Duolingo (DUOL) 10-K2022 FY Annual report

This Annual Report on Form 10-K contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. We intend such forward-looking statements to be covered by the safe harbor provisions for forward-looking statements contained in Section 27A of the Securities Act of 1933, as amended (the “Securities Act”) and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). All statements other than statements of historical facts contained in this Annual Report on Form 10-K, including without limitation, statements regarding our business model and strategic plans, including the introduction of new brands or products, and our implementation thereof; statements regarding our expectations, beliefs, plans, objectives, prospects, assumptions, future events or expected performance, including our ability to compete in our industry; the sufficiency of our cash, cash equivalents and investments; and the plans and objectives of management for future operations and capital expenditures are forward-looking statements.

Without limiting the generality of the foregoing, you can identify forward-looking statements because they contain words such as “may,” “will,” “shall,” “should,” “expects,” “plans,” “anticipates,” “could,” “intends,” “target,” “projects,” “contemplates,” “believes,” “estimates,” “predicts,” “potential,” “goal,” “objective,” “seeks,” or “continue” or the negative of these words or other similar terms or expressions that concern our expectations, strategy, plans, or intentions. Such forward-looking statements are neither promises nor guarantees, but involve a number of known and unknown risks, uncertainties and assumptions that may cause our actual results, performance or achievements to differ materially from those expressed or implied in the forward-looking statements due to various factors, including, but not limited to:

We caution you that the foregoing list does not contain all of the forward-looking statements made in this Annual Report on Form 10-K.

You should not rely upon forward-looking statements as predictions of future events. We have based the forward-looking statements contained in this Annual Report on Form 10-K primarily on our current expectations, estimates, forecasts, and projections about future events and trends that we believe may affect our business, results of operations, financial condition, and prospects. These statements are based upon information available to us as of the date of this Annual Report on Form 10-K and, although we

believe that we have a reasonable basis for each forward-looking statement contained in this Annual Report on Form 10-K, such information may be limited or incomplete, and our statements should not be read to indicate that we have conducted an exhaustive inquiry into, or review of, all potentially available relevant information. We cannot guarantee that the future results, levels of activity, performance, or events and circumstances reflected in the forward-looking statements will be achieved or occur at all. Moreover, we operate in a very competitive and rapidly changing environment. New risks and uncertainties emerge from time to time, and it is not possible for us to predict all risks and uncertainties that could have an impact on the forward-looking statements contained in this Annual Report on Form 10-K. The results, events, and circumstances reflected in the forward-looking statements may not be achieved or occur, and actual results, events, or circumstances could differ materially from those described in the forward-looking statements. You should not place undue reliance on our forward-looking statements.

The forward-looking statements made in this Annual Report on Form 10-K relate only to events as of the date on which the statements are made. While we may elect to update such forward-looking statements at some point in the future, we disclaim any obligation to do so, even if subsequent events cause our views to change.

You should read this Annual Report on Form 10-K and the documents that we reference in this Annual Report on Form 10-K completely and with the understanding that our actual future results may be materially different from what we expect. We qualify all of the forward-looking statements in this Annual Report on Form 10-K by these cautionary statements.

Unless the context otherwise requires, all references in this Annual Report on Form 10-K to “Duolingo,” the “Company”, “we,” “our,” “us,” or similar terms refer to Duolingo, Inc. and its subsidiaries.

We manage our business by tracking several operating metrics, including monthly active users (MAUs), daily active users (DAUs), paid subscribers, and bookings. We believe each of these operating metrics provides useful information to investors and others. For information concerning these metrics as measured by us, see Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Key Operating Metrics and Non-GAAP Financial Measures.”

While these metrics are based on what we believe to be reasonable estimates of our user base for the applicable period of measurement, there are inherent challenges in measuring how our platform is used. These metrics are determined by using internal data gathered on an analytics platform that we developed and operate and have not been validated by an independent third party. This platform tracks user account and session activity. If we fail to maintain an effective analytics platform, our metrics calculations may be inaccurate.

We believe that these metrics are reasonable estimates of our user base for the applicable period of measurement, and that the methodologies we employ and update from time-to-time to create these metrics are reasonable bases to identify trends in user behavior. Because we update the methodologies we employ to create metrics, our operating metrics may not be comparable to those in prior periods. See the section titled “Risk Factors—Our user metrics and other estimates are subject to inherent challenges in measurement, and real or perceived inaccuracies in those metrics may negatively affect our reputation and our business”. Other companies, including companies in our industry, may calculate these metrics differently.

The following is a summary of the principal risks that could materially adversely affect our business, results of operations, and financial condition, all of which are more fully described in Part I, Item 1A. “Risk Factors.” This summary should be read in conjunction with Part I, Item 1A. “Risk Factors” and should not be relied upon as an exhaustive summary of the material risks facing our business.

Our mission is to develop the best education in the world and make it universally available.

Although education can open the door to economic opportunity, it is also among the principal sources of inequality: the privileged can get the best education in the world, while those with fewer resources, especially in developing countries, may not be able to get even basic schooling. That is why we started Duolingo. We believe that everyone, regardless of how wealthy they are, should have access to high quality education. And for the first time in history, the technology necessary to enable this is in the hands of billions of people, in the form of a smartphone. At Duolingo, we build products native to the smartphone—bite-sized, on-demand and engaging—to make learning accessible and effective, opening doors for everyone alike.

Duolingo is a technology company founded by two engineers, Luis von Ahn and Severin Hacker. Luis and Severin met at Carnegie Mellon University, where Luis was a professor in the Computer Science Department and Severin was his Ph.D. student. Luis, a MacArthur Fellow, grew up in Guatemala and witnessed firsthand the tremendous impact that access to high quality education can have on people’s lives. Luis and Severin bonded over the dream of building an intelligent learning system informed by massive amounts of user engagement data that could deliver superior learning outcomes.

Our team, which as of December 31, 2022, consisted of over 600 passionate employees, including more than 270 engineers, aims to build the most sophisticated education platform in the world. We believe that by using modern technology, the very best engineering talent, and a mission-driven approach, we can create better learning experiences and meaningful improvements in efficacy. Our products are powered by sophisticated data analytics and artificial intelligence and delivered with world-class art, animation, and design to make it easier for learners to stay motivated, master new material, and achieve their learning goals.

With over 800 million downloads to date, our flagship app has organically become the world’s most popular way to learn languages and the top-grossing Education app in the App Stores. For many, Duolingo has become synonymous with language learning: for example, on Google, people search the term “Duolingo” approximately sixteen times more often than “learn Spanish.” We are particularly proud that our learners come from the entire socioeconomic spectrum, ranging from billionaires and celebrities to recently resettled refugees, a rare instance in which more money does not imply better access to a high quality educational platform.

We started with a focus on teaching languages because of the profound impact learning a new language can have on people’s lives, as well as the large market opportunity. According to HolonIQ, approximately 2 billion people across the world are learning a new language, and consumer spend on both online and offline language learning represents about a $60 billion market. Driving much of the demand for language learning is the reality that English can unlock tremendous economic opportunity. According to the World Economic Forum, job seekers around the world with exceptional English skills can expect to earn 30-50% higher salaries than their peers with average English ability. And the power of language learning is not limited to economic advancement. Learning another language can unlock new experiences and deep

human connections, ranging from navigating a first trip to another country, to communicating with family members of an older generation.

As of December 31, 2022, Duolingo offers courses in over 40 languages to more than 60 million monthly active users. To put our scale in context, there are more people in the United States learning languages on Duolingo than there are foreign language learners in all United States high schools combined, and there are more people learning certain languages on Duolingo, like Irish and Hawaiian, than there are native speakers of those languages worldwide.

Duolingo is the learning product built for the mobile generation: bite-sized, on-demand and fun. We believe that the hardest part of learning something new is staying motivated, so we build gamification features into our platform to motivate our learners, and we run thousands of A/B tests to optimize each feature for maximum engagement. Our obsession with user experience has yielded affinity and loyalty in our learners, which in turn has helped us cultivate millions of brand advocates who tell their friends and families about our products. Our brand has become part of pop culture, appearing in internet memes and in sketches on late night comedy shows. As an example, #duolingo on TikTok has approximately two billion views, and our official account has been highlighted by numerous press outlets. All of this has allowed us to grow our business organically, primarily relying on word-of-mouth virality rather than paid user acquisition.

Our millions of learners complete over 900 million exercises every day, creating what we believe to be the world's largest learning dataset. This data powers the high volume A/B testing and novel artificial intelligence (“AI”) that we use to continually improve how well we teach. According to an internal study, Duolingo learners who were assessed at the completion of our beginner-level content, learn as much as students taking four university semesters of language education.

We intentionally do not put our learning content behind a paywall. Anyone can download the Duolingo app, use it for as long as they like, and complete as many of our courses as they choose, all without paying anything. Learners who use Duolingo for free see an ad at the end of each lesson, whereas learners who purchase Super Duolingo, our premium subscription, enjoy an ad-free experience and access to additional features. As of December 31, 2022 approximately 8% of our monthly active users were paid subscribers of Super Duolingo. Our paid subscriber penetration has increased steadily since we launched Super Duolingo in 2017 and, combined with our user growth, has led to revenue growth each year since. We have a strong future roadmap of feature improvements and optimizations, and believe we are in the early stages of increasing our paid subscriber penetration.

Our freemium business model, which means allowing users to access our content for free and charging a subscription for additional features, is core to our success because it enables significant user scale. Our growth and competitive differentiation have been driven by two mutually-reinforcing flywheels: our learning flywheel and our investment flywheel.

In 2016, we launched the Duolingo English Test, an online, on-demand assessment of English proficiency. Every year, millions of people around the world seek to demonstrate English proficiency for a variety of reasons, including university admissions, work visas, and job applications. We developed the Duolingo English Test because language assessment has lacked innovation, with the most popular English proficiency tests still administered in physical testing centers and usually costing hundreds of dollars per test. By offering a more accessible, online option that is both rigorous and accurate, we provide greater opportunities for aspiring students and professionals dependent on successful completion of these high stakes assessments. As of December 2022, over 3,800 higher education programs around the world accept the Duolingo English Test results as proof of English proficiency for international student admissions. These include the top 25 undergraduate programs ranked by international enrollment, as well as top schools such as Yale, Stanford, MIT, Duke and Columbia.

We believe that there is an opportunity to diversify the scope of our platform beyond language learning to a variety of subjects, using the same product-focused, mobile-first, gamified approach to education. In 2020 we launched Duolingo ABC, an app for young children that teaches early literacy skills, which won the 2020 Time Magazine “Best New Product” award. In 2022 we launched Duolingo Math, an app where students can focus on elementary math, which covers classroom topics, or adults can focus on brain training, which strengthens mental math skills. We believe new products will leverage our scalable technology platform and benefit from our core competencies in product development, gamification and use of advanced data-driven analytics to deliver quantifiable efficacy. We believe that expanding the scope of our platform to additional learning subjects will further expand our addressable market.

The Duolingo learning experience sits at the rare intersection of fun and self-improvement. Learners love Duolingo because:

In a world where people are increasingly engaged in immersive, bite-sized, mobile-first experiences, we provide such an experience that also results in learning valuable skills. Indeed, many of our learners prefer to spend time on Duolingo rather than on social media or mobile games because they can learn while still feeling entertained.

Each of our learning and gamification features is carefully crafted to contribute to a learner experience that is defined by several key principles:

Technology is at the core of everything we do. We utilize the latest in artificial intelligence, machine learning and data analytics, along with a relentless focus on A/B testing, to fuel our differentiated learning experience.

Highlights of our technology platform include:

The Duolingo language learning app is the world’s most popular way to learn languages. Accessible for free, as of December 2022 it offers courses in over 40 languages to more than 60 million monthly active users. It is also the top-grossing app globally in the Education category on both Google Play and the Apple App Store. Duolingo can also be accessed by desktop computers via a web browser at https://duolingo.com.

While all course content on Duolingo can be accessed for free, our subscription offering, Super Duolingo, offers learners additional features to enhance their learning experience. In 2021, we launched a family plan, which includes up to six subscribers under one annual plan.

Launched in 2016, the Duolingo English Test is an online, on-demand, high-stakes English proficiency assessment. Anyone with a computer, webcam, and reliable internet connection can take the test from anywhere, at any time. The test is “computer adaptive,” meaning it gets harder or easier depending on the performance of the test taker, and can be completed in less than an hour. As of December 2022, it generally costs $49 per test.

Duolingo for Schools is a free, web-based tool that aims to make it easier for teachers to use the Duolingo platform in a structured learning environment, like a classroom. With Duolingo for Schools, teachers can create a dashboard for a class, assign specific Duolingo content to students and track students’ progress through the content.

Introduced in 2020, Duolingo ABC is a free app that teaches young children early literacy skills. Developed by learning experts, Duolingo ABC is aligned with the Common Core State Standards, and is designed based on recommendations by the National Reading Panel.

Launched in 2022, Duolingo Math is a free app where students can focus on elementary math, which covers classroom topics, or adults can focus on brain training, which strengthens mental math skills.

Attracting and retaining amazing talent is key to our success. As of December 31, 2022, we had over 600 employees. Most of our employees are located at our headquarters in Pittsburgh, Pennsylvania, and we also have offices in New York, Seattle, Detroit, Beijing and Berlin. We believe that being located outside of Silicon Valley has helped us cultivate a unique company culture.

Fundamental to Duolingo's culture is our mission orientation. Our mission tends to attract a certain kind of person. Our employees have a very strong sense of social responsibility and are interested in solving hard problems for the benefit of humanity. Over time, we have also developed nine “operating principles” that articulate our values as a company and help guide how we make decisions.

As a result of our mission, our culture, and the challenges we work on every day, we believe we have had great success in attracting the best talent. We have a very selective recruitment process: we hire one out of every 370 applicants. We recruit interns and new graduates from the top computer science, design, and business programs in the country. We also recruit experienced professionals from top technology companies—and many of them relocate from Silicon Valley to Pittsburgh.

Diversity, Equity, Inclusion, and Belonging is also core to who we are. We are proud to say that Duolingo was founded by two immigrants and that our employees come from over 30 countries. More than half of our employees are women-identifying or people of color. Approximately 30% of our executive team are women-identifying, including our Chief People Officer and Chief Engineering Officer. Today, our engineering organization is more than 30% women-identifying.

For almost a decade, Duolingo’s learner community has grown organically through word-of-mouth virality. In recent years, we have made investments in marketing to supplement our organic model and amplify the voices of our existing users. Key elements of our sales and marketing strategy include:

We believe that our relentless focus on building an engaging and effective language learning product, powered by our freemium model, has led to a leading market position, as measured by downloads, active users, and brand awareness. However, learners have a variety of options when choosing to learn a language. We compete for learners’ time, attention, and share of wallet not only with other online and app-based language learning platforms but also with offline forms of language learning. Because of the extensibility of the Duolingo platform beyond language learning, we also compete with language learning assessment providers and literacy platforms.

We believe that our ability to compete successfully depends primarily on the following factors:

We own several trademarks that have been registered, or for which registration applications are pending, in the United States as well as in a number of foreign jurisdictions. These trademarks include, among others, the word marks “Duolingo” and Duolingo in Chinese, and certain logos used in connection with our business, including our mascot Duo. The registrations of these trademarks are effective for varying periods of time and may be renewed periodically provided we comply with all applicable renewal requirements, including, where necessary, the continued use of the trademarks in the applicable jurisdictions in connection with certain goods and services. We may consider pursuing trademark registrations for additional marks and for additional jurisdictions if and to the extent we believe such registrations would be beneficial to our business and cost-effective.

We have registered several domain names, including www.duolingo.com, and we own several registered copyrights covering logos and characters used in our business, including Duo. We also enter into, and rely on, confidentiality and proprietary rights agreements with our employees, consultants, contractors and business partners to protect our trade secrets, proprietary technology and other confidential information. We further protect the use of our proprietary technology and intellectual property through provisions in both our user terms of use on our website and in our agreements with service providers.

In addition to the described trademark and domain name protection, Duolingo has filed two patent applications directed to proprietary techniques we developed for generating language proficiency test questions and evaluating language proficiency as part of an on-going program to identify and protect innovations developed by the Company. We expect that this program will continue and increase in size going forward. For information regarding risks related to our intellectual property, please see “Risk Factors—Risks Related to Our Intellectual Property.”

We are subject to many US federal and state and foreign laws and regulations, including those related to privacy, rights of publicity, data protection, payment processing, disability rights, digital accessibility standards, content regulation, intellectual property, health and safety, competition, protection of minors, consumer protection, and taxation. These laws and regulations are constantly evolving and may be interpreted, applied, created, or amended in a manner that could harm our business. In addition, the application and interpretation of these laws and regulations often are uncertain, particularly in new and rapidly evolving industries.

We collect and use personal information to create online accounts, process e-commerce transactions, provide customer service, support, and for other purposes. The regulatory framework for data protection, privacy and information security is evolving rapidly. For example, the US Federal Trade Commission (“FTC”) and many state attorneys general are applying federal and state consumer protection laws to require that the online collection, use and dissemination of data, the presentation of website or other electronic content, and broad commercial and digital marketing activities, comply with certain standards for notice, choice, security and access, among other things. Courts may also adopt these developing standards. A number of states, including but not limited to California and Virginia, have enacted laws or are considering the enactment of laws governing the personal information received from consumers, and imposing new requirements around the collection, use, sharing, and handling of data collected from or about consumers or their devices. In many cases, the specific limitations imposed by these standards are subject to interpretation by courts and other governmental authorities. In addition, federal and state regulators have interpreted various rules and regulations as requiring companies like ours to implement reasonable data security controls and measures.

