Alphabet Inc.
For the period ended Sep 30, 2026. Filed Oct 29, 2026.
View on SEC.govAbout this filing
A company's report for each of its first three quarters. The financial statements are not audited. It shows how the business has moved since the last annual report, and what management says changed.
Sep 30, 2026 · Filed Oct 29, 2026
GOOGL$288.15+1.2%Stored close · as of Nov 9, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-Q
Period ended 2026-06-30; filed 2026-07-23.
0001652044-26-000071
Item 1A. Risk FactorsUnregistered Sales of Equity Securities and Use of ProceedsCurrent report: 10-Q
Period ended 2026-09-30; filed 2026-10-29.
0001652044-26-000084
Item 1A. Risk FactorsUnregistered Sales of Equity Securities and Use of ProceedsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 37 previous paragraphs and 54 current paragraphs.
29 unchanged; 5 reworded; 20 added; 1 removed; 2 previous and 0 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (20)
Current report
Issues in the development and use of AI may result in reputational harm and increased liability exposure.
Current report
Our evolving AI-enabled products and services, including our development and deployment of AI agents, expose us to risks involving harmful content, inaccuracies, discrimination, product liability, intellectual property infringement or misappropriation, rights of publicity claims, defamation, data privacy, cybersecurity, minor protection, and other issues. As a result, deploying AI systems and agents could subject us to competitive harm, regulatory action, legal liability (including under new and proposed regulations), new applications of existing data protection, privacy, intellectual property, and other laws, and brand or reputational harm.
Current report
Some uses of AI will present ethical issues and may have broad effects on society. Although we have already devoted and will continue to invest significant resources to develop and deploy AI responsibly, the probabilistic nature of AI models means we may not be able to anticipate, identify, or resolve all AI-related issues, deficiencies, and failures before they arise. During model testing, we have sometimes observed unexpected behavior, including autonomous agents taking actions outside of their intended scope. Furthermore, as our AI systems increasingly orchestrate multi-step tasks and interact autonomously with third-party tools, applications, and APIs, errors or misalignments in one component may compound across the workflow, potentially leading to operational, technical, or transactional failures, unauthorized actions, or unforeseen liabilities for us or third parties. In the event of an incident, we may be unable to isolate root causes or detect and respond in a timely manner, and we may face difficulties identifying similar incidents in the future, any of which could subject us to heightened regulatory scrutiny, enforcement actions, or litigation. Unintended consequences, misalignment, misuse, abuse, or customization of our AI tools and systems, which we may not be able to prevent or control, could lead to severe or catastrophic security and societal incidents, or negatively affect human rights, privacy, cybersecurity, employment, public health, or other safety, ethical, and societal interests. Any such occurrences may result in litigation, brand or reputational damage, adverse legislation, increased regulatory scrutiny, orders or requirements to withdraw, retrain, or modify deployed models, and operational shutdowns or injunctions, any of which could harm our business, financial condition, and operating results.
Current report
Data privacy and security concerns relating to our technology and our practices could harm our reputation, cause us to incur significant liability, and deter current and potential users or customers from using our products and services. Computer viruses, software bugs or defects, security breaches, and attacks on our systems could result in the improper disclosure and use of user data and interference with our users' and customers' ability to use our products and services, harming our business and reputation.
Current report
Our products and services involve the storage, handling, and transmission of proprietary and other sensitive information. Malicious software such as viruses, software bugs, theft, misuse, defects, vulnerabilities in our products and services, as well as cyber attacks, phishing schemes, and other types of security attacks, which increasingly use AI and AI agents, expose us to a risk of loss or improper use and disclosure of such information, which could result in litigation and other potential liabilities, including regulatory fines and penalties, as well as reputational harm. Our technologies have contained, and are likely in the future to contain, undetected errors, bugs, or vulnerabilities, some of which we may discover only after the code is released. The use of AI to find and exploit vulnerabilities is accelerating timelines on which such vulnerabilities may be discovered and exploited by threat actors. Systems and control failures, security breaches, failure to comply with our data protection policies, and inadvertent disclosure of user data could result in regulatory and legal exposure, harm our reputation and business, and impair our ability to attract and retain users or customers. Such incidents have occurred in the past and may continue to occur, and we expect to continue to expend significant resources to maintain security protections that limit the effect of bugs, theft, misuse, and security vulnerabilities or breaches. Concerns regarding our handling of personal data or other data-privacy-related matters, even if unfounded, could harm our business, reputation, financial condition, and operating results.
