Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

View risk factors by ticker

Search filings by term

Risk Factors - CHGG

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

ITEM 1A. RISK FACTORS

The risks and uncertainties set forth below, as well as other risks and uncertainties described elsewhere in this Annual Report on Form 10-K including on our consolidated financial statements and related notes and the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” or in other filings by Chegg with the SEC, could adversely affect our business, financial condition, results of operations, and the trading price of our common stock. Additional risks and uncertainties that are not currently known to us or that are not currently believed by us to be material may also harm our business operations and financial results. Because of the following risks and uncertainties, as well as other factors affecting our financial condition and results of operations, past financial performance should not be considered to be a reliable indicator of future performance, and investors should not use historical trends to anticipate results or trends in future periods.

Table of Contents

Risks Related to Our Business and Growth

Failure to successfully execute our skilling-focused business-to-business strategy and realize the anticipated benefits of our business transformation and related restructuring plan could have a material adverse effect on our business financial results.

We are evolving our learning platform into a skilling-focused business-to-business organization, building on our existing businesses in professional language learning, workplace readiness and AI-related skills courses. This transformation involves a number of risks, including organizational, operational, financial, and technological challenges, such as the risks that we may not be able to develop novel or useful products, that we may not be able to attract or retain customers to these products, or that we may not have or hire the right talent to execute our business strategy in a competitive job market. Further, market acceptance of new product and service offerings will be dependent in part on our ability to include functionality and usability that address customer needs, and to optimally price our offerings and services to meet customer demand and cover our costs. Our go-to-market strategy also must adjust to customers' changing preferences, and there can be no assurance that our go-to-market approach will adequately and completely address such preferences. New product and services offerings may also increase our risk of liability and cause us to incur significant technical, legal or other costs. Additionally, our transformed organization will compete with numerous other organizations, many of which have greater resources and offer their products at a lower price than we do.

We may not be able to implement and realize the anticipated benefits from our strategy or business evolution plan. Events and circumstances, such as financial or unforeseen difficulties, delays and unexpected costs, may occur that could result in our not realizing desired outcomes. Even if the anticipated benefits and savings of our strategy and business evolution plan are substantially realized, there may be consequences, internal control issues, or business impacts that were not expected. Additionally, because of our restructuring efforts in connection with our strategy and business evolution plan, we may experience a loss of continuity, loss of accumulated knowledge or loss of efficiency during transitional periods. Reorganization and restructuring can require a significant amount of management and other employees' time and focus, which may divert attention from operating activities and growing our business.

Our business depends on our ability to attract new customers to use our products and services and to engage and retain existing customers to our learning platform while maintaining pricing levels. Our Academic Services business, representing the majority of our revenues, depends on small transactions made by a widely dispersed student population with an inherently high rate of turnover primarily as a result of graduation, and our Skilling business depends on attracting both enterprise customers and engaging with individual learners. The rate at which our customer base expands or declines, the rate at which we retain existing learners, and the engagement with our learning platform may fluctuate because of several factors, including, among others:

•our ability to locate and attract new customers to use our products and services and convert visitors to paying subscribers given the availability of competing content, including free content;

•our ability to attract new customers to grow our Skilling business;

•our ability to engage learners with our content;

•our ability to introduce new products and services that are favorably received by business customers and learners, including integrating AI-enabled products;

•piracy and unauthorized use of our content;

•our ability to localize our content, localize our pricing, localize our payment and commerce tools, and create new apps in different languages and for different geographies to further our international expansion through increased conversion and retention;

•our ability to increase our total addressable market beyond STEM-B (science, technology, engineering, mathematics and business);

•changes in customer spending levels and habits; and

•the effectiveness of our sales and marketing efforts, including generating word-of-mouth referrals.

Attracting new customers depends not only on our

Table of Contents

investment in our brand and content and our marketing efforts, but also on the perceived value of our products and services versus alternatives, some of which are free. As a result, our business, growth, results of operations, and financial condition could be adversely affected.

Additionally, even if we succeed in establishing brand awareness and loyalty, we may be unable to maintain and grow our customer base if we cannot offer competitive prices for our products and services, adequately prevent unauthorized account sharing of our subscription program services, or prevent the piracy and illegal reproduction of our content. If we fail to maintain and expand our user base, our business, results of operations, and financial condition could be adversely affected.

If we fail to innovate and offer new products and services in response to rapidly evolving technological and market developments, including AI, our competitive position and business prospects may be harmed.

Our future success depends, in part, on our ability to anticipate and respond effectively to the threat and opportunity presented by new technology disruption and developments. These include new software applications or related services based on AI and machine learning, among other developments. New technologies, including those based on AI, can provide students with more immediate responses than traditional tools. These new technologies have resulted in headwinds to our business, and over time, the accuracy of these tools and their ability to handle complex questions is expected to improve, which would further disrupt our business. Our success also depends, in part, on our ability to develop and scale a high-performance technology infrastructure to efficiently handle increased usage by students, especially during peak periods each academic term. We may develop new products, services, and technologies independently, by acquisition, or in conjunction with third parties.

Beginning in September 2023, we started to roll out the first phase of our new AI-powered user experience, and we are continuing to make significant investments in AI initiatives. Our updated user experience and investments in AI have not attracted as many new students as anticipated to our platform and our business has been adversely affected. If our business plans and product developments are unsuccessful or if we do not attract new students to our platform, we may not generate sufficient revenue, operating margin, or other value to justify our investments, and our business may be materially adversely affected.

While the overall effect of technological changes on our business is difficult to predict, recent technological shifts have created and are expected to continue creating headwinds for our industry and our business. We may invest in new products, services, and other initiatives, but there is no guarantee these approaches will be successful. The markets for new products and services may be unproven, and these products may include technologies and business models with which we have little or no prior experience or may significantly change our existing products and services. The effort to gain technological expertise and develop new technologies in our business requires us to incur significant expenses. In addition, we may be unable to obtain long-term licenses from third-party providers and/or government regulatory approvals and licenses necessary to allow a new or existing product or service to function. If we cannot offer new technologies as quickly as our competitors, or if our competitors develop more cost-effective technologies or product offerings, we could experience a material adverse effect on our operating results, growth and financial condition.

We face competition in all aspects of our business, including with respect to AI, and we expect such competition to increase.

We face significant competition from education and learning companies, many of which are developing their own AI products and technologies, as well as other companies that are not specifically focused on education and learning services but whose broad AI offerings may nonetheless significantly impact education and learning. Our services face competition from other education and learning companies based on the particular offering. The competitors for our language learning platform primarily include similar language learning platforms such as GoFluent, Speexx, and Duolingo. For our workforce skilling program, we face competition from other online learning platforms and online “skills accelerator” course providers, both white-label and co-branded, which compete for adult learners through third party institutions, including 2U, Inc., Simplilearn, General Assembly, Galvanize, Inc., Flatiron School, Codecademy, DataCamp, and Lambda, Inc. For Chegg Study, our competitors primarily include platforms that provide study materials and online instructional systems, such as Course Hero, Quizlet, Brainly, and Khan Academy. For Chegg Writing, we primarily face competition from other citation generating and grammar

Table of Contents

and plagiarism services, such as Grammarly. For Chegg Math, we face competition from other equation solver services, such as Photomath, Gauthmath, and Symbolab.

In particular, Google's roll out of Artificial Intelligence Overview (AIO) has created and is expected to continue to create headwinds for our industry and our business, most notably reductions in traffic to our website and customers subscribing to our services. In August 2024, Google began to significantly expand its AIO search experience, which displays AI-generated content at the top of its search results. This experience, which includes questions and solutions for education, keeps users on Google search results versus leading them onto our site. AIO’s prevalence has grown and may continue to increase. We expect Google may continue its shift from being a search origination point to the destination, which could materially adversely affect our business, operating results and financial condition. As described in more detail in Part I, Item 3, "Legal Proceedings" of this Annual Report on Form 10-K, on February 24, 2025, we filed a complaint in the U.S. District Court for the District of Columbia against Google LLC and Alphabet Inc. ("Google"), asserting federal antitrust claims and common-law unjust enrichment claims, in connection with Google's expansion of its AIO search experience ("Google suit"). Given the nature of the case, including that the proceedings are in their early stages, we are unable to predict the ultimate outcome of the case or whether Google will seek to counterclaim, or the likelihood of success should Google do so. This claim could result in costly litigation, require significant amounts of management time, and divert significant resources. See "— Adverse litigation judgments or settlements resulting from legal proceedings in which we are or may be involved could expose us to monetary damages or limit our ability to operate our business" in this "Risk Factors" section. In addition, we have licensed certain of our content to other entities who may use this content to train AI models that may compete with our products in the market.

Certain educational institutions, such as the University of Michigan, are also developing AI tools which may compete with our offerings. AI technologies may also significantly facilitate the entry of new competitors into our industry. Our competition may develop products and technologies that are similar or superior to our technologies or are more cost-effective to develop and deploy. Given the long history of development in the AI sector, other parties may have (or in the future may obtain) patents or other proprietary rights that would prevent, limit, or interfere with our ability to make, use, or sell our own AI products.

Across our industry, there has been a continued increase in the adoption of free and paid generative AI products for academic support, and students are increasingly turning to generative AI for academic support, such as homework and exams, as well as assistance in other areas of daily life. This shift in student behavior impacts education technology companies broadly, where students see generative AI products like ChatGPT and others as strong alternatives to vertically specialized solutions for education such as Chegg. These developments have negatively impacted our industry and our business and may continue to impact our overall traffic and accelerate the decline in the number of new subscribers that sign up for our services.

As a result, we have experienced, and could continue to experience, a material adverse effect on our operating results, growth and financial condition.

U.S. colleges have faced, and may continue to face, reduced enrollment, which could negatively impact our business and results of operations.