We are also subject to laws that govern specific types of data and/or specific types of marketing or other consumer engagement activities. For example, the Children’s Online Privacy Protection Act (“COPPA”) applies to operators of commercial websites and online services directed to US children under the age of 13 that collect personal information from children and to operators of general audience sites that have actual knowledge that they are collecting information from US children under the age of 13. Our language learning app is aimed at a general audience and we employ an age-gating procedure whereby anyone from the United States identifying themselves as being under the age of 13 during the registration process receives an ad-free version of the service, with special enrollment procedures and restricted information practices. We also apply age-gating for non-US users of the language learning app according to foreign laws. The Duolingo English Test service requires parental consent for users under the age of 13. The Duolingo ABC app is aimed at users under the age of 13 but does not collect personal information directly from the user beyond that required to use the app. Other laws such as the Restore Online Shoppers' Confidence Act ("ROSCA") and analogous state laws require certain and consent mechanisms, among other things, in relation to recurring payments and subscription based products or services. These rules are enforcement by federal and state regulators and can subject companies to significant penalties, fines and injunctive relief. In addition, federal and state agencies regularly investigate and bring enforcement actions under general unfair or deceptive acts or practices laws (referred to as "UDAP" statutes) in relation to a broad array of sales, marketing and advertising activities.

We also have many subscribers who access and pay for our services from outside the United States. Foreign data protection, e-commerce, privacy, consumer protection, content regulation and other laws and regulations are often more restrictive or burdensome than those in the United States, and those governments may attempt to apply such laws extraterritorially or through treaties or other arrangements with US governmental entities. For example, in the EEA we are subject to the GDPR and in the UK we are subject to the UK GDPR. The GDPR and the UK GDPR impose strict data protection compliance requirements including: providing detailed disclosures about how personal data is collected and

processed (in a concise, intelligible and easily-accessible form); demonstrating that an appropriate legal basis is in place or otherwise exists to justify data processing activities; granting new rights for data subjects in regard to their personal data (including the right to be “forgotten” and the right to data portability), as well as enhancing data subject rights (e.g., data subject access requests); introducing the obligation to notify data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant data breaches; defining for the first time pseudonymized (i.e., key-coded) data; imposing limitations on retention of personal data; maintaining a record of processing activities; and complying with the principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit.

Our website address is www.duolingo.com. The contents of, or information accessible through, our website are not part of this Annual Report on Form 10-K. The reference to our website address does not constitute incorporation by reference of the information contained on or available through our website, and you should not consider such information to be a part of this Annual Report on Form 10-K. We make our filings with the SEC, including our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, proxy statements, reports under Section 16 of the Exchange Act and all amendments to those reports, available free of charge on our website as soon as reasonably practicable after we file such reports with, or furnish such reports to, the SEC.

The size of our user base and our users’ level of engagement and paid conversion are critical to our success. Our financial performance has been and will continue to be significantly determined by our success in adding, keeping and engaging users of our products and converting them into paying subscribers. We expect that the size of our user base will fluctuate or decline in one or more markets from time to time. If people do not perceive our products to be useful, effective, reliable, and/or trustworthy, we may not be able to attract or keep users or otherwise maintain or increase the frequency and duration of their engagement or the percentage of users that are converted into paying subscribers. There is no guarantee that we will not experience an erosion of our user base or engagement levels. User engagement can be difficult to measure, particularly as we introduce new and different products and

services. Any number of factors can negatively affect user stickiness, growth, engagement and conversion, including if:

From time to time, certain of these factors have negatively affected user stickiness, growth and engagement to varying degrees. If we are unable to maintain or increase our user base and user engagement, our revenue and financial results may be materially adversely affected. In addition, we may not experience rapid user growth or engagement in countries that have high mobile device penetration, but due to the lack of sufficient cellular based data networks, consumers rely heavily on Wi-Fi and may not access our products regularly throughout the day. Any decrease in user stickiness, growth or engagement could render our products less attractive to users, which is likely to have a material and adverse impact on our revenue, business, financial condition and results of operations. If our user growth rate slows or declines, we will become increasingly dependent on our ability to maintain or increase levels of user engagement and monetization in order to drive revenue growth.

The online language learning industry is highly competitive, with a consistent stream of new products and entrants. As a result, new products, entrants and business models are likely to continue to emerge, both in the United States and abroad. It is possible that a new product could gain rapid scale at the expense of existing brands through harnessing a new technology, or a new or existing distribution channel, creating a new or different approach to connecting people or some other means. We compete for learners’ time, attention, and share of wallet not only with other online and app-based language learning platforms, but also with offline forms of language learning. Because of the extensibility of the Duolingo platform beyond language learning, we also compete with language learning assessment providers and literacy platforms and may compete with other kinds of online learning platforms in the future.

Many of the current and potential competitors, both domestically and internationally, have substantially greater financial, technical, sales, marketing and other resources than we do, as well as in some cases, lower costs. Some competitors offer more differentiated products (for example, online learning as well as physical classrooms and textbooks) that may allow them to more flexibly meet changing customer preferences. Some of our competitors may enjoy better competitive positions in certain geographical regions, user demographics or other key areas that we currently serve or may serve in the future, or in their ability to teach certain languages or to teach speakers of certain languages other languages. These advantages could enable these competitors to offer products that are more appealing to users and potential users than our products, to respond more quickly and/or cost-effectively than us to new or changing opportunities, new or emerging technologies or changes in customer requirements and preferences, or to offer lower prices than ours or to offer free language-learning products or services.

There are a number of free online language-learning opportunities to learn grammar, pronunciation, vocabulary (including specialties in areas such as medicine and business), reading and conversation by means of podcasts and mobile applications, audio courses and lessons, videos, games, stories, news, digital textbooks, and through other means, which compete with our products. We estimate that there are thousands of free mobile applications for language learning; free products are provided in at least 50 languages by private companies, universities and government agencies. Low barriers to entry allow start-

up companies with lower costs and less pressure for profitability to compete with us. Competitors that are focused more on user acquisition rather than profitability may be able to offer products at significantly lower prices or for free. As free online translation services improve and become more widely available and used, people may generally become less interested in language learning. If we cannot successfully attract users of these free products and convert a sufficient portion of these free users into paying users, our business could be adversely affected. If free products become more engaging and competitive or gain widespread acceptance by the public, demand for our products could decline or we may have to lower our prices, which could adversely impact our revenue and other results.

Potential competitors also include larger companies that could devote greater resources to the promotion or marketing of their products and services, take advantage of acquisition or other opportunities more readily or develop and expand their products and services more quickly than we do. For example, in 2020, Apple released “Translate," an iOS translation app developed by Apple for iOS devices, to translate text sentences or speech between several languages. Potential competitors also include established social media companies that may develop products, features, or services that may compete with ours or operators of mobile operating systems and app stores. These social media and mobile platform competitors could use strong or dominant positions in one or more markets, and ready access to existing large pools of potential users and personal information regarding those users, to gain competitive advantages over us. These may include offering different product features, services or pricing models that users may prefer, which may enable them to acquire and engage users at the expense of our user growth or engagement.

If we are not able to compete effectively against our current or future competitors and products or services that may emerge, the size and level of engagement of our user base may decrease, which could materially adversely affect our business, financial condition and results of operations.

Our ability to keep, increase, and engage our user base and to increase our revenue depends heavily on our ability to continue to evolve our existing brand and products and to create successful new brands and products. We may introduce significant changes to our existing brand and products, or acquire or introduce new and unproven brands, products and product extensions, including using technologies with which we have little or no prior development or operating experience. In addition, we often introduce a new product and delay its monetization until the product is more mature and the user base is better established. We have also invested, and expect to continue to invest, significant resources in growing our products to support increasing usage as well as new lines of business, new products, new product extensions and other initiatives to generate revenue. For example, in 2020, we launched our Duolingo ABC app, which has not yet generated any revenue for us. There is no guarantee that investing in new lines of business, new products, new product extensions and other initiatives will succeed. If our new or enhanced brands, products or product extensions fail to engage users, we may fail to attract or keep users or to generate sufficient revenue, operating margin, or other value to justify our investments, and our business may be materially adversely affected.

We have a limited operating history, which makes it difficult to forecast our future results. You should not rely on our past quarterly operating results as indicators of future performance. You should take into

account and evaluate our prospects in light of the risks and uncertainties frequently encountered by companies in rapidly-evolving markets like ours.

We have incurred operating losses each year since our inception and we may not achieve or maintain profitability in the future. Although our revenue has increased each quarter since the first quarter of 2018, there can be no assurances that it will continue to do so. Our operating expenses may continue to increase in the future as we increase our sales and marketing efforts and continue to invest in the development of products and services. These efforts may be costlier than we expect and we cannot guarantee that we will be able to increase our revenue to offset our operating expenses. Our revenue growth may slow or our revenue may decline for a number of other possible reasons, including reduced demand for our products or services, increased competition, a decrease in the growth or reduction in size of our overall market, or if we fail for any reason to capitalize on our growth opportunities. If we do not achieve or maintain profitability in the future, it could materially adversely affect our business, financial condition and results of operations.

We have experienced rapid growth and demand for our services since inception. We have expanded our operations rapidly and have limited operating experience at our current size. As we have grown, we have increased our employee headcount and we expect headcount growth to continue for the foreseeable future. From December 31, 2018 to December 31, 2022, our headcount grew from approximately 140 employees to over 600 employees. Further, as we grow, our business becomes increasingly complex. To effectively manage and capitalize on our growth, we must continue to expand our sales and marketing, focus on innovative product and content development, upgrade our management information systems and other processes, and obtain more space for our expanding staff. Our continued growth could strain our existing resources, and we could experience ongoing operating difficulties in managing our business across numerous jurisdictions, including difficulties in hiring, training, and managing a diffuse and growing employee base. Failure to scale and preserve our company culture with our growth could harm our future success, including our ability to retain and recruit personnel and to effectively focus on and pursue our corporate objectives. If our management team does not effectively scale with our growth, we may experience erosion to our brand, the quality of our products and services may suffer, and our company culture may be harmed. Moreover, we have been, and may in the future be, subject to legacy claims or liabilities arising from our systems and controls, content or workforce in earlier periods of our rapid development.

Because we have a limited history operating our business at its current scale, it is difficult to evaluate our current business and future prospects, including our ability to plan for and model future growth. Our limited operating experience at this scale, combined with the rapidly-evolving nature of the market in which we operate, substantial uncertainty concerning how these markets may develop, and other economic factors beyond our control, reduces our ability to accurately forecast quarterly or annual revenue. Failure to manage our future growth effectively could have a material adverse effect on our business, financial condition, and operating results.

Historically, our costs have increased each year since 2011 and we anticipate that our expenses will continue to increase in the future as we broaden our user base, develop and implement new products, market new and existing products and promote our brands, continue to expand our technical infrastructure, and continue to hire additional employees and contractors to support our expanding operations, including our efforts to focus on privacy, safety, and security. In addition, from time to time we may be subject to settlements, judgments, fines, or other monetary penalties in connection with legal and regulatory developments that may be material to our business. We may also invest in new platforms and technologies. Some of these investments may generate only limited revenue and reduce our operating margin and profitability. If these efforts are not successful, our ability to grow revenue will be harmed, which could materially adversely affect our business and financial performance.

Our quarterly operating results and other operating metrics have fluctuated in the past and may continue to fluctuate from quarter to quarter, which makes them difficult to predict. Our financial condition and operating results in any given quarter can be influenced by numerous factors, many of which we are unable to predict or are outside of our control, including, for example:

Any one of the factors above or the cumulative effect of some of the factors above may result in significant fluctuations in our results of operations.

The variability and unpredictability of our quarterly operating results or other operating metrics could result in our failure to meet our expectations or those of analysts that cover us or investors with respect to revenue or other operating results for a particular period. If we fail to meet or exceed such expectations, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

We track certain key operational metrics and non-GAAP financial measures, including MAUs, DAUs, paid subscribers, subscription bookings, total bookings, Adjusted EBITDA and free cash flow, to evaluate growth trends, measure our performance, and make strategic decisions. Our user metrics are calculated using internal company data gathered on an analytics platform that we developed and operate, have not been validated by an independent third party and may differ from estimates or similar metrics published by third parties due to differences in sources, methodologies, or the assumptions on which we rely. Our user metrics are also affected by technology on certain mobile devices that automatically runs in the background of our application when another phone function is used, and this activity can cause our system to miscount the user metrics associated with such an account. We continually seek to improve the accuracy of and our ability to track such data, but given the complexity of the systems involved and the rapidly changing nature of mobile devices and systems, we expect to continue to encounter challenges, particularly if we continue to expand in parts of the world where mobile data systems and connections are less stable. In addition, we may improve or change our methodologies for tracking these metrics over time, which could result in unexpected changes to our metrics, including the metrics we publicly disclose. As a result, while any future periods may benefit from such improvement or change, prior periods may not be as accurate or comparable, or we may need to adjust such prior periods. The methodologies used to measure these metrics require significant judgment and are also susceptible to algorithm or other technical errors. In addition, our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our metrics, including the metrics we publicly disclose. If the internal systems and tools we use to track these metrics undercount or overcount performance or contain algorithmic or other technical errors, the data we report may not be accurate. While these numbers are based on what we believe to be reasonable estimates of our metrics for the applicable period of

measurement, there are inherent challenges in measuring how our products are used across large populations globally.

Errors or inaccuracies in our metrics or data could also result in incorrect business decisions and inefficiencies. For instance, if a significant understatement or overstatement of active users were to occur, we may expend resources to implement unnecessary business measures or fail to take required actions to attract a sufficient number of users to satisfy our growth strategies. We continually seek to address technical issues in our ability to record such data and improve our accuracy, but given the complexity of the systems involved and the rapidly changing nature of mobile devices and systems, we expect these issues to continue, particularly if we continue to expand in parts of the world where mobile data systems and connections are less stable. If our operational metrics are not accurate representations of our business, or if investors do not perceive these metrics to be accurate, or if we discover material inaccuracies with respect to these figures, our reputation may be significantly harmed, our stock price could decline, we may be subject to stockholder litigation, and our business, results of operations, and financial condition could be materially adversely affected.

Our products depend on mobile app stores and other third parties such as data center service providers, as well as third party payment aggregators, computer systems, internet transit providers and other communications systems and service providers. Our mobile applications are almost exclusively accessed through and depend on the Apple App Store and the Google Play Store. While our mobile applications are generally free to download from these stores, we offer our users the opportunity to purchase subscriptions and certain à la carte features through these applications. We determine the prices at which these subscriptions and features are sold. Purchases of these subscriptions and features via our mobile applications are mainly processed through the in-app payment systems provided by Apple and Google. As of December 31, 2022 we paid Apple and Google, as applicable, a meaningful share (generally 15-30%) of the revenue we receive from transactions processed through in-app payment systems. In the year ended December 31, 2022, we derived 54% of our revenue and 57% of our total bookings from the Apple App Store, and 20% of our revenue and 20% of our total bookings from the Google Play Store. The timing of their payments also may change, which may negatively impact our cash receipts and working capital. While we do not anticipate any interruption in their distribution platforms or ability to accept customer payments, any such disruptions, even temporary, may have material impacts on our business and operations.

We are subject to the standard policies and terms of service of third-party platforms, which govern the promotion, distribution, content and operation generally of apps on the platform. Each platform provider has broad discretion to make changes to its operating systems or payment services or change the manner in which their mobile operating systems function and to change and interpret its terms of service and other policies with respect to us and other developers, and those changes may be unfavorable to us. For example, such changes could limit, eliminate or otherwise interfere with our products, our ability to distribute our applications through their stores, our ability to update our applications, including to make bug fixes or other feature updates or upgrades, the features we provide, the manner in which we market our in-app products, our ability to access native functionality or other aspects of mobile devices, and our ability to access information about our users that they collect. In addition, our distribution agreements with Apple and Google are generally terminable by Apple or Google without cause with 30 days prior written

notice (to the extent allowed by applicable local law). Apple and Google may also terminate our agreements with them immediately (unless a longer period is required by applicable law) under certain circumstances, including upon our uncured breach of such agreements. To the extent Apple, Google or other third party platform providers on which we rely make such changes or terminate our agreements with them, our business, financial condition and results of operations could be materially adversely affected.

A platform provider may also change its fee structure, add fees associated with access to and use of its platform, alter how we are able to advertise on the platform, change how the personal information of its users is made available to application developers on the platform, limit the use of personal information for advertising purposes, or restrict how users can share information with their friends on the platform or across platforms. For example, in December 2017, Apple revised its App Store Guidelines to require the disclosure of the odds of receiving certain types of virtual items from “loot boxes” (or similar mechanisms that offer a paid license to randomized virtual items) before customers purchase a license for the virtual items, and in May 2019 Google revised its Play Store policies to require similar disclosures. As another example, in April 2021 Apple released an update of iOS that requires its users, on an app-by-app basis, to explicitly opt-in to the use of identifier-for-advertising, a device identifier assigned by Apple to each of its devices and used by advertisers to attribute app installs to advertising campaigns, target users through user acquisition, and deliver targeted ads. This led to a reduction in the use of identifiers, and a more challenging environment for publishers and advertisers on iOS devices.

If we violate, or a platform provider believes we have violated, its terms of service (or if there is any change or deterioration in our relationship with these platform providers), that platform provider could limit or discontinue our access to the platform. A platform provider could also limit or discontinue our access to the platform if it establishes more favorable relationships with one or more of our competitors or it determines that we are a competitor. Any limit or discontinuation of our access to any platform could significantly reduce our ability to distribute our products to users, decrease the size of the user base we could convert into paying users, or decrease the revenues we derive from paying users or advertisers, each of which would materially and adversely affect our business, financial condition and results of operations.

We also rely on the continued popularity, customer adoption, and functionality of third-party platforms. In the past, some of these platform providers have been unavailable for short periods of time or experienced issues with their in-app purchasing functionality. If either of these events recurs on a prolonged, or even short-term, basis or other similar issues arise that impact users’ ability to access our app or access social features, our business, financial condition, results of operations or reputation may be harmed.

