ABNB

As our global customer base expands, particularly outside of North America and Europe, we face increased pressure to provide efficient, multilingual support.

We are a global platform with hosts in more than 220 countries and regions and over 100,000 cities and towns, and we serve a global guest community.

In addition, members of our workforce who work remotely may not have access to technology that is as robust as that in our offices, which could cause the networks, information systems, applications, and other tools available to those remote workers to be more limited or less reliable than in our offices.

For more information, see our risk factor titled “We are subject to risks associated with the physical impacts of climate change as well as various efforts to transition to a low-carbon society.”

We experience seasonality in our Nights and Experiences Booked and GBV, and seasonality in Adjusted Earnings Before Interest, Taxes, Depreciation, and Amortization (“EBITDA”) that is consistent with seasonality of our revenue, which has historically been, and is expected to continue to be, highest in the third quarter when we have the most check-ins as it is the peak travel season for North America and EMEA.

In the year ended December 31, 2024, we accrued approximately $95 million of corporate alternative minimum tax, and approximately $20 million of excise tax on stock repurchases.

The Organization for Economic Cooperation and Development (the “OECD”) is coordinating negotiations among more than 140 countries with the goal of achieving consensus around substantial changes to international tax policies, including the implementation of a minimum global effective tax rate of 15%. Our effective tax rate and cash tax payments could increase in future years as a result of these changes.

For example, we recorded approximately $53 million in expense related to digital service taxes relating to prior periods as a result of refining our interpretation of the law as it applies to us. Additionally, we recorded $18 million of lodging tax expense in a particular jurisdiction over uncertainty as to how a new law applies to us.

For instance, EU Member State laws pertaining to the recently enacted EU STR Regulation will require additional compliance efforts, potentially discouraging and prohibiting current and potential hosts from listing properties.

Airbnb Ireland Unlimited Company (“AIUC”) and Airbnb UK Services Limited (“AUKSL") each operate as an “appointed representative” and utilize the license of regulated third parties (“principal firms”) to: (i) in the case of AIUC, act as a credit broker (presenting regulated third party consumer credit products to UK customers); and (ii) in the case of AUKSL, distribute guest travel insurance and host and experiences liability insurance.

Additionally, the proposed EU Third Payment Services Directive (“PSD3”) and proposed regulation on the same (“EU PSR”) will include amendments to strong customer authentication and anti-fraud obligations amongst other day-to-day requirements. The United Kingdom is also considering areas for reform for its payment services regime, including information requirements regarding currency conversion charges, and notice provisions for the termination of customer contracts. When these proposed measures are finalized and in-force, they may increase our compliance costs and require additional resources as well as changes to our processes and operations.

Despite having these controls in place, there is a risk that we might inadvertently engage in transactions inconsistent with applicable sanctions laws.

Companies like Airbnb face heightened expectations regarding matters such as environmental sustainability, diversity, human rights, and data privacy.

Specifically, the Corporate Sustainability Reporting Directive (“CSRD”) and the Corporate Sustainability Due Diligence Directive (“CSDDD”) impose stringent requirements on companies to disclose detailed information regarding their ESG practices. Furthermore, the transposition of the CSRD by EU member states will also impact the scope of these requirements. Many member states have not yet transposed the directive, adding another layer of uncertainty to compliance efforts. Additionally, the EU's Omnibus Simplification Package introduces further complexity and uncertainty in the European Union. Compliance involves significant expenses and resources, with risks of errors in implementing necessary changes.

Additionally, we note that as the use of AI and machine learning technologies (“AI and ML Technologies”) continues to grow, regulators (including data protection regulators) are expected to take an increased interest in issues, such as how we and our vendors collect, maintain and process and provide transparency on the use of personal data of our users and/ or hosts in that context. Our technology platform incorporates the use of AI and ML Technologies, for example, for fraud detection, search, enabling customized features and enhancing community support. In addition, certain existing legal regimes, including those relating to data privacy and consumer protection, regulate certain aspects of AI and ML Technologies, and new laws regulating AI and ML Technologies have been or may be enacted or have entered into force in jurisdictions that we operate. For example, in the United States, California enacted seventeen new laws in 2024 that further regulate the use of AI and ML Technologies and provide consumers with additional protections around companies’ use of AI and ML Technologies, such as requiring companies to disclose certain uses of generative AI. Other states have also passed AI-focused legislation, such as Colorado’s Artificial Intelligence Act, which will require developers and deployers of “high-risk” AI systems to implement certain safeguards against algorithmic discrimination, and Utah’s Artificial Intelligence Policy Act, which establishes disclosure requirements and accountability measures for the use of generative AI in certain consumer interactions. Other legislation has been introduced or proposed at the federal and state level, and there remains uncertainty at the federal level regarding the regulation of AI and ML Technologies. The majority of the substantive requirements will apply from August 2026. The EU AI Act applies to companies that develop, use and/or provide AI in the EU and – depending on the AI use case – includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose AI and foundation models, and fines for breach of up to 7% of worldwide annual turnover. These regulations may impact our ability to use, procure and commercialize AI and ML Technologies in the future, and we may need to expend resources to adjust our products or services, including if the laws are not consistent across jurisdictions.

