Acquisitions, dispositions, joint ventures, strategic partnerships and strategic investments could result in operating difficulties and could harm our business or impact our financial results.
We have acquired a significant number of businesses of varying size and scope, technologies, services, and products, and we maintain investments in certain businesses. We have also disposed of significant businesses. We expect to continue to evaluate and consider a wide array of potential strategic transactions as part of our overall business strategy, including business combinations, acquisitions, and dispositions of businesses, technologies, services, products, and other assets, as well as strategic investments and joint ventures.
These transactions may involve significant challenges and risks, including:
- the potential loss of key customers, merchants, vendors and other key business partners of the companies we acquire, or dispose of, following and continuing after announcement of our transaction plans;
- declining employee morale and retention issues affecting employees of companies that we acquire or dispose of, which may result from changes in compensation, or changes in management, reporting relationships, future prospects or the direction of the acquired or disposed business, which risks may be heightened following our recently announced restructuring plan;
- difficulty making new and strategic hires of new employees;
- diversion of management time and a shift of focus from operating the businesses to the transaction, and in the case of an acquisition, integration and administration;
- the need to provide transition services to a disposed of company, which may result in the diversion of resources and focus;
- the need to integrate the operations, systems (including accounting, management, information, human resource and other administrative systems), technologies, products and personnel of each acquired company, which is an inherently risky and potentially lengthy and costly process;
- the inefficiencies and lack of control that may result if such integration is delayed or not implemented, and unforeseen difficulties and expenditures that may arise as a result;
- the need to implement or improve controls, procedures and policies appropriate for a larger public company at companies that prior to acquisition may have lacked such controls, procedures and policies or whose controls, procedures and policies did not meet applicable legal and other standards;
- risks associated with our expansion in new international markets and new areas of business;
- derivative lawsuits resulting from the acquisition or disposition;
- liability for activities of the acquired or disposed of company before the transaction, including intellectual property and other litigation claims or disputes, violations of laws, rules and regulations, commercial disputes, tax liabilities and other known and unknown liabilities and, in the case of dispositions, liabilities to the acquirers of those businesses under contractual provisions such as representations, warranties and indemnities;
- the potential loss of key employees following the transaction;
- the acquisition of new customer and employee personal data by us or a third party acquiring assets or businesses from us, which in and of itself may require regulatory approval and or additional controls, policies and procedures and subject us to additional exposure;
- any fluctuations in share prices, financial results and fluctuations in exchange rates, and our ability to sell our shares in any company we have invested in; and
- our dependence on the acquired business’ accounting, financial reporting, operating metrics and similar systems, controls and processes and the risk that errors or irregularities in those systems, controls and processes will lead to errors in our consolidated financial statements or make it more difficult to manage the acquired business.
We have made certain investments, including through joint ventures, in which we have a minority equity interest and/or lack management and operational control. The controlling joint venture partner in a joint venture may have business interests, strategies, or goals that are inconsistent with ours, and business decisions or other actions or omissions of the controlling joint venture partner or the joint venture company may result in harm to our reputation or adversely affect the value of our investment in the joint venture. Any circumstances, which may be out of our control, that adversely affect the value of our investments, or cost resulting from regulatory action or lawsuits in connection with our investments, could harm our business or negatively impact our financial results.
We entered into a warrant agreement in conjunction with a commercial agreement with Adyen that entitles us to acquire a fixed number of shares of Adyen’s common stock subject to certain milestones being met. This warrant is accounted for as a derivative instrument under Accounting Standards Codification (“ASC”) Topic 815, Derivatives and Hedging. Changes in Adyen’s common stock price and equity volatility have had, and may continue to have in the future, a significant impact on the value of this warrant. We report this warrant on a quarterly basis at fair value in our consolidated balance sheets, and changes in the fair value of this warrant are recognized in our consolidated statement of income. Fluctuations in Adyen’s common stock price and prevailing foreign exchange rate or other changes in assumptions could result in material changes in the fair value that we report in our consolidated balance sheets and our consolidated statement of income, which could have a material impact on our financial results.