Our technology infrastructure is critical to the performance of our products and to user satisfaction, as well as our corporate functions. Our products and company systems run on a complex distributed system, or what is commonly known as cloud computing. We own, operate and maintain elements of this system, but significant elements of this system are operated by third-parties that we do not control and which would require significant time and expense to replace. We expect this dependence on third-parties to continue. We have suffered interruptions in service in the past, including when releasing new software versions or bug fixes, and if any such interruption were significant and/or prolonged it could adversely affect our business, financial condition, results of operations or reputation.

In particular, a significant portion, if not almost all, of our product traffic, data storage, data processing and other computing services and systems is hosted by AWS and Google Cloud. AWS and Google Cloud provide us with computing and storage capacity pursuant to an agreement that continues until terminated by either party. The agreements require AWS and Google Cloud to provide us their standard computing and storage capacity and related support in exchange for timely payment by us. We have experienced, and may in the future experience, disruptions, outages and other performance problems due to a variety of factors, including infrastructure changes, human or software errors and capacity constraints. If a particular application is unavailable when users attempt to access it or navigation through a product is slower than they expect, users may stop using the application and may be less likely to return to the application as often, if at all.

Any failure, disruption or interference with our use of hosted cloud computing services and systems provided by third-parties, like AWS or Google Cloud, could adversely impact our business, financial condition or results of operations. For example, on December 7, 2021, an outage of the AWS platform caused Duolingo to go offline for over 5 hours. To the extent we do not effectively respond to any such interruptions, upgrade our systems as needed and continually develop our technology and network architecture to accommodate traffic, our business, financial condition or results of operations could be adversely affected. Furthermore, our disaster recovery systems and those of third-parties with which we do business may not function as intended or may fail to adequately protect our critical business information in the event of a significant business interruption, which may cause interruption in service of our products, security breaches or the loss of data or functionality, leading to a negative effect on our business, financial condition or results of operations.

In addition, we depend on the ability of our users to access the internet. Currently, this access is provided by companies that have significant market power in the broadband and internet access marketplace, including incumbent telephone companies, cable companies, mobile communications companies, government-owned service providers, device manufacturers and operating system providers, any of whom could take actions that degrade, disrupt or increase the cost of user access to our products or services, which would, in turn, negatively impact our business. The adoption or repeal of any laws or regulations that adversely affect the growth, popularity or use of the internet, including laws or practices limiting internet neutrality, could decrease the demand for, or the usage of, our products and services, increase our cost of doing business and adversely affect our results of operations.

We generate advertising revenue from the sale of display and video advertising delivered through advertising impressions. In 2022, approximately 12.1% of our total revenues were derived from advertising. We generally enter into arrangements with the major programmatic advertising networks to monetize our advertising inventory. We need to maintain good relationships with these advertising networks to provide us with a sufficient inventory of advertisements. Online advertising, including through mobile applications, is an intensely competitive industry. Many large companies, such as Amazon, Facebook and Google, invest significantly in data analytics to make their websites and platforms more attractive to advertisers. Our advertising revenue is primarily a function of the number and hours of engagement of our free users and our ability to provide innovative advertising products that are relevant to our users, maintain or increase user engagement and satisfaction with our products, and enhance returns for our advertising partners. If our relationship with any advertising partners terminates for any reason, or if the commercial terms of our relationships are changed or do not continue to be renewed on favorable terms, or if we cannot source high-quality ads consistent with our brand or product experience,

we would need to qualify new advertising partners, which could negatively impact our revenues, at least in the short term.

In addition, internet-connected devices and operating systems controlled by third parties increasingly contain features that allow device users to disable functionality that allows for the delivery of advertising on their devices or reduce the ability to provide personalized or targeted advertising, which results in less valuable ads. Device and browser manufacturers may include or expand these features as part of their standard device specifications. For example, when Apple announced that UDID, a standard device identifier used in some applications, was being superseded and would no longer be supported, application developers were required to update their apps to utilize alternative device identifiers such as universally unique identifier, or, more recently, identifier-for-advertising, which simplifies the process for Apple users to opt out of behavioral targeting. Furthermore, laws and regulations may also make it more difficult to deliver personalized or targeted advertising or impose requirements that result in more users making elections to block our ability to deliver targeted ads. If users do not elect to participate in functionality that supports the delivery of targeted advertising on their devices, our ability to deliver effective advertising campaigns could suffer, which could cause our business, financial condition, or results of operations to suffer. While the described changes did not result in material adverse impacts to us, the impact of similar potential future operating systems changes or potential future regulation on targeted advertising is highly uncertain.

We believe that our brand has significantly contributed to our word of mouth virality, which has in turn contributed to the success of our business. We also believe that maintaining, protecting and enhancing our brand is critical to expanding our base of users and, if we fail to do so, our business, financial condition and results of operations could be materially adversely affected. We believe that the importance of brand recognition will continue to increase, given the growing number of language learning applications, or “apps,” and the low barriers to entry for companies offering language learning products and services. Many of our new users are referred by existing users. Maintaining our brand will depend largely on our ability to continue to provide useful, reliable, trustworthy and innovative products, which we may not do successfully.

Further, we may experience media, legislative, or regulatory scrutiny of our actions or decisions regarding user privacy, encryption, content, contributors, advertising and other issues, which may materially adversely affect our reputation and brand. In addition, we may fail to respond expeditiously or appropriately to objectionable content within our app or practices by users, or to otherwise address user concerns, which could erode confidence in our brand. Maintaining and enhancing our brand will require us to make substantial investments and these investments may not be successful.

We have increased our marketing expenditures over time in order to attract and keep users and sustain our growth. For the year ended December 31, 2022 and 2021, our Sales and marketing expenses were $67.0 million and $59.2 million, respectively. Evolving consumer behavior can affect the availability of profitable marketing opportunities. For example, as consumers communicate less via email and more via text messaging, messaging apps and other virtual means, the reach of email campaigns designed to attract new and repeat users (and keep current users) for our products is adversely impacted. To continue to reach potential users and grow our businesses, we must identify and devote our overall marketing

activities and expenditures to newer advertising channels, such as mobile and online video platforms as well as targeted campaigns in which we communicate directly with potential, former and current users via new virtual means. For example, in 2021 and 2022, we expanded our activities on the TikTok platform. Generally, the opportunities in and sophistication of newer advertising channels are relatively undeveloped and unproven, and there can be no assurance that we will be able to continue to appropriately manage and fine-tune our marketing efforts in response to these and other trends in the advertising industry. Any failure to do so could materially adversely affect our business, financial condition and results of operations.

We believe that a critical contributor to our success has been our commitment to make free language learning available worldwide in an effort to help people throughout the world improve their economic outcomes. The mission of Duolingo is a significant part of our business strategy and who we are as a company. We believe that Duolingo users value our commitment to our mission. However, because we hold ourselves to such high standards, and because we believe our users have come to have high expectations of us, we may be more severely affected by negative reports or publicity if we fail, or are perceived to have failed, to live up to Duolingo’s mission. For example, maintaining a free version of the app that is both effective and enjoyable is central to Duolingo’s mission. As a result, our brand and reputation may be negatively affected by actions we take that are viewed as contrary to that mission, such as features that are only available to Super Duolingo subscribers or changes to the free offering that are viewed as undermining how fun or effective the free offering is. In these or other circumstances, the damage to our reputation may be greater than to other companies that do not share similar values with us, and it may take us longer to recover from such an incident and gain back the trust of our users.

We may make decisions regarding our business and products in accordance with Duolingo’s mission and values that may reduce our short- or medium-term operating results if we believe those decisions are consistent with the mission and will improve the aggregate user experience. Although we expect that our commitment to Duolingo’s mission will, accordingly, improve our financial performance over the long term, these decisions may not be consistent with the expectations of investors and any longer-term benefits may not materialize within the time frame we expect or at all, which could harm our business, revenue and financial results.

Unfavorable publicity or media reports regarding us, our privacy practices, our social media activities, data security compromises or breaches, product changes, product or service quality or features, litigation or regulatory activity or regarding the actions of our partners, our users, our employees or other companies in our industry, could materially adversely affect our brand image or reputation, regardless of the veracity of such publicity or media reports. If we fail to protect our brand image or reputation, we may experience material adverse effects to the size, demographics, engagement, and loyalty of our user base, resulting in decreased revenue, fewer app installs (or increased app uninstalls), or slower user growth rates. Damage to our brand or reputation could also adversely affect educational institutions’ willingness to accept the Duolingo English Test, which in turn could slow the growth of, or reduce, our revenue from the Duolingo English Test. In addition, if securities analysts or investors perceive any media coverage of

us to be negative, the price of our Class A common stock may be materially adversely affected. Any of the foregoing could materially adversely affect our business, financial condition and results of operations.

Our future success will depend upon our continued ability to identify, hire, develop, motivate, and retain highly skilled individuals across the globe, with the continued contributions of our senior management being especially critical to our success. Competition for well-qualified, highly skilled employees in our industry is intense and our continued ability to compete effectively depends, in part, upon our ability to attract and retain new employees. While we have established programs to attract new employees and provide incentives to retain existing employees, particularly our senior management, we cannot guarantee that we will be able to attract new employees or retain the services of our senior management or any other key employees in the future. Additionally, we believe that our culture and core values have been, and will continue to be, a key contributor to our success and our ability to foster the innovation, creativity and teamwork we believe we need to support our operations. If we fail to effectively manage our hiring needs and successfully integrate our new hires, or if we fail to effectively manage remote work arrangements, our efficiency and ability to meet our forecasts and our ability to maintain our culture, employee morale, productivity and retention could suffer, and our business, financial condition and results of operations could be materially adversely affected.

Finally, effective succession planning is also important to our future success. If we fail to ensure the effective transfer of senior management knowledge and smooth transitions involving senior management across our various businesses, our ability to execute short and long term strategic, financial and operating goals, as well as our business, financial condition, and results of operations generally, could be materially adversely affected.

The success of the Duolingo English Test depends in part upon the continued recognition and acceptance by schools, governments, and other institutions of technology-based assessment, such as the Duolingo English Test, and upon the continued utilization of assessment in general. As a result of the COVID-19 pandemic, in 2020, a number of universities waived standardized test requirements for admissions requirements and some universities plan to phase out requirements for standardized testing altogether. In addition, some have questioned the validity of language assessments taken online. If schools, governments, and other institutions reduce their reliance, or altogether cease to use standardized testing as part of admissions processes or otherwise, or reduce or eliminate reliance on standardized testing, it would have a material adverse effect on our Duolingo English Test business, which could adversely affect our revenues and results of operations.

Similarly, we continually seek to expand the number of schools, governments, and other institutions that accept the Duolingo English Test, including through direct engagement, government tenders, and other channels. If we are unable to do so, or if schools, governments, and other institutions rescind their acceptance of the Duolingo English Test, it may have a material adverse effect on our ability to grow the number of tests taken through the Duolingo English Test. For example, loss of confidence in the Duolingo English Test’s validity, security, or other characteristics could lead to a reduction in the number of accepting institutions, which could in turn reduce the appeal of the Duolingo English Test to test takers and adversely affect our revenues and results of operations. See “—Unfavorable media coverage could materially adversely affect our business, brand image or reputation.”.

Both our language learning application and the Duolingo English Test are available all over the world. Operating internationally, particularly in countries in which we have limited experience, exposes us to a number of additional risks, including:

Moreover, geopolitical tensions or regulatory uncertainty in countries in which we operate, such as China, may prevent us from operating in certain countries or increase our costs of operating in those countries. Additionally, if enforcement authorities demand access to our user data or require that we obtain hard to obtain local licenses, our failure to comply with those demands or obtain those licenses could lead to our inability to operate in such countries or other punitive acts.

In addition to the factors listed above, we have invested to expand our operations in China, which is an intensely competitive market, both on the consumer side and from a talent perspective. We expect to continue to incur significant expenses to operate our business in China, and we may not achieve profitability in that market. As we expand our operations in China, the above factors, sentiment of the workforce in China, and China’s policy towards foreign direct investment and for profit educational technology companies may particularly impact our operations in China. Further, as we expand our operations in China, we expect to continue to make modifications to the way our website, mobile apps, offerings, and features function in China as compared to other countries. In addition, we need to ensure that our business practices in China are compliant with local laws and regulations, which may be interpreted and enforced in ways that are different from our interpretation, and/or create obligations on us that are costly to meet or conflict with laws in other jurisdictions. For instance, in the fall of 2021 our language learning application became unavailable for download on most app stores in China. While this was temporary and we were reinstated in May 2022, it serves as an example of how the Chinese regulatory regime could adversely impact our efforts in China. Our office of over 30 employees in Beijing makes it easier for the Chinese authorities to bring enforcement actions against us.

The occurrence or impact of any or all of the events described above could materially adversely affect our international operations, which could in turn materially adversely affect our business, financial condition and results of operations.

Our products and services may be considered discretionary items for consumers. Factors affecting the level of consumer spending for such discretionary items include general economic conditions, and other factors, such as consumer confidence in future economic conditions, fears of recession, inflation, the availability and cost of consumer credit, levels of unemployment, and tax rates. In recent years, the United States and other significant economic markets have experienced cyclical downturns and worldwide economic conditions remain uncertain. As global economic conditions continue to be volatile or economic uncertainty remains, including due to the COVID-19 pandemic, trends in consumer discretionary spending also remain unpredictable and subject to reductions. To date, our business has operated almost exclusively in a relatively strong economic environment and, therefore, we cannot be sure the extent to which we may be affected by recessionary conditions. Unfavorable economic conditions may lead consumers to delay or reduce purchases of our products and consumer demand for our products may not grow as we expect. Our sensitivity to economic cycles and any related fluctuation in consumer demand for our products and services could materially adversely affect our business, financial condition, and results of operations. In addition, political instability or adverse political developments, could harm our business, financial condition and results of operations.

Our products and services and the operation of our business involve the collection, storage, processing, and transmission of data, including personal data. The information systems that store and process such data are susceptible to increasing threats of continually evolving cybersecurity risks. In particular, our industry is prone to cyber-attacks by third parties seeking unauthorized access to confidential or sensitive data, including user personal data, or to disrupt our ability to provide services. We face an ever-increasing number of threats to our information systems from a broad range of threat actors, including foreign governments, criminals, competitors, computer hackers, cyber terrorists and politically motivated groups or individuals, and we have previously experienced various attempts to access our information systems. These threats include physical or electronic break-ins, security breaches from inadvertent or intentional actions by our employees, contractors, consultants, and/or other third parties with otherwise legitimate access to our systems, website or facilities, or from cyber-attacks by malicious third parties which could breach our data security and disrupt our systems. The motivations of such actors may vary, but breaches that compromise our information technology systems or the personal data processed on such systems can cause interruptions, delays or operational malfunctions, which in turn could have a material adverse effect on our business, results of operations, financial condition and prospects.

In addition, the risks related to a security breach or disruption, including through ransomware, a distributed denial-of-service (“DDoS”) attack, computer malware, viruses, social engineering (predominantly spear phishing attacks), and general hacking, have become more prevalent in our industry and have generally increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased.

Such security breaches or disruptions have occurred on our systems in the past and will occur on our systems in the future. We also regularly encounter attempts to create false or undesirable user accounts and ads or take other actions on our platform for objectionable ends. As a result of our prominence, the size of our user base, the volume of personal data on our systems, and the evolving nature of our products and services (including our efforts involving new and emerging technologies), we may be a particularly attractive target for such attacks, including from highly sophisticated, state-sponsored, or otherwise well-funded criminal actors.

Our efforts to address undesirable activity on our platform also increase the risk of retaliatory attacks. Such breaches and attacks on us or our third-party service providers may cause interruptions to the services we provide, degrade the user experience, cause users or marketers to lose confidence and trust in our products and decrease the use of our products or stop using our products in their entirety, impair our internal systems, or result in financial harm to us. Any failure to prevent or mitigate security breaches and unauthorized access to or disclosure of our data or user data, including personal information, content, or payment information from users, or information from marketers, could result in the loss, modification, disclosure, destruction, or other misuse of such data, which could subject us to legal liability and penalties, harm our business and reputation and diminish our competitive position. We may incur significant costs in protecting against or remediating such incidents and as cybersecurity incidents continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Our efforts to protect our confidential and sensitive data, the data of our users or other personal information we receive, and to prevent or disable undesirable activities on our platform, may also be unsuccessful due to software bugs or other technical malfunctions; employee, contractor, or vendor error or malfeasance, including defects or vulnerabilities in our service providers’ information technology systems or offerings; government surveillance; breaches of physical security of our facilities or technical infrastructure; or other threats that may surface or evolve.

In addition, third parties may attempt to fraudulently induce employees or users to disclose information in order to gain access to our data or our users’ data. Cyber-attacks, including account take over, have increased. Account take over attacks occur when users re-use passwords from other sites, those sites have data leaks, and attackers use the leaked credentials from the other site to log in as those users on our site. Cyber-attacks continue to evolve in sophistication and volume, and may be difficult to detect for long periods of time. Although we have developed systems and processes that are designed to protect our data and user data, to prevent data loss, to disable undesirable accounts and activities on our platform, and to prevent or detect security breaches, we cannot assure you that such measures will be successful, that we will be able to anticipate or detect all cyber-attacks or other breaches, that we will be able to react to cyber-attacks or other breaches in a timely manner, or that our remediation efforts will be successful. We may incur significant costs in connection with such remediation efforts, including the costs of notifying applicable regulators and affected users, or offering credit monitoring services. We may also incur significant legal and financial exposure, including legal claims, higher transaction fees and regulatory fines and penalties as a result of any compromise or breach of our systems or data security, or the systems and data security of our third party providers. In addition, even though some user accounts are compromised due to user error or breaches unrelated to our products or security (such as during an account take over attack), users or the general public may become less confident in our product as a result of such compromises. Any of the foregoing could have a material adverse effect on our business, financial condition, results of operations and prospects.

