DUOL

•users feel that their experience is diminished as a result of the decisions we make with respect to the frequency, prominence, format, size and quality of internal or external ads that we display;

•users are no longer willing to pay for subscriptions or in-app purchases (“IAPs”) or we are unable to increase the price of our subscriptions or in-app purchases; IAPs;

From time to time, certain of these factors have negatively affected user stickiness, growth and engagement to varying degrees. If we are unable to maintain or increase our user base and user engagement, our revenue and financial results may be materially adversely affected. In addition, we may not experience rapid user growth or engagement in countries that have high mobile device penetration, but due to the lack of sufficient cellular based data networks, consumers rely heavily on Wi-Fi and may not access our products regularly throughout the day. Any decrease in user stickiness, growth or engagement is likely to may have a material and adverse impact on our revenue, business, financial condition and results of operations. If our user growth rate slows or declines, we will become increasingly dependent on paid marketing to attract users and our ability to maintain or increase levels of user engagement and monetization in order to drive revenue growth.

The online language learning industry is highly competitive, with a consistent stream of new products and entrants. As a result, new products, entrants and business models are likely to continue to emerge, both in the U.S. and abroad. It is possible that a new product could gain rapid scale at the expense of existing brands through harnessing a new technology (such as generative AI), artificial intelligence “GenAI”)), or a new or existing distribution channel, creating a new or different approach to connecting people or some other means. We compete for learners’ time, attention, and share of wallet spend not only with other online and app-based language learning platforms, but also with offline forms of language learning. Because of the extensibility of the Duolingo platform beyond language learning, learning and the Company’s Chess, Math, and Music courses, we also compete with language learning assessment providers and literacy platforms and may compete with other kinds of online learning platforms and may compete with additional types of learning platforms in the future.

Many of the current Current and potential competitors, both domestically and internationally, may have substantially greater financial, technical, sales, marketing and other resources than we do, as well as in some cases, lower costs. Some competitors offer more differentiated products (for example, online learning as well as physical classrooms and textbooks) that may allow them to more flexibly meet changing customer preferences. Some of our competitors may enjoy better competitive positions in certain geographical regions, user demographics or other key areas that we currently serve or may serve in the future, or in their ability to teach certain languages or to teach speakers of certain languages other languages. These advantages could enable these competitors to offer products that are more appealing to users and potential users than our products, to respond more quickly and/or or cost-effectively than us to new or changing opportunities, new or emerging technologies or changes in customer requirements and preferences, or to offer lower prices than ours or to offer free language-learning products or services.

There are a number of free online language-learning opportunities to learn grammar, pronunciation, vocabulary (including specialties in areas such as medicine and business), reading and conversation by means of podcasts and mobile applications, audio courses and lessons, videos, games, chatbots, stories, news, digital textbooks, and through other means, which compete with our products. We estimate that there are thousands of free mobile applications for language learning; free products are provided in at least 50 languages by private companies, universities and government agencies. Low barriers to entry allow start-up companies with lower costs and less pressure for profitability to compete with us. Competitors that are focused more on user acquisition rather than profitability may be able to offer products at significantly lower prices or for free. As free online translation services and products, such as wearable devices that provide translation, improve and become more widely available and used, people may generally become less interested in language learning. If we cannot successfully attract users of these free products and services and convert a sufficient portion of these free users into paying users, our business could be adversely affected. If free other products and services become more engaging and competitive or gain widespread acceptance by the public, demand for our products could decline or we may have to lower our prices, which could adversely impact our revenue and other results.

Our ability to keep, increase, and engage our user base and to increase our revenue depends heavily on our ability to continue to evolve our existing brand and products and to create successful new brands and products. We may introduce significant changes to our existing brand and products, or acquire or introduce new and unproven brands, products and product extensions, including using technologies with which we have little or no prior development or operating experience or for which the regulatory environment is still unsettled. In addition, we often introduce a new product and delay its monetization until the product is more mature and the user base is better established. We have also invested, and expect to continue to invest, significant resources in growing our products to support increasing usage as well as new lines of business, new products, new product extensions and other initiatives to generate revenue. For example, we launched our Math and Music courses, in the Duolingo App in 2022 and 2023, respectively, however, neither has generated material revenue for us. More recently, we launched Duolingo Max Max, which is powered by generative AI technology. GenAI technology, and our Chess course. There is no guarantee that investing in new lines of business, new products, new product features, new product extensions and other initiatives will succeed. If our new or enhanced brands, products, features or product extensions fail to engage users, we may fail to attract or keep users or to generate sufficient revenue, operating margin, or other value to justify our investments, and our business may be materially adversely affected.

We have had operating losses in the past and we may not be able to achieve maintain or maintain increase profitability in the future.