According to the National Student Clearinghouse, since 2010, total undergraduate college enrollment in the United States has decreased by approximately 2.8 million. Chegg derives a significant portion of its revenue from students attending U.S. colleges; and as such, a further decrease in the number of students enrolled in U.S. colleges could materially negatively impact our business, growth, results of operations, and financial condition.

We have a limited operating history in international jurisdictions and our expansion efforts into international markets may not be successful.

We periodically expand our international operations and presence in order to make our products and services available in more international markets. However, we have a limited operating history in international jurisdictions, and expanding our international operations will require considerable management attention and resources to attract talented employees and

Table of Contents

students. Our expansion efforts into international markets may not be successful. In addition, we face risks in doing business internationally that could constrain our operations, increase our cost structure, and compromise our growth prospects, including:

•the need to localize and adapt content for specific countries, including translation into foreign languages;

•local laws restricting students from accessing online education platforms such as ours;

•data privacy laws that may require data to be handled in a specific manner, including storing, processing, and encrypting data solely on local servers;

•varying levels of internet technology adoption and infrastructure, and increased or varying network and hosting service provider costs;

•difficulties in staffing and managing employment of individuals in foreign operations, including differing compensation and benefits regulations, relying on professional employer organizations and staffing agencies to provide personnel, foreign employees becoming part of labor unions, employee representative bodies, workers’ councils or collective bargaining agreements, and challenges relating to work stoppages or slowdowns;

•different pricing environments, difficulties in adopting and supporting new and different payment preferences, and collections issues;

•new and different sources of competition and practices which may favor local competitors;

•the ability to protect and enforce intellectual property rights abroad;

•the educational regulatory regime in certain countries and their ability to levy civil and criminal penalties on, or completely block students from accessing, services like Chegg;

•compliance challenges related to the complexity of multiple, conflicting and changing governmental laws and regulations, legal systems, and alternative dispute systems, including, but not limited to, employment, tax, privacy and data protection, economic sanctions and export controls, U.S. and other anti-boycott authorities, anti-money laundering laws, and anti-bribery laws and regulations such as the U.S. Foreign Corrupt Practices Act, the Office of Foreign Assets Controls, and the U.K. Bribery Act;

•increased financial accounting and reporting burdens, complexities, and commercial infrastructures;

•risks associated with international payment methods, including risks associated with fraudulent payments;

•risks associated with foreign tax regimes, trade tariffs, or similar issues, which could negatively impact international adoption of our offerings;

•fluctuations in currency exchange rates and the requirements of currency control regulations, which might restrict or prohibit conversion of other currencies into U.S. dollars;

•adverse tax consequences, including the potential for required withholding taxes for our overseas employees; and

•regional and economic political conditions.

If we cannot address these challenges, it could have an adverse effect on our business, results of operations, and financial condition. Our ability to gain market acceptance in any particular market is uncertain and the distraction of our senior management team could have an adverse effect on our business, results of operations, and financial condition.

The uncertainty surrounding the evolving educational landscape, including the impact of AI on learning and education, the state of the student including the amount and the extent to which AI will impact study habits and how students learn and/or complete their assignments, and the demand for our evolving offerings make it difficult to predict our operational trends and results of operations.

The uncertainty surrounding the evolving educational landscape, the state of the student, the use by students of free generative AI products for academic support, and the demand and market for our products and services make it difficult to predict our operational trends and results of operations, particularly with respect to our newer offerings, and the ultimate market size for our products and services. If the market and demand for a comprehensive learning platform does not develop as we expect, or if we fail to address the needs of this market, our business and prospects would be harmed.

Given the current environment of uncertainty, we may not be able to provide annual financial guidance accurately, or at all. We expect our results of operations to fluctuate in the future based on a variety of factors set forth above and elsewhere in this "Risk Factors" section, which may result in period-to-period comparisons of our results of operations not being a good indicator of our future or long-term performance.

If our efforts to drive user traffic, including search engine optimization, social media campaigns, and other marketing, are not successful, student discovery of, and engagement with, our learning platform could decline, which may harm our business and results of operations.

We have depended in the past on various search engines and free marketing tools to direct a significant amount of traffic to our website, but we are increasingly investing in other channels, including social media campaigns, to drive traffic and make

Table of Contents

us more discoverable to students. Similarly, we depend on mobile app stores such as the Google Play Store and the Apple App Store to allow students to locate and download Chegg mobile applications that enable our services. Our ability to maintain the number of students directed to our learning platform is not entirely within our control. Our competitors’ efforts to drive student discovery of, and engagement with, their offerings may be more successful than ours. Their websites may receive a higher search result page ranking than ours, or search engines could revise their methodologies or algorithms in ways that could adversely affect the placement of our search result page ranking or otherwise make it harder for students to find our learning platform.

In August 2024, Google broadly rolled out its AIO search experience, which displays AI-generated content at the top of its search results. This experience, which includes questions and solutions for education, keeps users on Google search results instead of leading them to Chegg’s site. AIO’s prevalence will only continue to increase.

Our website has experienced recent declines in search result rankings, and we anticipate that these declines will persist in the future. Global non-subscriber traffic to Chegg declined year-over-year and a continued decline in traffic to our site would materially adversely affect our business, operating results and financial condition.

Any reduction in the number of students directed to our learning platform could harm our business and results of operations.

If our efforts to build and maintain strong brands are not successful, we may not be able to grow our student user base, which could adversely affect our results of operations.

We believe our brands are a key asset of our business. Developing, protecting, and enhancing our “Chegg” brands are critical to expanding our student user base and increasing student engagement. Having a strong brand can counteract the significant student turnover we experience from year to year as students graduate and differentiate us from our competitors.

To succeed in our efforts to strengthen our brands’ identities, we must, among other activities:

•maintain our reputation as a trusted technology platform and source of content and services;

•maintain and improve the quality of our existing products, services, and technologies;

•introduce compelling products and services;

•adapt to changing technologies, including AI and machine learning, and changes in the learning environment;

•protect user data, such as passwords and personally identifiable information;

•adapt to students’ rapidly changing tastes, preferences, behavior, and brand loyalties;

•continue to expand our reach to students in high school, college, graduate school, lifelong learners throughout their careers, and internationally;

•ensure that the student-posted content to our website is reliable and does not infringe on third-party copyrights or violate other applicable laws, our terms of use, or the ethical codes of those students’ colleges;

•ensure that our experts' content is reliable and helpful;

•protect our trademarks and other intellectual property rights;

•convert and integrate the brands and students that we acquire into the Chegg brand and Chegg.com; and

•maintain and control the quality of our brand.

Our ability to successfully achieve these goals is not entirely within our control and we may not be able to maintain the strength of our brands or do so cost-effectively. Factors that could negatively affect our brands include, among others:

•changes in student sentiment about the quality or usefulness of our products and services, especially as we introduce our new AI-enabled interactive and personalized user experience;

•the quality and accuracy of our content;

•technical or other problems that prevent us from providing our products and services reliably or otherwise negatively affect the student experience with our products and services;

•concern from colleges and regulatory agencies regarding how students use our content offerings, such as our Expert Questions and Answers service;

Table of Contents

•student concerns related to privacy and use of data in our products and services;

•the reputation of the products and services of competitive companies; and

•students’ misuse of our products and services in ways that violate our Terms of Use, our Honor Code, other company policies, applicable laws, or the code of conduct at their educational institutions.

Our business depends on general economic conditions and their effect on spending behavior by students and advertising budgets.

To the extent that these conditions continue, students may elect to not attend colleges and universities and may reduce the amount they spend on educational content. In addition to decreased spending by students as a result of these economic conditions, business partners may reduce their spending on our offerings and brands may reduce their spending on our advertising services.

We have a history of losses, and we may not achieve or sustain profitability in the future.

We have experienced cumulative net losses since our incorporation in July 2005, and we may continue to experience net losses in the future. As of December 31, 2025, we had an accumulated deficit of $992.9 million. We expect to make significant investments in the development and expansion of our business and, as a result, our cost of revenues and operating expenses may increase. We may not succeed in increasing our revenues sufficiently to offset these higher expenses, and our efforts to grow the business may be more expensive than we anticipate. We may encounter unforeseen expenses, challenges, complications, delays, and other unknown factors, as we pursue our business plan. If we fail to timely implement these changes or we cannot implement them for any reason, including due to factors beyond our control, our business may suffer, which may hinder our ability to sustain or increase such profitability.

If we do not retain our senior management team and key employees, we may not be able to sustain our growth or achieve our business objectives.

We depend on the continued contributions of our senior management and other key personnel. All of our executive officers and key employees are at-will employees, meaning they may terminate their employment relationship at any time. If we lose the services of one or more members of our senior management team or other key personnel, or if one or more of them decides to join a competitor or otherwise compete directly or indirectly with us, we may not be able to successfully manage our business or achieve our business objectives. Our future success also depends on our ability to identify, attract, and retain highly skilled personnel. Competition for these employees is intense. Qualified individuals are in high demand, and if we cannot attract or retain the personnel we need to succeed, our business may suffer.

As of December 31, 2025, there were 6,606,932 shares available for grant under the 2023 Equity Incentive Plan. Given the number of shares available for grant and given the decrease in our stock price, we may need to request that our shareholders vote on a new equity incentive plan sooner than previously anticipated. If our shareholders do not approve a new equity incentive plan or if we are not able to grant employees the appropriate number of shares, we may not be successful in compensating our key employees commensurate with other technology companies with whom we compete for talent, and we may lose their services. In addition, we may not be able to attract their replacements. If we cannot retain our key employees or attract adequate replacements, we may not be able to achieve our business objectives and our financial condition could be materially negatively impacted.

Table of Contents

We have undertaken, and may in the future undertake, internal restructuring activities that could result in disruptions to our business or otherwise materially harm our results of operations or financial condition.