In addition, some of our partners may receive or store information provided by us or by our users through mobile or web applications integrated with our applications and we use third-party service providers to store, transmit and otherwise process certain confidential, sensitive or personal information on our behalf. If these third parties fail to adopt or adhere to adequate data security practices, or in the event of a breach

of their networks, our data or our users’ data may be improperly accessed, used, or disclosed, which could subject us to legal liability. We cannot control such third parties and cannot guarantee that a security breach will not occur on their systems. Although we may have contractual protections with our third-party service providers, contractors and consultants, any actual or perceived security breach could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach. Any contractual protections we may have from our third-party service providers, contractors or consultants may not be sufficient to adequately protect us from any such liabilities and losses, and we may be unable to enforce any such contractual protections.

While our insurance policies include liability coverage for certain of these matters, subject to retention amounts that could be substantial, if we experience a significant security incident, we could be subject to liability or other damages that exceed our insurance coverage and we cannot be certain that such insurance policies will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our results of operations, financial condition and cash flows.

We receive, process, store, and transmit personal user and other confidential or sensitive information, including credit card information and personal information of our employees and users. In some cases, we engage third-party service providers to process or store this information. We continuously develop and maintain systems to protect the security, integrity and confidentiality of this information, but we have experienced past incidents (which to our knowledge were immaterial) and cannot guarantee that inadvertent or unauthorized use or disclosure of such information will not occur in the future or that third parties will not gain unauthorized access to such information despite our efforts. When such incidents occur, we may not be able to remedy them, we may be required by law to notify regulators and individuals whose personal information was used or disclosed without authorization, we may be subject to claims against us, including government enforcement actions or investigations, fines and litigation, and we may have to expend significant capital and other resources to mitigate the impact of such events, including developing and implementing protections to prevent future events of this nature from occurring. When breaches of our or our third-party service providers’ and partners’ information technology systems occur or unauthorized access to any of the confidential, sensitive or other personal information we collect or process occurs, the perception of the effectiveness of our security measures, the security measures of our partners and our reputation may be harmed, we may lose current and potential users and the recognition of our various brands and such brands’ competitive positions may be diminished, any or all of which might materially adversely affect our business, financial condition and results of operations. See “—The varying and rapidly-evolving regulatory framework on privacy and data protection across jurisdictions

could result in claims, changes to our business practices, monetary penalties, increased cost of operations, or declines in user growth or engagement, or otherwise harm our business.”

In addition to purchases through the Apple App Store and the Google Play Store, we accept payment from our users through credit card transactions, certain online payment service providers, and mobile payment platforms. The ability to access credit card information on a real-time basis without having to proactively reach out to the consumer each time we process an auto-renewal payment or a payment for the purchase of a premium feature on any of our products is critical to our success and a seamless experience for our users.

When we or a third party experiences a data security breach involving credit card information, affected cardholders will often cancel their credit cards. In the case of a breach experienced by a third party, the more sizable the third party’s customer base and the greater the number of credit card accounts impacted, the more likely it is that our users would be impacted by such a breach. To the extent our users are ever affected by such a breach experienced by us or a third party, affected users would need to be contacted to obtain new credit card information and process any pending transactions. It is likely that we would not be able to reach all affected users, and even if we could, some users’ new credit card information may not be obtained and some pending transactions may not be processed, which could materially adversely affect our business, financial condition and results of operations.

Our third party payment service providers utilize tokenization tools to replace sensitive cardholder information with a stand-in token to help secure individual cardholder bank account details in credit card transactions and to reduce the number of systems that have access to our customers’ credit card information. While these tokenization tools can help limit the data security risks associated with credit card transactions, it does not eliminate those risks altogether.

Even if our users are not directly impacted by a given data security breach, they may lose confidence in the ability of service providers to protect their personal information generally, which could cause them to stop using their credit cards online and choose alternative payment methods that are not as convenient for us or restrict our ability to process payments without significant cost or user effort.

Additionally, if we fail to adequately prevent fraudulent credit card transactions, we may face litigation, fines, governmental enforcement action, civil liability, diminished public perception of our security measures, significantly higher credit card-related costs and substantial remediation costs, or refusal by credit card processors to continue to process payments on our behalf, any of which could materially adversely affect our business, financial condition and results of operations.

Finally, the passage or adoption of any legislation or regulation affecting the ability of service providers to periodically charge consumers for, among other things, recurring subscription payments may materially adversely affect our business, financial condition and results of operations. Legislation or regulation regarding the foregoing, or changes to existing legislation or regulation governing subscription payments, are being considered in many states in the US. While we monitor and attempt to comply with these legal developments, we have been in the past, and may be in the future, subject to claims under such legislation or regulation.

In order for us to succeed, our information technology systems and infrastructures must perform well on a consistent basis. Our products and systems rely on software and hardware that are highly technical and complex, and depend on the ability of such software and hardware to store, retrieve, process and manage immense amounts of data. We have in the past experienced, and we may from time to time in the future experience, system interruptions that make some or all of our systems or data temporarily unavailable and prevent our products from functioning properly for our users; any such interruption could arise for any number of reasons, including software bugs and human errors. Further, our systems and infrastructures are vulnerable to damage from fire, power loss, hardware and operating software errors, cyber-attacks, technical limitations, telecommunications failures, acts of God and similar events. While we have backup systems in place for certain aspects of our operations, not all of our systems and infrastructures are fully redundant. We do not have a formal disaster recovery plan, and system backups do not account for all possible eventualities and our property and business interruption insurance coverage may not be adequate to compensate us fully for any losses that we may suffer. Any interruptions or outages, regardless of the cause, could negatively impact our users’ experiences with our products, tarnish our brands’ reputations and decrease demand for our products, any or all of which could materially adversely affect our business, financial condition and results of operations. Moreover, even if detected, the resolution of such interruptions may take a long time, during which customers may not be able to access, or may have limited access to, the service. See “—Security breaches of our networks, systems or applications, improper unauthorized access to or disclosure of our proprietary data or user-related data, including personal data, other hacking and phishing attacks on our systems or service, or other cyber incidents could disrupt our services or compromise sensitive information related to our business and/or personal data processed by us or on our behalf and expose us to liability, which could harm our reputation and materially adversely affect our business.”

We also continually work to expand and enhance the efficiency and scalability of our technology and network systems to improve the experience of our users, accommodate substantial increases in the volume of traffic to our various products, ensure acceptable load times for our products and keep up with changes in technology and user preferences. Any failure to do so in a timely and cost-effective manner could materially adversely affect our users’ experience with our various products and thereby negatively impact the demand for our products, and could increase our costs, either of which could materially adversely affect our business, financial condition and results of operations.

We may seek potential acquisition candidates to add complementary companies, products or technologies. For example, in October 2022, we completed the acquisition for the assets of Gunner Made LLC (“Gunner”), a wholly owned entity of PNG Holdings LLC, a design and animation studio based in Detroit, Michigan. The identification of suitable acquisition candidates can be difficult, time-consuming and costly, and we may not be able to successfully complete identified acquisitions. We may experience operational and financial risks in connection with historical and future acquisitions if we are unable to:

Furthermore, we may not be successful in addressing other challenges encountered in connection with our acquisitions. The anticipated benefits of one or more of our acquisitions may not be realized or the value of goodwill and other intangible assets acquired could be impacted by one or more continuing unfavorable events or trends, which could result in significant impairment charges. The occurrence of any of these events could have a material adverse effect on our business, financial condition and results of operations.

Additionally, the integration of acquisitions requires significant time and resources, and we may not manage these processes successfully. Our ability to successfully integrate complex acquisitions is unproven, particularly with respect to companies that have significant operations or that develop products with which we do not have prior experience. We may make substantial investments of resources to support our acquisitions, which would result in significant ongoing operating expenses and may divert resources and management attention from other areas of our business. We cannot assure you that these investments will be successful. If we fail to successfully integrate the companies we acquire, we may not realize the benefits expected from the transactions and our business may be harmed.

Our functional currency is the US dollar, our operating expenses are denominated in the currencies of the countries in which our operations are located, which are primarily in the United States, China and Germany. Our consolidated results of operations and cash flows are, therefore, subject to fluctuations due to changes in foreign currency exchange rates and may be adversely affected in the future due to changes in foreign exchange rates. In addition, certain of our payment providers translate our payments from local currency into USD at time of settlement, which means that during periods of a strengthening US dollar, our international receipts could be reduced. In addition, as foreign currency exchange rates fluctuate, the translation of our international receipts into US dollars affects the period-over-period comparability of our operating results and can result in foreign currency exchange gains and losses. We have not entered into any hedging arrangements with respect to foreign currency risk or other derivative financial instruments, although we may choose to do so in the future. The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in

foreign exchange rates and may introduce additional risks if we are unable to structure effective hedges with such instruments.

Market opportunity estimates and expectations about market growth included in this Annual Report on Form 10-K are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. Even if the markets in which we compete meet the size estimates and growth expectations included in this Annual Report on Form 10-K, our business could fail to grow for a variety of reasons, which could adversely affect our results of operations.

We are subject to a variety of laws and regulations in the United States and abroad that involve matters that are important to or may otherwise impact our business, including, among others, broadband internet access, online commerce, advertising, user privacy, data protection, intermediary liability, protection of minors, consumer protection, accessibility, immigration and university admissions, taxation and securities law compliance. The introduction of new products, expansion of our activities in certain jurisdictions, or other actions that we may take may subject us to additional laws, regulations or other government scrutiny. In addition, foreign laws and regulations can impose different obligations or be more restrictive than those in the United States.

These US federal, state, and municipal and foreign laws and regulations, which in some cases can be enforced by private parties in addition to government entities, are constantly evolving and can be subject to significant change.

In addition, the introduction of new brands and products, or changes to our existing brand and products, may result in new or enhanced governmental or regulatory scrutiny. As a result, the application, interpretation, and enforcement of these laws and regulations are often uncertain, particularly in the new and rapidly-evolving industry in which we operate, and may be interpreted and applied inconsistently from state to state and country to country and inconsistently with our current policies and practices. These laws and regulations, as well as any associated inquiries or investigations or any other government actions, may be costly to comply with and may delay or impede the development of new products, require that we change or cease certain business practices, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to remedies that may harm our business, including fines, demands or orders that require us to modify or cease existing business practices. For example, a variety of laws and regulations govern the ability of users to cancel subscriptions and auto-payment renewals. We have in the past and may in the future be subject to claims under such laws and regulations that could materially adversely affect our business.

The promulgation of new laws or regulations, or the new interpretation of existing laws and regulations, in each case, that restrict or otherwise unfavorably impact our business, or our ability to provide or the manner in which we provide our services, could require us to change certain aspects of our business and operations to ensure compliance, which could decrease demand for services, reduce revenues, increase costs and subject us to additional liabilities.

The adoption of any laws or regulations that adversely affect the popularity or growth in use of the internet or our services, including laws or regulations that undermine open and neutrally administered internet access, could decrease user demand for our service offerings and increase our cost of doing business, any of which could have a material adverse effect on our business, financial condition and results of operations.

We are subject to rules and regulations of the United States and other relevant authorities relating to export controls and economic and trade sanctions, including sanctions administered by the Office of Foreign Assets Control (“OFAC”) within the US Department of the Treasury, as well as the Export Administration Regulations (i.e. export controls) administered by the Department of Commerce. These laws and regulations limit our ability to market, sell, distribute or otherwise transfer our products, software, or technology to, or otherwise transact or deal with, certain countries, territories, governments, and persons, absent US government permissions or exemptions.

Further, we have historically provided services to users in countries that are the target of US sanctions, such as Syria. We believe our provision of such services is in compliance with applicable law, and have implemented various control mechanisms to maintain such compliance. We have also secured a license from OFAC to provide certain of our services to end-users in Syria, which we renewed in 2022 for an additional two years. There is no assurance that OFAC will agree to extend or renew our license.

While we have taken steps to comply with these rules and regulations, a determination that we have failed to comply, whether knowingly or inadvertently, may result in substantial penalties, including fines, enforcement actions, civil and/or criminal sanctions, the disgorgement of profits, and may materially adversely affect our business, results of operations and financial condition

Increased regulation of data utilization practices, including self-regulation, new laws, or findings or guidance under existing laws that limit our ability to collect, disclose, process, transfer, retain and use information and other data, could have a material adverse effect on our business. In addition, if we were to disclose information and other data about our users in a manner that was objectionable to them, our business reputation could be materially adversely affected, and we could face potential legal claims that could impact our operating results. Internationally, we may become subject to additional and/or more stringent legal obligations concerning our treatment of customer and other personal information, such as laws regarding data localization and/or restrictions on data export. For example, in July 2020 the Court of Justice of the European Union (“CJEU”) invalidated the EU-US Privacy Shield Framework (“Privacy Shield”) under which personal data could be transferred from the European Economic Area (“EEA”) and the United Kingdom to entities in the United States who had self-certified under the Privacy Shield scheme. This has led to uncertainty about the adequate transfer mechanisms for other personal data transfers from the EEA and the United Kingdom to the United States or interruption of such transfers. In the event that any court of law orders the suspension of personal data transfers to or from a particular jurisdiction this could give rise to operational interruption in the performance of services for customers, greater costs to implement alternative data transfer mechanisms that are still permitted, regulatory liabilities or reputational harm. Failure to comply with evolving privacy laws could subject us to liability and expose us to fines, penalties and compliance orders, and to the extent that we need to alter our business model or practices to adapt to these obligations, we could incur additional expenses, which may in turn materially adversely affect our business, financial condition, and results of operations. See “—The varying and rapidly-evolving regulatory framework on privacy and data protection across jurisdictions could result

in claims, changes to our business practices, monetary penalties, increased cost of operations, or declines in user growth or engagement, or otherwise harm our business.”

Additionally, privacy activist groups have previously and may continue to provide resources to support individuals who wish to pursue privacy claims or put pressure on companies to change data processing practices. High-profile brands such as ours risk being targeted by such groups and there is a risk that if a user became disgruntled with our data processing practices they could leverage support from such privacy activist groups to take legal action, initiate regulatory investigation or gain publicity for their cause. There is a risk that these groups will seek to challenge our practices, particularly in relation to targeted advertising or international data transfers. Any such campaign could require significant resources to mount a response and could lead to negative publicity and potential investigation from regulators, any of which may materially adversely affect our business, financial condition, and results of operations.

As discussed above, we process personal information, personal data and other regulated information both from our employees and our users. There are numerous laws in the countries in which we operate regarding privacy and the storage, sharing, use, transfer, disclosure, protection and otherwise processing of this kind of information, the scope of which are constantly changing, and in some cases, inconsistent and conflicting and subject to differing interpretations, as new laws of this nature are proposed and adopted and we currently, and from time to time, may not be in technical compliance with all such laws. Such laws also are becoming increasingly rigorous and could be interpreted and applied in ways that may have a material adverse effect on our business, financial condition, results of operations and prospects. Therefore, enforcement practices are likely to remain uncertain for the foreseeable future. In recent years, there has been an increase in attention to and regulations of data protection and data privacy across the globe, including in the United States, the EEA and the United Kingdom. We are subject to various data protection laws, including: the General Data Protection Regulation 2016/679 (GDPR) in the EEA, the United Kingdom data protection regime consisting primarily of (i) the UK General Data Protection Regulation and (ii) the UK Data Protection Act 2018 (collectively (i) and (ii), the UK GDPR), the Personal Information Protection Law (“PIPL”) in China, the California Consumer Privacy Act (“CCPA”), , the California Privacy Rights Act of 2020 (“CPRA”) and the Virginia Consumer Data Protection Act (“CDPA” in the United States, and the Brazilian General Data Protection Law, which imposes requirements similar to the GDPR on products and services offered to users in Brazil. We may be subject to additional privacy regulations in the future. Other comprehensive data privacy or data protection laws or regulations have been passed or are under consideration in other jurisdictions, including China, India and Japan. Laws such as these give rise to an increasingly complex set of compliance obligations on us, as well as on many of our service providers. These laws impose restrictions on our ability to gather personal data, provide individuals with the ability to opt out of personal data collection and control how their personal data is processed, impose obligations on our ability to share personal data with others, limit the geographic locations in which we can store personal data, and potentially subject us to fines, lawsuits, and regulatory scrutiny.

For example, the GDPR and the UK GDPR impose strict data protection compliance requirements including: providing detailed disclosures about how personal data is collected and processed (in a concise, intelligible and easily-accessible form); demonstrating that an appropriate legal basis is in place or otherwise exists to justify data processing activities; complying with rights for data subjects in regard to their personal data (including the right to be “forgotten” and the right to data portability); notifying data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant

data breaches; ensuring appropriate safeguards are in place where personal data is transferred out of the EEA and the United Kingdom; limiting retention of personal data; maintaining a record of processing activities; and complying with the principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit. The GDPR and the UK GDPR create compliance obligations that are also applicable to entities established outside the EEA/United Kingdom, which offer goods or services to individuals located in the EEA/United Kingdom or which observe the behavior of individuals located in the EEA/United Kingdom. This has created a greater compliance burden for us and other companies with users or employees in the EEA and the United Kingdom, as the legal regimes may subject non-compliant entities to substantial monetary penalties. In particular, fines for the most serious violations under the GDPR and the UK GDPR may amount to the greater of €20 million/£17.5 million or, in the case of an undertaking, up to 4% of the total worldwide annual group turnover of the preceding financial year. Since we are subject to the supervision of relevant data protection authorities under both the GDPR and the UK GDPR, we could be fined under each of those regimes independently in respect of the same violation. In addition to potential substantial fines, non-compliance could result in regulatory investigations, reputational damage, orders to cease/ change the processing of personal data, enforcement notices, and/ or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs and diversion of internal resources.

