Item 4. Controls and Procedures

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our chief executive officer (CEO) and chief financial officer (CFO), has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a- 15(e) and 15d- 15(e) under the Securities Exchange Act of 1934, as amended (Exchange Act)), as of the end of the period covered by this Quarterly Report on Form 10-Q. Based on such evaluation, our CEO and CFO have concluded that as of June 30, 2024, our disclosure controls and procedures are designed at a reasonable assurance level and are effective to provide reasonable assurance that information we are required to disclose in reports that we file or submit under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the rules and forms of the Securities and Exchange Commission, and that such information is accumulated and communicated to our management, including our CEO and CFO, as appropriate, to allow timely decisions regarding required disclosure.

Changes in Internal Control

There were no changes in our internal control over financial reporting identified in management's evaluation pursuant to Rules 13a-15(d) or 15d-15(d) of the Exchange Act during the period covered by this Quarterly Report on Form 10-Q that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

In designing and evaluating the disclosure controls and procedures and internal control over financial reporting, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures and internal control over financial reporting must reflect the fact that there are resource constraints and that management is required to apply judgment in evaluating the benefits of possible controls and procedures relative to their costs.

PART II—OTHER INFORMATION

**Item 1.**Legal Proceedings

As a multinational company with a complex and evolving business, we are, and expect to continue to be, subject to numerous claims, litigation, regulatory, tax, and government inquiries and investigations, and other legal proceedings in jurisdictions around the world. Although we believe many of these matters are without merit and are vigorously defending them, we may not be successful. Any litigation to which we are a party may be resolved adversely or we may be subject to an unfavorable judgment that may not be reversed upon appeal. We may also decide to settle litigation, disputes, or other legal proceedings in some instances on terms that are unfavorable to us. In addition, we may become subject to orders or consent decrees imposed by government or regulatory authorities. Any such developments could cause us to incur substantial costs, expose us to civil and criminal liability (including liability for our personnel) or penalties (including substantial monetary remedies), interrupt or require us to change our business practices in a manner materially adverse to our business (including changes to our products and services or user data practices), result in negative publicity and reputational harm, divert resources and the time and attention of management from our business, or subject us to other structural or behavioral remedies that adversely affect our business. We have experienced such outcomes to varying degrees in the past, and we expect to continue to face a challenging litigation and regulatory environment, including in light of complex and evolving laws and regulations, as well as the scale of our business and the size of our user and advertiser base.

Over the last several years, the number and potential significance of the litigation and investigations involving the company have increased, and there can be no assurance that this trend will not continue. For example, we are facing numerous cases in the United States in which plaintiffs are attempting to avoid or limit the application of Section 230 of the Communications Decency Act to their claims and certain of those matters have survived motions to dismiss, including through the use of products liability theories. Outside of the United States, we are subject to new regulatory regimes, including the Digital Services Act, Digital Markets Act, and similar statutes in non-EU countries, and new fining guidelines under existing regulatory regimes like the General Data Protection Regulation (GDPR). We are facing inquiries and investigations regarding various aspects of our regulatory compliance, as well as private litigation in Europe, including class and mass actions, claiming damages and/or injunctions in respect of alleged failings to comply with such regulatory requirements. We are also responding to litigation and government investigations related to our alleged role in causing or contributing to various societal harms, including mental and physical health and safety impacts on users, particularly younger users, child and adult sexual exploitation, illegal activity with respect to drugs, fraud, unlawful discrimination, and other harms potentially impacting large numbers of people. This is in addition to significant tax, competition and antitrust, stockholder, commercial, consumer, and privacy litigation and investigations. Furthermore, as the number of our users and amount of our revenue have grown, our potential exposure to substantial damages awards and fines has increased.

In some instances, particularly with novel legal and factual claims, new regulatory regimes or statutes that have not previously been enforced, or where the nature or type of enforcement pursued against us is novel, it can be very difficult to assess the likelihood or extent of potential liabilities, including the nature and extent of injunctive or other non-monetary relief and the applicability and amount of any fines or penalties. While we have identified below certain matters that we believe to be material, there can be no assurance that additional material losses or limitations on our activities will not result from claims that have not yet been asserted or are not yet determined to be material.

