This Annual Report on Form 10-K contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended, which statements involve substantial risk and uncertainties. Forward-looking statements generally relate to future events or our future financial or operating performance. In some cases, you can identify forward-looking statements because they contain words such as “may,” “will,” “should,” “expects,” “plans,” “anticipates,” “could,” “intends,” “target,” “projects,” “contemplates,” “believes,” “estimates,” “predicts,” “potential,” or “continue” or the negative of these words or other similar terms or expressions that concern our expectations, strategy, plans, or intentions. Forward-looking statements contained in this Annual Report on Form 10-K include, but are not limited to, statements about:

Our business depends upon our ability to maintain and expand our relationships with our users. Our business is subscription based, and paying users are not obligated to and may not renew their subscriptions after their existing subscriptions expire. As a result, we cannot provide assurance that paying users will renew their subscriptions utilizing the same tier of our products or upgrade to premium offerings. Renewals of subscriptions to our platform may decline or fluctuate because of several factors, such as dissatisfaction with our products, and support, pricing, or mix of features, a user no longer having a need for our products, or the perception that competitive products provide better or less expensive options. In addition, some paying users downgrade or do not renew their subscriptions.

Although it is important to our business that our users renew their subscriptions after their existing subscriptions expire and that we expand our commercial relationships with our users, given the volume of our users, we do not actively monitor the retention rates of our individual users. As a result, we may be unable to address any retention issues with specific users in a timely manner, which could harm our business.

We must continually add new users to grow our business beyond our current user base and to replace users who choose not to continue to use our platform. Historically, our revenue has been driven by our self-serve model, and we generate more than 90% of our revenue from self-serve channels. Any decrease in user satisfaction with our products or support could harm our brand, word-of-mouth referrals, and ability to grow.

Additionally, many of our users initially access our platform free of charge. We strive to demonstrate the value of our platform to our registered users, thereby encouraging them to convert to paying users through in-product prompts and notifications, and time-limited trials of paid subscription plans. As of December 31, 2018,2019, we served over 500600 million registered users but only 12.714.3 million paying users. The actual number of unique users is lower than we report as one person may register more than once for our platform. As a result, we have fewer unique registered users that we may be able to convert to paying users. A majority of our registered users may never convert to a paid subscription to our platform.platform, and failure to convert users to a paid subscription will restrict our ability to grow our revenue.

In addition, our user growth rate has and may continue to slow in the future as our market penetration rates increase and we turn our focus to converting registered users to paying users rather than growing the total number of registered users. If we are not able to continue to expand our user base or fail to convert our registered users to paying users, demand for our paid services and our revenue may grow more slowly than expected or decline.

We have experienced significant revenue growth in prior periods. However, our rates of revenue growth are slowing and may continue to slow in the future. Many factors may contribute to declines in our growth rates, including higher market penetration, increased competition, slowing demand for our platform, a decrease in the growth of the overall content collaboration market, a failure by us to continue capitalizing on growth opportunities, and the maturation of our business, among others. You should not rely on the revenue growth of any prior quarterly or annual period as an indication of our future performance. If our growth rates decline, investors’ perceptions of our business and the trading price of our Class A common stock could be adversely affected.

We have incurred net losses on an annual basis since our inception. We incurred net losses of $52.7 million, $484.9 million, $111.7 million, and $210.2$111.7 million in the years ended December 31, 2019, 2018, 2017 and 2016,2017, respectively, and we had an accumulated deficit of $1,659.5$1,726.2 million as of December 31, 2018.2019. As we strive to grow our business, we expect expenses tomay increase in the near term, particularly as we continue to make investments to scale our business. For example, we will need an increasing amount of technical infrastructure to continue to satisfy the needs of our user base. We also expect ourOur research and development expenses tomay also increase as we plan to continue to hire employees for our engineering, product, and design teams to support these efforts. In addition, we will incur additional rent expense in connection with our move to our new corporate headquarters, and additional general and administrative expenses to support both our growth as well as our transition to being a publicly traded company. These investments may not result in increased revenue or growth in our business. Further, we have created mobile applications and mobile versions of Dropbox that are distributed to users primarily through app stores operated by Apple and Google, each of whom charge us in-application purchase fees. As a result, if more of our users subscribe to our products through mobile applications, these fees may have an adverse impact on our results of operations. We may also encounter unforeseen or unpredictable factors, including unforeseen operating expenses, complications, or delays, which may result in increased costs. Furthermore, it is difficult to predict the size and growth rate of our market, user demand for our platform, user adoption and renewal of our platform, the entry of competitive products and services, or the success of existing competitive products and services. As a result, we may not achieve or maintain profitability in future periods. If we fail to grow our revenue sufficiently to keep pace with our investments and other expenses, our results of operations and financial condition would be adversely affected.

The use of our platform involves the transmission, storage, and processing of user content, some of which may be considered personally identifiable, confidential, or sensitive. We face security threats from malicious third parties that could obtain unauthorized access to our systems, infrastructure, and networks. We anticipate that these threats will continue to grow in scope and complexity over time. For example, in 2016, we learned that an old set of Dropbox user credentials for approximately 68 million accounts was released. These credentials consisted of email addresses and passwords protected by cryptographic techniques known as hashing and salting. Hashing and salting can make it more difficult to obtain the original password, but may not fully protect the original password from being obtained. We believe these Dropbox user credentials were obtained in 2012 and related to a security incident we disclosed to users. In response, we notified all existing users we believed to be affected and completed a password reset for anyone who had not updated their password since mid-2012. We have responded to this event by expanding our security team and data monitoring capabilities and continuing to work on features such as two-factor authentication to increase protection of user information. While we believe our corrective actions will reduce the likelihood of similar incidents occurring in the future, third parties might use techniques that we are unable to defend against to compromise and infiltrate our systems, infrastructure, and networks. We may fail to detect the existence of a breach of user content and be unable to prevent unauthorized access to user and company content. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are often not recognized until launched against a target. They may originate from less regulated or remote areas around the world, or from state-sponsored actors. If our security measures are breached, or our users’ content is otherwise accessed through unauthorized means, or if any such actions are believed to occur, our platform may be perceived as insecure, and we may lose existing users or fail to attract and retain new users.

We may rely on third parties when deploying our infrastructure, and in doing so, expose it to security risks outside of our direct control. We rely on outside vendors and contractors to perform services necessary for the operation of the business, and they may fail to adequately secure our user and company content.

Third parties may attempt to compromise our employees and their privileged access into internal systems to gain access to accounts, our information, our networks, or our systems. Employee error, malfeasance, or other errors in the storage, use, or transmission of personal information could result in an actual or perceived breach of user privacy. Our users may also disclose or lose control of their passwords, or use the same or similar passwords on third parties’ systems, which could lead to unauthorized access to their accounts on our platform.

Any unauthorized or inadvertent access to, or an actual or perceived security breach of, our systems, infrastructure, or networks could result in an actual or perceived loss of, or unauthorized access to, our data or our users’ content, regulatory investigations and orders, litigation, indemnity obligations, damages, penalties, fines, and other costs in connection with actual and alleged contractual breaches, violations of applicable laws and regulations, and other liabilities. Any such incident could also materially damage our reputation and harm our business, results of operations, and financial condition, including reducing our revenue, causing us to issue credits to users, negatively impacting our ability to accept and process user payment information, eroding our users’ trust in our services and payment solutions, subjecting us to costly user notification or remediation, harming our ability to retain users, harming our brand, or increasing our cost of acquiring new users. We maintain errors, omissions, and cyber liability insurance policies covering certain security and privacy damages. However, we cannot be certain that our coverage will be adequate for liabilities actually incurred or that insurance will continue to be available to us on economically reasonable terms, or at all. Further, if a high profilehigh-profile security breach occurs with respect to another content collaboration solutions provider, our users and potential users could lose trust in the security of content collaboration solutions providers generally, which could adversely impact our ability to retain users or attract new ones.