As noted above, the CJEU invalidated the Privacy Shield on July 16, 2020 and, while it upheld the adequacy of the EU standard contractual clauses (a standard form of contract approved by the European Commission (“SCCs”) as an adequate transfer mechanism for personal data, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances. Use of the SCCs must be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular surveillance laws and the rights of individuals and additional measures and/or contractual provisions may need to be adopted, however, the nature of these additional measures is currently uncertain. The CJEU went on to state that, if the competent supervisory authority believes that the SCCs cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer unless the data exporter has already done so itself. We rely on a mixture of mechanisms to transfer personal data from the EEA and the United Kingdom to the United States and other jurisdictions deemed non-adequate, and are evaluating what additional mechanisms may be required to establish adequate safeguards for personal data. As supervisory authorities continue to issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used and/or start taking enforcement action, and court cases progress, there will be uncertainty as to how we comply with EEA and United Kingdom privacy laws and we could suffer additional costs, complaints, and/or regulatory investigations or fines. While a new EU-U.S. data transfer framework has been proposed, it remains subject to further scrutiny before it may be fully implemented. Accordingly, compliance requirements remain uncertain as do the costs or business changes that may be ultimately required by law. If we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, and we may find it necessary to establish systems in the EEA and the United Kingdom to maintain personal data originating from the EEA and the United Kingdom, which may involve substantial expense and distraction from other aspects of our business. Other countries have also passed or are considering passing laws requiring local data residency and/or restricting the international transfer of data, which would create similar risks for us in those countries.

We are also subject to evolving privacy laws in the EEA and the United Kingdom on cookies, tracking technologies and e-marketing. In the EEA and the United Kingdom, informed consent is required for the

placement of non-strictly necessary cookies or similar technologies on users’ devices and for direct electronic marketing. The GDPR and the UK GDPR also impose conditions on obtaining valid consent, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of non-strictly necessary cookie or similar technology. Regulators are increasingly focusing on compliance with such requirements in the online behavioral advertising ecosystem, and current national laws that implement the ePrivacy Directive may be replaced by an EU regulation known as the ePrivacy Regulation which would significantly increase fines for non-compliance. While the text of the ePrivacy Regulation is still under development, European court decisions and regulators’ guidance are driving increased attention to cookies and tracking technologies. If regulators continue to enforce the strict approach in recent guidance, this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users as well as personalize the consumer experience, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand and tailor our offerings to users.

Brexit (as defined below) and ongoing developments in the United Kingdom have created additional uncertainty as the United Kingdom may become a “third country” for the purposes of personal data transfers from the EEA to the United Kingdom should the United Kingdom lose its current “adequacy” status as a result of future privacy law reforms. These changes may require us to find alternative solutions for the compliant transfer of personal data from the EEA into and out of the United Kingdom, which may be costly or disruptive to our service or business.

We depend on a number of third parties in relation to the operation of our business, a number of which process personal data on our behalf. With each such provider we attempt to mitigate the associated risks of using third parties by performing security assessments and detailed due diligence, entering into contractual arrangements to ensure that providers only process personal data according to our instructions, and that they have sufficient technical and organizational security measures in place. Where we transfer personal data outside the EEA or the United Kingdom to such third parties, we do so while considering the relevant data export requirements, as described above. There is no assurance that these contractual measures and our own privacy and security-related safeguards will protect us from the risks associated with the third-party processing, storage and transmission of such information. Any violation of data or security laws by our third party processors could have a material adverse effect on our business and result in the fines and penalties outlined above.

The GDPR and the UK GDPR will continue to be interpreted by data protection regulators and courts in the EEA and the United Kingdom. If their interpretation of the requirements under these laws is inconsistent with our business practices, this may require us to make changes to our business practices, which could be time-consuming and expensive, and could generate additional risks and liabilities.

Multiple legislative proposals concerning privacy and the protection of user information are being considered by the US Congress. Various US state legislatures have announced intentions to consider additional privacy legislation, and US state legislatures such as California and Virginia have already passed and enacted comprehensive privacy legislation. For example, among other cases, the CCPA requires covered companies to provide disclosures to California consumers and provide such consumers certain data protection and privacy rights, including the ability to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. A ballot initiative from privacy rights advocates intended to augment and expand the CCPA called the California Privacy Rights Act (“CPRA”) was passed in November 2020 and

took effect in January 2023 (with a look back to January 2022). The CPRA significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. The CDPA, which took effect in January 2023, gives new data protection rights to Virginia residents and imposes additional obligations on controllers and processors of personal data. For example, like the CCPA, the CDPA grants Virginia residents certain rights to access personal data that is being processed by the controller, the right to correct inaccuracies in that personal data and the right to require that their personal data be deleted by the data controller. In addition, Virginia residents now have the right to request a copy of their personal data in a format that permits them to transmit it to another data controller. Further, under the CDPA, Virginia residents have the right to opt out of the sale of their personal data, as well as the right to opt out of the processing of their personal data for targeted advertising. New legislation proposed or enacted in a number of states impose, or have the potential to impose additional obligations on companies that collect, store, use, retain, disclose, transfer and otherwise process confidential, sensitive and personal information, and will continue to shape the data privacy environment nationally. State laws are changing rapidly and there is discussion in Congress of a new federal data protection and privacy law to which we would become subject if it is enacted. Additionally, governmental agencies like the Consumer Financial Protection Bureau and the Federal Trade Commission have adopted, or are considering adopting, laws and regulations concerning personal information and data security. For example, the Federal Trade Commission has increased its focus on privacy and data security practices at digital companies, as evidenced by obtaining increasing fines against companies found to be in violation of the Children’s Online Privacy Protection Act (“COPPA”), and obtaining twenty-year consent decrees mandating enhanced and specific requirements for information security management programs. While the FTC does not have legal authority to seek monetary penalties or relief in the area of data security as a general matter, a violation of a privacy or data security consent decree can subject the responding company to very high monetary penalties, as evidenced by the FTC obtaining $5 billion in negotiated monetary relief against Facebook for violation of a consent decree.

The myriad international and US privacy and data breach laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly. In addition to government regulation, privacy advocates and industry groups have and may in the future propose self-regulatory standards from time to time. These and other industry standards may legally or contractually apply to us, or we may elect to comply with such standards. We expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. Because the interpretation and application of data protection laws, regulations, standards and other obligations are still uncertain, and may be contradictory and in flux, it is possible that the scope and requirements of these laws may be interpreted and applied in a manner that is inconsistent with our practices and our efforts to comply with the evolving data protection rules may be unsuccessful.

We make public statements about our use and disclosure of personal information through our privacy policy, information provided on our website and press statements. Although we endeavor to ensure that our public statements are complete, accurate and fully implemented, we may at times fail to do so or be alleged to have failed to do so. We may be subject to potential regulatory or other legal action if such policies or statements are found to be deceptive, unfair or misrepresentative of our actual practices. In addition, from time to time, concerns may be expressed about whether our products and services compromise the privacy of our users and others. Any concerns about our data privacy and security practices (even if unfounded), or any failure, real or perceived, by us to comply with our posted privacy policies or with any legal or regulatory requirements, standards, certifications or orders or other privacy or consumer protection-related laws and regulations applicable to us, could cause our users to reduce their use of our products and services.

While we aim to comply with industry standards and applicable laws and industry codes of conduct relating to privacy and data protection in all material respects, there is no assurance that we will not be subject to claims that we have violated applicable laws or codes of conduct, that we will be able to successfully defend against such claims or that we will not be subject to significant fines and penalties in the event of non-compliance. Additionally, to the extent multiple state-level laws are introduced with inconsistent or conflicting standards and there is no federal law to preempt such laws, compliance with such laws could be difficult and costly to achieve and we could be subject to fines and penalties in the event of non-compliance.

Furthermore, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. We have in the past received, and may continue to receive inquiries from regulators regarding our data privacy practices. Any failure or perceived failure by us (or the third parties with whom we have contracted to process such information) to comply with applicable privacy and security laws, policies or related contractual obligations, or any compromise of security that results in unauthorized access, use or transmission of, personal user information, could result in a variety of claims against us, including governmental enforcement actions and investigations, class action privacy litigation in certain jurisdictions and proceedings by data protection authorities. We could further be subject to significant fines, other litigation, claims of breach of contract and indemnity by third parties, and adverse publicity. When such events occur, our reputation may be harmed, we may lose current and potential users and the competitive positions of our various brands might be diminished, any or all of which could materially adversely affect our business, financial condition, results of operations and prospects. In addition, if our practices are not consistent or viewed as not consistent with legal and regulatory requirements, including changes in laws, regulations and standards or new interpretations or applications of existing laws, regulations and standards, we may become subject to audits, inquiries, whistleblower complaints, adverse media coverage, investigations, loss of export privileges or severe criminal or civil sanctions, all of which may have a material adverse effect on our business, financial condition, results of operations and prospects.

In some locations we are subject to privacy regulations that may be seen as excessive, invasive or harmful, such as those that require organizations to provide access to personal information or confidential data to governmental bodies. We risk reputational damage if we are deemed to be negatively impacting the privacy of our users through our attempts to comply with such regulations. Should we actively choose to not comply with regulations we deem harmful to our users we risk damages from non-compliance as described previously.

A variety of laws and regulations have been adopted in recent years aimed at protecting children using the internet such as the COPPA, Article 8 of the GDPR and the UK GDPR, and the United Kingdom’s Age Appropriate Design Code (also referred to as the Children’s Code). As some of these laws and regulations apply to us or our applications, we implement certain precautions to ensure that we comply with such laws and regulations. Despite our efforts, no assurances can be given that such measures will be sufficient to completely avoid allegations (whether founded or not) or decisions that we have, or are, not in compliance with COPPA or another relevant law or regulation, any of which could expose us to significant liability, penalties, reputational harm and loss of revenue, among other things. We also expect further jurisdictions to adopt these types of laws and regulations, which would further increase these risks, and may require us to spend additional resources in order to comply.

Additionally, new regulations are being considered in various jurisdictions to require the monitoring of user content or the verification of users’ identities and age. Such new regulations, or changes to existing regulations, could increase the complexity of our compliance obligations and the cost of our operations.

As the regulatory framework for machine learning technology and artificial intelligence evolves, our business, financial condition, and results of operations may be adversely affected. The regulatory framework for machine learning technology, artificial intelligence and automated decision making is evolving. It is possible that new laws and regulations will be adopted in the United States and in non-U.S. jurisdictions, or that existing laws and regulations may be interpreted in ways that would affect the operation of our learning platforms, online testing business and data analytics and the way in which we use artificial intelligence and machine learning technology. Further, the cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could adversely affect our business, financial condition and results of operations.

For example, in Europe, on April 21, 2021, the European Commission proposed a regulation seeking to establish a comprehensive, risk-based governance framework for artificial intelligence in the EU market. The proposal is intended to apply to companies that develop, use and/ or provide artificial intelligence in the EU and includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security and accuracy, and proposes fines for breach of up to 6% of worldwide annual turnover. In addition, on September 28, 2022, the European Commission proposed two Directives seeking to establish a harmonized civil liability regime for artificial intelligence in the EU, in order to facilitate civil claims in respect of harm caused by artificial intelligence and to include artificial intelligence-enabled products within the scope of the EU’s existing strict liability regime. If enacted, this regulatory framework is expected to have a material impact on the way artificial intelligence is regulated in the EU, and together with developing guidance and/ or decisions in this area, may affect our use of artificial intelligence and our ability to provide and to improve our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition.

We are, and from time to time may become, subject to litigation and various legal proceedings, including litigation and proceedings related to intellectual property matters, privacy and consumer protection laws, as well as stockholder derivative suits, class action lawsuits, actions from former employees and other matters, that involve claims for substantial amounts of money or for other relief or that might necessitate changes to our business or operations. The defense of these actions could be time consuming and expensive and could distract our personnel from their normal responsibilities. We evaluate these litigation claims and legal proceedings to assess the likelihood of unfavorable outcomes and to estimate, if possible, the amount of potential losses. Based on these assessments and estimates, we may establish reserves or disclose the relevant litigation claims or legal proceedings, as and when required or appropriate. These assessments and estimates are based on information available to management at the time of such assessment or estimation and involve a significant amount of judgment. As a result, actual outcomes or losses could differ materially from those envisioned by our current assessments and estimates. Our failure to successfully defend or settle any of these litigations or legal proceedings could result in liability that, to the extent not covered by our insurance, could have a material adverse effect on our business, financial condition and results of operations. See Part I, Item 3. Legal Proceedings.

We are a US-based multinational company subject to tax in multiple US and foreign tax jurisdictions. Significant judgment is required in determining our global provision for income taxes, deferred tax assets or liabilities and in evaluating our tax positions on a worldwide basis. While we believe our tax positions are consistent with the tax laws in the jurisdictions in which we conduct our business, it is possible that these positions may be challenged by jurisdictional tax authorities, which may have a significant impact on our global provision for income taxes.

Tax laws are being re-examined and evaluated globally. New laws and interpretations of the law are taken into account for financial statement purposes in the quarter or year that they become applicable. Tax authorities are increasingly scrutinizing the tax positions of companies. Many countries in the European Union, as well as a number of other countries and organizations such as the Organization for Economic Cooperation and Development and the European Commission, are actively considering changes to existing tax laws that, if enacted, could increase our tax obligations in countries where we do business. These proposals include changes to the existing framework to calculate income tax, as well as proposals to change or impose new types of non-income taxes, including taxes based on a percentage of revenue. For example, several countries in the European Union have proposed or enacted taxes applicable to digital services, which includes business activities on social media platforms and online marketplaces, and would likely apply to our business. Many questions remain about the enactment, form and application of these digital services taxes. The interpretation and implementation of the various digital services taxes (especially if there is inconsistency in the application of these taxes across tax jurisdictions) could have a materially adverse impact on our business, results of operations and cash flows. Moreover, if the US or other foreign tax authorities change applicable tax laws, our overall taxes could increase, and our business, financial condition or results of operations may be adversely impacted.

Following a national referendum and enactment of legislation by the government of the United Kingdom, the United Kingdom formally withdrew from the European Union (“Brexit”) and ratified a trade and cooperation agreement governing its future relationship with the European Union. The agreement, which became effective in 2021, addresses trade, economic arrangements, law enforcement, judicial cooperation and a governance framework including procedures for dispute resolution, among other things. Because the agreement merely sets forth a framework in many respects and will require complex additional bilateral negotiations between the United Kingdom and the European Union as both parties continue to work on the rules for implementation, significant political and economic uncertainty remains about how the precise terms of the relationship between the parties will differ from the terms before withdrawal.

We have users in the United Kingdom and the European Union and, as a result, we face risks associated with the potential uncertainty and disruptions that may follow Brexit and the implementation and application of the trade and cooperation agreement, including with respect to volatility in exchange rates and interest rates, disruptions to the free movement of data, goods, services, people and capital between the United Kingdom and the European Union and potential material changes to the regulatory regime applicable to our operations in the United Kingdom. In addition, Brexit could lead to legal uncertainty and potentially divergent national laws and regulations as the United Kingdom determines which laws of the European Union to replace or replicate. These developments have had and may continue to have a material adverse effect on global economic conditions and the stability of global financial markets and could significantly reduce global market liquidity and limit the ability of key market participants to operate in certain financial markets.

The ongoing instability and uncertainty surrounding Brexit and the implementation and application of the Trade and Cooperation Agreement, could require us to restructure our business operations in the United Kingdom and the European Union, may increase our regulatory costs, and could have an adverse impact on our business and staff in the United Kingdom and European Union.

Our commercial success depends in part on avoiding infringement, misappropriation or other violations of the intellectual property rights of third parties. However, we may become party to disputes from time to time over rights and obligations concerning intellectual property held by third parties, and we may not prevail in these disputes. Companies in the internet, technology and social media industries are subject to frequent litigation based on allegations of infringement, misappropriation or other violations of intellectual property rights. Furthermore, various “non-practicing entities” that own patents and other intellectual property rights often attempt to assert claims in order to extract value from technology companies and, given that these patent holding companies or other adverse intellectual property rights holders typically have no relevant product revenue, our own issued or pending patents and other intellectual property rights may provide little or no deterrence to these rights holders in bringing intellectual property rights claims against us. From time to time we may receive claims from third parties which allege that we have infringed upon their intellectual property rights. Further, from time to time we may introduce new products, product features and services, including in areas where we currently do not have an offering, which could increase our exposure to patent and other intellectual property claims from competitors and non-practicing entities. In addition, some of our agreements with third-party partners require us to indemnify them for certain intellectual property claims against them, which could require us to incur considerable costs in defending such claims, and may require us to pay significant damages in the event of an adverse ruling. Such third-party partners may also discontinue their relationships with us as a result of injunctions or otherwise, which could result in loss of revenue and adversely impact our business operations.

Although we try to ensure that our employees and consultants do not use the proprietary information or know-how of others in their work for us, we may be subject to claims that we or our employees or consultants have inadvertently or otherwise used or disclosed intellectual property, including trade secrets, software code or other proprietary information, of a former employer or other third parties. Litigation may be necessary to defend against these claims and if we fail in defending any such claims, in addition to paying monetary damages, we may lose valuable intellectual property rights or personnel. Further, while it is our policy to require our employees and contractors who may be involved in the conception or development of intellectual property to execute agreements assigning such intellectual property to us, we may be unsuccessful in executing such an agreement with each party who, in fact, conceives or develops intellectual property that we regard as our own. Additionally, any such assignment of intellectual property rights may not be self-executing, or the assignment agreements may be breached, and we may be forced to bring claims against third parties, or defend claims that they may bring against us, to determine the ownership of what we regard as our intellectual property.

As we face increasing competition and develop new products, we expect the number of patent and other intellectual property claims against us may grow. There may be intellectual property or other rights held by others, including issued or pending patents, that cover significant aspects of our products and services, and we cannot be sure that we are not infringing or violating, and have not infringed or violated, any third-party intellectual property rights or that we will not be held to have done so or be accused of doing so in the future.

