27/264 Difficulties in obtaining accurate and comprehensive information necessary to identify the compositions embodied in sound recordings on our Service and the ownership thereof may impact our ability to perform our obligations under our licenses, affect the size of our catalog, impact our ability to control content acquisition costs, and lead to potential copyright infringement claims. Comprehensive and accurate ownership information for the musical compositions embodied in sound recordings is often unavailable to us or difficult or, in some cases, impossible for us to obtain, sometimes because it is withheld by the owners or administrators of such rights. We currently rely on the assistance of third parties to determine this information. If the information provided to us or obtained by such third parties does not comprehensively or accurately identify the ownership of musical compositions, or if we are unable to determine which musical compositions correspond to specific sound recordings, it may be difficult or impossible to identify the appropriate rights holders to whom to pay royalties. This may make it difficult to comply with the obligations of any agreements with those rights holders. In the United States, we also rely on the assistance of third parties to issue notices of intent (“NOIs”) to obtain a compulsory license under Section 115 of the Copyright Act to those copyright owners with whom we do not have a direct license agreement or, in the case of unknown copyright owners, to the United States Copyright Office. The lack of comprehensive and accurate ownership information or the inability to determine which musical compositions correspond to specific sound recordings can cause difficulties in issuing NOIs to the correct parties (including the United States Copyright Office) or serving NOIs in a timely manner and can otherwise cause difficulties in obtaining licenses. This could lead to a reduction of sound recordings available to be streamed on our Service, adversely impacting our ability to retain and expand our User base, and could make it difficult to ensure that we are fully licensed. These challenges, and others concerning the licensing of musical compositions embodied in sound recordings on our Service, may subject us to significant liability for copyright infringement, breach of contract, or other claims. See “Business—Legal Proceedings.” If our security systems are breached, we may face civil liability, and public perception of our security measures could be diminished, either of which would negatively affect our ability to attract and retain Premium Subscribers, Ad­Supported Users, advertisers, content providers, and other business partners. Techniques used to gain unauthorized access to data and software are constantly evolving, and we may be unable to anticipate or prevent unauthorized access to data pertaining to our Users, including credit card and debit card information and other personal data about our Users, business partners, and employees. Like all internet services, our Service, which is supported by our own systems and those of third parties that we work with, is vulnerable to software bugs, computer viruses, internet worms, break­ins, phishing attacks, attempts to overload servers with denial­of­service, or other attacks and similar disruptions from unauthorized use of our and third­party computer systems, any of which could lead to system interruptions, delays, or shutdowns, causing loss of critical data or the unauthorized access to personal data. Computer malware, viruses, and computer hacking and phishing attacks have become more prevalent in our industry, have occurred on our systems in the past, and may occur on our systems in the future. Because of our prominence, we believe that we are a particularly attractive target for such attacks. Though it is difficult to determine what, if any, harm may directly result from any specific interruption or attack, any failure to maintain performance, reliability, security, and availability of our products and technical infrastructure to the satisfaction of our Users may harm our reputation and our ability to retain existing Users and attract new Users. Although we have developed systems and processes that are designed to protect our data and User data, to prevent data loss, to disable undesirable accounts and activities on our platform, and to prevent or detect security breaches, we cannot assure you that such measures will provide absolute security, and we may incur significant costs in protecting against or remediating cyber­attacks. In addition, if an actual or perceived breach of security occurs to our systems or a third party’s systems, we may face regulatory or civil liability and public perception of our security measures could be diminished, either of which would negatively affect our ability to attract and retain Users, which in turn would harm our efforts to 20