operations and, in certain cases of the insolvency of such a partner could result in additional payments by us and loss of the total transaction value.

Tax Risks

We may have exposure to additional tax liabilities.

As an international business providing services around the world, we are subject to various taxes. Although we believe that our tax filing positions are reasonable and comply with applicable law, we regularly review them and we may change our positions or determine that previous positions should be amended, either of which could result in additional tax liabilities. The final determination of tax audits or disputes may be different from what is reflected in our historical tax provisions and accruals. We have been audited in many taxing jurisdictions. If audits find that additional taxes are due, we may be subject to incremental tax liabilities, possibly including interest and penalties, which could have a material adverse effect on our results of operations, financial condition, and cash flows. An unfavorable outcome or settlement of pending litigation or audit proceedings could encourage the commencement of additional litigation, audit proceedings, or other regulatory inquiries. See Notes 15 and 16 to our Consolidated Financial Statements for more information regarding certain tax matters and tax contingencies.

Governments are increasingly focused on ways to increase tax revenues, which has contributed to an increase in audit activity, more aggressive positions taken by tax authorities, more time and difficulty to resolve any audits or disputes, and an increase in new tax legislation. Any such additional taxes or other assessments may be in excess of our current tax provisions or may require us to modify our business practices in order to reduce our exposure to additional taxes going forward, any of which could have a material adverse effect on our business, results of operations, and financial condition.

The United States's Tax Cuts and Jobs Act (the "Tax Act") introduced a tax on 50% of global intangible low-taxed income ("GILTI"), which is income determined to be in excess of a specified routine rate of return on qualifying business assets. The Tax Act further introduced a base erosion and anti-abuse tax ("BEAT") aimed at preventing the erosion of the U.S. tax base and a new tax deduction with respect to certain foreign-derived intangible income. If we are unable to operate our business so that BEAT does not impact us, our effective tax rate, results of operations and cash flows would be adversely affected. The interpretation and implementation of the Tax Act have had and could have a negative impact on our results of operations and cash flows. In addition, the United States's recently enacted Inflation Reduction Act includes a 15% corporate minimum tax on book income and a 1% excise tax on stock repurchases. The interpretation and implementation of these provisions could have a negative impact on our results of operations and cash flows. Increases in the U.S. corporate income tax rate, increasing the percentage of GILTI subject to tax in the United States, or other changes to U.S. federal tax laws could have a negative impact on our results of operations and cash flows.

Certain countries have taken steps to unilaterally introduce a digital services tax to address the issue of multinational businesses carrying on business in their jurisdiction without a physical presence and therefore generally not being subject to income tax in those jurisdictions. These digital services taxes are calculated as a percentage of revenue rather than income or profits. The interpretation and implementation of the various digital services taxes (especially if there is inconsistency in the application of these taxes across tax jurisdictions) could adversely impact our results of operations and cash flows. Further, digital services taxes may not apply to our competitors, which could harm our business and competitive position.

Additionally, there have been significant changes made and proposed to international tax laws that increase the complexity, burden, and cost of tax compliance. The Organisation for Economic Co-operation and Development ("OECD") has been working on the "base erosion and profit shifting" ("BEPS") project to ensure international tax standards keep pace with changes in global business practices. This project could change various aspects of the existing rules under which our tax obligations are determined. In 2021, more than 130 countries agreed to a new OECD framework on BEPS that, among other provisions, includes proposed changes to how the right to tax income would be allocated among countries and imposes a 15% global minimum tax. The OECD recently issued additional commentary related to the 15% minimum tax, including the intention that provisions be incorporated into law with an effective date of January 1, 2024. Several member countries outside the U.S. have adopted these rules, effective January 1, 2024. The rules for the calculation of the 15% minimum tax are complex and additional guidance continues to be issued by the OECD and its member countries. The implementation of these rules could have a negative impact on our results of operations or cash flows.

Due to the large scale of our business activities outside of the United States, any changes in U.S. or international taxation of our activities, such as new definitions of permanent establishment, new nexus and profit allocation rules, or the combined effect of tax laws in multiple jurisdictions, may increase our worldwide effective tax rate, increase the complexity and costs associated with tax compliance, and adversely affect our cash flows and results of operations.

We are also subject to other non-income-based taxes, such as value-added, payroll, sales, use, excise, net worth, property, hotel occupancy, and goods and services. We refer generally to taxes on travel transactions (e.g., value-added taxes, sales taxes, excise taxes, hotel occupancy taxes, etc.) as "travel transaction taxes." From time to time, we are under audit or investigation by tax authorities or involved in legal proceedings related to these non-income-based taxes or we may revise our tax positions, which may result in additional non-income-based tax liabilities.

A number of jurisdictions in the United States have initiated lawsuits or other proceedings against OTCs, including us, related to, among other things, the payment of certain travel transaction taxes that could include historical taxes that are claimed to be owed, interest, penalties, punitive damages and/or attorney's fees and costs. Additional jurisdictions may assert that we are subject to travel transaction taxes and could seek to collect such taxes, either retroactively, prospectively or both. We continue to defend against these lawsuits and, where appropriate, intend to continue to assert that we should not be subject to such taxes. Although we believe we do not owe the taxes claimed in these lawsuits, litigation is uncertain, and if there was an adverse outcome in this litigation, or any similar litigation in other jurisdictions, it could result in liabilities for past and/or future bookings, and it could have an adverse effect on our business, profit margins, and results of operations. Jurisdictions could also seek to amend their tax statutes in order to collect travel transaction taxes from us on a prospective basis.

Additionally, jurisdictions have adopted or may adopt laws that require us to collect and remit travel transaction or other taxes on the total travel transaction value or on behalf of travel service providers, which in some instances may negatively impact our revenue, margins, cash flows, and results of operations and may require significant and costly system changes to implement.

We may not be able to maintain our "Innovation Box Tax" benefit.

The Netherlands corporate income tax law provides that income generated from qualifying innovative activities is taxed at the rate of 9% beginning in January 2021 and 7% prior to 2021 ("Innovation Box Tax") rather than the Dutch statutory rate of 25%. Effective January 1, 2022, the Netherlands corporate income tax rate increased from 25% to 25.8%. A portion of Booking.com's earnings historically has qualified for Innovation Box Tax treatment.

In order to be eligible for Innovation Box Tax treatment, Booking.com must, among other things, apply for and obtain a research and development ("R&D") certificate from a Dutch governmental agency every six months confirming that the activities that Booking.com intends to be engaged in over the subsequent six-month period are "innovative." The R&D certificate is current but should Booking.com fail to secure such a certificate in any future period - for example, because the governmental agency does not view Booking.com's new or anticipated activities as innovative, the Innovation Box Tax benefit may be reduced or eliminated. Booking.com intends to apply for continued Innovation Box Tax treatment for future periods. However, Booking.com's application may not be accepted, or, if accepted, the amount of qualifying earnings may be reduced.

The loss of the Innovation Box Tax benefit (or any material portion thereof) could substantially increase our effective tax rate and adversely impact our results of operations and cash flows in the future.