Any claim or litigation alleging that we have infringed or otherwise violated intellectual property or other rights of third parties, with or without merit, and whether or not settled out of court or determined in our favor, could be time-consuming and costly to address and resolve, and could divert the time and attention of our management and technical personnel. The outcome of any litigation is inherently uncertain, and there can be no assurances that favorable final outcomes will be obtained in all cases. In addition, third parties may seek, and we may become subject to, preliminary or provisional rulings in the course of any such litigation, including potential preliminary injunctions requiring us to cease some or all of our operations. We may decide to settle such lawsuits and disputes on terms that are unfavorable to us. Similarly, if any litigation to which we are a party is resolved adversely, we may be subject to an unfavorable judgment that may not be reversed upon appeal, including being subject to a permanent injunction and being required to pay substantial monetary damages, including treble damages, punitive damages, and attorneys’ fees, if we are found to have willfully infringed a party’s intellectual property rights. The terms of such a settlement or judgment may require us to cease some or all of our operations, pay substantial amounts to the other party, or admit liability. Moreover, as part of any settlement or other compromise to avoid complex, protracted litigation, we may agree not to pursue future claims against a third party, including for claims related to alleged infringement of our intellectual property rights. Part of any settlement or other compromise with another party may resolve a potentially costly dispute but may also have future repercussions on our ability to defend and protect our intellectual property rights, which in turn could adversely affect our business, financial conditions, and results of operations and prospects. In addition, we may have to seek a license to continue practices found to be in violation of a third-party’s rights. If we are required, or choose to enter into royalty or licensing arrangements, such arrangements may not be available on reasonable terms, or at all, and may significantly increase our operating costs and expenses. Such arrangements may also only be available on a non-exclusive basis such that third parties, including our competitors, could have access to the same licensed technology to compete with us. As a result, we may also be required to develop or procure alternative non-infringing technology, which could require significant effort, time and expense or discontinue use of the technology. There also can be no assurance that we would be able to develop or license suitable alternative technology to permit us to continue offering the affected products or services as currently offered. If we cannot develop or license alternative technology for any allegedly infringing aspect of our business, we would be forced to limit our products and services and may be unable to compete effectively. Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be compromised by disclosure during this type of litigation. Any of the foregoing, and any unfavorable resolution of such disputes and litigation, would materially and adversely impact our business, financial condition, results of operations and prospects.

Our intellectual property is a material asset of our business and our success depends in part on our ability to protect our proprietary information and techniques and multiple forms of intellectual property. For example, we rely heavily upon our trademarks, designs, copyrights, related domain names, social media handles and logos to market our brands and to build and maintain brand loyalty and recognition. We also rely upon proprietary technologies and trade secrets, as well as a combination of laws, and contractual restrictions, including confidentiality agreements with employees, customers, suppliers, affiliates and others, to establish, protect and enforce our various intellectual property rights. We have generally registered and continue to apply to register and renew, or secure by contract where appropriate, trademarks, service marks and copyrights as they are developed and used, and reserve, register and renew domain names and social media handles as we deem appropriate.

If our trademarks and trade names are not adequately protected, then we may not be able to build and maintain name recognition in our markets of interest and our business may be adversely affected.

Effective trademark protection may not be available or may not be sought in every country in which our products are made available, in every class of goods and services in which we operate, and contractual disputes may affect the use of marks governed by private contract. Our registered or unregistered trademarks, tradenames or other intellectual property rights may be challenged, infringed, circumvented or declared invalid or unenforceable or determined to be infringing on other marks. Further, at times, competitors may adopt trade names or trademarks similar to ours, thereby impeding our ability to build or extend brand identity and possibly leading to market confusion.

Similarly, not every variation of a domain name or social media handle may be available or be registered by us, even if available. The occurrence of any of these events could result in the erosion of our brands and limit our ability to market our brands using our various domain names and social media handles, as well as impede our ability to effectively compete against competitors with similar technologies or products, any of which could materially adversely affect our business, financial condition and results of operations. We are also party to certain agreements that may limit our trademark rights in certain jurisdictions; while we believe these agreements are unlikely to have a significant impact on our business as currently conducted, our ability to use our existing trademarks in new business lines in the future may be limited.

We also rely on seeking patent protection for key technologies or approaches we develop that enable us to deliver or enhance the products and services we offer. We seek patent protection for these types of innovations primarily in order to best protect our ability to utilize the innovations either by ourselves or as part of a joint development project.

We cannot guarantee that our efforts to obtain and maintain intellectual property rights are adequate, that we have secured, or will be able to secure, appropriate permissions or protections for all of the intellectual property rights we use or rely on. Furthermore, even if we are able to obtain intellectual property rights, any challenge to our intellectual property rights could result in them being narrowed in scope or declared invalid or unenforceable. In addition, other parties may independently develop technologies that are substantially similar or superior to ours and we may not be able to stop such parties from using such independently developed technologies to compete effectively with us.

We also rely upon unpatented proprietary information and other trade secrets to protect intellectual property that may not be registrable, or that we believe is best protected by means that do not require public disclosure. While it is our policy to enter into confidentiality agreements with employees and third parties to protect our proprietary expertise and other trade secrets, we cannot guarantee that we have entered into such agreements with each party that has or may have had access to our proprietary information or trade secrets and, even if entered into, these agreements may otherwise fail to effectively prevent disclosure of proprietary information, may be limited as to their term, or may not provide an adequate remedy in the event of unauthorized disclosure or use of proprietary information. Monitoring unauthorized uses and disclosures is difficult, and we do not know whether the steps we have taken to protect our proprietary technologies will be effective. Enforcing a claim that a party illegally disclosed or misappropriated a trade secret can be difficult, expensive and time-consuming, and the outcome is unpredictable. Further, some courts inside and outside the United States may be less willing or unwilling to protect trade secrets. In addition, trade secrets may be independently developed by others in a manner that could prevent legal recourse by us. If any of our confidential or proprietary information, such as our trade secrets, were to be disclosed or misappropriated, or if any such information was independently developed by a competitor, our competitive position would be materially adversely harmed.

Our intellectual property rights and the enforcement or defense of such rights may be affected by developments or uncertainty in laws and regulations relating to intellectual property rights. Moreover, many companies have encountered significant problems in protecting and defending intellectual property rights in foreign jurisdictions. The legal systems of certain countries, particularly certain developing

countries, may not favor the enforcement of trademarks, copyrights, trade secrets and other intellectual property protection, which could make it difficult for us to stop the infringement, misappropriation or other violation of our intellectual property or the marketing of competing products in violation of our intellectual property rights generally.

We also may be forced to bring claims against third parties to determine the ownership of what we regard as our intellectual property or to enforce our intellectual property rights against infringement, counterfeiting, misappropriation or other violations by third parties. However, the measures we take to protect our intellectual property from unauthorized use by others may not be effective and there can be no assurance that our intellectual property rights will be sufficient to protect against others offering products or services that are substantially similar or superior to ours or that compete with our business. We may not prevail in intellectual property-related proceedings that we initiate against third parties. Further, in such proceedings or in proceedings before patent, trademark and copyright agencies, our asserted intellectual property could be found to be invalid, unenforceable or limited in scope, in which case we could lose valuable intellectual property rights. In addition, even if we are successful in enforcing our intellectual property against third parties, the damages or other remedies awarded, if any, may not be commercially meaningful. Regardless of whether any such proceedings are resolved in our favor, such proceedings could cause us to incur significant expenses and could distract our personnel from their normal responsibilities. Accordingly, our efforts to enforce our intellectual property rights around the world may be inadequate to obtain a significant commercial advantage from the intellectual property that we develop or license.

Despite the measures we take to protect our intellectual property rights, our intellectual property rights may still not be adequate and protected in a meaningful manner, challenges to contractual rights could arise, third parties could copy or otherwise obtain and use our intellectual property without authorization, or laws and interpretations of laws regarding the enforceability of existing intellectual property rights may change over time in a manner that provides less protection or introduces uncertainty. The occurrence of any of these events could impede our ability to effectively compete against competitors with similar technologies, any of which could materially adversely affect our business, financial condition and results of operations.

We use open source software, content and materials (“Open Source Materials”) in connection with a portion of our proprietary software and our service offerings and we expect to continue to use Open Source Materials in the future. Under certain circumstances, some open source licenses require users of the Open Source Materials to provide the user’s own proprietary source code to third parties upon request, to license the user’s own proprietary source code or other materials for the purpose of making derivative works, prohibit users from charging a fee to third parties in connection with the use of the user’s proprietary code, or require the relicensing of the Open Source Materials and derivatives thereof under the terms of the applicable license. While we employ practices designed to monitor our compliance with the licenses of third-party Open Source Materials and protect our proprietary source code and content, we cannot guarantee that we will be successful, that all Open Source Materials are reviewed prior to use in our products, that our developers have not incorporated Open Source Materials into our products, or that they will not do so in the future. Accordingly, we may face claims from others challenging our use of Open Source Materials or seeking to enforce the license terms applicable to such Open Source Materials, including by demanding public release of the Open Source Materials or derivative works or our proprietary source code and content that was developed or distributed in connection with such Open Source Materials. Such claims could also require us to purchase a commercial license or require us to devote

additional research and development resources to change our software and content, any of which would have a negative effect on our business and results of operations. In addition, if the license terms for the open source code change, we may be forced to re-engineer our software, revise our content or otherwise incur additional costs. Additionally, the terms of many open source licenses to which we are subject have not been interpreted by US or foreign courts. There is a risk that open source licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market or provide our products.

In addition, the use of open source software may entail greater risks than the use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code. To the extent that our platform depends upon the successful operation of the open source software we use, any undetected errors or defects in this open source software could prevent the deployment or impair the functionality of our platform, delay the introduction of new solutions, result in a failure of our platform, and injure our reputation. For example, undetected errors or defects in open source software could render it vulnerable to breaches or security attacks and make our systems more vulnerable to data breaches.

Our exposure to these risks may be increased as a result of evolving our core source code base, introducing new content and offerings, integrating acquired-company technologies, or making other business changes, including in areas where we do not currently compete. Any of the foregoing could adversely impact the value or enforceability of our intellectual property, and materially adversely affect our business, results of operations, and financial condition.

We cannot predict the extent to which investor interest in us will sustain an active public trading market for shares of our Class A common stock. If an active public market does not continue to develop or is not sustained, it may be difficult for you to sell your shares of Class A common stock at a price that is attractive to you, or at all. The lack of an active market may also reduce the fair market value of your shares. An inactive market may also impair our ability to raise capital to continue to fund operations by selling shares and may impair our ability to make acquisitions by using our shares as consideration.

The trading price of our Class A common stock may be highly volatile and could be subject to wide fluctuations. Securities markets worldwide experience significant price and volume fluctuations. This market volatility, as well as general economic, market or political conditions, could reduce the market price of shares of our Class A common stock regardless of our operating performance. In addition, our operating results could be below the expectations of public market analysts and investors due to a number of potential factors, including variations in our quarterly operating results or dividends, if any, to stockholders, additions or departures of key management personnel, failure to meet analysts’ earnings estimates, publication of research reports about our industry, litigation and government investigations, changes or proposed changes in laws or regulations or differing interpretations or enforcement thereof affecting our business, adverse market reaction to any indebtedness we may incur or securities we may issue in the future, changes in market valuations of similar companies or speculation in the press or investment community, announcements by our competitors of significant contracts, acquisitions, dispositions, strategic partnerships, joint ventures or capital commitments, adverse publicity about the

industries we participate in or individual scandals, and in response the market price of shares of our Class A common stock could decrease significantly.

Stock markets and the price of our Class A shares may experience extreme price and volume fluctuations. In the past, following periods of volatility in the overall market and the market price of a company’s securities, securities class action litigation has often been instituted against these companies. This litigation, if instituted against us, could result in substantial costs and a diversion of our management’s attention and resources.

The trading market for our Class A common stock relies in part on the research and reports that industry or securities analysts publish about us or our business. If any of the analysts who cover us downgrade our Class A common stock or publish inaccurate or unfavorable research about our business, our Class A common stock price may decline. If analysts cease coverage of us or fail to regularly publish reports on us, we could lose visibility in the financial markets, which in turn could cause our Class A common stock price or trading volume to decline and our Class A common stock to be less liquid.

Our Class B common stock has 20 votes per share, and our Class A common stock has one vote per share. As of December 31, 2022, our directors, executive officers, and 5% stockholders and their affiliates held in the aggregate 85.2% of the voting power of our capital stock. Because of the 20-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively could continue to control a significant percentage of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval until all outstanding shares of Class A and Class B common stock have converted automatically into shares of a single class of common stock. This concentrated control may limit or preclude your ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that you may believe are in your best interest as one of our stockholders.

In addition, future transfers by holders of Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions, such as certain transfers effected for estate planning purposes. The conversion of Class B common stock to Class A common stock will have the effect, over time, of increasing the relative voting power of those holders of Class B common stock who retain their shares in the long term. As a result, it is possible that one or more of the persons or entities holding our Class B common stock could gain significant voting control as other holders of Class B common stock sell or otherwise convert their shares into Class A common stock.

In addition, while we do not expect to issue any additional shares of Class B common stock, any future issuances of Class B common stock would be dilutive to holders of Class A common stock.

We cannot predict whether our dual class structure will result in a lower or more volatile market price of our Class A common stock, in adverse publicity or other adverse consequences. Certain index providers have announced restrictions on including companies with multiple class share structures in certain of their indices. For example, S&P Dow Jones has stated that companies with multiple share classes will not be eligible for inclusion in the S&P Composite 1500 (composed of the S&P 500, S&P MidCap 400 and S&P SmallCap 600), although existing index constituents in July 2017 were grandfathered. Under the announced policies, our dual class capital structure would make us ineligible for inclusion in any of these indices. Given the sustained flow of investment funds into passive strategies that seek to track certain indices, exclusion from stock indices would likely preclude investment by many of these funds and could make our Class A common stock less attractive to other investors. As a result, the market price of our Class A common stock could be materially adversely affected.

Our amended and restated certificate of incorporation authorizes us to issue, without the approval of our stockholders, one or more classes or series of preferred stock having such designations, preferences, limitations and relative rights, including preferences over our Class A common stock respecting dividends and distributions, as our board of directors may determine. The terms of one or more classes or series of preferred stock could adversely impact the voting power or value of our Class A common stock. For example, we might grant holders of preferred stock the right to elect some number of our directors in all events or on the happening of specified events or the right to veto specified transactions. Similarly, the repurchase or redemption rights or liquidation preferences we might assign to holders of preferred stock could affect the residual value of the Class A common stock.

Sales of a substantial number of shares of our common stock in the public market or the perception that these sales might occur in large quantities, could cause the market price of our Class A common stock to decline and could impair our ability to raise capital through the sale of additional equity securities.

All shares of Class A common stock sold in our IPO are freely tradable without restrictions or further registration under the Securities Act except for any shares held by our affiliates as defined in Rule 144 under the Securities Act (“Rule 144”).

Moreover, as of December 31, 2022, the holders of up to 907,028 shares of our Class B common stock have rights, subject to some conditions, to require us to file registration statements for the public resale of the Class A common stock issuable upon conversion of such shares or to include such shares in registration statements that we may file for us or other stockholders. Any registration statement we file to register additional shares, whether as a result of registration rights or otherwise, could cause the market price of our Class A common stock to decline or be volatile.

Further, as of December 31, 2022, we had options outstanding that, if fully exercised, would result in the issuance of 3,375,500 shares of Class A common stock and 1,034,500 shares of Class B common stock, as well as 2,036,000 shares of Class A common stock issuable upon vesting and settlement of outstanding RSUs. We have registered on Form S-8 under the Securities Act the shares of our common stock subject to outstanding stock options and RSUs as of the date of the Final Prospectus (defined below) and shares that will be issuable pursuant to future awards granted under our equity incentive plan. These shares can be freely sold in the public market upon issuance, subject to applicable vesting

requirements, compliance by affiliates with Rule 144, and other restrictions provided under the terms of the applicable plan and/or the award agreements entered into with participants.

We may issue our shares of common stock or securities convertible into our common stock from time to time in connection with financings, acquisitions, investments, or otherwise. New investors in subsequent transactions could gain rights, preferences, and privileges senior to those of holders of our Class A common stock. Any such issuance could result in substantial dilution to our existing stockholders and cause the trading price of our Class A common stock to decline.

We do not intend to pay any dividends on our Class A common stock in the foreseeable future. We anticipate that we will retain all of our future earnings for use in the operation and growth of our business and for general corporate purposes. Any determination to pay dividends in the future will be at the discretion of our board of directors. Accordingly, investors must rely on sales of their Class A common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

Our amended and restated certificate of incorporation and amended and restated bylaws contain and Delaware law contains provisions which could have the effect of rendering more difficult, delaying or preventing an acquisition deemed undesirable by our board of directors. Our corporate governance documents provide for:

These provisions, alone or together, could delay or prevent hostile takeovers and changes in control or changes in our management.

As a Delaware corporation, we are also subject to provisions of Delaware law, including Section 203 of the General Corporation Law of the State of Delaware (the Delaware General Corporation Law), which prevents some stockholders holding more than 15% of our outstanding common stock from engaging in certain business combinations without approval of the holders of substantially all of our outstanding common stock.

Any provision of our certificate of incorporation, bylaws or Delaware law that has the effect of delaying or deterring a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock, and could also affect the price that some investors are willing to pay for our common stock.

Our amended and restated certificate of incorporation and amended and restated bylaws provide that we will indemnify our directors and officers, in each case to the fullest extent permitted by Delaware law.