Our brand, reputation, and ability to attract, retain, and serve our users are dependent upon the reliable performance of our platform, including our underlying technical infrastructure. Our users rely on our platform to store digital copies of their valuable content, including financial records, business information, documents, photos, and other important content. Our technical infrastructure may not be adequately designed with sufficient reliability and redundancy to avoid performance delays or outages that could be harmful to our business. If our platform is unavailable when users attempt to access it, or if it does not load as quickly as they expect, users may not use our platform as often in the future, or at all.

As our user base and the amount and types of information stored, synced, and shared on our platform continues to grow, we will need an increasing amount of technical infrastructure, including network capacity and computing power, to continue to satisfy the needs of our users. The vast majority of user content is stored on our own custom-built infrastructure at co-location facilities that we directly lease and operate. During 2015 and 2016, we migrated the vast majority of user content to our own custom-built infrastructure in co-location facilities that we directly lease and operate. As we add to our infrastructure, we may move or transfer additional content.

Further, as we continue to grow and scale our business to meet the needs of our users, we may overestimate or underestimate our infrastructure capacity requirements, which could adversely affect our results of operations. The costs associated with leasing and maintaining our custom-built infrastructure in co-location facilities and third-party datacenters already constitute a significant portion of our capital and operating expenses. We continuously evaluate our short- and long-term infrastructure capacity requirements to ensure adequate capacity for new and existing users while minimizing unnecessary excess capacity costs. If we overestimate the demand for our platform and therefore secure excess infrastructure capacity, our operating margins could be reduced. If we underestimate our infrastructure capacity requirements, we may not be able to service the expanding needs of new and existing users, and our hosting facilities, network, or systems may fail.

In addition, the datacenters that we use are vulnerable to damage or interruption from human error, intentional bad acts, earthquakes, floods, fires, war, terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures, and similar events, any of which could disrupt our service, destroy user content, or prevent us from being able to continuously back up or record changes in our users’ content. In the event of significant physical damage to one of these datacenters, it may take a significant period of time to achieve full resumption of our services, and our disaster recovery planning may not account for all eventualities. Damage or interruptions to these datacenters could harm our platform and business.

We generate, and expect to continue to generate, revenue from the sale of subscriptions to our platform. As a result, widespread acceptance and use of content collaboration solutions in general, and our platform in particular, is critical to our future growth and success. If the content collaboration market fails to grow or grows more slowly than we currently anticipate, demand for our platform could be negatively affected.

The content collaboration market is subject to rapidly changing user demand and trends in preferences. If we fail to successfully predict and address these changes and trends, meet user demands, or achieve more widespread market acceptance of our platform, our business, results of operations, and financial condition could be harmed.

One of the most important features of our platform is its broad interoperability with a range of diverse devices, operating systems, and third-party applications. Our platform is accessible from the web and from devices running Windows, Mac OS, iOS, Android, WindowsMobile, and Linux. We also have integrations with Microsoft, Adobe, Apple, Salesforce, Atlassian, Slack, BetterCloud, Google, IBM, Cisco, VMware, Okta, Symantec, Palo Alto Networks, Zoom, and a variety of other productivity, collaboration, data management, and security vendors. We are dependent on the accessibility of our platform across these third-party operating systems and applications that we do not control. Several of our competitors own, develop, operate, or distribute operating systems, app stores, third-party datacenter services, and other software, and also have material business relationships with companies that own, develop, operate, or distribute operating systems, applications markets, third-party datacenter services, and other software that our platform requires in order to operate. Moreover, some of these competitors have inherent advantages developing products and services that more tightly integrate with their software and hardware platforms or those of their business partners.

Third-party services and products are constantly evolving, and we may not be able to modify our platform to assure its compatibility with that of other third parties following development changes. In addition, some of our competitors may be able to disrupt the operations or compatibility of our platform with their products or services, or exert strong business influence on our ability to, and terms on which we, operate and distribute our platform. For example, we currently offer products that directly compete with several large technology companies that we rely on to ensure the interoperability of our platform with their products or services. We also rely on these companies to make our mobile applications available through their app stores. As our respective products evolve, we expect this level of competition to increase. Should any of our competitors modify their products or standards in a manner that degrades the functionality of our platform or gives preferential treatment to competitive products or services, whether to enhance their competitive position or for any other reason, the interoperability of our platform with these products could decrease and our business, results of operations, and financial condition could be harmed.

The content collaboration market is characterized by rapid technological change and frequent new product and service introductions. Our ability to grow our user base and increase revenue from existing users will depend heavily on our ability to enhance and improve our platform, introduce new features and products, increase our strategic partnerships with third parties, and interoperate across an increasing range of devices, operating systems, and third-party applications. Users may require features and capabilities that our current platform does not have. We invest significantly in research and development, and our goal is to focus our spending on measures that improve quality and ease of adoption and create organic user demand for our platform. For example, in 2017, we released Smart Sync, an advanced productivity feature, and introduced Paper, a new collaborative product experience. More recently, inIn 2018, we announced Dropbox Extensions, which allows users to initiate and manage workflows with third-party partner applications from Dropbox. More recently, in 2019, we launched Dropbox Spaces, an evolution of the shared folder which creates a collaborative workspace for individuals and teams to work together. There is no assurance that our enhancements to our platform or our new product experiences, partnerships, features, or capabilities will be

The introduction of new products and services by competitors or the development of entirely new technologies to replace existing offerings could make our platform obsolete or adversely affect our business, results of operations, and financial condition. We may experience difficulties with software development, design, or marketing that could delay or prevent our development, introduction, or implementation of new product experiences, features, or capabilities. We have in the past experienced delays in our internally planned release dates of new features and capabilities, and there can be no assurance that new product experiences, features, or capabilities will be released according to schedule. Any delays could result in adverse publicity, loss of revenue or market acceptance, or claims by users brought against us, all of which could have a material and adverse effect on our reputation, business, results of operations, and financial condition. Moreover, new features to our platform may require substantial investment, and we have no assurance that such investments will be successful. If users do not widely adopt our new product experiences, features, and capabilities, we may not be able to realize a return on our investment. If we are unable to develop, license, or acquire new features and capabilities to our platform on a timely and cost-effective basis, or if such enhancements do not achieve market acceptance, our business, results of operations, and financial condition could be adversely affected.

Since our founding in 2007, we have experienced rapid growth. For example, our headcount has grown from 1,612 employees as of December 31, 2016, to 2,3232,801 employees as of December 31, 2018,2019, with employees located both in the United States and internationally. The growth and expansion of our business places a continuous significant strain on our management, operational, and financial resources. Further growth of our operations to support our user base or our expanding third-party relationships, our information technology systems, and our internal controls and procedures may not be adequate to support our operations. In addition, as we continue to grow, we face challenges of integrating, developing, and motivating a rapidly growing employee base in various countries around the world. Certain members of our management have not previously worked together for an extended period of time and some do not have prior experience managing a public company, which may affect how they manage our growth. Managing our growth will also require significant expenditures and allocation of valuable management resources.

