eBay 2005 Annual Report Download - page 30

licensure or prohibited from conducting our business in their jurisdiction, either with respect to our services in
general, or in order to allow the sale of certain items, such as real estate, event tickets, cultural goods, boats,
and automobiles.
Numerous states and foreign jurisdictions, including the State of California, where our headquarters are
located, have regulations regarding ""auctions'' and the handling of property by ""secondhand dealers'' or
""pawnbrokers.'' No final legal determination has been made as to whether the California regulations apply to
our business (or that of our users) and little precedent exists in this area. Several states and some foreign
jurisdictions have attempted, and may attempt in the future, to impose such regulations upon us or our users.
Attempted enforcement of these laws against some of our users appears to be increasing and such attempted
enforcements could harm our business. In 2002, Illinois amended its auction law to provide for a special
regulatory regime for ""Internet auction listing services,'' and we have registered as an Internet auction listing
service in Illinois. Although this registration has not had a negative impact on our business to date, other
regulatory and licensure claims could result in costly litigation or could require us to change the way we or our
users do business in ways that increase costs or reduce revenues or force us to prohibit listings of certain items
for some locations. We could also be subject to fines or other penalties, and any of these outcomes could harm
our business.
In addition, because our services are accessible worldwide, and we facilitate sales of goods to users
worldwide, foreign jurisdictions may claim that we are required to comply with their laws. For example, the
Australian high court has ruled that a U.S. website in certain circumstances must comply with Australian laws
regarding libel. As we expand and localize our international activities, we become obligated to comply with the
laws of the countries in which we operate. Laws regulating Internet companies outside of the U.S. may be less
favorable than those in the U.S., giving greater rights to consumers, content owners, and users. Compliance
may be more costly or may require us to change our business practices or restrict our service offerings relative
to those in the U.S. Our failure to comply with foreign laws could subject us to penalties ranging from criminal
prosecution to bans on our services.
Our business is subject to online security risks, including security breaches and identity theft.
To succeed, online commerce and communications must provide a secure transmission of confidential
information over public networks. Our security measures may not prevent security breaches that could harm
our business. Currently, a significant number of our users authorize us to bill their credit card accounts
directly for all transaction fees charged by us. PayPal's users routinely provide credit card and other financial
information. We rely on encryption and authentication technology licensed from third parties to provide the
security and authentication to effect secure transmission of confidential information, including customer credit
card numbers. Advances in computer capabilities, new discoveries in the field of cryptography or other
developments may result in a compromise or breach of the technology used by us to protect transaction data.
In addition, any party who is able to illicitly obtain a user's password could access the user's transaction data.
An increasing number of websites have reported breaches of their security. Any compromise of our security
could harm our reputation and, therefore, our business. In addition, a party who is able to circumvent our
security measures could misappropriate proprietary information, or cause interruptions in our operations,
damage our computers or those of our users, or otherwise damage our reputation and business.
Our servers are also vulnerable to computer viruses, physical or electronic break-ins, and similar
disruptions, and we have experienced ""denial-of-service'' type attacks on our system that have made all or
portions of our websites unavailable for periods of time. We may need to expend significant resources to
protect against security breaches or to address problems caused by breaches. These issues are likely to become
more difficult as we expand the number of places where we operate. Security breaches could damage our
reputation and expose us to a risk of loss or litigation and possible liability. Our insurance policies carry low
coverage limits, which may not be adequate to reimburse us for losses caused by security breaches.
Our users, as well as those of other prominent Internet companies, have been and will continue to be
targeted by parties using fraudulent emails to misappropriate passwords, credit card numbers, or other
personal information or to introduce viruses through ""trojan horse'' programs to our users' computers. These
26