From time to time, we have undertaken and may continue to undertake internal restructuring activities in an effort to better align our resources with our business strategy. For example, in May 2025 and October 2025, we announced restructuring plans that included reductions of our global workforce of approximately 640 employees, or approximately 56% of our workforce, to better align our cost structure with recent industry challenges that are negatively impacting our business, including increased competition and student adoption of generative AI products.

We incur substantial costs to implement restructuring plans, and our restructuring activities may subject us to reputational risks and litigation risks and expenses. There can be no assurance that any restructuring activities that we have undertaken or undertake in the future will achieve the cost savings, operating efficiencies, or other benefits that we may initially expect. In addition, restructuring activities result in the loss of institutional knowledge and expertise, and may result in attrition beyond our intended reduction in force, or a negative impact on employee morale and productivity or on our ability to attract highly skilled employees. Internal restructurings also require a significant amount of time and focus from management and other employees, which may divert attention from commercial operations. If any internal restructuring activities we have undertaken or undertake in the future fail to achieve some or all of the expected benefits, our business, financial condition, and results of operations could be materially and adversely affected.

We depend on customers having access to and choosing to use our mobile apps in order to acquire new student users and expand their engagement with our learning platform.

Each operating system provider has broad discretion to make changes to its operating systems or payment services or change the manner in which their mobile operating systems function and to change and interpret its terms of service and other policies with respect to us and other developers, and those changes may be unfavorable to us. For example, such changes could limit, eliminate or otherwise interfere with our products, our ability to distribute our applications through their stores, our ability to update our applications, including to make bug fixes or other feature updates or upgrades, the features we provide, the manner in which we market our products, our ability to access native functionality, or other aspects of mobile devices, and our ability to access information about our users that they collect. If it is more difficult for students to access and use our apps on their mobile devices, our student user base and engagement levels could be harmed.

Our wide variety of accepted payment methods subjects us to third-party payment processing-related risks, including risks associated with credit card fraud.

We accept payments from students using a variety of methods, including credit cards, debit cards, and PayPal. As we offer new payment options to students, we may be subject to additional regulations, compliance requirements and incidents of fraud. For certain payment methods, including credit and debit cards, we pay interchange and other fees, which may increase over time and raise our operating costs and lower our profit margins. For example, we have in the past experienced higher transaction fees from our third-party processors as a result of chargebacks on credit card transactions.

We rely on third parties to provide payment processing services, including the processing and information storage of credit cards and debit cards. If these companies become unwilling or unable to provide these services to us, our business could be disrupted. We are also subject to payment card association operating rules, certification requirements, and rules governing electronic funds transfers, which could change or be reinterpreted to make it difficult or impossible for us to comply. If we fail to comply with these rules or requirements, we may be subject to additional fines and higher transaction fees; lose our ability to accept credit and debit card payments from our students or process electronic funds transfers; or facilitate other types of online payments, and our business and results of operations could be adversely affected.

While we do have safeguards in place, we cannot be certain that other fraudulent schemes will not be successful. A failure to adequately control fraudulent transactions could harm our business and results of operations.

Table of Contents

We rely on Amazon Web Services (AWS) and other third-party software and service providers to provide systems, storage, and services for our website and any disruption of such services or a material change to our arrangements could adversely affect our business.

We rely on AWS and other third-party software and service providers to provide systems, storage, and services, including user login authentication, for our website. Our reliance makes us vulnerable to any errors, interruptions, or delays in their operations. Any disruption in the services provided by third-party providers, including AWS, could harm our reputation or brand, cause us to lose subscribers or revenues or incur substantial recovery costs and distract management from operating our business. If they cannot adapt to the increase in demand or fail to ensure availability of their software and services, our ability to service users’ requests may be impacted, which could have an adverse impact on our results of operations.

AWS may terminate its agreement with us upon 30 days’ notice. Upon expiration or termination of our agreement with AWS, we may not be able to replace the services provided to us in a timely manner or on terms and conditions, including service levels and cost, that are favorable to us, and a transition from one vendor to another vendor could subject us to operational disruptions and inefficiencies until the transition is complete.

Our growth strategy includes acquisitions, and we may not be able to execute on our acquisition strategy or integrate acquisitions successfully.

As part of our business strategy, we have made and intend to continue to make acquisitions to add specialized employees, complementary businesses, products, services, operations, or technologies. Prior acquisitions include Busuu, Mathway, and Thinkful. To be successful, we must timely and efficiently integrate acquired companies, including their technologies, products, services, operations, and personnel. Acquired companies can be complex and time consuming to integrate and we may incur significant integration costs and we may not be able to offset our acquisition costs. Acquisitions involve many risks that may negatively impact our financial condition and results of operations, including the risks that the acquisitions may:

•require us to incur charges and substantial debt or liabilities;

•cause adverse tax consequences, substantial depreciation, or deferred compensation charges;

•result in acquired in-process research and development expenses or in the future may require the amortization, write-down, or impairment of amounts related to deferred compensation, goodwill, and other intangible assets; and

•give rise to various litigation and regulatory risks.

In addition:

•we may encounter difficulties or unforeseen expenditures to integrate an acquired company;

•an acquisition may disrupt our business, divert resources, increase expenses, and distract our management;

•an acquisition may reduce or delay adoption and engagement rates for our acquired products and services because of student uncertainty about continuity and effectiveness;

•an acquisition may subject us to laws and operational challenges in new jurisdictions with which we are unfamiliar;

•we may not successfully transition acquired users to the Chegg platform and therefore may not realize the potential benefits of these acquisitions;

•we may incur unforeseen costs as a result of the pre-acquisition activities of businesses and technologies we acquire;

•we may be required to honor the pre-existing contractual relationships of businesses we acquire, which contracts may be on terms that we would not have otherwise accepted;

•it may be difficult to monetize any acquired products and services;

•an acquisition may not ultimately be complementary to our offerings; and

•an acquisition may involve entry into markets where we have little or no prior experience.

Our ability to acquire and integrate larger or more complex businesses, products, services, operations, or technologies in a successful manner is unproven. Our newer products and services, such as skills-based learning and language learning, may not be integrated effectively into our business, achieve or sustain profitability, or achieve market acceptance at levels sufficient to justify our investment. We may not be able to find suitable acquisition candidates, and we may not be able to complete acquisitions on favorable terms, if at all. To finance any future acquisitions, we may issue equity or equity-linked securities, which could be dilutive, or debt, which could be costly, potentially dilutive, and impose substantial restrictions on the conduct of our business. If we fail to successfully complete any acquisitions or integrate them into our company, or identify and address

Table of Contents

liabilities associated with the acquisition, our business, results of operations, and financial condition could be adversely affected. We have encountered and will continue to encounter these risks, and if we do not manage them successfully, our business, financial condition, results of operations, and prospects may be materially and adversely affected.

If we fail to convince brands of the benefits of advertising on our learning platform, or if platforms such as Google Chrome, Safari, or Firefox limit our access to advertising and marketing audiences, or the data required to effectively reach those audiences, our business could be harmed.

Our business strategy includes increasing our revenues from brand advertising. Additionally, if platforms such as Google Chrome, Safari, or Firefox, limit our access to or understanding of advertising and marketing audiences, they could reduce our advertising rates and ultimately reduce our revenues from brand advertising. For example, the release of iOS 14 on Apple devices brought with it a number of new changes, including the need for app users to opt in before their identifier for advertisers (IDFA) can be accessed by an app. Apple’s IDFA is a string of numbers and letters assigned to Apple devices which advertisers use to identify app users to deliver personalized and targeted advertising. As more users opt out of granting IDFA access, the ability of advertisers to accurately target and measure their advertising campaigns at the user level may become significantly limited and we may experience increased cost per registration.

We may need additional capital, and we cannot be sure that additional financing will be available on favorable terms, if at all.

We have funded our operating losses and capital expenditures through proceeds from equity and debt financings, and cash flow from operations. We are attempting to grow our skilling business, and although we currently anticipate that our available funds and cash flow from operations will be sufficient to meet our cash needs for the foreseeable future, including those related to investing in our skilling business and strengthening our balance sheet, we may require additional financing. If we raise additional funds through the issuance of equity, equity-linked, or debt securities, those securities may have rights, preferences or privileges senior to the rights of our common stock, and our stockholders may experience substantial dilution.

Our core value of putting students first may conflict with the short-term interests of our business.

We believe that adhering to our core value of putting students first is essential to our success and in the best interests of our company and the long-term interests of our stockholders. In the past, we have forgone, and in the future, we may forgo, short-term revenue opportunities that we do not believe are in the best interests of students, even if our decision negatively impacts our results of operations in the short term. Our philosophy of putting students first may cause us to make decisions that could negatively impact our relationships with publishers, colleges, and brands, whose interests may not always be aligned with ours or those of our students. Our decisions may not result in the long-term benefits that we expect, in which case our level of student satisfaction and engagement, business, and results of operations could be harmed.

Adverse litigation judgments or settlements resulting from legal proceedings in which we are or may be involved could expose us to monetary damages or limit our ability to operate our business.

Currently, we are involved in various legal proceedings, including securities litigation, derivative suits, putative class actions, and other matters described elsewhere herein. We have in the past and may in the future become involved in other private actions, collective actions, investigations, and various other legal proceedings by subscribers, employees, suppliers, competitors, government agencies, stockholders, or others. For example, we are a party to the matters described in more detail in Part I, Item 3, "Legal Proceedings" of this Annual Report on Form 10-K. The results of any such litigation, investigations, and other legal proceedings are inherently unpredictable and expensive. Any claims against us, whether meritorious or not, could be time consuming, result in costly litigation, damage our reputation, require significant amounts of management time, and divert significant resources. If any of these legal proceedings were to be determined adversely to us, or we were to enter into a settlement arrangement, we could be exposed to monetary damages or limits on our ability to operate our business in the way that it is currently operated, which could have an adverse effect on our business, financial condition, and operating results.