As a result of a prior transaction, we own a significant number of Adevinta shares, and fluctuations in Adevinta’s share price and financial results and fluctuations in exchange rates could result in material changes in our consolidated balance sheet and our consolidated statement of income. As described more fully under “Note 7 — Investments — Equity Investments,” we recorded significant unrealized gains and losses in 2023 and 2022, respectively, relating to the change in fair value of these shares and also entered into an agreement in November 2023 to sell 50% of our shares and exchange our remaining shares for an equity stake of approximately 20% in a newly privatized Adevinta, which transaction remains subject to closing conditions and is expected to close in the second quarter of 2024 (the “Adevinta Transaction”). If the Adevinta Transaction closes and Adevinta shares cease to trade on the Oslo Stock Exchange, our ability to sell our shares in a newly privatized Adevinta in the future will be limited and subject to market conditions and other factors, which may impact the value we are able to realize from any such sales.
We could incur significant liability if the Distribution of PayPal is determined to be a taxable transaction.
We have received an opinion from outside tax counsel to the effect that our distribution of 100% of the outstanding common stock of PayPal to our stockholders on July 17, 2015 (the “Distribution”) qualifies as a transaction that is described in Sections 355 and 368(a)(1)(D) of the Internal Revenue Code. The opinion relies on certain facts, assumptions, representations and undertakings from PayPal and us regarding the past and future conduct of the companies’ respective businesses and other matters. If any of these facts, assumptions, representations or undertakings are incorrect or not satisfied, our stockholders and we may not be able to rely on the opinion of tax counsel and could be subject to significant tax liabilities. Notwithstanding the opinion of tax counsel that we have received, the IRS could determine on audit that the Distribution is taxable if it determines that any of these facts, assumptions, representations or undertakings are not correct or have been violated or if it disagrees with the conclusions in the opinion. If the Distribution is determined to be taxable for U.S. federal income tax purposes, our stockholders that are subject to U.S. federal income tax and we could incur significant U.S. federal income tax liabilities.
We may be exposed to claims and liabilities as a result of the Distribution.
We entered into a separation and distribution agreement and various other agreements with PayPal to govern the Distribution and the relationship of the two companies. These agreements provide for specific indemnity and liability obligations and could lead to disputes between us and PayPal. The indemnity rights we have against PayPal under the agreements may not be sufficient to protect us. In addition, our indemnity obligations to PayPal may be significant and these risks could negatively affect our results of operations and financial condition.
ITEM 1B: UNRESOLVED STAFF COMMENTS
Not applicable.
ITEM 1C: CYBERSECURITY
Risk Management and Strategy
Our approach to risk management is designed to identify, assess, prioritize and manage risk exposures that could affect our ability to execute our corporate strategy and fulfill our business objectives. As part of our comprehensive enterprise risk management (“ERM”) program, we perform risk assessments in which we map and prioritize cybersecurity risks identified through the processes described below, including risks associated with our use of third-party service providers, based on probability, immediacy and potential magnitude. These assessments inform our ERM strategies and oversight processes, and we view cybersecurity risks as one of the key risk categories we face. For example, our information technology and infrastructure may be vulnerable to cyberattacks (including ransomware attacks) or other security incidents, as a result of which unauthorized third parties may be able to access our users’ proprietary information and payment card data that are stored on or accessible through our systems. For more information regarding the cybersecurity-related risks we face, see the information in “Item 1A: Risk Factors” under the caption “Our business is subject to online security risks, including security breaches and cyberattacks.”
Our processes for assessing, identifying and managing cybersecurity risks and vulnerabilities are embedded across our business as part of our ERM program. Among other things, we (i) conduct audits and tests of our information systems (including reviews and assessments by independent third-party advisors) to help identify areas for continued focus and improvement; (ii) review cybersecurity threat information published by government entities and other organizations in which we participate; (iii) provide cybersecurity awareness training for all employees and enhanced training for information security and other specialized personnel; (iv) perform phishing simulation testing of all employees; (v) perform security risk assessments of third-party providers to evaluate controls, mitigations and contractual obligations, as well as reporting obligations in connection with cybersecurity events and other risks that could have an adverse impact on eBay data and information systems; (vi) perform security risk assessments of newly acquired companies as well as material changes to products and technologies and (vii) run tabletop exercises to simulate and test responses to cybersecurity incidents. We also maintain a “bug bounty” program to encourage professional security researchers to report potential security vulnerabilities to us. We use the findings from these and other processes, as well as benchmarking against industry practices, to improve our cybersecurity practices, procedures and technologies. We also have implemented and maintain cybersecurity incident response plans, which include processes to triage, assess, escalate, contain, investigate and remediate cybersecurity incidents, and to comply with potentially applicable legal obligations and mitigate brand and reputational damage. In addition, we maintain insurance to protect against potential losses arising from a cybersecurity incident.
