TWLO · 10-K filed 24 Feb 2026 · year to 31 Dec 2025

Twilio

25 named things its latest annual report says its results depend on, each in the company's own words. 15 of them are also named by other companies we've read.

Read the filing on SEC.gov ↗

Suppliers

Amazon Web Services (AWS)

depends on · a substantial majority of our cloud infrastructurenamed as a risk

For example, we outsource a substantial majority of our cloud infrastructure to Amazon Web Services (“AWS”), which hosts our products and platform.Risk factors (Item 1A)

Also named by AAON, ABNB, ADSK, AIOT, BLK, CARR, CG, COF and 56 more

U.S. mobile carriers A2P messaging fees

exposed to its pricenamed as a risk

For example, recent increases to A2P messaging fees charged by major U.S. mobile carriers are expected to create a modest headwind on our margins going forward, and such fees may increase further over time.Risk factors (Item 1A)

Network service providers

depends onnamed as a risk

We are exposed to significant fluctuations in applicable fees paid to network service providers, intermediaries, and internet service providers.Risk factors (Item 1A)

Partners and platforms

Google, Yahoo and Microsoft email sender requirements (DMARC)

subject tonamed as a risk

For example, in 2024 and 2025, Google, Yahoo and Microsoft began enforcing new email sender requirements aimed at sender authentication, including Domain-based Message Authentication, Reporting and Conformance (“DMARC”) record requirements, requiring us to devote time and resources toward compliance efforts.Risk factors (Item 1A)

Apple and Google spam filtering

depends onnamed as a risk

For example, Apple, Google, Yahoo and other mobile device operating system providers or inbox service providers have developed, and may in the future develop, new applications or functions intended to filter spam and unwanted phone calls, messages or emails.Risk factors (Item 1A)

Places

International (outside United States)

earns from · 36%named as a risk

In the years ended December 31, 2025, 2024 and 2023, we derived 36%, 35% and 34% of our revenue from customer accounts located outside the United States, respectively.Risk factors (Item 1A)

Also named by DDOG, MDB, MSI, OKTA, ROP, SNOW

Hazards

San Francisco Bay Area earthquakes

operates innamed as a risk

For example, our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity.Risk factors (Item 1A)

Also named by FFIV, FTNT, PANW, PLTR, PYPL, RBRK, RDDT, XYZ and 1 more

Commodities and inputs

Euro

exposed to its pricenamed as a risk

We have implemented a program to hedge transactional exposure against the Euro, and may do so in the future with respect to other foreign currencies.Risk factors (Item 1A)

Also named by ABBV, ABNB, ABT, ADBE, ADI, AME, AMG, AMGN and 186 more

Numbering Resources (phone numbers, short codes)

depends onnamed as a risk

If we are unable to acquire or retain Numbering Resources, our voice and messaging products may be less attractive to potential customers.Risk factors (Item 1A)

Regulators

Federal Communications Commission (FCC)

subject tonamed as a risk

Additionally, as a provider of interconnected VoIP service, we must also comply with certain U.S. federal privacy laws and regulations, including Section 222 of the Communications Act of 1934, as amended, and the FCC’s customer proprietary network information rules.Risk factors (Item 1A)

Also named by AIOT, AMT, ANET, ASTS, CCI, CMCSA, DIS, ECHO and 26 more

Laws and programs

General Data Protection Regulation (GDPR)

subject to · up to 4% of our worldwide revenuenamed as a risk

For example, under the GDPR, regulators may impose temporary or definitive bans on data transfers or other processing, require deletion, and impose significant fines, potentially ranging up to 4% of our worldwide revenue.Risk factors (Item 1A)

Also named by A, AB, ABNB, ADBE, ADP, AGX, AIOT, AJG and 100 more

OECD Pillar Two global minimum tax

subject to · 15%named as a risk

As another example, the Organization for Economic Co-operation and Development (the “OECD”) has proposed a global minimum tax (“Pillar Two”), contemplating a minimum tax rate of 15% for large multinational companies, and various countries have proposed or enacted implementing legislation.Risk factors (Item 1A)