In relation to cross-border transfers of personal data outside of Europe, we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, the European Commission approval of the current EU-US Data Privacy Framework for data transfers to certified entities in the United States may be challenged, which could also lead to challenges to, or impact the effectiveness of, other data transfer mechanisms such as the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism). In general, we expect that international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators and we cannot guarantee the ongoing efficacy of our data transfer mechanisms.

For example, the California Consumer Privacy Act (“CCPA”) provides enhanced data privacy rights to California residents, such as affording residents the right to access and delete their data and to opt out of certain sharing and sales of personal data. The CCPA imposes a range of other compliance obligations and imposes severe statutory damages, which could lead to injunctive relief or agreed settlements providing for ongoing audit and reporting requirements, as well as a private right of action, for certain data breaches. This private right of action has increased the risks associated with data breach litigation. For example, since the CCPA went into effect, comprehensive privacy statutes that share similarities with the CCPA are now in effect and enforceable in other states. Many other states have passed or proposed similar laws and there remains increased interest at the federal level as well.

Further, the majority of the substantive provisions of the DSA took effect in February 2024. Failure to comply with the DSA can result in fines of up to 6% of total annual worldwide turnover and recipients of services have the right to seek compensation from providers in respect of damage or loss suffered due to infringement by the provider to comply with the DSA. Failure to comply with the OSA can result in fines of up to 10% of total annual worldwide turnover or £18 million (whichever is greater).

When we are required to disclose personal data to government agencies, such as tax authorities and law enforcement agencies, this could be perceived by third parties as non-compliance with data privacy and security laws, potentially leading to legal proceedings or actions against us. Conversely, if we refuse to provide requested information due to a disagreement, such as on the interpretation of the law, we may face actions, litigation, and increased regulatory scrutiny, which could harm our relationships with governments and limit our ability to operate in certain regions.

For example, as we are subject to both the EU GDPR and the UK GDPR, we could be fined under each regime independently in respect of the same breach. Penalties for certain breaches are up to the greater of €20 million or £17.5 million, or up to 4% of the annual global revenue of the infringer, whichever is greater.

If these events occur, they could materially and adversely impact our business operations, financial condition, and overall results.

The use of AI and ML Technologies presents emerging ethical and social issues, and if we enable or offer solutions that draw scrutiny or controversy due to their perceived or actual impact on our customers or on society as a whole, we may experience brand or reputational harm, competitive harm, consumer complaints, legal liability, and other adverse consequences, any of which could materially adversely affect our business, results of operations, and financial condition.

Development, maintenance and operation of AI and ML Technologies requires additional investment in the development of proprietary datasets, machine learning models, and systems to monitor and test for accuracy, bias, and other variables, which are complex, costly, and could impact our profit margin as we expand the use of AI and ML Technologies in our offerings. Developing, testing, and deploying AI and ML Technologies also increase associated computing costs.

Many federal, state and foreign government bodies and agencies have introduced or proposed additional laws and regulations. Already, certain existing legal regimes (e.g., relating to data privacy) regulate certain aspects of AI and ML Technologies, and new laws regulating AI and ML Technologies are expected to continue to be proposed and enacted in the United States and globally. For further information related to AI laws and regulations that may affect our business, see the risk factor titled “Compliance with federal, state, and foreign laws relating to data privacy, data security, artificial intelligence, marketing and consumer protection involves significant expenditure and resources, and any actual or perceived failure by us or our vendors to comply may result in significant liability, litigation or other legal action against us, negative publicity, an erosion of trust, and/or result in regulatory scrutiny, fines and penalties and could materially adversely affect our business, results of operations, and financial condition.”

It is also possible that new laws and regulations will be adopted in the United States and in other non-U.S. jurisdictions, or that existing laws and regulations, including data privacy, consumer protection, competition laws, may be interpreted in ways that would limit our ability to use AI and ML Technologies for our business, or require us to change the way we use AI and ML Technologies in a manner that negatively affects the performance of our products, services, and business and requires us to expend resources and adjust our products or services in certain jurisdictions. Further, the cost to comply with such laws, regulations, or decisions and/or guidance interpreting existing laws, could be significant and would increase our operating expenses (such as by imposing additional reporting obligations regarding our use of AI and ML Technologies). Such an increase in operating expenses, as well as any actual or perceived failure to comply with such laws and regulations, could adversely affect our business, financial condition and results of operations.

The EU's Consumer Rights Directive and the Unfair Commercial Practices Directive impose strict consumer protection requirements, with potential fines for non-compliance.