Privacy and Related Matters

Beginning on March 20, 2018, multiple putative class actions were filed in state and federal courts in the United States and elsewhere against us and certain of our directors and officers alleging various causes of action in connection with our platform and user data practices as well as the misuse of certain data by a developer that shared such data with third parties in violation of our terms and policies, and seeking unspecified damages and injunctive relief. With respect to the putative class actions alleging fraud and violations of consumer protection, privacy, and other laws in connection with the same matters, several of the cases brought on behalf of consumers in the United States were consolidated in the U.S. District Court for the Northern District of California (In re Facebook, Inc., Consumer Privacy User Profile Litigation). On September 9, 2019, the court granted, in part, and denied, in part, our motion to dismiss the consolidated putative consumer class action. On December 22, 2022, the parties entered into a settlement agreement to resolve the lawsuit, which provides for a payment of $725 million by us. The settlement was approved by the court on October 10, 2023, and the payment was made in November 2023. In addition, our platform and user data practices, as well as the events surrounding the misuse of certain data by a developer, became the subject of U.S. Federal Trade Commission (FTC), state attorneys general, and other government inquiries in the United States, Europe, and other jurisdictions. We entered into a settlement and modified consent order to

resolve the FTC inquiry, which took effect in April 2020 and required us to pay a penalty of $5.0 billion and to significantly enhance our practices and processes for privacy compliance and oversight. The state attorneys general inquiry and certain government inquiries in other jurisdictions remain ongoing and could subject us to additional substantial fines and costs, require us to change our business practices, divert resources and the attention of management from our business, or adversely affect our business. On July 16, 2021, a stockholder derivative action was filed in Delaware Court of Chancery against certain of our directors and officers asserting breach of fiduciary duty and related claims relating to our historical platform and user data practices, as well as our settlement with the FTC. On July 20, 2021, other stockholders filed an amended derivative complaint in a related Delaware Chancery Court action, asserting breach of fiduciary duty and related claims against certain of our current and former directors and officers in connection with our historical platform and user data practices. On November 4, 2021, the lead plaintiffs filed a second amended and consolidated complaint in the stockholder derivative action. The pending consolidated matter is In re Facebook Inc. Derivative Litigation. On January 19, 2022, we filed a motion to dismiss, which was denied in part on May 10, 2023. The insider trading claim was dismissed as to all defendants except Mark Zuckerberg, and the motion was denied as to the breach of fiduciary duty claims.

On May 3, 2023, the FTC filed a public administrative proceeding (In the Matter of Facebook, Inc.) seeking substantial changes to the modified consent order, which took effect in April 2020 after its entry by the U.S. District Court for the District of Columbia. The changes sought by the FTC are set forth in a proposed order and include, among others, a prohibition on our use of minors' data for any commercial purposes, changes to the composition of our board of directors, and significant limitations on our ability to modify and launch new products. On May 31, 2023, we filed a motion before the U.S. District Court for the District of Columbia (USA v. Facebook, Inc.) seeking to enjoin the FTC from further pursuing its agency process to modify the modified consent order. On November 27, 2023, the district court denied our motion, and we then appealed to the U.S. Court of Appeals for the District of Columbia Circuit (U.S. v. Facebook, Inc.) and sought to stay the FTC proceeding pending resolution of the appeal. Our motion for a stay pending appeal was denied in March 2024 and the underlying appeal is fully briefed with our reply brief filed on July 12, 2024. Oral argument has not been scheduled.