Also named by ABNB, ACN, ADI, ADM, ADSK, AKAM, ALB, AMAT and 70 more

Indirect taxes reserve

subject to · $42.8 millionnamed as a risk

We reserved $42.8 million on our December 31, 2025 balance sheet for these tax payments.Risk factors (Item 1A)

California Consumer Privacy Act (CCPA)

subject tonamed as a risk

In the United States, for example, the California Consumer Privacy Act (as amended by the California Privacy Rights Act of 2020, the “CCPA”) provides our customers, employees, and other individuals certain rights related to their personal information.Risk factors (Item 1A)

Also named by AAP, AIOT, AKAM, ALL, APP, AYI, BAC, BBSI and 69 more

One Big Beautiful Bill Act (OBBB Act)

subject tonamed as a risk

The OBBB Act could potentially increase our effective tax rate as we continue to expand our international operations in the coming years.Risk factors (Item 1A)

Also named by AA, ABR, ADI, ADM, ALB, AMAT, AMGN, AMKR and 121 more

EU AI Act

subject tonamed as a risk

For example, we expect increased global regulation in the use of AI and ML such as the recent AI Act in Europe, which imposes onerous obligations related to the development, placement on the market and use of AI systems.Risk factors (Item 1A)

Also named by ACN, ADBE, AMD, AXON, CGNX, CRM, CRWD, CTSH and 36 more

Telephone Consumer Protection Act (TCPA)

subject tonamed as a risk

TCPA violations can result in significant financial penalties, as businesses can incur civil or criminal penalties imposed by the FCC, FTC, state attorneys general or other state actors or through private litigation.Risk factors (Item 1A)

Also named by ADP, AFL, BBW, CART, COMP, CRM, CSGP, FCFS and 9 more

Section 230 of the Communications Decency Act

subject tonamed as a risk

We also cannot predict whether our role in facilitating our customers’ or other users’ activities would expose us to liability under applicable state or federal law, or whether that possibility could become more likely if changes to current laws regulating content moderation, such as Section 230 of the Communications Decency Act, are enacted.Risk factors (Item 1A)

Also named by APP, DOCN, EBAY, GOOG, META, PPLI, RBLX, RDDT and 1 more

CAN-SPAM Act

subject tonamed as a risk

If we were found to be in violation of the CAN-SPAM Act, applicable state laws governing email not preempted by the CAN-SPAM Act or foreign laws regulating the distribution of email, whether as a result of violations by our customers or our own acts or omissions, we could be required to pay large penalties, which would adversely affect our financial condition, significantly harm our business, injure our reputation and erode customer trust.Risk factors (Item 1A)

Also named by KVYO, ZETA

E.U.-U.S. Data Privacy Framework

subject tonamed as a risk

As a result of this uncertainty, we have encountered hesitancy, reluctance or refusal by European and multinational customers to use our services.Risk factors (Item 1A)

Also named by PANW

CTIA Shortcode Agreement and The Campaign Registry

subject tonamed as a risk

Our customers’ and other users’ promotion of their products and services through our platform might not comply with federal, state, and foreign laws or of contractual requirements imposed by carriers, such as the CTIA Shortcode Agreement, The Campaign Registry, carrier codes of conduct and similar policies.Risk factors (Item 1A)

FCC net neutrality rules

subject tonamed as a risk

For example, in January 2025, the U.S. Court of Appeals for the Sixth Circuit struck down the FCC’s net neutrality rules, and it is unlikely that similar federal rules will be adopted.Risk factors (Item 1A)

California NOL limitation

subject tonamed as a risk

For example, California legislation limits the use of state NOLs for taxable years beginning on or after January 1, 2024 and before January 1, 2027.Risk factors (Item 1A)

HIPAA

subject to

In addition, we support customer workloads involving the processing of protected health information and are required to sign business associate agreements with customers that subject us to certain requirements under federal and state laws governing health information, such as the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009.Risk factors (Item 1A)

Also named by AFL, BAX, BBSI, CI, DHR, DOC, DOCN, DOCU and 19 more

Technology

One-time passwords (user authentication)

earns fromnamed as a risk

For example, if user authentication practices evolve to reduce or eliminate the use of one-time passwords, our revenue could be adversely affected.Risk factors (Item 1A)