There can be no assurances that we will continue to maintain or increase our profitability. Our costs of revenues or operating expenses may continue to increase in the future as we increase our sales and marketing efforts and continue to invest in the development of products and services. These efforts may be costlier than we expect, and we cannot guarantee that we will be able to increase our revenue to offset our operating expenses. Our In addition, our revenue growth may slow or our revenue may decline for a number of other possible reasons, including reduced demand for our products or services, increased competition, a decrease in the growth or reduction in size of our overall market, strategic operational decisions in how we prioritize user engagement and long-term growth, or if we fail for any reason to capitalize on our growth opportunities. If we are unable to maintain or increase profitability in the future, it could materially adversely affect our business, financial condition and results of operations.

Our costs are continuing continue to grow, increase, and some of our investments have the effect of reducing our operating margin and profitability. If our investments are not successful, our business and financial performance could be harmed.

Errors or inaccuracies in our metrics or data could also result in incorrect misinformed business decisions and inefficiencies. For instance, if a significant understatement or overstatement of active users were to occur, we may expend resources to implement unnecessary business measures or fail to take required actions to attract a sufficient number of users to satisfy our growth strategies. Our efforts to address technical issues in our ability to record such data and improve our accuracy may not always be successful, and given the complexity of the systems involved and the rapidly changing nature of mobile devices and systems, we expect these issues to continue, particularly if we continue to expand in parts of the world where mobile data systems and connections are less stable. If our operational metrics are not accurate representations of our business, or if investors do not perceive these metrics to be accurate, or if we discover material inaccuracies with respect to these figures, our reputation may be significantly harmed, our stock price could decline, we may be subject to stockholder litigation, and our business, financial condition, and results of operations could be materially adversely affected.

A platform provider may also change its fee structure, add impose additional fees associated with access to and or use of its platform, alter advertising practices, modify how we are able to advertise on the platform, change how the personal information of its users user data is made available to application developers on the platform, developers, limit the use of personal information for advertising or attribution purposes, or restrict how users can share information with their friends on the platform or across platforms. Such changes could materially affect how we market and monetize our products, measure the effectiveness of our advertising, or reach and engage users, and could create a more challenging environment for publishers and advertisers on these platforms.

Any failure, disruption or interference with our use of hosted cloud computing services and systems provided by third-parties, like AWS or Google Cloud, could adversely impact our business, financial condition or results of operations. For example, on December 7, 2021, October 20, 2025, an outage of the us-east-1 region of the AWS platform caused Duolingo to go offline for over 5 12 hours. To the extent we do not effectively respond to any such interruptions, upgrade our systems as needed and continually develop our technology and network architecture to accommodate traffic, our business, financial condition or results of operations could be adversely affected. Furthermore, our disaster recovery systems and those of third-parties with which we do business may not function as intended or may fail to adequately protect our critical business information in the event of a significant business interruption, which may cause interruption in service of our products, security breaches or the loss of data or functionality, leading to a negative effect on our business, financial condition or results of operations.

In addition, internet-connected devices and operating systems controlled by third parties increasingly contain features that allow device users to disable functionality that allows for the delivery of advertising on their devices or reduce the ability to provide personalized or targeted advertising, which results in less valuable ads. Device and browser manufacturers may include or expand these features as part of their standard device specifications. For example, when Apple announced that UDID, a standard device identifier used in some applications, was being superseded and would no longer be supported, application developers were required to update their apps to utilize alternative device identifiers such as universally unique identifier, or, more recently, identifier-for-advertising, which simplifies the process for Apple users to opt out of behavioral targeting. Furthermore, laws and regulations may also make it more difficult to deliver personalized or targeted advertising or impose requirements that result in more users making elections to block our ability to deliver targeted ads. For example, many U.S. states have enacted laws allowing their residents to opt out of the use of their Personal Data for targeted advertising. If users do not elect to participate in functionality that supports the delivery of targeted advertising on their devices, our ability to deliver effective advertising campaigns could suffer, which could cause our business, financial condition, or results of operations to suffer. While the described changes did not result in material adverse impacts to us, the The impact of similar potential future operating systems changes or potential future regulation on targeted advertising is highly uncertain.

If we are not able to maintain the value and reputation of our brand, our ability to expand our base of users may be impaired, and our business and financial results may be harmed.

We believe that our brand has significantly contributed to our word of mouth virality, which has in turn contributed to the success of our business. We also believe that maintaining, protecting and enhancing our brand is critical to expanding our base of users and, if we fail to do so, our business, financial condition and results of operations could be materially adversely affected. We believe that the importance of brand recognition will continue to increase, given the growing number of language learning applications, or “apps,” applications and the low barriers to entry for companies offering language learning products and services. Many of our new users are referred by existing users or are acquired by content created by unrelated third parties about our products, services and brand. Maintaining our brand will depend largely on our ability to continue to provide useful, reliable, trustworthy and innovative products, which we may not do successfully.