On November 29, 2023, we separately filed a complaint, also in the U.S. District Court for the District of Columbia (Meta Platforms, Inc. v. FTC), asserting constitutional challenges to the structure of the FTC, and seeking to preliminarily enjoin the FTC proceeding during the pendency of the litigation. On December 13, 2023, the FTC filed an opposition to our motion for preliminary injunction and a motion to dismiss the complaint. On March 14, 2024, the district court denied our motion to preliminarily enjoin the FTC proceeding during the pendency of the litigation, and also denied the FTC's motion to dismiss our complaint without prejudice, pending the Supreme Court's decision in SEC v. Jarkesy (Jarkesy). Our motion for a stay of the FTC proceeding pending appeal was denied in March 2024. Both the district court action and the appeal were stayed pending the Supreme Court's decision in Jarkesy. Following the Supreme Court's ruling in Jarkesy on June 27, 2024, the district court entered an agreed order requiring the FTC to file its anticipated renewed motion to dismiss by August 14, 2024. On July 18, 2024, we filed an unopposed motion to stay the appeal of the district court's denial of our motion for preliminary injunction pending resolution of the FTC's renewed motion to dismiss. On July 24, 2024, the circuit court granted the motion for a stay. The parties are required to report back to the circuit court within 30 days of the district court's disposition of the FTC's motion to dismiss.

On April 1, 2024, we filed our response to the FTC's Order to Show Cause, arguing that the Order to Show Cause proceeding was legally improper. We filed a reply to the FTC's response on July 18, 2024 and expect the FTC to schedule oral argument on these legal issues. Through the administrative process, the FTC could amend the order to impose the additional requirements set forth in the proposed order. We should have the opportunity to appeal an FTC decision modifying the order and could request the appellate court to stay the enforcement of the modifications to the order while the appeal is pending. It is unclear whether the appeal or the request for a stay would be successful.

We also notify the Irish Data Protection Commission (IDPC), our lead European Union privacy regulator under the GDPR, of certain other personal data breaches and privacy issues, and are subject to inquiries and investigations by the IDPC and other European regulators regarding various aspects of our regulatory compliance. For example, the IDPC is continuing to assess the compliance of our "subscription for no ads" consent model with requirements under the GDPR. In addition, on May 12, 2023, the IDPC issued a Final Decision concluding that Meta Platforms Ireland's reliance on Standard Contractual Clauses in respect of certain transfers of European Economic Area (EEA) Facebook user data was not in compliance with the GDPR. The IDPC issued an administrative fine of EUR €1.2 billion as well as corrective orders requiring Meta Platforms Ireland to suspend the relevant transfers and to bring its processing operations into compliance with Chapter V GDPR by ceasing the unlawful processing, including storage, of such data in the United States. We are appealing this Final Decision and it is currently subject to an interim stay from the Irish High Court. On October 7, 2022, President Biden signed the Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities (E.O.), and on June 30, 2023, the

European Union and the three additional countries making up the EEA were designated by the United States Attorney General as a "qualifying state" under Section 3(f) of the E.O. On July 10, 2023, the European Commission adopted an adequacy decision in relation to the United States. The adequacy decision concludes that the United States ensures an adequate level of protection for personal data transferred from the European Union to organizations in the United States that are included in the "Data Privacy Framework List," maintained and made publicly available by the United States Department of Commerce pursuant to the EU-U.S. Data Privacy Framework (EU-U.S. DPF). The implementation of the EU-U.S. DPF and the adequacy decision are important and welcome milestones, and we are implementing steps to comply with the above corrective orders following engagement with the IDPC. For additional information, see Part II, Item 1A, "Risk Factors—Our business is subject to complex and evolving U.S. and foreign laws and regulations regarding privacy, data use, data combination, data protection, content, competition, safety and consumer protection, e-commerce, and other matters" in this Quarterly Report on Form 10‑Q. Any such inquiries or investigations (including the IDPC proceedings) could subject us to substantial fines and costs, require us to change our business practices, divert resources and the attention of management from our business, or adversely affect our business.