In addition, our rapid growth may make it difficult to evaluate our future prospects. Our ability to forecast our future results of operations is subject to a number of uncertainties, including our ability to effectively plan for and model future growth. We have encountered in the past, and may encounter in the future, risks and uncertainties frequently experienced by growing companies in rapidly changing industries. If we fail to achieve the necessary level of efficiency in our organization as it grows, or if we are not able to accurately forecast future growth, our business, results of operations, and financial condition could be harmed.

Historically, our business model has been driven by organic adoption and viral growth, with more than 90% of our revenue generated from self-serve channels. As a result, we do not have a significant outbound sales force, which has enabled us to be more efficient with our sales and marketing spend. Although we believe our business model can continue to scale without a large outbound sales force, our word-of-mouth and user referral marketing model may not continue to be as successful as we anticipate, and our limited experience selling directly to large organizations through our outbound sales force may impede our future growth. As we continue to scale our business, an enhanced sales infrastructure could assist in reaching larger organizations and growing our revenue. Identifying and recruiting additional qualified sales personnel and training them would require significant time, expense, and attention, and would significantly impact our business model. Further, adding more sales personnel would change our cost structure and results of operations, and we may have to reduce other expenses in order to accommodate a corresponding increase in sales and marketing expenses. If our limited experience selling and marketing to large organizations prevents us from reaching larger organizations and growing our revenue, and if we are unable to hire, develop, and retain talented sales personnel in the future, our business, results of operations, and financial condition could be adversely affected.

As our business evolves, we may need to invest more resources into sales to large organizations. Large organizations may undertake a significant evaluation and negotiation process, which can lengthen our sales cycle. We may also face unexpected deployment challenges with large organizations or more complicated deployment of our platform. Large organizations may demand more configuration and integration of our platform or require additional security management or control features. We may spend substantial time, effort, and money on sales efforts to large organizations without any assurance that our efforts will

We have designed our platform to be easy to adopt and use with minimal to no support necessary. Any increased user demand for customer support could increase costs and harm our results of operations. In addition, as we continue to grow our operations and support our global user base, we need to be able to continue to provide efficient customer support that meets our customers’ needs globally at scale. Paying users receive additional customer support features and the number of our paying users has grown significantly, which will put additional pressure on our support organization. For example, the number of paying users has grown from 8.8 million as of December 31, 2016, to 12.714.3 million as of December 31, 2018.2019. If we are unable to provide efficient customer support globally at scale, our ability to grow our operations may be harmed and we may need to hire additional support personnel, which could harm our results of operations. Our new user signups are highly dependent on our business reputation and on positive recommendations from our existing users. Any failure to maintain high-quality customer support, or a market perception that we do not maintain high-quality customer support, could harm our reputation, business, results of operations, and financial condition.

Our quarterly results of operations, including our revenue, gross margin, operating margin, profitability, cash flow from operations, and deferred revenue, may vary significantly in the future and period-to-period comparisons of our results of operations may not be meaningful. Accordingly, the results of any one quarter should not be relied upon as an indication of future performance. Our quarterly results of operations may fluctuate as a result of a variety of factors, many of which are outside of our control, and as a result, may not fully reflect the underlying performance of our business. Fluctuation in quarterly results may negatively impact the value of our securities. Factors that may cause fluctuations in our quarterly results of operations include, without limitation, those listed below:

We recognize revenue from subscriptions to our platform over the terms of these subscriptions. Our subscription arrangements generally have monthly or annual contractual terms, and we also have a small percentage of multi-year contractual terms. Amounts that have been billed are initially recorded as deferred revenue until the revenue is recognized. As a result, a large portion of our revenue for each quarter reflects deferred revenue from subscriptions entered into during previous

We depend on the continued service and performance of our key personnel. In particular, Andrew W. Houston, our President and Chief Executive Officer and one of our co-founders, is critical to our vision, strategic direction, culture, and offerings. From time to time, there may be changes in our management team resulting from the hiring or departure of our executives. For example, in the third quarter of 2018 we announced that Dennis Woodside,Bharat Mediratta recently has joined us as our formerChief Technology Officer and Senior Vice President, Platform, Timothy Young joined us as our Senior Vice President and General Manager, Core Dropbox and Olivia Nottebohm joined us as our Chief Operating Officer. In 2019, Quentin Clark stepped down as our Chief Technology Officer had resigned such role, remaining an advisor through the end of 2018. Some ofand Yamini Rangan stepped down as our Chief Customer Officer. In addition to Mr. Mediratta, Mr. Young, and Ms. Nottebohm, other key personnel have recently joined us and are still being integrated into our company. WeWhile we seek to manage these transitions carefully, such changes may continue to make changesresult in a loss of institutional knowledge and cause disruptions to our management team, which could make it difficult to execute on our business plans and strategies. New hires also require significant training and, in most cases, take significant time before they achieve full productivity.business. Our failure to successfully integrate these key personnel into our business could adversely affect our business.

We do not have long-term employment agreements with anyAll of our officers orand key personnel.personnel are at-will employees. In addition, many of our key technologies and systems are custom-made for our business by our key personnel. The loss of key personnel, including key members of our management team, as well as certain of our key marketing, sales, product development, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business.

To execute our growth plan, we must attract and retain highly qualified personnel. Competition for these employees is intense, particularly in the San Francisco Bay Area where our headquarters is located, and we may not be successful in attracting and retaining qualified personnel. We have from time to time in the past experienced, and we expect to continue to experience, difficulty in hiring and retaining highly skilled employees with appropriate qualifications. Our recent hires and planned hires may not become as productive as we expect, and we may be unable to hire, integrate, or retain sufficient numbers of qualified individuals. Many of the companies with which we compete for experienced personnel have greater resources than we have. In addition, in making employment decisions, particularly in the internet and high-technology industries, job candidates often consider the value of the equity they are to receive in connection with their employment. Employees may be more likely to leave us if the shares they own or the shares underlying their equity incentive awards have significantly appreciated or significantly reduced in value. Many of our employees may receive significant proceeds from sales of our equity in the public markets, which may reduce their motivation to continue to work for us. If we fail to attract new personnel, or fail to retain and motivate our current personnel, our business and growth prospects could be harmed.

Additionally, if we do not maintain and continue to develop our corporate culture as we grow and evolve, it could harm our ability to foster the innovation, creativity, and teamwork we believe that we need to support our growth. Additions of executive-level management and large numbers of employees could significantly and adversely impact our culture.

We believe that our brand identity and awareness have contributed to our success and have helped fuel our efficient go-to-market strategy. We also believe that maintaining and enhancing the Dropbox brand is critical to expanding our base of users. We anticipate that, as our market becomes increasingly competitive, maintaining and enhancing our brand may become increasingly difficult and expensive. Any unfavorable publicity or consumer perception of our platform or the providers of content collaboration solutions generally could adversely affect our reputation and our ability to attract and retain users. Additionally, if we fail to promote and maintain the Dropbox brand, our business, results of operations, and financial condition will be materially and adversely affected.