We have increased our marketing expenditures over time in order to attract and keep users and sustain our growth. For the year years ended December 31, 2024 2025 and 2023, 2024, our Sales and marketing expenses were $90.5 $125.7 million and $75.8 $90.5 million, respectively. Evolving consumer behavior can affect the availability of profitable marketing opportunities. For example, as consumers communicate less via email and more via text messaging, messaging apps and other virtual means, the reach of email campaigns designed to attract new and repeat users (and keep current users) for our products is adversely impacted. To continue to reach potential users and grow our businesses, we must identify and devote our overall marketing activities and expenditures to new and evolving advertising channels, such as mobile and online video and social media platforms as well as targeted campaigns in which we communicate directly with potential, former and current users via new virtual means. Generally, the opportunities in and sophistication of newer advertising channels are relatively undeveloped and unproven, and there can be no assurance that we will be able to continue to appropriately manage and fine-tune our marketing efforts in response to these and other trends in the advertising industry. Furthermore, these newer advertising channels often change rapidly, including changes in policies and algorithms, and can be subject to disruptions for reasons beyond our control (for example example, the potential U.S. governmental restrictions or limitations on the TikTok platform). Any failure to successfully and cost-effectively manage our marketing efforts on, or disruptions to, social media platforms that we have come to depend on for marketing, including due to legislation, regulation, or directives (including executive orders), could materially adversely affect our business, financial condition and results of operations.

We believe that a critical contributor to our success has been our commitment to make free language learning available worldwide in an effort to help people throughout the world improve their economic outcomes. The mission of Duolingo is a significant part of our business strategy and who we are as a company. We believe that Duolingo users value our commitment to our mission. However, because we hold ourselves to such high standards, and because we believe our users have come to have high expectations of us, we may be more severely affected by negative reports or publicity if we fail, or are perceived to have failed, to live up to Duolingo’s mission. For example, maintaining a free version of the app that is both effective and enjoyable is central to Duolingo’s mission. Any actions we take that are viewed as contrary to that mission, including paid-only features or changes to the offering, that are viewed as undermining its fun or effectiveness may, therefore, harm our brand and reputation. These effects may be more significant or lasting for us than for other companies that do not have a mission-based brand.

We have made and in the future may make decisions regarding our business and products in accordance with Duolingo’s mission and values that may reduce our short- or medium-term operating results if we believe those decisions are consistent with the mission and will improve the result in longer-term benefits, such as maintaining or improving aggregate user experience. experience in keeping with our mission. However, this may not result in the long-term value and financial performance we anticipate, either on the time frame we expect or at all, particularly due to the uncertainty and variables inherent in longer-term expectations.

Unfavorable publicity or media reports reports, including in social media platforms, regarding us, our privacy practices, our social media activities, data security compromises or breaches, product changes, product or service quality or features, litigation or regulatory activity or regarding the actions of our partners, our users, our employees or other companies in our industry, could materially adversely affect our brand image or reputation, regardless of the veracity of such publicity or media reports. If we fail to protect our brand image or reputation, we may experience material adverse effects to the size, demographics, engagement, and loyalty of our user base, resulting in decreased revenue, fewer app installs (or increased app uninstalls), or slower user growth rates. For example, in April 2025, the Company publicly released a memo regarding the use of AI in its operations, which may have contributed to unfavorable publicity, adverse impacts on the Company’s brand and social media presence, and a deceleration in user growth. Damage to our brand or reputation could also adversely affect educational institutions’ willingness to accept the Duolingo English Test, which in turn could slow the growth of, or reduce, our revenue from the Duolingo English Test. In addition, if securities analysts or investors perceive any media coverage of us to be negative, the price of our Class A common stock may be materially adversely affected. Any of the foregoing could materially adversely affect our business, financial condition and results of operations.

•operational and compliance challenges caused by distance, language language, legal and cultural differences;

•low usage and/or or penetration of internet-connected consumer electronic devices;

In addition to the factors listed above, we have invested to expand our operations in China, which is an intensely competitive market, both on the consumer side and from a talent perspective. We maintain an office in China with employees primarily engaged in research and development and marketing-related activities. Operating in China exposes us to additional risks, including heightened regulatory scrutiny, evolving data security and privacy requirements, restrictions on cross-border data transfers, and increased compliance costs. Regulatory authorities in China may also seek access to user data or impose requirements that conflict with our practices or with laws and regulations in other jurisdictions, which could limit our ability to operate our services consistently across markets.

Security breaches of our IT Systems, improper or unauthorized access to or disclosure of our Confidential Information, other hacking and social engineering or phishing attacks on our IT Systems or service, or other cyber incidents could disrupt our services or compromise Confidential Information related to our business and expose us to liability, which could harm our reputation and materially adversely affect our business.

Our products and services and the operation of our business involve the collection, storage, processing, and transmission of data, including personal data related to users and others, as well as proprietary information belonging to our business (collectively, “Confidential Information”). We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services.