Table of Contents

If we are not able to manage the changes in our business both in terms of scale and complexity, our business could be adversely affected.

Managing the transition to a focus on our Skilling business and growing its product offerings will increase the complexity of our business, and managing it will become more challenging. Acquisitions of new companies, products, and services create integration risk, while developing and enhancing products and services involves significant time, labor, and expense as well as other challenges, including managing the length of the development cycle, entering new markets, regulatory compliance, evolution of sales and marketing, and protecting proprietary rights. Any future expansion will likely place significant demand on our resources, capabilities and systems, and we may need to develop new processes and procedures and expand our infrastructure to respond to these demands.

Risks Related to Our Industry

Government regulation of education and student information is evolving, and unfavorable developments could have an adverse effect on our business, results of operations, and financial condition.

Compliance requires, without limitation, making disclosures, obtaining consents, and restrictions on transferring data for which we may in the future need to build further infrastructure to support. We cannot guarantee that we or our acquired companies have been or will be fully compliant in every jurisdiction, due to lack of clarity concerning how existing laws and regulations governing educational institutions affect our business and lengthy governmental compliance process timelines.

Moreover, as the education industry continues to evolve, increasing regulation by federal, state, and foreign agencies becomes more likely. These acts do not apply to general audience Internet websites but it is unclear how these acts will be interpreted and the breadth of services that will be restricted by them. Other states may adopt similar statutes. Additionally, for-profit postsecondary institutions, many of which provide course offerings predominantly online, remain under intense regulatory and other scrutiny.

Certain jurisdictions have also adopted statutes, such as California Education Code § 66400, which prohibit the preparation or sale of material that should reasonably be known will be submitted for academic credit. These laws and regulations are directed at enterprises selling term papers, theses, dissertations, and the like, which we do not offer, and were not designed for services like ours which are designed to help students understand the relevant subject matter.

The adoption of any laws or regulations that adversely affect the popularity or growth in the use of the Internet particularly for educational services, including laws limiting the content and learning programs that we can offer, and the audiences that we can offer that content to, may decrease demand for our service offerings and increase our cost of doing

Table of Contents

business. Future regulations, or changes in laws and regulations or their existing interpretations or applications, could also hinder our operational flexibility, raise compliance costs, and result in additional historical or future liabilities for us, resulting in adverse impacts on our business and our results of operations.

ROSCA bans online negative options, such as pre-checked online subscriptions or automatic sign-ups at checkout, unless the company: 1) clearly discloses all material terms of the deal before obtaining a consumer’s billing information; 2) gets the consumer’s express informed consent before making the charge; and 3) provides simple mechanisms for stopping recurring charges. Failure to comply could result in a violation of the FTC Act, subjecting us to penalties, including monetary fines and injunctive relief, including from State Attorney Generals. Legislation or regulation regarding the foregoing, or changes to existing legislation or regulation governing subscription payments, are being considered in many U.S. States, and have been recently passed or updated in states such as California and New York. We are and have been in the past, and may be in the future, the subject of investigations, inquiries, and claims under such laws or regulations, including from the Federal Trade Commission (FTC).

As the regulatory framework for machine learning, artificial intelligence, and automated decision making evolves, our business, financial condition, and results of operations may be adversely affected by related laws or regulations. It is possible that new laws and regulations will be adopted in the U.S. (at the federal or state level) or in non-U.S. jurisdictions, or that existing laws and regulations may be interpreted in ways that would affect the operation of our business, including our learning platform and the ways in which we use artificial intelligence and machine learning technology. We may not always be able to anticipate how regulators will apply existing laws to AI, predict how new legal frameworks will develop to address AI, or otherwise respond to these frameworks as they are still rapidly evolving.

While we expect and plan for new laws, regulations, and standards to be adopted over time that will be directly applicable to the Internet and to our student-focused activities, any existing or new legislation applicable to our business could expose us to substantial liability, including significant expenses necessary to comply with such laws and regulations and potential penalties or fees for non-compliance, and could negatively impact the growth in the use of the Internet for educational purposes and for our services in particular. We may also run the risk of retroactive application of new laws to our business practices that could result in liability or losses. Due to the global nature of the Internet, it is possible that the governments of other states and foreign countries might attempt to change previous regulatory schemes or choose to regulate transmissions or prosecute us for violations of their laws. We might unintentionally violate such laws, such laws may be modified, and new laws may be enacted in the future. Any such developments could harm our business, results of operations, and financial condition.

Colleges and certain governments may restrict online access or access to our website, which could lead to the loss of or slowing of growth in our student user base and their level of engagement with our platform.

The growth of our business and our brand depends on the ability of students to access the Internet and the products and services available on our website, in particular in non-U.S. countries. Colleges that provide students with access to the Internet either through on-campus computer terminals or Internet access points on campus could block or restrict access to our website, content, or services or the Internet generally for a number of reasons, including security, confidentiality, regulatory concerns, or if they believe our products or services contradict or violate their policies. If governments or colleges modify their laws or policies, or choose to apply laws or policies, in ways that are detrimental to the growth of our student user base or in ways that make it harder for students to use our website, the overall growth in our student user base would slow, student engagement would decrease and we would lose revenues. Any reduction in the number of students directed to our website would harm our business and results of operations.

If we are required to discontinue certain of our current marketing activities, our ability to attract new students may be adversely affected.

Laws or regulations may be enacted which restrict or prohibit use of emails or similar marketing activities that we currently rely on. Other state privacy laws such as CDPA and CPA place additional restrictions on our marketing practices.

Table of Contents

Notwithstanding existing laws, we may discontinue use or support of these activities if we become concerned that students or potential students deem them intrusive, or they otherwise adversely affect our reputation, goodwill and brand. If our marketing activities are curtailed, our ability to attract new students may be adversely affected.

We are subject to U.S. trade control laws that may restrict growth prospects and impose liability if we are non-compliant.

As a U.S. company with U.S. origin software applications, we are required to comply with U.S. trade controls. Our activities are subject to U.S. economic sanctions laws and regulations administered by the Department of the Treasury, Office of Foreign Assets Control (OFAC), which prohibit most transactions with embargoed jurisdictions or prohibited parties without a specific or general license from OFAC. Additionally, the U.S. Department of Commerce, Bureau of Industry and Security (BIS) administers the Export Administration Regulations (EAR), which restrict exports of software subject to the EAR to embargoed countries and prohibited parties. Although we have taken precautions to prevent our platform, services and software applications from being provided in embargoed jurisdictions and to prohibited parties, and we continue to enhance our policies and procedures relating to sanctions and export compliance, we may not be able to prevent all transactions that are noncompliant with U.S. trade controls. Sanctions and export violations can result in significant fines or penalties, as well as reputational harm and loss of business.

Our customers outside of the United States generated approximately 15% of our net revenues during the year ended December 31, 2025, and our growth strategy includes further expanding our operations and customer base across all major global markets. An escalation in sanctions or export controls against regions where we operate, or the issuance of new sanctions designations or export restrictions against individuals and entities located in various regions, could result in decreased ability to provide our platform, services and software applications to existing or potential customers. Any limitation on our ability to operate in various global markets could adversely affect our business performance and growth prospects.

Risks Related to Taxes and Accounting Matters

We may be subject to greater than anticipated liabilities for income, property, sales, and other taxes, and any successful action by federal, state, foreign, or other authorities to collect additional taxes could adversely harm our business.

We are subject to regular review and audit by both U.S. federal and state and foreign tax authorities and such jurisdictions may assess additional taxes against us. Although we believe our tax estimates are reasonable, the final determination of tax audits and any related litigation could be materially different from our historical tax provisions and accruals and could have a negative effect on our financial position and results of operations. The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for valuing and allocating income from our intercompany transactions, which could increase our worldwide effective income tax rate. We collect sales taxes in all U.S. states with a sales tax and most local jurisdictions on our sales and digital services sold through our commerce system. In June 2018, the U.S. Supreme Court in South Dakota v. Wayfair, Inc. et al ruled that a state can require an online retailer with no in-state property or personnel to collect and remit sales and use tax on sales made to the state’s residents. It is possible that such taxes could be assessed by certain states retroactively for periods before the Wayfair decision on acquired products that are not sold through our commerce system. Any successful action by federal, state, foreign or other authorities to impose or collect additional income tax or compel us to collect and remit additional sales, use, value-added or similar taxes, either retroactively, prospectively or both, could harm our business, financial condition, and results of operations.

Our effective tax rate may fluctuate as a result of new U.S. and worldwide tax laws and our interpretations of those new tax laws, which are subject to significant judgments and estimates. The ongoing effects of the new tax laws and the refinement of provisional estimates could make our results difficult to predict.

Our effective tax rate may fluctuate in the future as a result of new tax laws. Due to the complexities involved in applying the provisions of new tax legislation, we may make reasonable estimates of the effects in our financial statements. As we collect and prepare necessary data and interpret the new tax legislation, we may make adjustments that could affect our financial position and results of operations as well as our effective tax rate in the period in which the adjustments are made.

Our earnings are affected by the application of accounting standards and our critical accounting policies, which involve subjective judgments and estimates formulated by our management. Our actual results could differ from the estimates and assumptions used to prepare our consolidated financial statements.

The accounting standards that we use in preparing our financial statements are often complex and require us to make significant estimates and assumptions in interpreting and applying those standards. We make critical

Table of Contents

estimates and assumptions involving accounting matters including revenue recognition and deferred revenue, impairment of acquired intangible assets and other long-lived assets, goodwill and indefinite lived intangible assets, share-based compensation expense, and provision for income taxes. These estimates and assumptions involve matters that are inherently uncertain and require us to make subjective and complex judgments. Although we believe we have the experience and processes to enable us to formulate appropriate assumptions and produce reasonably dependable estimates, these assumptions and estimates may change significantly in the future and could result in the reversal of previously recognized amounts. If we used different estimates and assumptions or used different methods to determine these estimates, our financial results could differ, which could have a material negative impact on our financial condition and reported results of operations. For more information about our critical accounting policies and use of estimates, see Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations-Critical Accounting Policies, Significant Judgments and Estimates.” of this Annual Report on Form 10-K.