We have paying users across 180 countries and approximately half of our revenue in the year ended December 31, 20182019 was generated from paying users outside the United States. We expect to continue to expand our international operations, which

Compliance with laws and regulations applicable to our global operations substantially increases our cost of doing business in international jurisdictions. We may be unable to keep current with changes in laws and regulations as they change. Although we have implemented policies and procedures designed to support compliance with these laws and regulations, there can be no assurance that we will always maintain compliance or that all of our employees, contractors, partners, and agents will comply. Any violations could result in regulatory investigations and enforcement actions, fines, civil and criminal penalties, damages, injunctions, or reputational harm. If we are unable comply with these laws and regulations or manage the complexity of our global operations successfully, our business, results of operations, and financial condition could be adversely affected.

We conduct our business across 180 countries around the world. As we continue to expand our international operations, we will become more exposed to the effects of fluctuations in currency exchange rates. This exposure is the result of selling in multiple currencies and operating in foreign countries where the functional currency is the local currency. In 2018, 30%2019, 29% of our sales were denominated in currencies other than U.S. dollars. Our expenses, by contrast, are primarily denominated in U.S.

We host our services and serve all of our users using a combination of our own custom-built infrastructure that we lease and operate in co-location facilities and third-party datacenter services such as Amazon Web Services. While we typically control and have access to the servers we operate in co-location facilities and the components of our custom-built infrastructure that are located in those co-location facilities, we control neither the operation of these facilities nor our third-party service providers. Furthermore, we have no physical access or control over the services provided by Amazon Web Services.

Datacenter leases and agreements with the providers of datacenter services expire at various times. The owners of these datacenters and providers of these datacenter services may have no obligation to renew their agreements with us on commercially reasonable terms, or at all. Problems faced by datacenters, with our third-party datacenter service providers, with the telecommunications network providers with whom we or they contract, or with the systems by which our telecommunications providers allocate capacity among their users, including us, could adversely affect the experience of our users. Our third-party datacenter operators could decide to close their facilities or cease providing services without adequate notice. In addition, any financial difficulties, such as bankruptcy, faced by our third-party datacenters operators or any of the service providers with whom we or they contract may have negative effects on our business, the nature and extent of which are difficult to predict.

If the datacenters and service providers that we use are unable to keep up with our growing needs for capacity, or if we are unable to renew our agreements with datacenters, and service providers on commercially reasonable terms, we may be required to transfer servers or content to new datacenters or engage new service providers, and we may incur significant costs, and possible service interruption in connection with doing so. Any changes in third-party service levels at datacenters or any real or perceived errors, defects, disruptions, or other performance problems with our platform could harm our reputation and may result in damage to, or loss or compromise of, our users’ content. Interruptions in our platform might, among other things, reduce our revenue, cause us to issue refunds to users, subject us to potential liability, harm our reputation, or decrease our renewal rates.

We use software and services licensed and procured from third parties to develop and offer our platform. We may need to obtain future licenses and services from third parties to use intellectual property and technology associated with the development of our platform, which might not be available to us on acceptable terms, or at all. Any loss of the right to use any software or services required for the development and maintenance of our platform could result in delays in the provision of our platform until equivalent technology is either developed by us, or, if available from others, is identified, obtained, and integrated, which could harm our platform and business. Any errors or defects in third-party software or services could result in errors or a failure of our platform, which could harm our business, results of operations, and financial condition.

We also depend on our ecosystem of developers to create applications that will integrate with our platform. As of December 31, 2018,2019, Dropbox was receiving over 50 billion API calls per month, and more than 500,000750,000 developers had registered and built applications on our platform. Our reliance on this ecosystem of developers creates certain business risks relating to the quality of the applications built using our APIs, service interruptions of our platform from these applications, lack of service support for these applications, and possession of intellectual property rights associated with these applications. We may not have the ability to control or prevent these risks. As a result, issues relating to these applications could adversely affect our business, brand, and reputation.

We are subject to compliance with various laws, including those covering copyright, indecent content, child protection, consumer protection, and similar matters. There have been instances where improper or illegal content has been stored on our platform without our knowledge. As a service provider, we do not regularly monitor our platform to evaluate the legality of content stored on it. While to date we have not been subject to material legal or administrative actions as result of this content, the laws in this area are currently in a state of flux and vary widely between jurisdictions. Accordingly, it may be possible that in the future we and our competitors may be subject to legal actions, along with the users who uploaded such content. In addition, regardless of any legal liability we may face, our reputation could be harmed should there be an incident generating

We are also subject to consumer protection laws that may impact our sales and marketing efforts, including laws related to subscriptions, billing, and auto-renewal. These laws, as well as any changes in these laws, could adversely affect our self-serve model and make it more difficult for us to retain and upgrade paying users and attract new ones. Additionally, we have in the past, are currently, and may from time to time in the future become the subject of inquiries and other actions by regulatory authorities as a result of our business practices, including our subscription, billing, and auto-renewal policies. Consumer protection laws may be interpreted or applied by regulatory authorities in a manner that could require us to make changes to our operations or incur fines, penalties or settlement expenses, which may result in harm to our business, results of operations, and brand.

Our platform depends on the ability of our users to access the internet and our platform has been blocked or restricted in some countries for various reasons. For example, our platform is blocked in the People’s Republic of China. If we fail to anticipate developments in the law, or fail for any reason to comply with relevant law, our platform could be further blocked or restricted and we could be exposed to significant liability that could harm our business.

We are also subject to various U.S. and international anti-corruption laws, such as the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, and Irish Criminal Justice (Corruption Offences) Act 2018, as well as other similar anti-bribery and anti-kickback laws and regulations. These laws and regulations generally prohibit companies and their employees and intermediaries from authorizing, offering, or providing improper payments or benefits to officials and other recipients for improper purposes. Although we take precautions to prevent violations of these laws, our exposure for violating these laws increases as we continue to expand our international presence and any failure to comply with such laws could harm our reputation and our business.

We are subject to U.S. export controls and sanctions regulations that prohibit the shipment or provision of certain products and services to certain countries, governments, and persons targeted by U.S. sanctions. While we take precautions to prevent our products and services from being exported in violation of these laws, including implementing IP address blocking, we cannot guarantee that the precautions we take will prevent violations of export control and sanctions laws. For example, in 2011, we provided certain downloadable portions of our software to international users that, prior to export, required either a one-time product review or application for an encryption registration number in lieu of such product review. These exports were likely made in violation of U.S. export control and sanction laws. In March 2011, we filed a Final Voluntary Self Disclosure with the U.S. Department of Commerce’s Bureau of Industry and Security, or BIS, concerning these potential violations. In June 2012, BIS notified us that it had completed its review of these matters and closed its review with the issuance of a Warning Letter. No monetary penalties were assessed against us by BIS with respect to the 2011 filing. In addition, in 2017, we discovered that our platform has been accessed by certain users in apparent violation of United States sanctions regulations. We filed an Initial Voluntary Self Disclosure in October 2017 with the Office of Foreign Assets Control, or OFAC, and a Final Voluntary Self Disclosure with OFAC in February 2018. In October 2018, OFAC notified us that it had completed its review of these matters and closed its review with the issuance of a Cautionary Letter. No monetary penalties were assessed with respect to the 2018 filing. If in the future we are found to be in violation of U.S. sanctions or export control laws, it could result in substantial fines and penalties for us and for the individuals working for us.