The Our IT Systems that store and process such Confidential Information, including as well as the information systems of third parties, parties on which we rely, are susceptible to increasing threats of continually evolving cybersecurity risks. In particular, our industry is prone to cyber-attacks by third parties seeking unauthorized access to Confidential Information or to disrupt our ability to provide services. We face an ever-increasing number of threats to our IT Systems and Confidential Information from a broad range of threat actors, including foreign governments, criminals, competitors, computer hackers, cyber terrorists and politically motivated groups or individuals, and we have previously experienced various attempts to access our IT Systems and Confidential Information. These threats include physical or electronic break-ins, security breaches from inadvertent or intentional actions by our employees, contractors, consultants, and/or or other third parties with otherwise legitimate access to our systems, website or facilities, or from cyber-attacks by malicious third parties which could disrupt our IT Systems or impact our Confidential Information.

Such security breaches or disruptions have occurred on our IT Systems in the past and will occur on our IT Systems in the future. While to date no incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. The risks related to a security breach or disruption, including through ransomware, a distributed denial-of-service (“DDoS”) attack, computer malware, viruses, social engineering (predominantly spear phishing attacks), AI model prompt injections, AI model inversion, and general hacking, have become more prevalent in our industry and have generally increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased. We also regularly encounter attempts to create false or undesirable user accounts and ads or take other actions on our platform for objectionable ends. As a result of our prominence, the size of our user base, the volume of Confidential Information on our systems, the reach and popularity of our social media accounts, and the evolving nature of our products and services (including our efforts involving new and emerging technologies), we may be a particularly attractive target for such attacks, including from highly sophisticated, state-sponsored, or otherwise well-funded criminal actors.

In addition, some of our partners may receive or store Confidential Information provided by us or by our users through mobile or web applications integrated with our applications and we use third-party service providers to store, transmit and otherwise process certain Confidential Information on our behalf. If these third parties fail to adopt or adhere to adequate data security practices, or in the event of a breach of their networks, our Confidential Information (including our users’ data) may be improperly accessed, used, or disclosed, which could subject us to legal liability. We cannot control such third parties and cannot guarantee that a security breach will not occur on their systems. Although we may have contractual protections provisions designed to provide protection with our third-party service providers, contractors and consultants, any actual or perceived security breach could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach. Any contractual protections we may have from our third-party service providers, contractors or consultants may not be sufficient to adequately protect us from any such liabilities and losses, and we may be unable to enforce any such contractual protections. Any adverse impact to the availability, integrity or confidentiality of our IT Systems or Confidential Information can result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties, negative reputational impacts that cause us to lose existing or future customers, and/or or significant incident response, system restoration or remediation and future compliance costs. Any or all of the foregoing could materially adversely affect our business, results of operations, and financial condition.

Finally, the ability to access payment-related information on a real-time basis without having to proactively reach out to the consumer each time we process an auto-renewal payment or a payment for the purchase of a premium feature on any of our products is critical to our success and a seamless experience for our users. The passage or adoption of any legislation or regulation affecting the ability of service providers to periodically charge consumers for, among other things, recurring subscription payments may materially adversely affect our business, financial condition and results of operations. We are subject to legislation and regulation regarding the foregoing, such as California’s Automatic Renewal Law, and further legislation and regulation, or changes to existing legislation or regulation governing subscription payments and the automatic renewal of subscriptions, are being considered in many states in the US. U.S. While we monitor and attempt to comply with these legal developments, we have been in the past, and may be in the future, subject to claims under such legislation or regulation.

We have in the past and may in the future seek potential acquisition candidates to add complementary companies, products or technologies. For example, in October 2022, July 2025, we completed the acquisition for of the assets team behind NextBeat through the purchase of Gunner Made LLC (“Gunner”), Music Learning Services Limited, a wholly owned entity of PNG Holdings LLC, a design and animation studio based in Detroit, Michigan, U.K.-based entity, and in July 2024, we completed the acquisition of Hobbes, an animation and motion design studio based in Detroit, Michigan. The identification of suitable acquisition candidates can be difficult, time-consuming and costly, and we may not be able to successfully complete identified acquisitions. We may also experience operational and financial risks in connection with historical and future acquisitions if we are unable to:

•retain or hire senior management and other key personnel at acquired businesses; and businesses.

Our reporting currency and our functional currency is the U.S. dollar, our operating expenses are denominated in the currencies of the countries in which our operations are located, which are primarily in the U.S., China China, Germany, and Germany. the United Kingdom. Our consolidated results of operations and cash flows are, therefore, subject to fluctuations due to changes in foreign currency exchange rates and may be adversely affected in the future due to changes in foreign exchange rates. In addition, certain of our payment providers translate our payments from local currency into USD at time of settlement, which means that during periods of a strengthening U.S. dollar, our international receipts could be reduced. In addition, as foreign currency exchange rates fluctuate, the translation of our international receipts into U.S. dollars affects the period-over-period comparability of our operating results and can result in foreign currency exchange gains and losses. We have not entered into any hedging arrangements with respect to foreign currency risk or other derivative financial instruments, although we may choose to do so in the future. instruments. The To the extent we choose to do so in the future, the use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates and may introduce additional risks if we are unable to structure effective hedges with such instruments.