Risks Related to Intellectual Property

Failure to protect or enforce our intellectual property and other proprietary rights could adversely affect our business, financial condition, and results of operations.

Our success and ability to compete depends in part on our intellectual property and our other proprietary business information. We rely and expect to continue to rely on a combination of trademark, copyright, patent, and trade secret protection laws, as well as confidentiality and license agreements with our employees, consultants, and third parties with whom we have relationships to protect our intellectual property and proprietary rights. However, we may be unable to secure intellectual property protection for all of our technology and methodologies or the steps we take to enforce our intellectual property rights may be inadequate. If the protection of our intellectual property and proprietary rights is inadequate to prevent use or misappropriation by third parties, the value of our brand and other intangible assets may be diminished, competitors may be able to more effectively mimic our service and methods of operations, the perception of our business and service to customers and potential customers may become confused in the marketplace, and our ability to attract customers may be adversely affected.

Third parties may challenge any patents, copyrights, trademarks, and other intellectual property and proprietary rights owned or held by us. Third parties may knowingly or unknowingly infringe, misappropriate, or otherwise violate our patents, copyrights, trademarks, and other proprietary rights and we may not be able to prevent infringement, misappropriation, or other violations. Any attempt by us to prevent or address such violations may involve substantial expense to us. Additionally, if we fail to protect our domain names, it could adversely affect our reputation and brand and make it more difficult for students to find our website, our content, and our services. If we pursue litigation to assert our intellectual property or proprietary rights, an adverse decision could limit our ability to assert our intellectual property or proprietary rights, limit the value of our intellectual property or proprietary rights, or otherwise negatively impact our business, financial condition, and results of operations.

Misuse of our platform and content, including digital piracy and improper sharing and misappropriation of user credentials, may continue to adversely affect our business, financial condition, and results of operation.

Our content has been subject to unauthorized copying and widespread digital dissemination without an economic return to us. Some students may misuse our products and services in ways that violate our Terms of Use, our Honor Code, other company policies, applicable laws, or the code of conduct at their educational institutions. We have experienced improper sharing and misappropriation of user credentials, allowing for parties to access content and services that they have not paid for. Through such misuse of our platform and content, students may be able to access our offerings for free or at a reduced cost relative to our paid subscription, which has and may continue to negatively impact our ability to attract students to, and retain students on, our platform. The impact of misuse of our platform and content on our revenues and subscriptions is hard to quantify, but we believe that illegal copying and dissemination of our content, improper sharing and misappropriation of user credentials, and other forms of unauthorized activity have had a substantial negative impact on our revenues and subscriptions. Also, despite the potential benefits of AI technology, the advancement of AI may increase certain risks and adverse impacts associated with misuse of our content, including the development of AI applications that may facilitate piracy and new forms of intellectual property infringement through the unauthorized reproduction of copyrighted content to “train” AI applications and to create unauthorized derivative works.

If we fail to obtain appropriate relief through the judicial process or the complete enforcement of judicial decisions issued in our favor (or if judicial decisions are not in our favor) or fail to develop effective means of protecting our content and enforcing our intellectual property rights, our business, financial condition, and results of operations may be negatively impacted.

Table of Contents

If we become subject to liability for the Internet content that we publish or that is uploaded to our websites by students or other users, our results of operations could be adversely affected.

In addition, the applicability and scope of these and other laws and regulations, as interpreted by the courts, remain uncertain and could be interpreted in ways that harm our business. For example, we rely on statutory safe harbors, like those set forth in the DMCA and Section 230 of the Communications Decency Act in the U.S. and the E-Commerce Directive in Europe, to protect against liability. Legislation (such as the Sunset to Reform Section 230 Act) or court rulings affecting these safe harbors may adversely affect us and may impose significant operational challenges. There are legislative proposals and pending litigation in the U.S. (currently in district and appellate courts around the country), EU, and around the world that could diminish or eliminate safe harbor protection for websites and online platforms.

We have in the past and may in the future receive communications containing allegations of infringement, which we assess on a case-by-case basis. We may elect not to respond to the communication if we believe it is without merit or we may try to resolve disputes out-of-court by removing content or services we offer or paying licensing or other fees. If we fail to resolve such disputes, litigation may result. For example, we have been subject to lawsuits alleging copyright infringement. Litigation to defend these claims could be costly, divert our technical and management personnel, render us unable to use our current website or to market our service or sell our products and therefore harm our results of operations. We may not be adequately insured to cover claims of these types or indemnified for all liability that may be imposed on us. Any adverse publicity resulting from actual or potential litigation may also materially and adversely affect our reputation, which in turn could adversely affect our results of operations.

We maintain content usage review systems that, through a combination of manual and automated blocks, monitor for and make us aware of potentially infringing content on our platform. Nevertheless, claims may continue to be brought and threatened against us for negligence, intellectual property infringement, or other theories and there is no guarantee that we will be able to resolve any such claims quickly and without damage to our business, our reputation or our operations. From time to time, we have been subject to copyright infringement claims, some of which we have settled. While these settlements have not had a material impact on our financial condition, we may be subject to similar lawsuits in the future and the outcome of any such lawsuits may not be favorable to us and could have a material adverse effect on our financial condition.

Changes in or our failure to comply with the requirements for eligibility for the Digital Millennium Copyright Act (DMCA) safe harbors could harm our business.

The DMCA has provisions that limit, but do not necessarily eliminate, our liability for caching or hosting or for serving as a mere conduit for the transmission of or linking to, content or third-party websites that include materials or other content that infringe copyrights, provided we comply with the strict statutory requirements of the DMCA. The applications and interpretations of the statutory requirements of the DMCA are evolving and may be modified by court rulings and industry practice. The safe harbors available under the DMCA can limit liability for copyright infringement in the U.S., but they do not limit our liability for infringement of other intellectual property or proprietary rights, they do not automatically apply outside the U.S., and they do not prevent or address requests for injunctive relief. Any determination in litigation that a DMCA safe harbor does not shield us from liability could negatively impact our business, financial condition, and results of operations.

We are, and may in the future be, subject to intellectual property claims, which are costly to defend and could harm our business, financial condition, and results of operations.

From time to time, third parties have alleged and are likely to allege in the future that we or our business infringes, misappropriates, or otherwise violates their intellectual property or proprietary rights beyond those circumstances discussed in other risk factors contained in this Section, “Risks Relating to Our Intellectual Property.” Many companies, including various “non-practicing entities” or “patent trolls,” devote significant resources to developing or acquiring patents that could affect aspects of our business. Our patent portfolio may provide little or no deterrence in any litigation involving non-practicing entities or other adverse patent owners that have no relevant solution revenue, as we would not be able to assert our patents against such entities or individuals. For instance, on November 5, 2018, a non-practicing entity (NPE) filed an action against us

Table of Contents

in the U.S. District Court for the Southern District of New York captioned NetSoc, LLC v. Chegg, Inc., Civil Action No. 1:18-CV-10262-RAC (the NetSoc Action).

While we ultimately prevailed in the NetSoc Action and we intend to vigorously defend any intellectual property claims, our technologies may not be able to withstand all third-party claims or rights against their use. The costs of supporting such litigation and disputes are considerable, and there can be no assurances that a favorable outcome will be obtained. We also may be required to settle such litigation and disputes on terms that are unfavorable to us. The terms of any settlement or judgment may require us to cease some or all of our operations and/or pay substantial amounts to the other party.

Additionally, because patent applications can take years to issue and are often afforded confidentiality for some period of time, there may currently be pending applications, unknown to us, that later result in issued patents that could cover our technology and there is also a risk that we could adopt a technology without knowledge of a pending patent application, which technology would infringe a third-party patent once that patent is issued.

Moreover, in a patent infringement claim against us, we may assert, as a defense, that we do not infringe the relevant patent claims, that the patent is invalid or both. The strength of our defenses will depend on the patents asserted, the interpretation of these patents, and our ability to invalidate the asserted patents. However, we could be unsuccessful in advancing non-infringement and/or invalidity arguments in our defense. In the United States, issued patents enjoy a presumption of validity, and the party challenging the validity of a patent claim must present clear and convincing evidence of invalidity, which is a high burden of proof. Conversely, the patent owner need only prove infringement by a preponderance of the evidence, which is a lower burden of proof.

Some aspects of our technology include open-source software, and any failure to comply with the terms of one or more of these open-source licenses could harm our business.

We use open source software in connection with certain of our products and services. Companies that incorporate open source software into their products have, from time to time, faced claims challenging the ownership of open source software and/or compliance with open source license terms. As a result, we could be subject to suits by parties claiming ownership of what we believe to be open source software or noncompliance with open source licensing terms. Some open source software licenses require users who distribute or use open source software as part of their software to publicly disclose all or part of the source code to such software and/or make available any derivative works of the open source code on unfavorable terms or at no cost. Any requirement to disclose our proprietary source code or pay damages for breach of contract could have a material adverse effect on our business, financial condition and results of operations.

Risks Related to Data Privacy

The compromise of our information technology systems or data, including through computer malware, viruses, hacking, phishing attacks, spamming and other security incidents, could harm our business and results of operations.

We process personal data regarding various individuals, including students, tutors, educators, and our employees, as well as other sensitive data, including intellectual property and confidential and proprietary business information. We, and our service providers and other third parties upon which we rely, are subject to a variety of evolving security threats. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. For example, severe ransomware attacks are becoming increasingly prevalent. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Additionally, nation-state actors are expected to continue to engage in cyber-attacks for geopolitical reasons and in conjunction with military conflicts and defense activities. Furthermore, remote work has become more common and has increased risks to our information technology systems and data, as more of our employees, as well as employees of our service providers and other third parties on which we rely, utilize network connections, computers and devices outside our premises or network, including while working at home, while in transit and in public locations.