In addition, various countries regulate the import and export of certain encryption and other technology, including import and export permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our users’ ability to access our platform in those countries. Changes in our platform or client-side software, or future changes in export and import regulations may prevent our users with international operations from deploying our platform globally or, in some cases, prevent the export or import of our platform to certain countries, governments, or persons altogether. Any change in export or import regulations, economic sanctions or related legislation, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our platform by, or in our

We receive, store, process, and use personal information and other user content. There are numerous federal, state, local, and international laws and regulations regarding privacy, data protection, information security, and the storing, sharing, use, processing, transfer, disclosure, and protection of personal information and other content, the scope of which are changing, subject to differing interpretations, and may be inconsistent among countries, or conflict with other rules. We also post privacy policies and are also subject to the terms of our privacy policies andcontractual obligations to third parties related to privacy, data protection, and information security. We strive to comply with applicable laws, regulations, policies, and other legal obligations relating to privacy, data protection, and information security to the extent possible. However, the regulatory framework for privacy and data protection worldwide is, and is likely to remain, uncertain for the foreseeable future, and it is possible that these or other actual or alleged obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices.

We also expect that there will continue to be new laws, regulations, and industry standards concerning privacy, data protection, and information security proposed and enacted in various jurisdictions. For example, in May 2018, the General Data Protection Regulation, or GDPR, went into effect in the European Union, or EU. The GDPR imposed more stringent data protection requirements and provides greater penalties for noncompliance than previous data protection laws. Further, following a referendum in June 2016 in which voters in the United Kingdom approved an exit from the EU ("Brexit"), the United Kingdom government has initiated a process to leave the EU. The United Kingdom withdrew from the EU or Brexit.pursuant to Brexit on January 31, 2020, subject to a transition period that is set to end on December 31, 2020. Brexit has created uncertainty with regard to the regulation of data protection in the United Kingdom. In particular, it is unclear whetheralthough the United Kingdom will enact data protection laws or regulationshas enacted a Data Protection Act designed to be consistent with the GDPR, andit remains unclear how data transfers to and from the United Kingdom will be regulated. Additionally, although we have self-certified under the U.S.-EU and U.S.-Swiss Privacy Shield Frameworks with regard to our transfer of certain personal data from the EU and Switzerland to the United States, some regulatory uncertainty remains surrounding the future of data transfers from the EU and Switzerland to the United States, and we are closely monitoring regulatory developments in this area. Additionally, California recently enacted legislation, theThe California Consumer Privacy Act of 2018, that will affordwhich affords California consumers expanded privacy protections when it goeswent into effect on January 1, 2020. LegislatorsHowever, the regulations governing certain aspects of the California Consumer Privacy Act and its enforcement have stated that they intend to propose amendments to this legislation, and it remains unclear what, if any, modifications will be made to this legislation or how it will be interpreted.not yet been finalized. The effects of this legislation remain potentially are far-reaching, however, and depending on final regulatory guidance and other related developments, may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. Similarly, there are a number of legislative proposals in the European Union, the United States, at both the federal and state level, as well as other jurisdictions that could impose new obligations in areas affecting our business. In addition, some countries are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data, or similar requirements, that could increase the cost and complexity of delivering our services.

With laws and regulations such as the GDPR in the EU and the California Consumer Privacy Act in the U.S. imposing new and relatively burdensome obligations, and with substantial uncertainty over the interpretation and application of these and other laws and regulations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices, and may incur significant costs and expenses in an effort to do so. Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to users or other third parties, or any of our other legal obligations relating to privacy, data protection, or information security may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us by consumer advocacy groups or others, and could result in significant liability or cause our users to lose trust in us, which could have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our users may limit the adoption and use of, and reduce the overall demand for, our services.

Additionally, if third parties we work with, such as vendors or developers, violate applicable laws or regulations or our policies, such violations may also put our users’ content at risk and could in turn have an adverse effect on our business. Any significant change to applicable laws, regulations, or industry practices regarding the collection, use, retention, security, or disclosure of our users’ content, or regarding the manner in which the express or implied consent of users for the collection, use, retention, or disclosure of such content is obtained, could increase our costs and require us to modify our services and features, possibly in a material manner, which we may be unable to complete, and may limit our ability to store and process user data or develop new services and features.

Our platform depends on the quality of our users’ access to the internet. Certain features of our platform require significant bandwidth and fidelity to work effectively. Internet access is frequently provided by companies that have significant market power that could take actions that degrade, disrupt or increase the cost of user access to our platform, which would negatively impact our business. We could incur greater operating expenses and our user acquisition and retention could be negatively impacted if network operators:

On June 11, 2018, the repeal of the Federal Communications Commission’s, or FCC, “net neutrality” rules took effect and returned to a “light-touch” regulatory framework. The prior rules were designed to ensure that all online content is treated the same by internet service providers and other companies that provide broadband services. Additionally, on September 30, 2018, California enacted the California Internet Consumer Protection and Net Neutrality Act of 2018, making California the fourth state to enact a state-level net neutrality law since the FCC repealed its nationwide regulations, mandating that all broadband services in California must be provided in accordance with state net neutrality requirements. The U.S. Department of Justice has sued to block the law going into effect, and California has agreed to delay enforcement until the resolution of the FCC’s repeal of the federal rules. A number of other states are considering or have enacted legislation or executive actions that would regulate the conduct of broadband providers. We cannot predict whether the FCC order or state initiatives will be modified, overturned, or vacated by legal action of the court, federal legislation, or the FCC. With the repeal of net neutrality rules in effect, we could incur greater operating expenses, which could harm our results of operations. As the internet continues to experience growth in the number of users, frequency of use, and amount of data transmitted, the internet infrastructure that we and our users rely on may be unable to support the demands placed upon it. The failure of the internet infrastructure that we or our users rely on, even for a short period of time, could undermine our operations and harm our results of operations.

In addition, there are various laws and regulations that could impede the growth of the internet or other online services, and new laws and regulations may be adopted in the future. These laws and regulations could, in addition to limiting internet neutrality, involve taxation, tariffs, privacy, data protection, content, copyrights, distribution, electronic contracts and other communications, consumer protection, and the characteristics and quality of services, any of which could decrease the demand for, or the usage of, our platform. Legislators and regulators may make legal and regulatory changes, or interpret and apply existing laws, in ways that require us to incur substantial costs, expose us to unanticipated civil or criminal liability, or cause us to change our business practices. These changes or increased costs could materially harm our business, results of operations, and financial condition.

We own a large number of patents, copyrights, trademarks, domain names, and trade secrets and, from time to time, are subject to litigation based on allegations of infringement, misappropriation or other violations of intellectual property, or other rights. As we face increasing competition and gain an increasingly high profile, the possibility of intellectual property rights claims, commercial claims, and other assertions against us grows. We have in the past been, are currently, and may from time to time in the future become, a party to litigation and disputes related to our intellectual property, our business practices, transactions involving our securities and our platform. For example, we are currently subject to a number of putative class action lawsuits in state and federal court alleging federal securities law violations in connection with our IPO. The costs of supporting litigation and dispute resolution proceedings are considerable, and there can be no assurances that a favorable outcome will be obtained. Our business, results of operations, and financial condition could be materially and adversely affected by such costs and any unfavorable outcomes in current or future litigation.