In addition, as permitted by Section 145 of the Delaware General Corporation Law, our amended and restated bylaws and our indemnification agreements that we have entered or intend to enter into with our directors and officers provide that:

Our directors’ and officers’ liability insurance policies may not be available to us in the future at a reasonable rate, may not cover all potential claims for indemnification, and may not be adequate to indemnify us for all liability that may be imposed.

Our amended and restated certificate of incorporation and amended and restated bylaws provide that the Court of Chancery of the State of Delaware is the exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a breach of fiduciary duty, any action asserting a claim against us arising pursuant to the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws, or any action asserting a claim against us that is governed by the internal affairs doctrine; provided that, the exclusive forum provision will not apply to suits brought to enforce any liability or duty created by the Exchange Act or any other claim for which the federal courts have exclusive jurisdiction; and provided further that, if and only if the Court of Chancery of the State of Delaware dismisses any such action for lack of subject matter jurisdiction, such action may be brought in another state or federal court sitting in the State of Delaware. Our amended and restated certificate of incorporation and amended and restated bylaws also provide that the federal district courts of the United States of America will be the exclusive forum for the resolution of any complaint asserting a cause of action against us or any of our directors, officers, or employees arising under the Securities Act. Nothing in our amended and restated certificate of incorporation or amended and restated bylaws precludes stockholders that assert claims under the Exchange Act from bringing such claims in state or federal court, subject to applicable law.

We believe these provisions may benefit us by providing increased consistency in the application of Delaware law and federal securities laws by chancellors and judges, as applicable, particularly experienced in resolving corporate disputes, efficient administration of cases on a more expedited schedule relative to other forums and protection against the burdens of multi-forum litigation. This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers, other employees or stockholders, which may discourage lawsuits with respect to such claims. If a court were to find the choice of forum provision that will be contained in our amended and restated certificate of incorporation or amended and restated bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could materially adversely affect our business, results of operations, and financial condition.

As a public company, we incur significant legal, accounting, and other expenses that we did not incurred as a private company. We are subject to the reporting requirements of the Exchange Act, the applicable requirements of the Sarbanes-Oxley Act, the Dodd-Frank Act, the rules and regulations of the SEC, and the Listing Rules of the Nasdaq Global Select Market. Stockholder activism and the level of government intervention and regulatory reform may lead to substantial new regulations and disclosure obligations, which may lead to additional significant compliance costs and impact the manner in which we operate our business in ways we cannot currently anticipate. The increased costs will increase our net loss or decrease our net income, and may require us to reduce costs in other areas of our business or increase our service fees which could result in a reduction in bookings. For example, we expect these rules and regulations to make it more difficult and more expensive for us to obtain director and officer liability insurance. The impact of these requirements could also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, on our board committees, or as executive officers. Furthermore, if we are unable to satisfy our obligations as a public company, we could be subject to delisting of our Class A common stock, fines, sanctions, and other regulatory action and potentially civil litigation.

Further, the majority of our management team, including our Chief Executive Officer and Chief Financial Officer, have either no or limited experience in managing publicly-traded companies. Our management team may not successfully or efficiently manage our transition to being a public company and the continuous scrutiny of securities analysts and investors. These obligations and constituents have and will require significant attention from our senior management and could divert their attention away from the day-to-day management of our business, and could materially adversely affect our business, results of operations, and financial condition.

As a result of becoming a public company, we are required, pursuant to Section 404 of The Sarbanes-Oxley Act of 2002 (“Section 404”), to furnish a report by management on the effectiveness of our internal control over financial reporting. This assessment includes disclosure of any material weaknesses identified by our management in our internal control over financial reporting. As a result no longer qualifying as an “emerging growth company” as defined in the Jumpstart Our Business Startups Act of 2012 and becoming a large accelerated filer, we are also required to comply with, among other requirements, the auditor attestation requirements of Section 404.

We expect to incur costs related to implementing an internal audit and compliance function in the upcoming years. If we identify material weaknesses in our internal control over financial reporting or if we are unable to comply with the demands placed upon us as a public company, including the requirements of Section 404, in a timely manner, we may be unable to accurately report our financial results, or report them within the timeframes required by the SEC. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our Consolidated Financial Statements will not be prevented or detected on a timely basis. We cannot assure you that the measures we have taken to date, and actions we may take in the future, will be sufficient to prevent or avoid potential future material weaknesses. A material weakness

in our internal control over financial reporting could result in an increased probability of fraud, the potential loss of customers, litigation from our stockholders, reduction in our ability to obtain financing, and require additional expenditures to remediate. Our failure to implement and maintain effective internal control over financial reporting could result in errors in our financial statements that could result in loss of investor confidence in the accuracy and completeness of our financial reports and a decline in our stock price, and we could be subject to sanctions or investigations by the SEC or other regulatory authorities.

We prepare Consolidated Financial Statements in accordance with accounting principles generally accepted in the United States. The accounting for our business is subject to change based on the evolution of our business model, interpretations of relevant accounting principles, enforcement of existing or new regulations, and changes in policies, rules, regulations, and interpretations, of accounting and financial reporting requirements of the SEC or other regulatory agencies. A change in any of these principles or guidance, or in their interpretations or application to us, may have a significant effect on our reported results, as well as our processes and related controls, and may retroactively affect previously reported results, which may negatively impact our financial statements, which may in turn adversely affect our prospects. It is difficult to predict the impact of future changes to accounting principles and accounting policies over financial reporting, any of which could adversely affect our results of operations and financial condition and could require significant investment in systems and personnel.

The preparation of financial statements in conformity with generally accepted accounting principles in the United States requires us to make estimates and assumptions that affect the reported amount of assets and liabilities and the disclosure of contingent liabilities as of the date of the financial statements and the reported amount of revenues and expenses during the reporting period. For example, we make certain assumptions about the interpretation of these principles and accounting treatment of our non-cash stock-based compensation expense and related obligations with respect to our financial statements. If these assumptions turn out to be unfounded, our stock-based compensation expense could be materially higher than expected for current and future periods, which could have a material adverse effect on our net loss. We base estimates and assumptions on historical experience and on various other factors that we believe to be reasonable under the circumstances, the results of which form the basis for making judgments about the carrying values of assets, liabilities, equity, revenue and expenses that are not readily apparent from other sources. We may make estimates regarding activities for which the accounting treatment is still uncertain. Actual results could differ from those estimates. If our assumptions change or if actual circumstances differ from our assumptions, our operating results may be adversely affected and could fall below our publicly announced guidance or the expectations of securities analysts and investors, resulting in a decline in the market price of our common stock.

None.

We lease approximately 84,000 square feet in multiple facilities in Pittsburgh, Pennsylvania where we operate our headquarters. Our headquarters currently accommodates our principal executive,

development, engineering, product, marketing, business development, human resources, finance, legal, information technology and administrative activities.

Outside of Pittsburgh, we and our subsidiaries in China and Germany use co-working space as needed for the business. As of December 31, 2022, we have membership agreements with WeWork for offices in or near New York, Seattle, Beijing, Tokyo, and Berlin. Additionally, as a result of the Gunner Made LLC acquisition, we now lease office space in Detroit.

We believe that our existing facilities are sufficient for our current needs. We believe that suitable additional or substitute space will be available as needed to accommodate changes in our operations.

From time to time we may be involved in claims and proceedings arising in the course of our business. The outcome of any such claims or proceedings, regardless of the merits, is inherently uncertain. We are not currently party to any material legal proceedings.

Not applicable.

Our Class A common stock is listed on the Nasdaq Global Select Market under the symbol “DUOL”.

As of February 27, 2023, there were 32,201,681 stockholders of record of our Class A common stock. The actual number of stockholders is greater than this number of record holders and includes stockholders who are beneficial owners but whose shares are held in street name by brokers and other nominees.

As of February 27, 2023, there were 8,434,238 stockholders of record of our Class B common stock.

We have never declared or paid any cash dividends on our common stock, and we do not currently intend to pay any cash dividends on our common stock in the foreseeable future. We currently intend to retain all available funds and any future earnings to support operations and to finance the growth and development of our business. Any future determination related to dividend policy will be made at the discretion of our board of directors, subject to applicable laws and the restrictions set forth in any of our contractual agreements, and will depend upon, among other factors, our results of operations, financial condition, contractual restrictions and capital requirements. Our future ability to pay cash dividends on our common stock may also be limited by the terms of any future debt or preferred securities we may issue or any future credit facilities we may enter into.

None

None

The graph below compares the cumulative total stockholder return on our Class A common stock with the cumulative total return on the S&P 500 Index (“S&P 500”) and the S&P Software and Services Index. We have chosen to update the comparison included in our Annual Report on Form 10-K for the fiscal year ended December 31, 2021 to include the S&P Software and Services Index to be more industry specific. We will remove the Nasdaq Composite Index (“NASDAQ”) in future reports, however since the NASDAQ was presented in the prior year, we are presenting it one more year for comparative purposes. The graph assumes $100 was invested at the market close on July 28, 2021, which was the first day our Class A common stock began trading. Data for the Nasdaq Composite Index, S&P 500 Index, and S&P 500 Information Technology Index assume reinvestment of dividends. The graph uses the closing market price on July 28, 2021 of $134.26 per share as the initial value of our Class A common stock. The comparisons in the graph below are based upon historical data and are not indicative of, nor intended to forecast, future performance of our Class A common stock.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our Consolidated Financial Statements and related notes included elsewhere in this Annual Report on Form 10-K. The following discussion contains forward-looking statements, such as those relating to our plans, objectives, expectations, intentions, and beliefs, that involve risks, uncertainties and assumptions. Our actual results could differ materially from these forward-looking statements as a result of many factors, including those discussed in Part I, Item 1A. “Risk Factors,” “Special Note Regarding Forward-Looking Statements,” and included elsewhere in this Annual Report on Form 10-K. Our historical results are not necessarily indicative of the results that may be expected for any periods in the future.

Amounts reported in millions are rounded based on the amounts in thousands. As a result, the sum of the components reported in millions may not equal the total amount reported in millions due to rounding. In addition, percentages presented are calculated from the underlying numbers in thousands and may not add to their respective totals due to rounding.

Our flagship app has organically become the world’s most popular way to learn languages and the top-grossing Education app in the App Stores, offering courses in over 40 languages to over 60 million monthly active users for the three months ended December 31, 2022. We believe that we have become the preeminent online destination for language learning due to our beautifully designed products, exceptional user engagement, and demonstrated learning efficacy.

On July 30, 2021, Duolingo completed its Initial Public Offering (“IPO”) of 5.9 million shares of its Class A common stock at a price to the public of $102.00 per share, 4.5 million of which were sold by the Company and 1.4 million of which were sold by certain selling stockholders, which includes the exercise in full by the underwriters of their option to purchase from the Company an additional 0.8 million shares of the Company’s Class A common stock. The gross proceeds to the Company from the IPO were $455.5 million, before deducting underwriting discounts and commissions and offering expenses payable by the Company. The Company did not receive any proceeds from the sale of shares of Class A common stock in the offering by the selling stockholders. Immediately prior to the completion of the IPO, all convertible preferred stock outstanding, totaling approximately 19.1 million shares, was automatically converted into an equivalent number of shares of Class B common stock on a one-to-one basis and their carrying value of $182.6 million was reclassified to additional paid-in capital within stockholders’ equity. Additionally, on July 15, 2021, 6.9 million shares held by our founders were exchanged from Class A common stock into Class B common stock.

We use a freemium business model that relies on a premium subscription offering, advertising, and in-app-purchases (IAPs) to produce revenue. We believe the following key attributes of our freemium subscription business model are core to our success.

Our subscription offering is called Super Duolingo. It offers learners features such as an ad-free experience, along with additional learning and gamification features that enhance their learning experience. One such enhancement is unlimited Hearts, which give learners more flexibility in how they move through course content.

For users who are unable or unwilling to pay a subscription fee, we provide free access to our product and generate advertising revenue from the sale of display and video advertising delivered through

advertising impressions. We generally enter into arrangements with the major programmatic advertising networks to monetize our advertising inventory. Our advertising revenue is primarily a function of the number of our free users, hours of engagement of our free users, and our ability to provide innovative advertising placements that are relevant to our users and enhance returns for our advertising partners.

In-app purchases consist of learners purchasing one-time benefits within the app, such as “Streak Freezes” and “Timer Boosts.”

In addition to monetizing the Duolingo language learning app, we generate revenue from the Duolingo English Test by charging test takers a one-time fee that generally costs $49. University program acceptance is a driver of Duolingo English Test revenue. As of December 31, 2022, over 3,800 higher education programs around the world accept the Duolingo English Test results as proof of English proficiency for international student admissions, including the top 25 undergraduate programs ranked by international enrollment, as well as top schools such as Yale, Stanford, MIT, Duke and Columbia.

The Company also recognizes revenue from Dos Lenguas LLC, “Duo’s Taquería,” a restaurant that opened during 2022, in the space adjacent to our headquarters in Pittsburgh.

Items within Management's Discussion and Analysis of Financial Condition and Results of Operations include a discussion of changes between the years ended December 31, 2022 and 2021. For a discussion of changes from the year ended December 31, 2021 to the year ended December 31, 2020, refer to Management’s Discussion and Analysis of Financial Condition and Results of Operation in Part II, Item 7. of our Annual report on Form 10-K for the year ended December 31, 2021 (filed with the SEC on March 3, 2022).

We regularly review a number of key operating metrics and non-GAAP financial measures to evaluate our business, measure our performance, identify trends, prepare financial projections and make business decisions. The measures set forth below should be considered in addition to, not as a substitute for or in isolation from, our financial results prepared in accordance with GAAP. Monthly active users (MAUs) and daily active users (DAUs), along with paid subscribers, are operating metrics that help inform management about the underlying growth in users of our platform, and are a measure of our monetization efforts. To calculate the year-over-year change in MAUs and DAUs for a given period, we subtract the average for the same period in the previous year from the average for the same period in the current year and divide the result by the average for the same period in the previous year. Other companies, including companies in our industry, may calculate these measures differently or not at all, which reduces their usefulness as comparative measures.

We had approximately 60.7 million and 42.4 million MAUs for the three months ended December 31, 2022 and 2021, respectively, representing an increase of 43% from the prior year period. We grew MAUs through product initiatives designed to make the app more social and engaging, through marketing and through improving our courses, all of which we believe helped us attract new users, retain existing users, and reengage the millions of former users who return to our language learning app.

We use certain non-GAAP financial measures to supplement our Consolidated Financial Statements, which are presented in accordance with GAAP. These non-GAAP financial measures include Adjusted EBITDA and free cash flow. We use these non-GAAP financial measures for financial and operational decision-making and as a means to evaluate period-to-period comparisons. By excluding certain items that may not be indicative of our recurring core operating results, we believe that Adjusted EBITDA and free cash flow provide meaningful supplemental information regarding our performance. Accordingly, we believe these non-GAAP financial measures are useful to investors and others because they allow for additional information with respect to financial measures used by management in its financial and operational decision-making and they may be used by our institutional investors and the analyst community to help them analyze the health of our business. However, there are a number of limitations related to the use of non-GAAP financial measures, and these non-GAAP measures should be considered in addition to, not as a substitute for or in isolation from, our financial results prepared in accordance with GAAP. Other companies, including companies in our industry, may calculate these non-GAAP financial measures differently or not at all, which reduces their usefulness as comparative measures.

The Company also uses non-GAAP constant currency revenues and non-GAAP percentage change in constant currency revenues, which exclude the impact of fluctuations in foreign currency exchange rates, for financial and operational decision-making and as a means to evaluate period-to-period comparisons. The effect of currency exchange rates on our business is an important factor in understanding period to period comparisons and we believe this information is useful to investors to facilitate comparisons and better identify trends in our business. The impact of changes in foreign currency may vary significantly from period to period, and such changes generally are outside of the control of our management. We calculate constant currency revenues by using current period foreign currency revenues and translating them to constant currency using prior year comparable period exchange rates. Constant currency revenue percentage change is calculated by determining the change in current period revenues over prior year comparable period revenues where current period foreign currency revenues are translated using prior year comparable period exchange rates.

For the year ended December 31, 2022 and 2021, we generated Adjusted EBITDA of $15.5 million and an Adjusted EBITDA loss of $1.1 million, respectively. Adjusted EBITDA increased in both periods due to a combination of our growth in revenue, improved gross margin, and reduction in operating expenses as a percentage of revenue as compared to the prior year periods.

For the year ended December 31, 2022 and 2021, we generated $46.2 million and $12.7 million of free cash flow, respectively. The increase in free cash flow in both periods was mainly attributable to the increase in net cash provided by operating activities.

Total revenues were $369,495 for the year ended December 31, 2022, an increase of 47% over the year ended December 31, 2021 on a reported basis, and 51% on a constant currency basis. Subscription revenues totaled $273,507 for the year ended December 31, 2022, an increase of 51% over the year ended December 31, 2021 on a reported basis, and 55% on a constant currency basis.

We experience some seasonality in both user growth and monetization on our platform. Historically, the number of users on our platform and the number of subscribers we have increase in January and then moderate throughout the first quarter and second quarter back to our secular growth trend. In the third quarter, historically, we’ve seen the number of users on our platform increase as our product is used by students that return to school in certain geographies. Finally, in the latter part of December, as the new year approaches, we see an increase in usage as people make New Years resolutions, including resolutions to learn new things like languages. Monetization, through an increase in subscribers, also increases at the end of December and into January when we run a promotion tied to the New Year holiday.

We generate revenues primarily from the sale of subscriptions. The term-length of our subscription agreements are primarily monthly or annual. We began to roll out a family plan during the second half of 2021 and as of December 31, 2022 offer it exclusively as an annual subscription. We have historically had a six-month subscription plan, but during the fourth quarter of 2020, we began to phase it out. We also generate revenue from advertising, the in-app sale of virtual goods, and the Duolingo English Test.

Cost of revenues predominantly consists of third-party payment processing fees charged by various distribution channels, and also includes hosting fees. To a much lesser extent, cost of revenues includes costs for contractors, wages and stock-based compensation for certain employees in the capacity of customer support, amortization of revenue generating capitalized software, and depreciation of certain property and equipment.