On February 14, 2022, the State of Texas filed a lawsuit against us in Texas state court (Texas v. Meta Platforms, Inc.) alleging that "tag suggestions" and other uses of facial recognition technology violate the Texas Capture or Use of Biometric Identifiers Act and the Texas Deceptive Trade Practices-Consumer Protection Act, and seeking statutory damages and injunctive relief. On July 29, 2024, the parties entered into a settlement agreement to resolve the lawsuit, which provides for a payment of $1.4 billion by us. On July 30, 2024, the court entered judgment, dismissing the case.

Beginning on June 7, 2021, multiple putative class actions were filed against us alleging that we improperly received individuals' information from third-party websites or apps via our business tools in violation of our terms and various state and federal laws and seeking unspecified damages and injunctive relief (for example, In re Meta Pixel Healthcare Litigation; In re Meta Pixel Tax Filing Cases; Frasco v. Flo Health, Inc.; Doe v. Hey Favor, Inc. et al.; Doe v. GoodRx Holdings, Inc. et al. in the U.S. District Court for the Northern District of California; and Rickwalder, et al. v. Meta Platforms, Inc. in the Santa Clara County Superior Court). These cases are in different stages, but several of our motions to dismiss have been denied in whole or in part, while certain others have been granted in whole or in part. We are currently in discovery and litigating class certification in the cases that are most advanced.

Competition

We are subject to various litigation and government inquiries and investigations, formal or informal, by competition authorities in the United States, Europe, and other jurisdictions. Such investigations, inquiries, and lawsuits concern, among other things, our business practices in the areas of social networking or social media services, digital advertising, and/or mobile or online applications, as well as our acquisitions. For example, in 2019 we became the subject of antitrust investigations by the FTC and U.S. Department of Justice. On December 9, 2020, the FTC filed a complaint (FTC v. Meta Platforms, Inc.) against us in the U.S. District Court for the District of Columbia alleging that we engaged in anticompetitive conduct and unfair methods of competition in violation of Section 5 of the Federal Trade Commission Act and Section 2 of the Sherman Act, including by acquiring Instagram in 2012 and WhatsApp in 2014 and by maintaining conditions on access to our platform. The FTC sought a permanent injunction against our company's alleged violations of the antitrust laws, and other equitable relief, including divestiture or reconstruction of Instagram and WhatsApp. On June 28, 2021, the court granted our motion to dismiss the complaint filed by the FTC with leave to amend. On August 19, 2021, the FTC filed an amended complaint, and on October 4, 2021, we filed a motion to dismiss this amended complaint. On January 11, 2022, the court denied our motion to dismiss the FTC's amended complaint. On April 5, 2024, we filed our motion for summary judgment and the FTC filed its opposition and its own motion for partial summary judgment on May 24, 2024. Briefing on the motions for summary judgment will conclude on August 9, 2024. Multiple putative class actions have also been filed in state and federal courts in the United States and in the United Kingdom against us alleging violations of antitrust laws and other causes of action in connection with these acquisitions and/or other alleged anticompetitive conduct, and seeking damages and injunctive relief. Several of the cases brought on behalf of certain advertisers and users in the United States were consolidated in the U.S. District Court for the Northern District of California (Klein et al., v. Meta Platforms, Inc.). On January 14, 2022, the court granted, in part, and denied, in part, our motion to dismiss the consolidated actions. On March 1, 2022, a first amended consolidated complaint was filed in the putative class action brought on behalf of certain advertisers. On December 6, 2022, the court denied our motion to dismiss the first amended consolidated complaint filed in the putative class action brought on behalf of certain advertisers. In December 2022, the European Commission issued a Statement of Objections alleging that we tie Facebook Marketplace to Facebook and use data in a manner that infringes European Union competition rules.

In March 2024, the European Commission opened an investigation into the compliance of our “subscription for no ads” consent model with requirements under Article 5(2) of the Digital Markets Act. The European Commission issued preliminary findings on July 1, 2024 reflecting its preliminary view that our model does not comply with such requirements, and indicated that it will conclude its investigation by March 2025.

On February 6, 2019, the German Federal Cartel Office (FCO) issued an antitrust injunction order claiming that our terms and policies on data sharing across our apps, and collection from third-party websites via our business tools, breached European data protection principles and German competition law. We brought a lawsuit seeking to invalidate the order on February 11, 2019.