Further, we We have historically provided provided, and continue to provide, services to users in certain countries that are the target of U.S. sanctions, such as Syria. sanctions. We have implemented various control mechanisms designed to maintain compliance with applicable law as we provide these services, however, our efforts to comply with these rules and regulations may not be successful. Our efforts to comply with these rules and regulations may not be successful, and a A determination that we have failed to comply, whether knowingly or inadvertently, may result in substantial penalties, including fines, enforcement actions, civil and/or or criminal sanctions, the disgorgement of profits, and may materially adversely affect our business, financial condition and results of operations.

We and our vendors are subject to a variety of federal, state and foreign data privacy laws, rules, regulations, industry standards standards, contractual obligations, and other requirements, including those that apply generally to the handling of Personal Data, and those that are specific to certain industries, sectors, contexts, or locations. The increased regulation of Personal Data processing, including self-regulatory frameworks, laws, rules, and regulations, could have a material adverse effect on our business, financial condition and results of operations.

There are numerous laws in the countries in which we operate regarding privacy and the storage, sharing, use, transfer, disclosure, protection and other processing of Personal Data, the The scope of which data privacy laws are constantly changing, and in some cases, inconsistent and conflicting and subject to differing interpretations, as new laws of this nature are proposed and adopted. Such laws also are becoming increasingly rigorous and could be interpreted and applied in ways that may require us to incur significant costs, implement new processes, or change our processing of information and business operations, which could ultimately hinder our ability to grow our business by extracting value from our data assets.

For example, the GDPR and the U.K. GDPR impose strict data protection compliance requirements on entities established inside the EEA/U.K. as well as including: providing detailed disclosures about how personal data is collected and processed (in a concise, intelligible and easily-accessible form); demonstrating that an appropriate legal basis is in place or otherwise exists to justify data processing activities; complying with rights for data subjects in regard to their personal data (including the right to be “forgotten” and the right to data portability); data; notifying data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant data breaches; ensuring assuring that appropriate safeguards are in place where personal data is transferred out of the EEA and the U.K.; limiting retention of personal data; maintaining a record of processing activities; and complying with the principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit. audit which create compliance obligations that are also applicable to entities established outside the EEA/U.K. that offer goods or services to individuals located in the EEA/U.K. or that observe the behavior of individuals located in the EEA/U.K. This has created a greater compliance burden for us as the legal regimes may subject non-compliant entities to substantial monetary penalties. Since we are subject to the supervision of relevant data protection authorities under both the GDPR and the U.K. GDPR, we could be fined under each of those regimes independently in respect of the same violation. In addition to potential substantial fines, non-compliance could result in regulatory investigations, reputational damage, orders to cease/ change the processing of personal data, enforcement notices, and/ or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs and diversion of internal resources.

We rely on a mixture of mechanisms to transfer personal data from the EEA and the U.K. to the U.S. and other jurisdictions deemed non-adequate, non-adequate and are evaluating continue to evaluate what additional mechanisms may be required to establish adequate safeguards for personal data. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, there will be uncertainty as to how we comply with EEA and U.K. privacy laws and we could suffer additional costs, complaints, and/or or regulatory investigations or fines. If we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, and we may find it necessary to establish systems in the EEA and the U.K. to maintain personal data originating from the EEA and the U.K., which may involve substantial expense and distraction from other aspects of our business. Other countries have also passed or are considering passing laws requiring local data residency and/or or restricting the international transfer of data, which would create similar risks for us in those countries.

We are also subject to evolving privacy laws in the EEA and the U.K. on cookies, tracking technologies and e-marketing. Regulators are increasingly focusing on compliance with such requirements in the online behavioral advertising ecosystem, and current national laws that implement the ePrivacy Directive may be replaced by an EU regulation known as the ePrivacy Regulation which would significantly increase fines for non-compliance. If regulators continue to enforce the strict approach to opt-in consent for all but essential use cases, as seen in recent guidance and decisions, this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users as well as personalize the consumer experience, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand and tailor our offerings to users. Our online advertising partners may also change their own policies in response to these legal developments; for example, Google recently enacted new Consent Management Platform requirements for advertisers in the EEA and U.K. Such policies may restrict our ability to personalize and serve advertisements.

Additionally, in the U.S., numerous federal and state laws that we are subject to regulate the privacy and security of Personal Data. For example, in 2020 California enacted the CCPA, which, among other obligations, CCPA requires covered companies to provide disclosures to California consumers and provide such consumers certain data protection and privacy rights, including the ability to opt-out of certain disclosures of Personal Data. Data, among other obligations. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches. Other state comprehensive laws that are similar to the CCPA have been enacted, or are under consideration, in numerous other states.

Additionally, Further, U.S. governmental agencies like the Federal Trade Commission and state attorneys general enforce a variety of data privacy issues, such as promises made in privacy policies or failures to appropriately protect information about individuals, as unfair or deceptive acts or practices in or affecting commerce in violation of the Federal Trade Commission Act or similar state laws. We make public statements about our use and disclosure of Personal Data through our privacy policy, information provided on our website and press statements, and we may be subject to potential regulatory or other legal action if such policies or statements are found to be deceptive, unfair or misrepresentative of our actual practices.

A variety of laws and regulations have been adopted enacted aimed at protecting children minors/children using the internet such as the COPPA, U.S. state laws such as the Texas Securing Children Online Through Parental Empowerment (“SCOPE”) Act, Article 8 of the GDPR and the U.K. GDPR, and the U.K.’s Age Appropriate Design Code (also referred to as the Children’s Code) and China’s Regulations on the Protection of Minors on the Internet, which took effect on January 1, 2024. Various U.S. states have enacted laws heavily restricting the use of minors’ Personal Data, and several have also recently enacted, or are considering enacting, laws relating to age verification. As some of these laws and regulations apply to us or our applications, we implement certain precautions designed to ensure for our compliance with such laws and regulations. Despite our efforts, no assurances can be given that such measures will be sufficient. Failure to comply with such laws could expose us to significant liability, penalties, reputational harm and loss of revenue, or force us to change the way in which we process data, Personal Data, among other things. Any of the foregoing could materially adversely impact our business, results of operations, or financial condition. We also expect further jurisdictions to adopt these types of laws and regulations, which would further increase these risks, and may require us to spend additional resources in order to comply.

We use machine learning and AI technologies throughout the business, including technologies that we have developed internally and via integrations with a third party’s AI technologies. For example, we use AI and machine learning technologies to help us produce content for both the learning application and the Duolingo English Test. Furthermore, in the third quarter of 2024 Additionally, we announced use an AI-powered product enhancement, Video Call, within our highest subscription tier that allows users to practice conversation skills through video calls with one of our characters.

We are working to incorporate generative AI (i.e., GenAI, including AI that can produce and output new content, software code, data and information based on inferences from the data it receives) receives, features into our solutions, such as Duolingo Max. Generative AI GenAI technologies can be subject to accuracy issues in the output, introduce unintended biases, be trained on content in a manner that infringes on third party intellectual property or privacy rights, generate output that infringes on intellectual property or privacy rights, disclose sensitive information in a manner that is not intended, and otherwise lead to discriminatory outcomes. There is a risk that generative AI GenAI technologies could produce inaccurate or misleading content or other discriminatory or unexpected results or behaviors, such as hallucinatory behavior that can generate irrelevant, nonsensical, or factually incorrect results but in a manner that appears accurate, all of which could harm our reputation, business, or customer relationships. While we take Our measures that are designed to ensure the for accuracy of such AI generated content, those measures content may not always be successful, and in some cases, we may need to rely on end users or other third parties to report such inaccuracies. The law is also uncertain across jurisdictions regarding the copyright ownership of output that is produced in whole or in party part by generative AI GenAI tools, and the level of human authorship that is needed to ensure so that such output is copyrightable. The United States Copyright Office has previously denied copyright protection for content generated by AI technologies, and the United States Patent and Trademark Office has similarly stated that an AI tool cannot be an “inventor” of a patent, rendering it impossible to obtain patent protection for inventions created solely by AI technologies. Further, if we are deemed to not have sufficient rights to the data we use to train our AI technologies, we may be subject to litigation by the owners of the content or other materials that comprise such data, similar to the litigation that is currently pending in various U.S. courts against other developers of generative AI GenAI technologies, and in which the outcome of such litigation is uncertain.

Further, our ability to continue to develop, maintain or use such technologies may be dependent on access to specific third-party software and infrastructure, such as processing infrastructure for the training of our own machine-learning models or the use of third-party AI models. We cannot control the availability or pricing of such third-party software and infrastructure, especially in a highly competitive environment, and we may be unable to negotiate favorable economic terms with the applicable providers. Our products and services may not compete effectively with alternative products and services if we are not able to source and integrate the latest AI and machine learning technologies into our products and services. Moreover, if any such third-party AI and machine learning technologies become incompatible with our solutions or unavailable for use, or if the providers of such models unfavorably change the terms on which their AI and machine learning technologies are offered or terminate their relationship with us, our solutions may become less appealing to our customers and our business will be harmed. In addition, market acceptance and consumer perceptions of AI and machine learning technologies is uncertain, and negative trends in acceptance or perception of such technologies may subject us to brand or reputational harm. harm that may persist even where we undertake improvements to how we implement such technologies.

As the regulatory framework for machine learning technology and AI evolves, our business, financial condition, and results of operations may be adversely affected. We may not always be able to anticipate how to respond to such rapidly evolving AI-specific laws or regulations. New laws regulating AI have been enacted in several jurisdictions, such as the U.S., China, and Europe and it is possible that new laws and regulations will be adopted in other jurisdictions. In the U.S., there has been uncertainty regarding the applicable regulations that will apply to the development and use of AI technologies. The Trump administration’s approach to investment in and regulation of AI technologies has and is expected to continue to deviate from that of the previous administration and we will need to adapt to any changes that may result from such approach, including as the result of new or changing executive orders. For instance, the federal government may seek to preempt state laws when they seek to govern certain topics involving AI, as evidenced by the Trump administration’s “Ensuring a National Policy Framework for Artificial Intelligence” Executive Order signed on December 11, 2025. This order calls for federal standards and legislation that would preempt conflicting state AI regulations and create a federal litigation task force focused on challenging state AI laws in court. The Trump administration may continue to implement new or rescind existing federal orders and/or administrative policies relating to AI technologies. Any such changes at the federal level could require us to expend significant resources to modify our products, services, or operations so that we comply or for us to ensure compliance or remain compliant and competitive.

AI laws like Colorado’s Artificial Intelligence Act and various state privacy laws, including the CCPA, regulate the use of automated decision making technology that results in legal or similarly significant effects on individuals and provide rights to individuals in respect of automated decision making. Such additional regulations, and the manner in which such new laws are interpreted, may impact our ability to develop, use, procure and commercialize AI and machine learning technologies in the future. Additionally, it is possible that existing laws and regulations may be interpreted in ways that would affect the operation of our learning platforms, online testing business and data analytics and the way in which we use AI and machine learning technologies. Further, the cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could adversely affect our business, financial condition and results of operations.

For example, in Europe, the EU Artificial Intelligence Act (“EU AI Act”), which Act”) establishes a risk-based governance framework for AI in the EU market, entered into force on August 2, 2024, and the majority of the substantive requirements will apply two years later. market. The EU AI Act entered into force on August 1, 2024, and the majority of the substantive requirements are expected to apply from August 2, 2026, and though the European Commission has proposed an extension to December 2, 2027, such extension is not yet finalized or effective. This framework categorizes AI applications into risk categories such as “unacceptable”, “high”, “limited”, and “minimal”. Some of our current or future AI applications may fall within the “high” or “limited” risk categories. AI applications in the “high” risk category are subject to new ex ante conformity assessments and a range of new requirements, particularly on risk management, testing, technical documentation and robustness, data training and data governance and log recording, transparency, human oversight, and cybersecurity, while AI applications in the “limited” risk category are expected to become subject to new transparency and output labelling obligations. The EU AI Act also includes specific requirements for general purpose AI and foundational models, such as transparency, training data obligations, and labeling for generative AI GenAI systems. Fines for breaches of the EU AI Act extend up to 7% of worldwide annual turnover.

In 2023, China has implemented a number of regulations to govern AI, algorithmic recommendation and deep synthesis technologies, namely the Provisional Provisions on Management of Generative Artificial Intelligence Services, Administrative Provisions on Algorithm Recommendation for Internet Information Services and Provisions on Management of Deep Synthesis in Internet Information Service, respectively. Such regulations impose strict obligations on service providers, among other entities, with respect to their provision and use of AI, algorithmic recommendation and deep synthesis technologies. In addition, China’s Measures for the Labelling of AI-Generated Synthetic Content requiring explicit AI labels for deep synthesis outputs are likely to cause confusion and implicit, metadata-based labels for other outputs, and Chinese authorities have published further guidance on the use of generative AI through a series of national standards, addressing requirements on as data labelling in the context of training generative AI models, data security during the model training and AI deployment stages.

Our commercial success depends in part on avoiding infringement, misappropriation or other violations of the intellectual property rights of third parties. However, we may become party to disputes from time to time over rights and obligations concerning intellectual property held by third parties, and we may not prevail in these disputes. Companies in the internet, technology and social media industries are subject to frequent litigation based on allegations of infringement, misappropriation or other violations of intellectual property rights. Furthermore, various “non-practicing entities” that own patents and other intellectual property rights often attempt to assert claims in order to extract value from technology companies and, given that these patent holding companies or other adverse intellectual property rights holders typically have no relevant product revenue, our own issued or pending patents and other intellectual property rights may provide little or no deterrence to these rights holders in bringing intellectual property rights claims against us. From time to time we have received and may continue to receive claims from third parties which allege that we have infringed upon their intellectual property rights. Further, from time to time we may introduce new products, product features and services, including in areas where we currently do not have an offering, which could increase our exposure to patent and other intellectual property claims from competitors, non-practicing entities, and other rights holders. For example, we may license and use musical content in our newly launched music courses, marketing activities, and elsewhere, and may receive intellectual property claims relating to our use of this musical content. In addition, some of our agreements with third-party partners require us to indemnify them for certain intellectual property claims against them, which could require us to incur considerable costs in defending such claims, and may require us to pay significant damages in the event of an adverse ruling. Such third- party third-party partners may also discontinue their relationships with us as a result of injunctions or otherwise, which could result in loss of revenue and adversely impact our business operations.

Although we try to ensure that our employees and consultants do not use the proprietary information or know-how of others in their work for us, we We may be subject to claims that we or our employees or consultants have inadvertently or otherwise used or disclosed intellectual property, including trade secrets, software code or other proprietary information, of a former employer or other third parties. Litigation may be necessary to defend against these claims and if we fail in defending any such claims, in addition to paying monetary damages, we may lose valuable intellectual property rights or personnel. Further, the agreements that we require our employees and contractors who may be involved in the conception or development of intellectual property to execute may not be successful in establishing that intellectual property they conceive or develop is ours. Additionally, any such assignment of intellectual property rights may not be self-executing, or the assignment agreements may be breached, and we may be forced to bring claims against third parties, or defend claims that they may bring against us, to determine the ownership of what we regard as our intellectual property.

Despite the The measures we take to protect our intellectual property rights, rights may not always be successful, and our intellectual property rights may still not be adequate and protected in a meaningful manner, challenges to contractual rights could arise, third parties could copy or otherwise obtain and use our intellectual property without authorization, or laws and interpretations of laws regarding the enforceability of existing intellectual property rights may change over time in a manner that provides less protection or introduces uncertainty. The occurrence of any of these events could impede our ability to effectively compete against competitors with similar technologies, any of which could materially adversely affect our business, financial condition and results of operations.

The trading price of our Class A common stock has been and may continue to be highly volatile and could be subject to wide fluctuations. Securities markets worldwide experience significant price and volume fluctuations. This market volatility, as well as general economic, market or political conditions, could reduce the market price of shares of our Class A common stock regardless of our operating performance. In addition, our operating results could be below the expectations of public market analysts and investors due to a number of potential factors, including including, for example, variations in our quarterly operating results or dividends, if any, to stockholders, results, additions or departures of key management personnel, failure to meet analysts’ earnings estimates, publication of research reports about our industry, the timing and amount of any share repurchases, litigation and government investigations, changes or proposed changes in laws or regulations or differing interpretations or enforcement thereof affecting our business, adverse market reaction to any indebtedness we may incur or securities we may issue in the future, changes in market valuations of similar companies or speculation in the press or investment community, announcements by our competitors of significant contracts, acquisitions, dispositions, strategic partnerships, joint ventures or capital commitments, adverse publicity about the industries we participate in or individual scandals, in, and in response the market price of shares of our Class A common stock could decrease significantly.

The Organization for Economic Co-operation and Development ("OECD"), an international association of 38 countries including the U.S., has proposed changes to numerous long-standing tax principles, including a global minimum tax initiative. On December 12, 2022, the European Union member states agreed to implement the OECD’s Pillar 2 global corporate minimum tax rate of 15% on companies with revenues of at least EUR 750 million, which went into effect in 2024. On January 5, 2026, the OECD released a “side-by-side” package that generally establishes an exemption for U.S.-based multinational company from the 15% global minimum tax. However, implementation of the package depends on domestic legislation and regulation in OECD member countries and is subject to subsequent review. Accordingly, we We will continue to monitor and evaluate the potential consequences of Pillar 2 and the OECD’s “side-by-side” package on our longer-term financial position.

Companies across industries are facing increasing scrutiny from a variety of stakeholders related to their environmental, social, sustainability, and related corporate responsibility (“ESG”) practices. Increasingly, different stakeholder groups have divergent (or conflicting) views on ESG matters, which increases the risk that any action, or lack thereof, with respect to ESG matters will be perceived negatively by at least some stakeholders. Both advocates and opponents to certain ESG matters are increasingly resorting to a range of activism forms, including media campaigns and litigation, to advance their perspectives. Any failure to successfully navigate such stakeholder expectations may result in costs, reputational harm (including in various ratings), adverse stakeholder engagement, issues in attracting/retaining employees and customers, or other adverse impacts to our business.

While we have engaged, and expect to continue to engage in, certain initiatives (such as disclosures, certifications, or goals) to improve the ESG profile of our company and/or and products or respond to stakeholder concerns, such initiatives may be costly and may not have the desired effect. For example, many ESG initiatives rely on methodologies and data that are complex, subject to varying interpretations, and continuing to evolve. As with other companies, our approach to ESG matters also continues to evolve, and there can be no guarantee that our approach will align with the expectations or preferences of any particular stakeholder. For example, any failure (or perceived failure) to advance our initiatives may result in various adverse impacts, including reputational damage and damage, potential stakeholder engagement and/or or litigation, even if such initiatives are currently voluntary. For example, Additionally, various policymakers, including the European Union and the State of California, have adopted (or are considering adopting) requirements for the disclosure of certain climate-related information disclosures or other ESG disclosures. actions on climate- or ESG-related matters. Such requirements are not uniform, and may not be interpreted or applied uniformly, which may result in increases cost and complexity of compliance, as well as any associated risks. This and other stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor. Additionally, certain of our customers, business partners, and suppliers may be subject to similar expectations, which may augment or create additional risks, including risks that may not be known to us.