We intend to continue to invest additional resources in our infrastructure and our customer support and success organization to expand the capabilities of our platform and ensure that our users are realizing the full benefit of our products. The level, timing, and relative investment in these areas could affect our cost of revenues in the future.

Gross profit represents revenues less cost of revenues. Gross margin is gross profit expressed as a percentage of revenues. Our gross profit may fluctuate from period to period as our revenues fluctuate, and also as a result of the timing and amount of investments we make in items related to cost of revenues.

Our operating expenses consist of research and development, sales and marketing, and general and administrative expenses. Personnel costs are the most significant component of operating expenses and consist of salaries, benefits, and stock-based compensation expense. Operating expenses also include overhead costs for facilities, including depreciation expense.

Interest income consists of income earned on our money market funds included in cash and cash equivalents and on our marketable securities.

Other (expense) income, net consists primarily of foreign currency exchange losses and gains losses.

The provision for income taxes represents the income tax expense associated with our operations based on the tax laws of the jurisdictions in which we operate. These foreign jurisdictions have different statutory tax rates than the United States. Our effective tax rates will vary depending on the relative proportion of foreign to domestic income, changes in the valuation of our deferred tax assets and liabilities, and changes in tax laws.

The following table sets forth our Consolidated Statements of Operations and Comprehensive Loss data, including year-over-year change, for the periods indicated:

Revenues increased $118.7 million, or 47%, to $369.5 million during the year ended December 31, 2022, from revenues of $250.8 million during the year ended December 31, 2021. The main drivers of the increase for both periods were:

The following table provides the changes in revenues by product type:

The following table provides the change in cost of revenues, along with related gross margins:

Research and development continues to be our largest operating expense as we invest in it in order to drive user engagement with and customer satisfaction in our platform. This engagement and satisfaction, we believe, helps to drive organic growth in MAUs and DAUs, growth in, and better retention of, paid subscribers, as well as increased advertising opportunities with free users.

Direct marketing spend and other expenses as a percentage of revenue decreased for both periods presented as a result of applying learnings from past years, which enabled us to spend marketing expenses more efficiently.

Interest income increased $7.2 million during the year ended December 31, 2022 due to an increase in interest rates earned on our money market funds.

Other (expense) income, net decreased $0.7 million, during the year ended December 31, 2022, mainly the impact from changes in foreign currency rates.

Provision for income taxes increased $0.8 million, during the year ended December 31, 2022, primarily attributable to estimated foreign tax expense as well as the impact, for US federal income tax purposes, of the capitalization of research and development expenses in accordance with Internal Revenue Code ("IRC") Section 174.

Since inception, we have financed operations primarily through revenues and the net proceeds we have received from the issuance of equity.

As of December 31, 2022, we had $608.2 million in cash and cash equivalents. Our cash and cash equivalents primarily consist of bank deposits and money market funds. Our marketable securities consist of US government treasury and agency securities.

We believe that our existing cash and cash equivalents, and cash flow from operations will be sufficient to support working capital and capital expenditure requirements for at least the next 12 months. Our future capital requirements will depend on many factors, including our subscription growth rate and renewal activity, the timing of cash received from our payment processing platforms, the expansion of our sales and marketing activities, the introduction of new products and the enhancements to existing products, and the current uncertainty in the global markets. We may be required to seek additional equity. If we are unable to raise additional capital or generate cash flows necessary to expand our operations and invest in continued innovation, we may not be able to compete successfully, which would harm our business, operations and financial condition.

A substantial source of our cash from operations comes from deferred revenue, which is included in the liabilities section of our Consolidated Balance Sheet. Deferred revenues consists of the unearned portion of customer billings, which is recognized as revenue in accordance with our revenue recognition policy. As of December 31, 2022, we had deferred revenues of $157.6 million, which is recorded as a current liability and expected to be recognized as revenue in the next 12 months, provided all other revenue recognition criteria have been met.

The following table summarizes our cash flows for the periods presented:

Cash flows from operating activities can fluctuate significantly from period to period due to timing of payments and cash collections. Our largest source of operating cash is cash collection from sales of subscriptions to our users. Our primary uses of cash from operating activities are for personnel expenses, marketing expenses, hosting expenses, and overhead expenses.

Cash provided by operating activities for the year ended December 31, 2022 increased $44.5 million, or 485%, to $53.7 million. This increase was mainly due to the decrease of net loss adjusted by stock-based compensation expense, in addition to an increase in deferred revenue.

Cash used in investing activities increased $8.0 million, or 128%, to $14.2 million for the year ended December 31, 2022, from $6.2 million for the year ended December 31, 2021. The increase was due to increased costs from capital expenditures to purchase property and equipment to support office space and site operations, capitalization of software development and the acquisition of Gunner Made LLC.

Cash provided by financing activities for the year ended December 31, 2022 was $14.8 million, which was from proceeds from exercises of stock options. Cash provided by financing activities for the year ended December 31, 2021 was $430.5 million and was driven by the net proceeds from the IPO of $431.1 million less costs of $4.9 million, and proceeds from exercises of stock options of $12.5 million. These increases were partially offset by cash paid in the prior year for the tender offer of $8.2 million, which did not reoccur.

The following table summarizes our contractual obligations and commitments as of December 31, 2022:

We did not have during the periods presented, and we do not currently have, any off-balance sheet financing arrangements or any relationships with unconsolidated entities or financial partnerships, including entities sometimes referred to as structured finance or special purpose entities, that were established for the purpose of facilitating off-balance sheet arrangements or other contractually narrow or limited purposes.

Revenue from time-based subscriptions includes a stand-ready obligation to provide hosting services that are consumed by the customer over the subscription period. Users can purchase Super Duolingo monthly or they can purchase a six-month or year-long subscription and pay for the subscription at the time of purchase. Under the year-long subscription, users can purchase a single plan or a family plan. The family plan includes up to six users on one subscription. Such payments are initially recorded to deferred revenue. The user has the ability to download limited content offline. However, as there is a significant level of integration and interdependency with the online functionality, we consider the service to be a single performance obligation for the online and offline content.

We enter into arrangements with advertising networks to monetize the in-app advertising inventory. Revenue from in-app advertising placement is recognized at a point in time when the advertisement is placed and is based upon the amount received.

Duolingo English Test revenue is generally recognized once the tests have gone through the proctoring process and a certification decision has been made. This process usually takes less than 48 hours after the test has been completed and uploaded. Customers have 21 days from the date of purchase to take the exam or their purchase will expire and revenue will be recognized. The vast majority of customers complete their exams prior to expiration. Sometimes organizations may purchase tests in bulk via coupons with a one year expiration date. We defer revenue from all tests that have neither been proctored nor expired.

Our users have the option to purchase consumable in-app virtual goods. We recognize revenue over the period in which the user consumes the virtual good, which is generally within a month.

Determining whether products and services are considered distinct performance obligations that should be accounted for separately versus together may require significant judgment. Our time-based subscriptions allow users the ability to download limited content offline. Significant judgment is required to determine whether this offline content should be considered distinct and accounted for separately, or not distinct and accounted for together with the online functionality provided and recognized over time. As there is a significant level of integration and interdependency with the online functionality, which is not the

case with the offline functionality, we believe we have a single performance obligation for the online functionality and offline content.

ASC 718 requires all stock-based payments to employees, including grants of employee stock options, to be recognized in the income statement based on their fair values. We generally grant our option awards in a combination of service-based and performance-based. We measure the fair value of our options on the date of grant using the Black-Scholes pricing model which requires the use of several estimates, including the volatility of our share price, the expected life of the option, risk free interest rates and expected dividend yield. The use of different assumptions in the Black-Scholes pricing model would result in different amounts of equity based compensation expense. Furthermore, if different assumptions are used in future periods, our equity based compensation expense could be materially impacted in the future.

We began to grant RSUs in November 2020. The fair value of RSUs is estimated based on the fair value of our common stock on the date of grant. For awards granted prior to the IPO, each RSU award vested based upon the satisfaction, during the term of the RSUs, of two requirements: length of service and a liquidity event defined as a change in control or a qualified IPO. The service-based vesting condition for the majority of these awards is satisfied over four years. The liquidity-based vesting condition was satisfied upon the occurrence of the IPO on July 30, 2021, and $2,035 of stock-based compensation expense was recognized related to those awards. For awards granted subsequent to the IPO, each RSU vests based upon the satisfaction of length of service. We measure and recognize compensation expense for all stock-based awards based on the estimated fair value of the award.

In June 2021, we granted an aggregate of 1.8 million performance-based RSUs (“Founder Awards”) to our founders. The Founder Awards vest upon the satisfaction of both a service-based condition and a performance-based condition and generally are settled one year after vesting. The service-based condition is satisfied as to 25% of the Founder Awards on each anniversary of the completion of the IPO, subject to the continuous service of the founders through the applicable date. The performance-based

condition will be satisfied with respect to each of ten equal tranches only upon the achievement of the specified stock-price hurdles for each such tranche over a period of ten years from the date of grant. The fair value of the Founder Awards is determined using a model based on multiple stock-price paths developed through the use of a Monte Carlo simulation that incorporates into the valuation the possibility that the stock-price hurdles may not be satisfied. The associated stock-based compensation is recorded over the derived service period, using the accelerated attribution method. If the stock-price hurdles are met sooner than the requisite service period, the stock-based compensation expense will be adjusted to prospectively recognize the remaining expense over the remaining derived service period. Provided that the founders continue to provide services to us, stock-based compensation expense is recognized over the derived service period, regardless of whether the stock-price hurdles are achieved.

Subsequent to our IPO in July 2021, the fair value of common stock is determined based upon the closing price of our Class A common stock immediately prior to the grant date.

Prior to our IPO, determining the fair value of our common stock requires complex and subjective judgment and estimates. There is inherent uncertainty in making these judgments and estimates. The absence of an active market for our common stock required our board of directors to estimate the fair value of the common stock for purpose of setting the exercise price of the options and estimating the fair value of the common stock at the time options were granted based on factors such as valuations of comparable companies, the status of our development and sales efforts, revenue growth, and additional objective and subjective factors relating to our business. We performed its analysis in accordance with applicable elements of the practice aid issued by the American Institute of Certified Public Accountants’ (“AICPA”) Practice Guide, Valuation of Privately Held Company Equity Securities Issued as Compensation; with this guidance, our board of directors exercised reasonable judgment and considered numerous and subjective factors to determine the best estimate of fair value of our common stock, including the following:

Deferred tax assets and liabilities are recognized principally for the expected tax consequences of temporary differences between the tax basis of assets and liabilities and their reported amounts, using currently enacted tax rates. The measurement of a deferred tax asset is reduced, if necessary, by a valuation allowance if it is more likely than not that some portion or all of the deferred tax asset will not be realized. Significant judgment is required in evaluating the need for and magnitude of appropriate valuation allowances. The realization of our deferred tax assets is dependent on generating future taxable income and the reversal of existing temporary differences. Changes in tax laws and assumptions with respect to future taxable income could result in adjustment to these allowances. As of December 31, 2022, we maintained a valuation allowance of approximately $108,504 against our domestic net deferred tax assets primarily related to net operating loss carryforwards, research and development credit carryforwards and research and development expense capitalization.

In addition, we recognize a tax benefit for uncertain tax positions only if we believe it is more likely than not that the position will be upheld on audit based solely on the technical merits of the tax position. We evaluate uncertain tax positions after the consideration of all available information.

We capitalize certain costs related to the development of our platform and other software applications for internal use. In accordance with authoritative guidance, we begin to capitalize our costs to develop software when preliminary development efforts are successfully completed, management has authorized and committed project funding, and it is probable that the project will be completed and the software will be used as intended. We stop capitalizing these costs when the software is substantially complete and ready for its intended use, including the completion of all significant testing. These costs are amortized on a straight-line basis over the estimated useful life of the related asset, generally estimated to be three years. We also capitalize costs related to specific upgrades and enhancements when it is probable the expenditure will result in additional functionality and expense costs incurred for maintenance and minor upgrades and enhancements. Costs incurred prior to meeting these criteria together with costs incurred for training and maintenance are expensed as incurred and recorded within research and development expenses in our consolidated statements of operations.

We exercise judgment in determining the point at which various projects may be capitalized, in assessing the ongoing value of the capitalized costs and in determining the estimated useful lives over which the costs are amortized. To the extent that we change the manner in which we develop and test new features and functionalities related to our platform, assess the ongoing value of capitalized assets or determine the estimated useful lives over which the costs are amortized, the amount of internal-use software development costs we capitalize and amortize could change in future periods.

See Note 2, Basis of Presentation and Summary of Significant Accounting Policies in the notes to our Consolidated Financial Statements included in Part II, Item 8 of this Annual Report on Form 10-K for a discussion of Recent Accounting Pronouncements.

Upon completion of the IPO, the Company qualified as an Emerging Growth Company ("EGC"), as defined in the Jumpstart Our Business Startups Act, and previously elected to take advantage of the extended transition period for the adoption of new or revised accounting standards available to EGCs. Effective December 31, 2022, the Company lost EGC status as a result of becoming a “large accelerated

filer." As a result, we are no longer able to take advantage of the reduced disclosure requirements applicable to an EGC.

As of December 31, 2022, we had $517.0 million of cash equivalents invested in money market funds. Our cash and cash equivalents are held for working capital purposes in addition to future investments in our product. We do not enter into investments for trading or speculative purposes. Our investments are exposed to market risk due to a fluctuation in interest rates, which may affect our interest income and the fair market value of our investments. As of December 31, 2022, a hypothetical 10% relative change in interest rates would not have a material impact on our Consolidated Financial Statements.

Our reporting currency and the functional currency of our wholly owned foreign subsidiaries is the US dollar. Certain of our payment providers translate our payments from local currency into USD at time of settlement, which means that during periods of a strengthening US dollar, our international receipts could be reduced. Our operating expenses are denominated in the currencies of the countries in which our operations are located, which are primarily in the United States and China. Our consolidated results of operations and cash flows are, therefore, subject to fluctuations due to changes in foreign currency exchange rates and may be adversely affected in the future due to changes in foreign exchange rates. In addition, as foreign currency exchange rates fluctuate, the translation of our international receipts into US dollars affects the period-over-period comparability of our operating results and can result in foreign currency exchange gains and losses. To date, we have not entered into any hedging arrangements with respect to foreign currency risk or other derivative financial instruments, although we may choose to do so in the future. A hypothetical 10% increase or decrease in the relative value of the US dollar to other currencies would not have a material effect on our operating results.

Inflationary factors such as increases in costs may adversely affect our results of operations. We do not believe that inflation has had a material effect on our business, financial condition or results of operations to date. If our costs were to become subject to significant inflationary pressures, we may not be able to fully offset such higher costs through price increases. Our inability or failure to do so could harm our business, financial condition or results of operations.

To the Stockholders and the Board of Directors of Duolingo, Inc.

We have audited the accompanying consolidated balance sheets of Duolingo, Inc. and subsidiaries (the "Company") as of December 31, 2022 and 2021, the related consolidated statements of operations and comprehensive loss, convertible preferred stock and stockholders' equity, and cash flows, for each of the three years in the period ended December 31, 2022, and the related notes (collectively referred to as the "financial statements"). In our opinion, the financial statements present fairly, in all material respects, the financial position of the Company as of December 31, 2022 and 2021, and the results of its operations and its cash flows for each of the three years in the period ended December 31, 2022, in conformity with principles generally accepted in the United States of America.

These financial statements are the responsibility of the Company's management. Our responsibility is to express an opinion on the Company's financial statements based on our audits. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud. Our audits included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audits provide a reasonable basis for our opinion.

The critical audit matter communicated below is a matter arising from the current-period audit of the financial statements that was communicated or required to be communicated to the audit committee and that (1) relates to accounts or disclosures that are material to the financial statements and (2) involved our especially challenging, subjective, or complex judgments. The communication of critical audit matters does not alter in any way our opinion on the financial statements, taken as a whole, and we are not, by communicating the critical audit matter below, providing a separate opinion on the critical audit matter or on the accounts or disclosures to which it relates.

The Company develops software for internal use and capitalizes the software development costs incurred during the application development stage. Costs are capitalized when preliminary development efforts are successfully completed, management has authorized and committed project funding, and it is probable that the project will be completed and the software will be used as intended. The Company will stop capitalizing these costs when the software is substantially complete and ready for its intended use, including the completion of all significant testing. Costs are amortized on a straight-line basis over the estimated useful life of the related asset, generally estimated to be three years. The Company also capitalizes costs related to specific upgrades and enhancements when it is probable the expenditure will result in additional functionality and expenses costs incurred for maintenance and minor upgrades and enhancements. Costs incurred prior to meeting these criteria together with costs incurred for training and maintenance are expensed as incurred and recorded within research and development expenses in our consolidated statements of operations and comprehensive loss. The Company capitalized $5.7 million of software development costs during the year ended December 31, 2022. Total capitalized software, net of accumulated amortization, is $8.5 million as of as of December 31, 2022.

We identified capitalized software as a critical audit matter because of the judgment exercised by management in determining whether costs incurred on software development projects have met the capitalization criteria, which in turn, required a higher degree of auditor judgment. The determination of costs to be capitalized is subjective in nature as it requires management to determine that the costs (1) related to a project that had entered the application development stage, (2) resulted in additional functionality, and (3) for which it was probable that the project would be completed and used to perform the function that was intended.

Our audit procedures related to capitalized software included the following, among others:

February 28, 2023

We have served as the Company's auditor since 2018.

To the Stockholders and the Board of Directors of Duolingo, Inc.

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated financial statements as of and for the year ended December 31, 2022, of the Company and our report dated February 28, 2023, expressed an unqualified opinion on those financial statements.

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management’s Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk

that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.