The result of such litigation, investigations or inquiries could subject us to substantial monetary remedies and costs, interrupt or require us to change our business practices, divert resources and the attention of management from our business, or subject us to other structural or behavioral remedies that adversely affect our business.

Securities and Other Actions

Beginning on March 20, 2018, multiple putative class actions and derivative actions were filed in state and federal courts in the United States and elsewhere against us and certain of our directors and officers alleging violations of securities laws, breach of fiduciary duties, and other causes of action in connection with our platform and user data practices as well as the misuse of certain data by a developer that shared such data with third parties in violation of our terms and policies, and seeking unspecified damages and injunctive relief. Beginning on July 27, 2018, two putative class actions were filed in federal court in the United States against us and certain of our directors and officers alleging violations of securities laws in connection with the disclosure of our earnings results for the second quarter of 2018 and seeking unspecified damages. These two actions subsequently were transferred and consolidated in the U.S. District Court for the Northern District of California (In Re Facebook, Inc. Securities Litigation) with the putative securities class action described above relating to our platform and user data practices. In a series of orders in 2019 and 2020, the district court granted our motions to dismiss the plaintiffs' claims. On January 17, 2022, the plaintiffs filed a notice of appeal of the order dismissing their case, and on October 18, 2023, the U.S. Court of Appeals for the Ninth Circuit issued its decision affirming in part and reversing in part the district court's order dismissing the plaintiffs' case. We filed a petition for writ of certiorari on March 4, 2024 with the U.S. Supreme Court, seeking review of the Ninth Circuit's order. On June 10, 2024, the U.S. Supreme Court granted in part our petition for writ of certiorari.

We are also subject to other government inquiries and investigations relating to our business activities and disclosure practices. For example, beginning in September 2021, we became subject to government investigations and requests relating to a former employee's allegations and release of internal company documents concerning, among other things, our algorithms, advertising and user metrics, and content enforcement practices, as well as misinformation and other undesirable activity on our platform, and user well-being. We have since received additional requests relating to these and other topics. Beginning on October 27, 2021, multiple putative class actions and derivative actions were filed in the U.S. District Court for the Northern District of California against us and certain of our directors and officers alleging violations of securities laws, breach of fiduciary duties, and other causes of action in connection with the same matters, and seeking unspecified damages. Ohio Pub. Empl. Ret. Sys. v. Meta Platforms, Inc.

On March 8, 2022, a putative class action was filed in the U.S. District Court for the Northern District of California against us and certain of our directors and officers alleging violations of securities laws in connection with the disclosure of our earnings results for the fourth quarter of 2021 and seeking unspecified damages (Plumbers & Steamfitters Local 60 Pension Trust v. Meta Platforms, Inc.). On July 18, 2023, the court dismissed the claims against Meta and its officers with leave to amend. On September 18, 2023, the plaintiffs filed an amended complaint.

Youth-Related Actions

Beginning in January 2022, we became subject to litigation and other proceedings that were filed in various federal and state courts alleging that Facebook and Instagram cause "social media addiction" in users, with most proceedings focused on those under 18 years old, resulting in various mental health and other harms. Putative class actions have been filed in the United States and Canada on behalf of users in those jurisdictions, and numerous school districts, municipalities, and tribal nations, have filed public nuisance claims in the United States and/or Canada based on similar allegations. On October 6, 2022, these U.S. federal cases were centralized in the U.S. District Court for the Northern District of California (In re Social Media Adolescent Addiction Product Liability Personal Injury Litigation). Beginning in March 2023, U.S. states began filing