Future or past business transactions (such as acquisitions or integrations) could also expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Moreover, we rely heavily on SaaS enterprise resource planning systems to conduct our e-commerce and financial transactions and reporting. In addition, we utilize third-party cloud computing services in connection with our business operations. Our reliance on these and other third-party service providers and technologies to operate critical business

Table of Contents

systems to process sensitive information in a variety of contexts and to otherwise assist in the operation of our business increases our risk exposure as our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

If our data or security measures, or the security measures of our service providers, other third parties upon which we may rely or companies we may acquire, are compromised, disrupted or breached or are perceived to have been compromised, disrupted or breached, including as a result of any of the aforementioned threats or other cyberattacks, online or offline fraud, other intentional misconduct by computer hackers, employee error or malfeasance, social-engineering attacks, credential harvesting, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods or other similar threats or activities (including those Chegg has experienced in the past, as discussed below), we could face a variety of adverse consequences. For example, we could be required to expend significant capital and other resources to address the problem and could face or be subject to litigation (including class action litigation such as those matters identified below) and enforcement actions, investigations, audits, additional reporting requirements and/or oversight, data processing restrictions, indemnity obligations, damages, penalties and costs for remediation, damage our reputation or brand, interruptions in our operations (including availability of data), and similar harms. Security incidents, including those Chegg has experienced in the past, as identified below, and attendant consequences may cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. Additionally, applicable data privacy and security obligations may require us to notify relevant stakeholders, including regulators and impacted individuals, of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to additional adverse consequences. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI/machine learning (ML) platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

We may expend significant resources or modify our business activities to try to protect against threats to our security or systems. However, while we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We have not always been able in the past and may be unable in the future to detect vulnerabilities in our information technology systems because such threats and techniques change frequently, are often sophisticated in nature, and may not be detected until after a security incident has occurred. We have experienced security incidents in the past. For example, in April 2018, an unauthorized individual gained access to and exfiltrated user data for approximately 40 million users of chegg.com and certain other services in our family of brands, including EasyBib, (the “2018 Data Incident”). The types of information that may have been obtained by the threat actor included a Chegg user’s name, email address, shipping address, Chegg username, and Chegg password. For a small percentage of the impacted users who had entered details into our scholarship search service, the incident also exposed information about additional personal characteristics, including dates of birth, parents’ income range, sexual orientation, religious denomination, heritage and information concerning disabilities. We have faced other claims for allegedly misleading statements regarding our security measures to protect users' data and related internal controls and procedures and for failure to take reasonable security measures.

The FTC consent order was finalized in January 2023. The FTC consent order requires us to establish, implement and maintain a comprehensive information security program, provide multi-factor authentication methods as an option or requirement for consumers, document and adhere to a detailed information retention schedule and provide consumers with online tools they can use to request access to or the deletion of their personal information. The consent order also requires us to obtain initial and biennial assessments of our

Table of Contents

Information Security and Governance Program ("ISP") from an independent third-party assessor and comply with detailed reporting requirements for the 20 year-duration of the order. Although we have completed our second such independent assessment of our ISP with no material findings, we are unable to guarantee that there will not be future issues, and any such issues and the steps required to remediate them could negatively impact our business, results of operations, and financial condition.

Actions and investigations such as the foregoing, and any similar or other actions, claims, litigation, investigations or events, whether arising from prior or future incidents, may harm our business and cause us to suffer adverse consequences.

Our efforts to prevent hackers and others from entering our computer systems or accessing our data may not be fully effective and we cannot guarantee that future events will not occur that have a material impact on our business.

We also rely on computer systems globally to manage our operations. We have experienced and expect to continue to experience periodic service interruptions and delays involving our systems. While we maintain a fail-over capability to switch our operations from one facility to another in the event of a service outage, that process would still result in service interruptions that could be significant in duration. Such interruptions could have a disproportionate effect on our operations if they were to occur during one of our peak periods or if multiple of our service facilities experiences outages at the same time. Our facilities are also vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures, and similar events as well as the cyber-attacks and security risks and threats discussed above.

We collect, process, store and use personal information and other sensitive data, which subjects us to stringent and evolving U.S. and foreign laws, governmental regulation, contractual obligations, policies and other legal obligations.

In the ordinary course of business, we collect, receive, process, store, disclose, make accessible and otherwise use personal information and other sensitive data, including proprietary and confidential business data and intellectual property, from various parties, including students, tutors, educators and employees. We may enable students and others to share their personal information with each other and with third parties and to communicate and share information into and across our platform. Our data processing activities may subject us to numerous data privacy and security obligations, including foreign, federal, state, and local laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations regarding privacy and the collection, storing, sharing, using, processing, disclosing and protecting of personal information and other user data, including from minors under the age of 18, the scope of which are changing, subject to differing interpretations, and which may be costly to comply with and may be inconsistent between countries and jurisdictions or conflict with other rules.

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

Additionally, regulators are increasingly scrutinizing companies that process children’s data. Numerous laws, regulations, and legally binding codes, such as the Children’s Online Privacy Protection Act (“COPPA”), California’s Age Appropriate Design Code, the CCPA, other U.S. state comprehensive privacy and social media laws, the GDPR, and the UK Age Appropriate Design Code impose various obligations on companies that process children’s data, including requiring certain consents to process such data and extending certain rights to children and their parents with respect that data. Some of these obligations have wide ranging applications, including for services that do not intentionally target child users (defined in some circumstances as a user under the age of 18 years old). These laws may be, or in some cases, have already been, subject to legal challenges and changing interpretations, which may further complicate our efforts to comply with these laws.

Table of Contents

Students who use some of our services, including high school students who use our services, may be under the age of 18. Accordingly, our business is subject to certain laws covering the protection of minors. For example, various U.S. and international laws restrict the distribution of materials considered harmful to minors and impose additional restrictions on the ability of online services to collect information from minors.

Additionally, we may be subject to certain marketing laws that govern our use of personal information. For example, the CAN-SPAM and the TCPA impose specific requirements on communications with customers. For example, the TCPA imposes various consumer consent requirements and other restrictions on certain telemarketing activity and other communications with consumers by phone, fax or text message. Furthermore, under various other privacy laws and other obligations, we may be required to obtain certain consents to process personal data.

Foreign privacy, data protection, and other laws and regulations, particularly in Europe, are often at least as restrictive as, if not more restrictive than, those in the United States. 13,709/2018), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal data.

In addition, some countries (including Europe) and states are considering or have passed legislation implementing requirements with respect to cross-border transfers of data or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our services. For example, in the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area ("EEA") and the United Kingdom ("UK") have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses (“SCCs”), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. In addition, Switzerland similarly restricts personal data transfers outside of those jurisdictions to countries that do not provide an adequate level of personal data protection.

Furthermore, European legislative proposals and present laws and regulations – other than the EU and UK GDPR – apply to cookies and similar tracking technologies, electronic communications, and marketing and regulators are increasingly focusing on compliance with requirements related to the behavioral, interest-based, or tailored advertising ecosystem. Compliance with these laws may require us to make significant operational changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, and subject us to liabilities.

Outside of Europe, other laws further regulate behavioral, interest-based, or tailored advertising, making certain online advertising activities more difficult and subject to additional scrutiny. For example, the CCPA grants California residents the right to opt-out of a company’s sharing of personal data for advertising purposes in exchange for money or other valuable consideration.

Table of Contents

We use AI, including generative AI, and ML technologies in our products and services (collectively, “AI/ML” technologies). The development and use of AI/ML present various privacy and security risks that may impact our business. AI/ML are subject to privacy and data security laws, as well as increasing regulation and scrutiny. Several jurisdictions around the world, including Europe and certain U.S. states, including California, have proposed enacted, or are considering laws governing the development and use of AI/ML, such as the EU’s AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

In addition to data privacy and security laws, we may be or may become subject to industry standards adopted by industry groups. For example, we may rely on vendors to process payment card data, and we, or those vendors, may be subject to the Payment Card Industry Data Security Standard (“PCI DSS”), which requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. We also have internal and publicly posted policies regarding, and are bound by contractual commitments with respect to, our collection, processing, use, disclosure, deletion and security of information. The publication of our privacy policies, our contracts and other documentation that provide commitments about data privacy and security can subject us to potential actions and other adverse consequences.

Public scrutiny of Internet privacy issues and actual or perceived failure to comply with our obligations with respect to privacy and data security could harm our business, including by damaging our reputation and relationships with students and educators.

We strive to comply with all applicable laws, policies, contractual obligations, and industry codes of conduct relating to privacy and data protection. However, U.S. federal, state and local, and international laws and regulations regarding privacy and data protection are rapidly evolving and may be inconsistent and we could be deemed out of compliance as such laws and their interpretations change. Our business model materially depends on our ability to process personal data, so we are particularly exposed to the risks associated with the rapidly changing legal landscape. Practices regarding the collection, use, storage, display, processing, transmission and security of personal information by companies, particularly those offering online services, have recently come under increased public scrutiny.

Any failure or perceived failure by us, our personnel, or third parties on which we rely or with which we work to comply with the aforementioned privacy obligations or any compromise of security that results in the unauthorized release or transfer of sensitive information, which may include personal information or other data, may result in significant consequences, including governmental enforcement actions, litigation, additional reporting requirements and/or oversight, bans on processing personal information, orders to destroy or not to use personal information, or public statements against us by consumer advocacy groups or others and could cause students, tutors, educators, partners and others to lose trust in us, which could have an adverse effect on our business. Additionally, such events could lead to loss of customers; interruptions or stoppages in our business operations; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

Noncompliance with certain privacy and data security laws we may be subject to could subject us to particularly significant penalties. For example, violations of federal and state calling/texting/marketing laws can result in civil penalties imposed by the Federal Communications Commission, the Federal Trade Commission, or states attorneys general, or private civil litigation that can seek statutory damages awards of thousands of dollars per violation (i.e., per call or text), which, when aggregated in a class action, can create significant exposure for large volume outreach program. Additionally, the CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Furthermore, under the EU GDPR, companies may face temporary or definitive bans on data processing, fines of up to 20 million Euros or 4% of annual global revenue (whichever is greater), audits and inspections, private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests, among other penalties.