We may need to settle litigation and disputes on terms that are unfavorable to us, or we may be subject to an unfavorable judgment that may not be reversible upon appeal. The terms of any settlement or judgment may require us to cease some or all of our operations or pay substantial amounts to the other party. With respect to any

We rely and expect to continue to rely on a combination of patents, patent licenses, trade secrets, domain name protections, trademarks, and copyright laws, as well as confidentiality and license agreements with our employees, consultants, and third parties, to protect our intellectual property and proprietary rights. In the United States and abroad, we have over 7501,000 issued patents and more than 600500 pending patent applications. However, third parties may knowingly or unknowingly infringe our proprietary rights, third parties may challenge our proprietary rights, pending and future patent, trademark, and copyright applications may not be approved, and we may not be able to prevent infringement without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes. In order to protect our proprietary technologies and processes, we rely in part on trade secret laws and confidentiality agreements with our employees, consultants, and third parties. These agreements may not effectively prevent disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights, or develop similar technologies and processes. Further, laws in certain jurisdictions may afford little or no trade secret protection, and any changes in, or unexpected interpretations of, the intellectual property laws in any country in which we operate may compromise our ability to enforce our intellectual property rights. Costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights. If the protection of our proprietary rights is inadequate to prevent use or appropriation by third parties, the value of our platform, brand, and other intangible assets may be diminished and competitors may be able to more effectively replicate our platform and its features. Any of these events could materially and adversely affect our business, results of operations, and financial condition.

A portion of the technologies we use incorporates open source software, and we may incorporate open source software in the future. Open source software is generally licensed by its authors or other third parties under open source licenses. These licenses may subject us to certain unfavorable conditions, including requirements that we offer our platform that incorporates the open source software for no cost, that we make publicly available source code for modifications or derivative works we create based upon, incorporating or using the open source software, and/or that we license such modifications or derivative works under the terms of the particular open source license. Additionally, if a third-party software provider has incorporated open source software into software that we license from such provider, we could be required to disclose any of our source code that incorporates or is a modification of our licensed software. If an author or other third party that distributes open source software that we use or license were to allege that we had not complied with the conditions of the applicable license, we could be required to incur significant legal expenses defending against those allegations and could be subject to significant damages, enjoined from offering or selling our solutions that contained the open source software, and required to comply with the foregoing conditions. Any of the foregoing could disrupt and harm our business, results of operations, and financial condition.

The software technology underlying our platform is inherently complex and may contain material defects or errors, particularly when first introduced or when new features or capabilities are released. We have from time to time found defects or errors in our platform, and new defects or errors in our existing platform or new software may be detected in the future by us or our users. There can be no assurance that our existing platform and new software will not contain defects. Any real or perceived errors, failures, vulnerabilities, or bugs in our platform could result in negative publicity or lead to data security, access, retention, or other performance issues, all of which could harm our business. The costs incurred in correcting such defects or errors may be substantial and could harm our results of operations and financial condition. Moreover, the harm to our reputation and legal liability related to such defects or errors may be substantial and could harm our business, results of operations, and financial condition.

We also utilize hardware purchased or leased and software and services licensed from third parties to offeron our platform. Any defects in, or unavailability of, our or third-party software, services, or hardware that cause interruptions to the availability of our services, loss of data, or performance issues could, among other things:

As part of our business strategy, we have acquired, and may in the future acquire, other companies, employee teams, or technologies to complement or expand our products, obtain personnel, or otherwise grow our business. For example, in the first fiscal quarter of 2019 we acquired HelloSign, an e-signature and document workflow platform, to expand our content collaboration capabilities to include additional business critical workflows. The pursuit of acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating, and pursuing suitable acquisitions, whether or not they are consummated.

We have limited experience making acquisitions. We may not be able to find suitable acquisition candidates and we may not be able to complete acquisitions on favorable terms, if at all. If we do complete acquisitions, we may not ultimately strengthen our competitive position or achieve the anticipated benefits from such acquisitions, due to a number of factors, including:

We may not be able to integrate acquired businesses successfully or effectively manage the combined company following an acquisition. If we fail to successfully integrate acquisitions, or the people or technologies associated with those acquisitions, the results of operations of the combined company could be adversely affected. Any integration process will require significant time, resources, and attention from management, and disrupt the ordinary functioning of our business, and we may not be able to manage the process successfully, which could adversely affect our business, results of operations, and financial condition.

Any acquisition we complete could be viewed negatively by users, developers, partners, or investors, and could have adverse effects on our existing business relationships. In addition, we may not successfully evaluate or utilize acquired technology or accurately forecast the financial impact of an acquisition transaction, including accounting charges.

We may have to pay a substantial portion of our available cash, incur debt, or issue equity securities to pay for any such acquisitions, each of which could affect our financial condition or the value of our capital stock. The sale of equity to finance any such acquisitions could result in dilution to our stockholders. If we incur more debt, it would result in increased fixed obligations and could also subject us to covenants or other restrictions that would impede our ability to flexibly operate our business.

Our business may be affected by changes in the economy generally, including any resulting effect on spending by our business and consumer users. Some of our users may view a subscription to our platform as a discretionary purchase, and our paying users may reduce their discretionary spending on our platform during an economic downturn. If an economic downturn

Occurrence of any catastrophic event, including earthquake, fire, flood, tsunami, or other weather event, power loss, telecommunications failure, software or hardware malfunctions, cyber-attack, war, or terrorist attack, could result in lengthy interruptions in our service. Further, outbreaks of pandemic diseases, such as coronavirus, or the fear of such events, could provoke responses, including government-imposed travel restrictions, grounding of flights, and shutdown of workplaces. In particular, our U.S. headquarters and some of the datacenters we utilize are located in the San Francisco Bay Area, a region known for seismic activity, and our insurance coverage may not compensate us for losses that may occur in the event of an earthquake or other significant natural disaster. In addition, acts of terrorism could cause disruptions to the internet or the economy as a whole. Even with our disaster recovery arrangements, our service could be interrupted. If our systems were to fail or be negatively impacted as a result of a natural disaster or other event, our ability to deliver products to our users would be impaired or we could lose critical data. If we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster, and successfully execute on those plans in the event of a disaster or emergency, our business, results of operations, financial condition, and reputation would be harmed.

While to date we have not incurred significant income taxes in operating our business, we are subject to income taxes in the United States and various jurisdictions outside of the United States. Our effective tax rate could fluctuate due to changes in the mix of earnings and losses in countries with differing statutory tax rates. Our tax expense could also be impacted by changes in non-deductible expenses, changes in excess tax benefits of stock-based compensation, changes in the valuation of deferred tax assets and liabilities and our ability to utilize them, the applicability of withholding taxes and effects from acquisitions.

Our tax provision could also be impacted by changes in accounting principles, changes in U.S. federal, state, or international tax laws applicable to corporate multinationals such as the recent legislation enacted in the United States, United Kingdom and Australia, other fundamental law changes currently being considered by many countries, and changes in taxing jurisdictions’ administrative interpretations, decisions, policies, and positions. Additionally, in October 2015, the Organization for Economic Co-Operation and Development has released final guidance covering various topics, including digital economy, transfer pricing, country-by-country reporting, and definitional changes to permanent establishment that could ultimately impact our tax liabilities.

We are subject to review and audit by U.S. federal, state, local, and foreign tax authorities. Such tax authorities may disagree with tax positions we take and if any such tax authority were to successfully challenge any such position, our financial results and operations could be materially and adversely affected. We may also be subject to additional tax liabilities due to changes in non-income based taxes resulting from changes in federal, state, or international tax laws, changes in taxing jurisdictions’ administrative interpretations, decisions, policies, and positions, results of tax examinations, settlements or judicial decisions, changes in accounting principles, changes to the business operations, including acquisitions, as well as the evaluation of new information that results in a change to a tax position taken in a prior period.