Governance and Oversight
Our ERM program enables our Board of Directors (the “Board”) to establish a mutual understanding with management on the effectiveness of our cybersecurity risk management practices and capabilities, including the division of responsibilities for reviewing our risk exposure and risk tolerance, tracking emerging risks and ensuring proper escalation of certain key risks for periodic review by the Board and its committees. As part of its broader risk oversight activities, the Board oversees risks from cybersecurity threats, both directly and through the Risk Committee of the Board (the “Risk Committee”). As reflected in its charter, the Risk Committee assists the Board in its management of cybersecurity and data management risks and oversees our ERM function and structure, including governance structure and our guidelines and processes for risk assessment and risk management. The Audit Committee of the Board also oversees our audits and tests of our cybersecurity practices and controls, as well as our internal control over financial reporting, including with respect to financial reporting-related information systems.
As an element of its ERM oversight activities, the Risk Committee regularly reviews the results of our enterprise risk assessments, including cybersecurity risk assessments, as well as management's strategies to detect, monitor and manage such risks. The Risk Committee discusses these risks with our Chief Technology Officer (“CTO”) and Chief Information Security Officer (“CISO”) and reports to the Board on the substance of these reviews and discussions. Each year, the Risk Committee also receives “deep dive” reports from our CTO and CISO on cybersecurity and data management risks, and the full Board also discusses cybersecurity risks with our CTO and CISO at least once per year. In addition to these regularly scheduled updates, our CTO and CISO may also report to the Risk Committee or the full Board, as appropriate, on the management of certain cybersecurity risks and progress towards agreed mitigation goals, as well as any potential material risks from cybersecurity threats that have been detected by the information security team.
We maintain an information security policy, which was approved by the Board and delegates to our CISO the authority and responsibility for managing our information security program. Our CISO reports to our CTO and is responsible for day-to-day identification, assessment and management of the cybersecurity risks we face. Along with other senior managers, our CTO and CISO are also responsible for prioritizing cybersecurity risks and developing a culture of risk-aware practices. Existing and emerging cybersecurity risks are reported to and discussed with the CTO and CISO on a regular basis and as needed based on the threat level or severity of an incident.
Our CTO, Mazen Rawashdeh, has served in his role since July 2019 and previously served as our Chief Infrastructure and Architecture Officer since May 2016. Prior to that, he was VP of Infrastructure Engineering and Operations responsible for global infrastructure engineering at Twitter for over four years. He received his BSCS in computer science and mathematics. Our CISO, Sean Embry, has served in his role since August 2015 and previously served as the senior leader responsible for infrastructure and operations engineering at Salesforce for three years. He received his BSBA in management information systems and decision sciences, and his MBA in information technology management.
In accordance with our information security incident response plans, our information security team assesses the severity of any incidents it detects and follows escalation procedures embedded within the plans for upward reporting to the CISO and CTO, other members of management and the Board, each as needed. In addition to the ordinary-course Board and Risk Committee reporting and oversight described above, we also maintain disclosure controls and procedures, including within our cybersecurity incident response plans, designed for analysis of potentially material events covered by our risk management framework, including cybersecurity incidents or threats.
ITEM 2: PROPERTIES
We own and lease various properties in the United States and 23 other countries around the world. We use the properties for executive and administrative offices, data centers, product development offices and customer service offices. Our headquarters are located in San Jose, California and occupies approximately 0.5 million square feet. Our owned data centers are solely located in Utah. The following table presents the aggregate square footage of our owned and leased properties for our continuing operations as of December 31, 2023 (in millions):
United States
Other Countries
Total
Owned facilities
1.3
—
1.3
Leased facilities
0.8
0.9
1.7
Total facilities
2.1
0.9
3.0
From time to time we consider various alternatives related to our long-term facilities needs. While we believe that our existing facilities are adequate to meet our immediate needs, it may become necessary to develop and improve land that we own or lease or acquire additional or alternative space to accommodate any future growth.