Inability to comply with applicable data transfer restrictions may also present unique risks. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face the interruption or degradation of our operations, the need to relocate

Table of Contents

part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data (including data regarding foreign students) and work with partners, vendors and other third parties, injunctions against our processing or transferring of personal data necessary to operate our business, among other consequences.

We have in the past and may in the future be subject to regulatory investigations and actions or litigation in connection with any noncompliance with our privacy obligations or a security breach or related issue, and we could also be liable to third parties for these types of incidents. For instance, we have been subject to litigation and investigations as a result of past security incidents, as further described in the risk factor titled “The compromise of our information technology systems or data, including through computer malware, viruses, hacking, phishing attacks, spamming and other security incidents, could harm our business and results of operations,” and a consent order has been finally approved and entered by the FTC related to the same, as further described in “Note 10. Commitments and Contingencies,” of our accompanying Notes to Consolidated Financial Statements included in Part II, Item 8, “Consolidated Financial Statements and Supplementary Data” of this Annual Report on Form 10-K. We could face similar actions, or other actions related to our privacy and data security practices, in the future.

We are subject to privacy and cybersecurity laws across multiple jurisdictions which are highly complex, overlapping, and which create compliance challenges that may expose us to substantial costs, liabilities, or loss of customer trust. Our actual or perceived failure to comply with these laws could harm our business.

We have internal and publicly posted policies regarding our collection, processing, use, disclosure, deletion and security of information. Although we endeavor to comply with our policies and documentation, we may at times fail to do so or be accused of having failed to do so. The publication of our privacy policies and other documentation that provide commitments about data privacy and security can subject us to potential actions if they are found to be deceptive, unfair, or otherwise misrepresent our actual practices, which could materially and adversely affect our business, financial condition and results of operations. In addition, compliance with inconsistent or new privacy and cybersecurity laws could impact our business strategies and the availability of previously useful data, increase our potential liability, increase our compliance costs, require changes in business practices and policies and adversely impact our business.

Our business, including our ability to operate internationally, could be adversely affected if new legislation or regulations are adopted or due to changes in interpretations or implementations of current legislation and regulations.

Any new or significant change to applicable laws, regulations or industry standards or practices regarding the use, disclosure or other processing of personal data could adversely affect our business, including insofar as it may require us to modify our products and services and limit our ability to develop new products and services.

For example, proposed or recently adopted EU laws could significantly affect our business in the future. The European Union AI Act establishes a risk-based governance framework for AI and imposes new obligations that may affect our business, such as transparency requirements, training data obligations, and regular evaluations of AI model. The legal landscape with respect to privacy and data security in the U.S. and elsewhere is similarly in flux with a number of pending legislative and regulatory proposals that could have significant impacts on our business, if effected.

In addition, the FTC has moved to revive its recently announced “click-to-cancel” rule, which will require subscription services like Chegg to make it as easy for consumers to cancel their enrollment as it was to sign up. The “click-to-cancel” rule was vacated by the U.S. Court of Appeals for the Eighth Circuit in July 2025, but the FTC submitted a new rulemaking process in January 2026. Other jurisdictions and states, such as California, are contemplating similar legislation. This new legislation and regulation could have a material negative impact on our business, financial condition, and results of operations.

Risks Related to Our Securities

Our failure to regain compliance with the continued listing requirements of the NYSE, or any future failure to remain in compliance with such standards, could result in the delisting of our common stock, which would have an adverse impact on the trading, liquidity and market price of our common stock.

On December 12, 2025, we were notified by the New York Stock Exchange (NYSE) that we are not in compliance with Section 802.01C of the NYSE Listed Company Manual because the average closing price of our common stock as of December 11, 2025 was less than $1.00 over a consecutive 30 trading-day period. On, or around, December 24, 2025 we notified the

Table of Contents

NYSE that we intend to cure the stock price deficiency and to return to compliance with the NYSE continued listing standard. We can regain compliance at any time within an applicable cure period following receipt of the NYSE notice if on the last trading day of any calendar month during the cure period our common stock has a closing share price of at least $1.00 and an average closing share price of at least $1.00 over the 30 trading-day period ending on the last trading day of that month. Under the NYSE’s rules, if we determine that we will cure the stock price deficiency by taking an action that will require stockholder approval at our next annual meeting of stockholders, the price condition will be deemed cured if the price promptly exceeds $1.00 per share, and the price remains above that level for at least the following 30 trading days. We are considering options to regain compliance with the NYSE’s minimum share price requirement or cure the deficiency, which may include, if necessary, effecting a reverse stock split, subject to approval by the board of directors and our stockholders. We cannot guarantee that closing price of our common stock will increase such that we will regain compliance with the NYSE’s minimum share price requirement during the cure period; that, if necessary, we will obtain stockholder approval with respect to a reverse stock split in order to cure the deficiency; or that we will remain in compliance with any of the NYSE’s other applicable continued listing standards. Our failure to regain compliance with the NYSE’s minimum share price requirement within the applicable cure period could lead to suspension and delisting procedures. Any suspension and delisting procedures taken by the NYSE, any future failure to remain in compliance with the NYSE’s continued listing standards, and any subsequent failure to timely resume compliance with the NYSE’s continued listing standards within the applicable cure period, if any, could have adverse consequences, including, among others, reducing the number of investors willing to hold or acquire our common stock, loss of confidence from stakeholders, employees and potential business partners, reducing the liquidity and market price of our common stock, adverse publicity, and a reduced interest in us from investors, analysts and other market participants. A suspension or delisting could impair our ability to raise additional capital through the public markets, result in negative publicity, adversely affect the market liquidity of our securities, decrease securities analysts’ coverage of us, diminish investor, supplier and employee confidence and impair our ability to attract and retain employees by means of equity compensation.

Our stock price has been and will likely continue to be volatile.

The trading price of our common stock has been, and is likely to continue to be, volatile. In addition to the factors discussed in this Annual Report on Form 10-K, the trading price of our common stock may fluctuate significantly in response to numerous factors, many of which are beyond our control, including, among others:

•our announcement of actual results for a fiscal period that are higher or lower than projected results or our announcement of revenues or earnings guidance that is higher or lower than expected;

•issuance of new or updated research or reports by securities analysts, including unfavorable reports or change in recommendation or downgrading of our common stock;

•announcements by us, our competitors, or other parties of significant products or features, technologies (including AI-related developments), acquisitions, strategic relationships and partnerships, joint ventures, or capital commitments;

•actual or anticipated changes in our growth rate relative to our competitors;

•changes in the economic performance or market valuations of actual or perceived comparable companies;

•future sales of our common stock by our officers, directors, and existing stockholders or the anticipation of such sales;

•issuances of additional shares of our common stock or convertible instruments in connection with acquisitions and capital raising transactions;

•share price and volume fluctuations attributable to inconsistent trading volume levels of our shares, including any common stock issued upon conversion of the notes;

•lawsuits threatened or filed against us;

•regulatory developments in our target markets affecting us, students, colleges, brands, or our competitors;

•the U.S. political climate, with a focus on cutting budgets, higher education, and taxation;

•terrorist attacks or natural disasters or similar events impacting countries where we operate; and

•general economic and market conditions.

These fluctuations often have been unrelated or disproportionate to the operating performance of those companies. Technology companies have been particularly susceptible to stock price volatility. In the past, companies that have experienced volatility in the market price of their stock have been subject to securities class action litigation. We have been and may continue to be the target of this type of litigation in the future. Securities litigation against us could result in substantial costs and divert our management’s attention from other business concerns, which could seriously harm our business and results of operations.

Table of Contents

We may be subject to short-selling strategies that may drive down the market price of our common stock.

Short selling occurs when an investor borrows a security and sells it on the open market, with the intention of buying identical securities at a later date to return to the lender. A short seller hopes to profit from a decline in the value of the securities between the sale of the borrowed securities and the purchase of the replacement shares. Because it is in the short seller’s best interests for the price of the stock to decline, some short sellers publish, or arrange for the publication of, opinions or characterizations regarding the relevant issuer, its business prospects, and similar matters calculated to or which may create negative market momentum. Short sellers can publicly attack a company’s reputation and business on a broader scale via online postings. In the past, the publication of such commentary about us by a disclosed short seller has precipitated a decline in the market price of our common stock, and future similar efforts by other short sellers may have similar effects.

In addition, if we are subject to unfavorable allegations promoted by short sellers, even if untrue, we may have to expend a significant amount of resources to investigate such allegations and defend ourselves from possible shareholder suits prompted by such allegations, which could adversely impact our business, results of operations, and financial condition.

Delaware law and provisions in our restated certificate of incorporation and restated bylaws could make a merger, tender offer or proxy contest difficult, thereby depressing the trading price of our common stock.

