Pandora 2012 Annual Report Download - page 42

Table of Contents
delays, or shutdowns, causing loss of critical data or the unauthorized access to personally identifiable information. If an actual or perceived breach of security
occurs of our systems or a vendor's systems, we may face civil liability and public perception of our security measures could be diminished, either of which
would negatively affect our ability to attract listeners, which in turn would harm our efforts to attract and retain advertisers. We also would be required to
expend significant resources to mitigate the breach of security and to address related matters.
We cannot control the actions of third parties who may have access to the listener data we collect. The integration of the Pandora service with
applications provided by third parties represents a significant growth opportunity for us, but we may not be able to control such third parties' use of listeners'
data, ensure their compliance with the terms of our privacy policies, or prevent unauthorized access to, or use or disclosure of, listener information, any of
which could hinder or prevent our efforts with respect to growth opportunity. In addition, these third party vendors may become the victim of security
breaches, or have practices that may result in a breach and we may be responsible for those third party acts or failures to act.
Any failure, or perceived failure, by us to maintain the security of data relating to our listeners and employees, to comply with our posted privacy
policy, laws and regulations, rules of self-regulatory organizations, industry standards, and contractual provisions to which we may be bound, could result in
the loss of confidence in us, or result in actions against us by governmental entities or others, all of which could result in litigation and financial losses, and
could potentially cause us to lose listeners, advertisers, revenue, and employees.
We are subject to a number of risks related to credit card and debit card payments we accept.
We accept payments exclusively through credit and debit card transactions. For credit and debit card payments, we pay interchange and other fees,
which may increase over time. An increase in those fees would require us to either increase the prices we charge for our products, which could cause us to
lose subscribers and subscription revenue, or suffer an increase in our operating expenses, either of which could harm our operating results.
If we or any of our processing vendors have problems with our billing software, or the billing software malfunctions, it could have an adverse effect on
our subscriber satisfaction and could cause one or more of the major credit card companies to disallow our continued use of their payment products. In
addition, if our billing software fails to work properly and, as a result, we do not automatically charge our subscribers' credit cards on a timely basis or at all,
we could lose subscription revenue, which would harm our operating results.
We are also subject to payment card association operating rules, certification requirements and rules governing electronic funds transfers, which could
change or be reinterpreted to make it more difficult for us to comply. Currently, we are implementing the steps that are required for us to become fully
compliant with the Payment Card Industry, or PCI, Data Security Standard, or PCI DSS, a security standard with which companies that collect, store, or
transmit certain data regarding credit and debit cards, credit and debit card holders, and credit and debit card transactions are required to comply. Our failure
to comply fully with PCI DSS may violate payment card association operating rules, federal and state laws and regulations, and the terms of our contracts
with payment processors and merchant banks. Such failure to comply fully also may subject us to fines, penalties, damages, and civil liability, and may result
in the loss of our ability to accept credit and debit card payments. Further, there is no guarantee that, even if PCI DSS compliance is achieved, we will
maintain PCI DSS compliance or that such compliance will prevent illegal or improper use of our payment systems or the theft, loss, or misuse of data
pertaining to credit and debit cards, credit and debit card holders and credit and debit card transactions.
If we fail to adequately control fraudulent credit card transactions, we may face civil liability, diminished public perception of our security measures
and significantly higher credit card-related costs, each of which could adversely affect our business, financial condition and results of operations.
If we are unable to maintain our chargeback rate or refund rates at acceptable levels, credit card and debit card companies may increase our transaction
fees or terminate their relationships with us. Any increases in our credit card and debit card fees could adversely affect our results of operations, particularly if
we elect not to raise our rates for our service to offset the increase. The termination of our ability to process payments on any major credit or debit card would
significantly impair our ability to operate our business.
31