As of December 31, 2018,2019, we had $923.6$916.9 million of federal and $403.5$390.8 million of state net operating loss carryforwards available to reduce future taxable income. Of our federal net operating loss carryforwards, $307.4$288.9 million will begin to expire in 20312032 and $616.2$628.0 million will carryforward indefinitely, while state net operating losses begin to expire in 2029.2026. As of December 31, 2018,2019, we also had $265.1$221.4 million of foreign net operating loss carryforwards available to reduce future taxable income, which will carryforward indefinitely. In addition, we had $22.9 million of foreign acquired net operating losses, which will carryforward indefinitely. The Company also had $0.7 million of foreign tax credit carryforwards, which will carryforward indefinitely. It is possible that we will not generate taxable income in time to use these net operating loss carryforwards before their expiration or at all. Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended, or the Code, if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change attributes, such as research tax credits, to offset its post-change income may be limited. In general, an “ownership change” will occur if there is a cumulative change in our ownership by “5-percent shareholders” that exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under state tax laws. We performed a study for the period through December 31, 2018 andThe Company has determined that noit has experienced multiple ownership changes exceeding 50 percentage points had occurred. Ourand, as a result, the annual utilization of our net operating loss

We collect sales and value-added tax as part of our subscription agreements in a number of jurisdictions. One or more states or countries may seek to impose incremental or new sales, use, or other tax collection obligations on us, including for past sales by us or our resellers and other partners. A successful assertion by a state, country, or other jurisdiction that we should have been or should be collecting additional sales, use, or other taxes on our services could, among other things, result in substantial tax liabilities for past sales, create significant administrative burdens for us, discourage users from purchasing our platform, or otherwise harm our business, results of operations, and financial condition.

On December 22, 2017, the legislation commonly referred to as the Tax Cuts and Jobs Act ("Tax Reform Act") was enacted, which contains significant changes to U.S. tax law, including, but not limited to, a reduction in the corporate tax rate and a transition to a new territorial system of taxation. The primary impact of the new legislation on our provision for income taxes was a reduction of the future tax benefits of our deferred tax assets as a result of the reduction in the corporate tax rate. However, since we have recorded a full valuation allowance against our deferred tax assets, these changes did not have a material impact on our consolidated financial statements. As we expand the scale of our international business activities, any changes in the U.S. or foreign taxation of such activities may increase our worldwide effective tax rate and harm our business, results of operations, and financial condition.

We are subject to the reporting requirements of the Securities Exchange Act of 1934, as amended, or the Exchange Act, the Sarbanes-Oxley Act of 2002, or the Sarbanes-Oxley Act, and the rules and regulations of the applicable listing standards of the Nasdaq Global Select Market, or Nasdaq. We expect that the requirements of these rules and regulations will continue to increase our legal, accounting, and financial compliance costs, make some activities more difficult, time-consuming and costly, and place significant strain on our personnel, systems, and resources.

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We are also required to provide an annual management report on the effectiveness of our disclosure controls and procedures over financial reporting. We are continuing to develop and refine our disclosure controls and other procedures that are designed to ensure that information required to be disclosed by us in the reports that we will file with the SEC is recorded, processed, summarized, and reported within the time periods specified in SEC rules and forms and that information required to be disclosed in reports under the Exchange Act is accumulated and communicated to our principal executive and financial officers. We are also continuing to improve our internal control over financial reporting. In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and anticipate that we will continue to expend, significant resources, including accounting-related costs and

Our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business. Additionally, to the extent we acquire other businesses, the acquired company may not have a sufficiently robust

Generally accepted accounting principles in the United States are subject to interpretation by the Financial Accounting Standards Board, or FASB, the SEC, and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported results of operations, and may even affect the reporting of transactions completed before the announcement or effectiveness of a change. It is difficult to predict the impact of future changes to accounting principles or our accounting policies, any of which could negatively affect our results of operations.

Market opportunity estimates and growth forecasts are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. The estimates and forecasts we disclose relating to the size and expected growth of our target market may prove to be inaccurate. Even if the markets in which we compete meet the size estimates and growth we have forecasted, our business could fail to grow at similar rates, if at all. We also rely on assumptions and estimates to calculate certain of our key metrics, such as paying users, average revenue per paying user, and free cash flow. We regularly review and may adjust our processes for calculating our key metrics to improve their accuracy. Our key metrics may differ from estimates published by third parties or from similarly titled metrics of our competitors due to differences in methodology. We have found that aggregate user activity metrics are not leading indicators of revenue or conversion. For that reason, we do not comprehensively track user activity across the Dropbox platform for financial planning and forecasting purposes. If investors or analysts do not perceive our metrics to be accurate representations of our business, or if we discover material inaccuracies in our metrics, our reputation, business, results of operations, and financial condition would be harmed.

We are party to a revolving credit and guarantee agreement, as amended, which contains a number of covenants that limit our ability and our subsidiaries’ ability to, among other things, incur additional indebtedness, pay dividends, make redemptions and repurchases of stock, make investments, loans and acquisitions, create liens, engage in transactions with affiliates, merge or consolidate with other companies, or sell substantially all of our assets. We are also required to maintain certain financial covenants, including a maximum consolidated leverage ratio and a minimum liquidity balance. The terms of our revolving credit facility may restrict our current and future operations and could adversely affect our ability to finance our future

A failure by us to comply with the covenants or payment requirements specified in our credit agreement, as amended, could result in an event of default under the agreement, which would give the lenders the right to terminate their commitments to provide additional loans under our revolving credit facility and to declare all borrowings outstanding, together with accrued and unpaid interest and fees, to be immediately due and payable. In addition, the lenders would have the right to proceed against the collateral we granted to them, which consists of substantially all our intellectual property and certain other assets. If the debt under our revolving credit facility were to be accelerated, we may not have sufficient cash or be able to borrow sufficient funds to refinance the debt or sell sufficient assets to repay the debt, which could immediately materially and adversely affect our business, cash flows, results of operations, and financial condition. Even if we were able to obtain new financing, it may not be on commercially reasonable terms or on terms that are acceptable to us.

We finance a significant portion of our expenditures through leasing arrangements, some of which are not required to be reflected on our balance sheet, and we may enter into additional similar arrangements in the future. As of December 31, 2018,2019, we had an aggregate of $1,394.9$1,457.9 million of commitments to settle contractual obligations. In particular, we have used these types of arrangementsutilize both finance and operating leases to finance some of our equipment, datacenters and datacenters.offices. In addition, we may draw upon our revolving credit facility to finance our operations or for other corporate purposes. If we default on these leasing or credit obligations, our leasing partners and lenders may, among other things:

If some or all of these events were to occur, our operations may be interrupted and our ability to fund our operations or obligations, as well as our business, results of operations, and financial condition, could be adversely affected.

Historically, we have funded our operations and capital expenditures primarily through equity issuances, cash generated from our operations, and debt financing for capital purchases. Although we currently anticipate that our existing cash, cash equivalents and short-term investments, amounts available under our existing credit facilities, and cash flow from operations will be sufficient to meet our cash needs for the foreseeable future, we may require additional financing. We evaluate financing opportunities from time to time, and our ability to obtain financing will depend, among other things, on our development efforts, business plans, operating performance, and condition of the capital markets at the time we seek financing. We cannot

The trading price of our Class A common stock may be volatile and could be subject to fluctuations in response to various factors, some of which are beyond our control. Factors that could cause fluctuations in the trading price of our Class A common stock include the following:

In addition, in the past, following periods of volatility in the overall market and the market price of a particular company’s securities, securities class action litigation has often been instituted against these companies. For example, we are currently subject to a number of putative class action lawsuits in state and federal court alleging federal securities law violations in connection with our IPO. This current litigation, ifand any securities litigation that may be instituted against us in the future, could result in substantial costs and a diversion of our management’s attention and resources.

