Facebook 2012 Annual Report Page 34

significant costs investigating and defending such claims and, if we are found liable, significant damages. If any
of these events occur, our business and financial results could be adversely affected.

Computer malware, viruses, hacking and phishing attacks, and spamming could harm our business and
results of operations.

Computer malware, viruses, and computer hacking and phishing attacks have become more prevalent in our

industry, have occurred on our systems in the past, and may occur on our systems in the future. Because of our
prominence, we believe that we are a particularly attractive target for such attacks. Though it is difficult to
determine what, if any, harm may directly result from any specific interruption or attack, any failure to maintain
performance, reliability, security, and availability of our products and technical infrastructure. Any such failure
may harm our reputation and our ability to retain existing users and attract new users.

In addition, spammers attempt to use our products to send targeted and untargeted spam messages to users,

which may embarrass or annoy users and make Facebook less user-friendly. We cannot be certain that the
technologies and employees that we have to attempt to defeat spamming attacks will be able to eliminate all
spam messages from being sent on our platform. As a result of spamming activities, our users may use Facebook
less or stop using our products altogether.

Payment transactions on the Facebook Platform may subject us to additional regulatory requirements and
other risks that could be costly and difficult to comply with or that could harm our business.

Our users can use the Facebook Platform to purchase virtual and digital goods from our Platform developers

using our Payments infrastructure. Depending on how our Payments product evolves, we may be subject to a
variety of laws and regulations in the United States, Europe, and elsewhere, including those governing money
transmission, gift cards and other prepaid access instruments, electronic funds transfers, anti-money laundering,
counter-terrorist financing, gambling, banking and lending, and import and export restrictions. In some
jurisdictions, the application or interpretation of these laws and regulations is not clear. To increase flexibility in
how our use of Payments may evolve and to mitigate regulatory uncertainty, we have applied for and received
certain money transmitter licenses in the United States and expect to apply for certain regulatory licenses in
Europe, which will generally require us to demonstrate compliance with many domestic and foreign laws in these
areas. Our efforts to comply with these laws and regulations could be costly and result in diversion of
management time and effort and may still not guarantee compliance. In the event that we are found to be in
violation of any such legal or regulatory requirements, we may be subject to monetary fines or other penalties
such as a cease and desist order, or we may be required to make product changes, any of which could have an
adverse effect on our business and financial results.

In addition, we may be subject to a variety of additional risks as a result of Payments on the Facebook

Platform, including:

increased costs and diversion of management time and effort and other resources to deal with bad
transactions or customer disputes;

potential fraudulent or otherwise illegal activity by users, developers, employees, or third parties;

restrictions on the investment of consumer funds used to transact Payments; and

additional disclosure and reporting requirements.

We plan to continue expanding our operations abroad where we have limited operating experience and may be
subject to increased business and economic risks that could affect our financial results.

We plan to continue the international expansion of our business operations and the translation of our

products. We currently make Facebook available in more than 70 different languages, and we have offices or