2/24/2018 S-1 Table of Contents European legislators have adopted a General Data Protection Regulation, or GDPR, that will, when effective in May 2018, supersede current European Union, or EU, data protection legislation, impose more stringent EU data protection requirements, and provide for greater penalties for noncompliance. Further, following a referendum in June 2016 in which voters in the United Kingdom approved an exit from the EU, the United Kingdom government has initiated a process to leave the EU, or Brexit. Brexit has created uncertainty with regard to the regulation of data protection in the United Kingdom. In particular, it is unclear whether the United Kingdom will enact data protection laws or regulations designed to be consistent with the pending EU General Data Protection Regulation and how data transfers to and from the United Kingdom will be regulated. Additionally, although we have self­ certified under the U.S.­EU and U.S.­Swiss Privacy Shield Frameworks with regard to our transfer of certain personal data from the EU and Switzerland to the United States, some regulatory uncertainty remains surrounding the future of data transfers from the EU and Switzerland to the United States, and we are closely monitoring regulatory developments in this area. Any failure or perceived failure by us to comply with our privacy policies, our privacy­related obligations to users or other third parties, or any of our other legal obligations relating to privacy, data protection, or information security may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us by consumer advocacy groups or others and could result in significant liability or cause our users to lose trust in us, which could have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our users may limit the adoption and use of, and reduce the overall demand for, our services. Additionally, if third parties we work with, such as vendors or developers, violate applicable laws or regulations or our policies, such violations may also put our users’ content at risk and could in turn have an adverse effect on our business. Any significant change to applicable laws, regulations, or industry practices regarding the collection, use, retention, security, or disclosure of our users’ content, or regarding the manner in which the express or implied consent of users for the collection, use, retention, or disclosure of such content is obtained, could increase our costs and require us to modify our services and features, possibly in a material manner, which we may be unable to complete, and may limit our ability to store and process user data or develop new services and features. Our business could be adversely impacted by changes in internet access for our users or laws specifically governing the internet. Our platform depends on the quality of our users’ access to the internet. Certain features of our platform require significant bandwidth and fidelity to work effectively. Internet access is frequently provided by companies that have significant market power that could take actions that degrade, disrupt or increase the cost of user access to our platform, which would negatively impact our business. We could incur greater operating expenses and our user acquisition and retention could be negatively impacted if network operators: • implement usage­based pricing; • discount pricing for competitive products; • otherwise materially change their pricing rates or schemes; • charge us to deliver our traffic at certain levels or at all; • throttle traffic based on its source or type; • implement bandwidth caps or other usage restrictions; or • otherwise try to monetize or control access to their networks. On December 14, 2017, the Federal Communications Commission voted to repeal the “net neutrality” rules and return to a “light­touch” regulatory framework. However, the repeal has not yet taken effect and a number of parties have already stated their intent to appeal this order; thus, the future impact of such repeal and any 28 https://www.sec.gov/Archives/edgar/data/1467623/000119312518055809/d451946ds1.htm 35/235