Our status as a Delaware corporation and the anti-takeover provisions of the Delaware General Corporation Law may discourage, delay or prevent a change in control by prohibiting us from engaging in a business combination with an interested stockholder for a period of three years after the person becomes an interested stockholder, even if a change of control would be beneficial to our existing stockholders. In addition, our restated certificate of incorporation and restated bylaws contain provisions that may make the acquisition of our company more difficult, including the following:

•our Board is classified into three classes of directors with staggered three-year terms and directors can only be removed from office for cause and by the approval of the holders of at least two-thirds of our outstanding common stock;

•subject to certain limitations, our Board has the sole right to set the number of directors and to fill a vacancy resulting from any cause or created by the expansion of our Board, which prevents stockholders from being able to fill vacancies on our Board;

•only our Board is authorized to call a special meeting of stockholders;

•our restated certificate of incorporation authorizes undesignated preferred stock, the terms of which may be established and shares of which may be issued, without the approval of the holders of common stock;

•advance notice procedures apply for stockholders to nominate candidates for election as directors or to bring matters before an annual meeting of stockholders;

•our stockholders cannot act by written consent;

•our restated bylaws can only be amended by our Board or by the approval of the holders of at least two-thirds of our outstanding common stock; and

•certain provisions of our restated certificate of incorporation can only be amended by the approval of the holders of at least two-thirds of our outstanding common stock.

In addition, our restated certificate of incorporation provides that the Court of Chancery of the State of Delaware shall be the sole and exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a breach of fiduciary duty, any action asserting a claim against us arising pursuant to the Delaware General Corporation Law, our restated certificate of incorporation, or our bylaws, or any action asserting a claim against us that is governed by the internal affairs doctrine. This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees. This exclusive forum provision will not apply to claims that are vested in the exclusive jurisdiction of a court or forum other than the Court of Chancery of the State of Delaware, or for which the Court of Chancery of the State of Delaware does not have subject matter jurisdiction. For instance, the provision would not preclude the filing of claims brought to enforce any liability or duty created by the Exchange Act or Securities Act of 1933, as amended (Securities Act) or the rules and regulations thereunder in federal court.

Table of Contents

Our securities repurchase program could affect the price of our common stock and increase volatility and may be suspended or terminated at any time, which may result in a decrease in the trading price of our common stock.

The timing, volume, and nature of the repurchases will be determined by management based on the capital needs of the business, market conditions, applicable legal requirements, alternative investment opportunities, and other factors. As of February 20, 2026, as a result of the Note Repurchase Transaction defined in the following risk factor, we had $122.4 million remaining under the securities repurchase program. The securities repurchase program has no expiration date and will continue until otherwise suspended, terminated or modified at any time for any reason by our Board.

The existence of our securities repurchase program could also cause the price of our common stock to be higher than it would be in the absence of such a program and could reduce the market liquidity for our common stock. Any repurchases made pursuant to our securities repurchase program, including for our goal of repurchasing our outstanding 2026 notes by the end of 2026, will diminish our cash reserves, which could impact our ability to further develop our business and service our indebtedness. There can be no assurance that any repurchases will enhance stockholder value because the market price of our common stock may decline below the levels at which we repurchased such shares. Any failure to repurchase securities after we have announced our intention to do so may negatively impact our reputation and investor confidence in us and may negatively impact our stock price. Although our securities repurchase program is intended to enhance long-term stockholder value, short-term price fluctuations could reduce the program’s effectiveness.

In August 2020, we issued $1.0 billion in aggregate principal amount of 2026 notes, which as of December 31, 2025 had an outstanding principal amount of $53.9 million. On February 13, 2026, we entered into an individual, privately negotiated repurchase agreement with a holder of our outstanding 2026 notes to repurchase $20.0 million in aggregate principal amount of the 2026 notes for an aggregate cash repurchase price of $19.4 million (the “Notes Repurchase Transaction”). The Notes Repurchase Transaction was entered into in connection with our previously announced securities repurchase program and closed on February 20, 2026. Following the closing, $33.9 million aggregate principal amount of the 2026 notes remain outstanding

Our ability to make scheduled payments of or to refinance our indebtedness, including the 2026 notes, depends on our future performance, which is subject to many factors, including, economic, financial, competitive and other, beyond our control. Our ability to refinance the 2026 notes will depend on the capital markets and our financial condition at such time. Given the volume of our repurchases of the 2026 notes to date and our intention to repurchase all of the outstanding 2026 notes by the end of 2026, our future repurchases may be restrained by the quantity available for sale on the capital markets. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations, and limit our flexibility in planning for and reacting to changes in our business.

Holders of the 2026 notes will have the right to require us to repurchase all or a portion of their 2026 notes upon the occurrence of a fundamental change, which includes if our common stock ceases to be listed on the New York Stock Exchange, before the maturity date at a repurchase price equal to 100% of the principal amount of the 2026 notes to be repurchased, plus accrued and unpaid interest, if any. However, we may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of 2026 notes surrendered therefore or pay cash with respect to 2026 notes being converted. If we elect to deliver shares of our common stock to settle such conversion, the issuance of our common stock may cause immediate and significant dilution.

Our failure to repurchase the 2026 notes at a time

Table of Contents

when the repurchase is required by the indenture or to pay cash upon conversions of 2026 notes as required by the indenture would constitute a default under the indenture. A default under the indenture or the fundamental change itself could also lead to a default under agreements governing any future indebtedness. If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the 2026 notes or to pay cash upon conversions of 2026 notes.

General Risk Factor

Our operations are susceptible to earthquakes, floods, rolling blackouts and other types of power loss, and public health crises. If these or other natural or man-made disasters were to occur, our business and results of operations would be adversely affected.

We may not be able to effectively shift our operations due to disruptions arising from the occurrence of such events, and our business and results of operations could be affected adversely as a result.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

ITEM 1C. CYBERSECURITY

Chegg and its Board recognize the critical importance of maintaining the trust and confidence of our students, business partners, and employees. We have established an ISP utilizing the National Institute of Standards and Technology Cybersecurity Framework as an authoritative source of cybersecurity standards and framework for measurement. The ISP is comprised of the following components: (i) policies which describe the core requirements and design aspects of the program, (ii) standards that provide quantifiable and prescriptive requirements to meet the program's design, (iii) processes that provide operational requirements to meet the ISP's policies and standards consistently, and (iv) implementation playbooks which are created, maintained, and used by the respective team responsible for implementation.

The ISP has three core functions underlying its design, which are intended to provide Chegg with appropriate oversight and governance to execute, monitor, measure and report on the performance of the program in a consistent manner:

•management (control owners) have a responsibility to own and manage risks associated with day-to-day operations, including the design, implementation, and ongoing operation of controls;

•compliance and cybersecurity teams enable the identification of emerging risks in daily operation of our business, providing compliance and oversight in the form of frameworks, policies, tools, and techniques to support management; and

•third-party independent assessors provide objective evaluation by assessing whether the first and second functions above are operating successfully, providing assurance that controls are effective in both design and operation.

The Audit Committee of the Board (the “Audit Committee”) provides independent oversight of the ISP. As a component of the ISP, the Audit Committee receives a report on the health and performance of the ISP on at least an annual basis. The Audit Committee provides guidance and oversight to help ensure the ISP meets the needs of all interested parties and fulfills its core functions. Management provides the Audit Committee a quarterly update on cybersecurity risks and incidents. Cybersecurity risks, including through oversight of the ISP, are considered alongside other operational and strategic risks as part of Chegg’s broader risk management and reporting.

Our Trust and Security organization (“T&S”) is responsible for implementing the ISP. T&S is led by our Chief Information Security Officer (“CISO”) who reports to our Chief Technology Officer (“CTO”). T&S is made up of two sub-teams, each led by a director who reports to the CISO:

•Information Security, which is responsible for implementing all aspects of the ISP and is structured around the following pillars: (i) Application Security, (ii) Infrastructure (Cloud) Security, (iii) Corporate IT Security, and (iv) Security Operations.

Table of Contents

•Compliance and Privacy, which is responsible for assessing and preparing internal teams for regulatory compliance pertaining to information security, secured financial reporting, and privacy and is structured around the following pillars: (i) Privacy, (ii) Compliance, (iii) Vendor Risk Management, (iv) Security Awareness, (v) Governance and Risk Management, and (vi) Privacy and Abuse Engineering.

Our CISO has served various roles in information technology and security for over 25 years, including serving as CISO. Our CISO holds an undergraduate degree in Information Technology with a specialization in Information Assurance and Security and was a distinguished graduate of the US Air Force Secure Communications school. Our CTO holds an undergraduate degree in computer science and has more than 25 years of experience in technology and operations.

During the year ended December 31, 2025, Chegg did not experience any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For discussion of our risk factors relating to cybersecurity and data privacy, see the “Risks Related to Data Privacy” section included in Part I, Item 1A, “Risk factors” of this Annual Report on Form 10-K.

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
RBB	an hour ago
TETEF	an hour ago
CHGG	an hour ago
SABS	an hour ago
TREE	2 hours ago
CHRS	2 hours ago
ACIC	2 hours ago
EDIT	2 hours ago
AMPY	2 hours ago
GLRE	2 hours ago
NL	2 hours ago
FSP	2 hours ago
OYSE	2 hours ago
OWLT	2 hours ago
RAIL	2 hours ago
SVCC	2 hours ago
HTBK	2 hours ago
FIGX	2 hours ago
OSUR	2 hours ago
ACCO	2 hours ago
NPWR	2 hours ago
ZVRA	2 hours ago
MYO	2 hours ago
CRBP	2 hours ago
RBOT	2 hours ago
RPAY	2 hours ago
SEPN	2 hours ago
KRO	2 hours ago
MGNX	2 hours ago
DSGN	2 hours ago
EGBN	2 hours ago
FISI	2 hours ago
BOX	2 hours ago
CTM	2 hours ago
ALXO	2 hours ago
DDD	2 hours ago
TIPT	2 hours ago
VYGR	2 hours ago
EBMT	3 hours ago
BCBP	5 hours ago
BETA	9 hours ago
CRCL	10 hours ago
DY	10 hours ago
GBTG	10 hours ago
SPRB	11 hours ago
DNTH	11 hours ago
BOLD	11 hours ago
RNAC	11 hours ago
CCRN	12 hours ago
MASS	12 hours ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - CHGG

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - CHGG

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing