Yahoo 2014 Annual Report Download - page 26

defending against third-party claims regardless of the merit of such claims. In addition, many of our
agreements with our customers or Affiliates require us to indemnify them for some types of third-
party intellectual property infringement claims, which could increase our costs in defending such
claims and our damages. Furthermore, such customers and Affiliates may discontinue the use of our
products, services, and technologies either as a result of injunctions or otherwise. The occurrence of
any of these results could harm our brands or have an adverse effect on our business, financial
position, operating results, and cash flows.
If our security measures are breached, our products and services may be perceived as not being
secure, users and customers may curtail or stop using our products and services, and we may incur
significant legal and financial exposure.
Our products and services involve the storage and transmission of Yahoo’s users’ and customers’
personal and proprietary information in our facilities and on our equipment, networks and corporate
systems. Security breaches expose us to a risk of loss of this information, litigation, remediation costs,
increased costs for security measures, loss of revenue, damage to our reputation, and potential
liability. Outside parties may attempt to fraudulently induce employees, users, or customers to
disclose sensitive information to gain access to our data or our users’ or customers’ data. In addition,
hardware, software or applications we procure from third parties may contain defects in design or
manufacture or other problems that could unexpectedly compromise network and data security.
Security breaches or unauthorized access have resulted in and may in the future result in a
combination of significant legal and financial exposure, increased remediation and other costs,
damage to our reputation and a loss of confidence in the security of our products, services and
networks that could have an adverse effect on our business. We take steps to prevent unauthorized
access to our corporate systems, however, because the techniques used to obtain unauthorized
access, disable or degrade service, or sabotage systems change frequently or may be designed to
remain dormant until a triggering event, we may be unable to anticipate these techniques or
implement adequate preventative measures. If an actual or perceived breach of our security occurs,
the market perception of the effectiveness of our security measures could be harmed and we could
lose users and customers.
Changes in regulations or user concerns regarding privacy and protection of user data, or any failure
to comply with such laws, could adversely affect our business.
Federal, state, and international laws and regulations govern the collection, use, retention, disclosure,
sharing and security of data that we receive from and about our users. The use of consumer data by
online service providers and advertising networks is a topic of active interest among federal, state,
and international regulatory bodies, and the regulatory environment is unsettled. Many states have
passed laws requiring notification to users where there is a security breach for personal data, such as
California’s Information Practices Act. We face similar risks in international markets where our
products, services and apps are offered. Any failure, or perceived failure, by us to comply with or
make effective modifications to our policies, or to comply with any federal, state, or international
privacy, data-retention or data-protection-related laws, regulations, orders or industry self-regulatory
principles could result in proceedings or actions against us by governmental entities or others, a loss
of user confidence, damage to the Yahoo brands, and a loss of users, advertising partners, or
Affiliates, any of which could potentially have an adverse effect on our business.
In addition, various federal, state and foreign legislative or regulatory bodies may enact new or
additional laws and regulations concerning privacy, data-retention and data-protection issues,
including laws or regulations mandating disclosure to domestic or international law enforcement
bodies, which could adversely impact our business, our brand or our reputation with users. For
example, some countries are considering laws mandating that user data regarding users in their
22