Our Class A common stock has one vote per share, our Class B common stock has ten votes per share, and our Class C common stock has no voting rights, except as otherwise required by law. As of December 31, 2018,2019, our directors, executive officers and holders of more than 5% of our common stock, and their respective affiliates, held in the aggregate 87.1%85.3% of the voting power of our capital stock, with our Co-Founders holding approximately 53%60.8% of the voting power of our capital stock (including the Co-Founder Grants and voting agreements that our co-founders entered into with certain of our stockholders that covered an aggregate of 1.2% of the voting power of our capital stock as of December 31, 2018).stock. We are including the Co-Founder Grants in this calculation since they are legally issued and outstanding shares of our Class A common stock and our co-founders are able to vote these shares prior to their vesting. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval so long as the shares of Class B common stock represent at least 9.1% of all outstanding shares of our Class A and Class B common stock. This concentrated control will limit or preclude other stockholders' ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that other stockholders may feel are in their best interests as one of our stockholders.

Future transfers or sales by holders of Class B common stock will generally result in those shares converting to Class A common stock, except for certain transfers described in our amended and restated certificate of incorporation, including transfers effected for estate planning purposes where sole dispositive power and exclusive voting control with respect to the shares of Class B common stock is retained by the transferring holder and transfers between our co-founders. In addition, each outstanding share of Class B common stock held by a stockholder who is a natural person, or held by the permitted entities or permitted transferees of such stockholder (as described in our amended and restated certificate of incorporation), will convert automatically into one share of Class A common stock upon the death of such natural person. In the event of the death or permanent and total disability of a co-founder, shares of Class B common stock held by such co-founder, his permitted entities or permitted transferees will convert to Class A common stock, provided that the conversion will be deferred for nine months, or up to 18 months if approved by a majority of our independent directors, following his death or permanent and total disability.

In addition, because our Class C common stock carries no voting rights (except as otherwise required by law), if we issue Class C common stock in the future, the holders of Class B common stock may be able to elect all of our directors and to determine the outcome of most matters submitted to a vote of our stockholders for a longer period of time than would be the case if we issued Class A common stock rather than Class C common stock in such transactions.

In addition, in July 2017, FTSE Russell and Standard & Poor’s announced that they would cease to allow most newly public companies utilizing dual or multi-class capital structures to be included in their indices. Affected indices include the Russell 2000 and the S&P 500, S&P MidCap 400, and S&P SmallCap 600, which together make up the S&P Composite 1500. UnderAlthough we have since met the announced policies,requirements to be included, and are now included, in an FTSE Russell index, our multi-class capital structure likelystill makes us ineligible for inclusion in any of thesethe above listed S&P indices, and as a result, mutual funds, exchange-traded funds, and other investment vehicles that attempt to passively track these indices will not be investing in our stock. These policies are still new and itIt is as of yet unclear what effect, if any, theythese policies will have on the valuations of publicly traded companies excluded from theone or more of these indices, but it is possible that they may depress these valuations compared to those of other similar companies that are included.

The market price of our Class A common stock could decline as a result of a large number of sales of shares of such stock, and the perception that these sales could occur may also depress the market price of our Class A common stock.

Under our investors’ rights agreement, certain stockholders can require us to register shares owned by them for public sale in the United States. In addition, we filed a registration statement to register shares reserved for future issuance under our equity compensation plans. As a result, subject to the satisfaction of applicable exercise periods, the shares issued upon exercise of outstanding stock options or upon settlement of outstanding RSU awards are available for immediate resale in the United States in the open market.

Sales of our shares may make it more difficult for us to sell equity securities in the future at a time and at a price that we deem appropriate. These sales also could cause the trading price of our Class A common stock to fall and make it more difficult for you to sell shares of our Class A common stock.

Our status as a Delaware corporation and the anti-takeover provisions of the Delaware General Corporation Law may discourage, delay, or prevent a change in control by prohibiting us from engaging in a business combination with an interested stockholder for a period of three years after the person becomes an interested stockholder, even if a change of control would be beneficial to our existing stockholders. In addition, our restated certificate of incorporation and restated bylaws contain provisions that may make the acquisition of our company more difficult, including the following:

These anti-takeover defenses could discourage, delay, or prevent a transaction involving a change in control of our company. These provisions could also discourage proxy contests and make it more difficult for stockholders to elect directors of their choosing and to cause us to take other corporate actions they desire, any of which, under certain circumstances, could limit the opportunity for our stockholders to receive a premium for their shares of our capital stock, and could also affect the price that some investors are willing to pay for our Class A common stock.

Our amended and restated bylaws provide that, unless we consent in writing to the selection of an alternative forum, the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf, (2) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, officers, or other employees to us or our stockholders, (3) any action arising pursuant to any provision of the Delaware General Corporation Law, or the certificate of incorporation or the amended and restated bylaws or (4) any other action asserting a claim that is governed by the internal affairs doctrine shall be the Court of Chancery of the State of Delaware (or, if the Court of Chancery does not have jurisdiction, the federal district court for the District of Delaware), in all cases subject to the court having jurisdiction over indispensable parties named as defendants.

Our amended and restated bylaws also provide that the federal district courts of the United States of America will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act, or a Federal Forum Provision.

Any person or entity purchasing or otherwise acquiring any interest in any of our securities shall be deemed to have notice of and consented to this provision. These exclusive-forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees.

As previously disclosed in our Current Report on Form 8-K filed with the SEC on December 19, 2018, in light of the decision issued by the Delaware Court of Chancery in Matthew Sciabacucchi v. Matthew B. Salzberg et al., C.A. No. 2017-0931-JTL (Del. Ch.), finding Federal Forum Provisions are not valid under Delaware law, we do not intend to enforce the Federal Forum Provision in our amended and restated bylaws unless and until such time there is a final determination by the Delaware Supreme Court regarding the validity of such provisions. To the extent the Delaware Supreme Court makes a final determination that provisions such as the Federal Forum Provision are not valid as a matter of Delaware law, our board of directors intends to amend our amended and restated bylaws to remove the Federal Forum Provision.

If we face relevant litigation and are unable to enforce these provisions, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could harm our results of operations.

The trading market for our Class A common stock will depend in part on the research and reports that securities or industry analysts publish about us or our business. The analysts’ estimates are based upon their own opinions and are often different from our estimates or expectations. If one or more of the analysts who cover us downgrade our Class A common stock or publish inaccurate or unfavorable research about our business, the price of our securities would likely decline. If few securities analysts commence coverage of us, or if one or more of these analysts cease coverage of us or fail to publish reports on us regularly, demand for our securities could decrease, which might cause the price and trading volume of our Class A common stock to decline.

We have never declared nor paid cash dividends on our capital stock. We currently intend to retain any future earnings to finance the operation and expansion of our business, and we do not expect to declare or pay any dividends in the foreseeable future. As a result, stockholders must rely on sales of their Class A common stock after price appreciation as the only way to realize any future gains on their investment. In addition, our revolving credit facility contains restrictions on our ability to pay dividends.