lawsuits on these topics in various federal and state courts. These additional lawsuits include allegations regarding violations of the Children's Online Privacy Protection Act (COPPA) as well as violations of state laws concerning consumer protection, unfair business practices, public nuisance, and products liability, with proceedings focused on our alleged business practices (including the use of end-to-end encryption) and harms to users under 18 years old. These lawsuits seek damages and injunctive relief, and include cases filed by various state attorneys general in In re Social Media Adolescent Addiction Product Liability Personal Injury Litigation in the U.S. District Court for the Northern District of California, as well as various state courts around the country. We are also subject to government investigations and requests from multiple regulators in various jurisdictions globally concerning the use of our products and services, and the alleged mental and physical health and safety impacts on users, particularly younger users. On May 16, 2024, the European Commission opened formal proceedings assessing our compliance with certain requirements under Articles 28, 34, and 35 of the Digital Services Act (DSA), including the way in which we identified, assessed, and mitigated against certain systemic risks to minors and other vulnerable users that may stem from the design and functioning of Instagram and Facebook.

Other Actions

Beginning on August 15, 2018, multiple putative class actions were filed against us alleging that we inflated our estimates of the potential audience size for advertisements, resulting in artificially increased demand and higher prices. The cases were consolidated in the U.S. District Court for the Northern District of California (DZ Reserve v. Facebook, Inc.) and seek unspecified damages and injunctive relief. In a series of rulings in 2019, 2021, and 2022, the court dismissed certain of the plaintiffs' claims, but permitted their fraud and unfair competition claims to proceed. On March 29, 2022, the court granted the plaintiffs' motion for class certification. On March 21, 2024, the U.S. Court of Appeals for the Ninth Circuit affirmed in part and reversed in part the order granting class certification. On May 3, 2024, we filed a petition for panel rehearing and rehearing en banc.

Beginning on July 7, 2023, multiple putative class actions were filed against us in the U.S. District Court for the Northern District of California (Kadrey, et al. v. Meta Platforms, Inc. and Chabon, et al. v. Meta Platforms, Inc.) and U.S. District Court for the Southern District of New York (Huckabee, et al. v. Meta Platforms, Inc. et al., which was subsequently transferred to the U.S. District Court for the Northern District of California) alleging that we used various copyrighted books and materials to train our artificial intelligence models, and seeking unspecified damages and injunctive relief. These cases have all been consolidated into Kadrey, et al. v. Meta Platforms, Inc.

In the first quarter of 2024, the U.S. Supreme Court heard argument in Vivek H. Murthy, Surgeon General, et al. v. Missouri, et al., on the question of whether federal government officials violated the First Amendment in their communications with the company and others related to content moderation practices, and heard argument in Netchoice, et al. v. Paxton and Moody, et al. v. Netchoice et al., regarding the application of the First Amendment relating to content moderation on tech platforms. As to Murthy, a majority of the Supreme Court decided the case on plaintiffs' standing, declining to rule on the First Amendment questions. As to NetChoice, the Supreme Court unanimously vacated the intermediate appellate court decisions, remanding the cases back to the lower courts. Although we are not a party in these actions, the ultimate resolution of the lawsuits could impact our business.

On April 30, 2024, the European Commission opened formal proceedings against us to assess Facebook and Instagram's compliance with certain requirements under Articles 14, 16, 17, 20, 24, 25, 34, 35, and 40 of the DSA, regarding a range of topics including elections, content reporting and appeals, third-party access to data, political content recommendations, potential deceptive advertising and disinformation, including the way in which we identified, assessed, and mitigated against certain systemic risks on Instagram and Facebook.

In addition, we are subject to litigation and other proceedings involving law enforcement and other regulatory agencies, including in particular in Brazil, Russia, and other countries in Europe, in order to ascertain the precise scope of our legal obligations to comply with the requests of those agencies, including our obligation to disclose user information in particular circumstances. A number of such instances have resulted in the assessment of fines and penalties against us. We believe we have multiple legal grounds to satisfy these requests or prevail against associated fines and penalties, and we intend to vigorously defend such fines and penalties.

We are also party to various other legal proceedings, claims, and regulatory, tax or government inquiries and investigations that arise in the ordinary course of business, and we expect to be subject to additional legal proceedings and disputes in the future.