Current report
We continue to incorporate AI-based features, including AI agents, into our offerings and internal systems. These technologies may introduce novel and unanticipated security threats as our and the market’s understanding of AI-centric risks evolves. In particular, the deployment of and interaction with AI agents presents heightened cybersecurity risks where AI agents may be exploited by malicious actors to facilitate hacking, data exfiltration, privilege escalation, or lateral movement within our systems or the systems of our partners and customers. AI agents may also be vulnerable to prompt injection, adversarial manipulation, or other novel attack vectors that could cause them to bypass access controls, disclose sensitive data, or take unauthorized actions. Furthermore, agentic AI systems that can take actions autonomously may experience model misalignment, fail to work as intended, malfunction, make unintended decisions, or execute multi-step actions without adequate human review, which could lead to accessing systems or executing actions outside their intended scope, data leakage or loss, operational disruption, erroneous transactions, harm to individuals and businesses, cybersecurity incidents, or noncompliance with laws such as the Computer Fraud and Abuse Act or other legal frameworks. In addition, our increasing internal reliance on AI-driven tools and autonomous agents to assist in writing, testing, and deploying software across our production environments and core infrastructure may introduce undetected vulnerabilities, coding errors, or architectural defects that could degrade system reliability or expose us to heightened cybersecurity risks. Because these risks are inherent in emerging and rapidly evolving technology, our existing security frameworks and controls may not fully anticipate, detect, or address them.
Current report
We experience cyber attacks and other attempts to gain unauthorized access to our systems on a regular basis. These attacks, which increasingly leverage AI to breach systems, target employees, or impersonate senior management, continue to evolve in sophistication and volume and may be difficult to detect. We have also seen, and will continue to see, industry-wide software supply chain vulnerabilities and attacks on telecommunications and other critical infrastructure, as well as by nation-states and state-sponsored actors. These attacks may target us or our customers, particularly our public sector customers (including federal, state, and local governments). Geopolitical tensions or armed conflicts, such as the ongoing conflicts in the Middle East and Ukraine, may increase these risks. Our efforts to prevent security incidents may require significant additional resources and could increase the risk of retaliatory attacks.
Current report
Security and privacy incidents may also arise from employee or insider error or malfeasance, system errors, or vulnerabilities in our or other parties' systems. If partners, service providers, or other third parties with whom we share information fail to implement adequate data-security practices or suffer a security breach, our users’ data may be improperly accessed, used, or disclosed.
Current report
While we may not determine certain issues to be material at the time they occur, there is no guarantee that these issues will not ultimately result in significant legal, financial, and reputational harm, including government inquiries, enforcement actions, litigation, and negative publicity. A series of related issues may be determined to be material in the aggregate at a later date, even if not material individually at the time of their occurrence. Because the techniques used to obtain unauthorized access to, disable, or degrade service provided by or otherwise sabotage systems change frequently and often are not recognized until deployed, we may be unable to anticipate certain attacks or implement adequate preventative measures. Any actual or perceived breach, whether of our systems or those of our business partners or service providers, could undermine market confidence in our security measures, result in the loss of users and customers, compromise trade secrets, and expose us to significant legal claims, regulatory actions, fines, and penalties.
Current report
While we have dedicated significant resources to incident response capabilities, including worldwide incident response teams, our response process may not be adequate or fast enough to limit or prevent harm or may fail to accurately assess the severity of or sufficiently remediate an incident. As a result, we may suffer significant legal, reputational, or financial exposure, which could harm our business, financial condition, and operating results.
Current report
For additional information, see also our risk factor on privacy and data protection regulations under 'Risks Related to Laws, Regulations, and Policies' below.
Current report
We are and may continue to be subject to claims, lawsuits, regulatory and government inquiries and investigations, enforcement actions, consent orders, and other forms of regulatory scrutiny and legal liability, including competition matters, that could harm our business, reputation, financial condition, and operating results.
Current report
We are subject to claims, lawsuits, regulatory and government inquiries and investigations, other proceedings, and orders involving competition, intellectual property, AI, data privacy and security, tax and related compliance, labor and employment, commercial disputes, content generated by our users, goods and services offered by advertisers or publishers using our platforms, design of our products and services, personal injury and other tort and nuisance theories, consumer protection claims, including how we moderate content on our platforms, AI, and other matters.
Current report
The US Department of Justice (DOJ), various states, and other plaintiffs have filed, and may continue to file in the future, several antitrust lawsuits about aspects of our business, including our advertising technologies and practices, the operation and distribution of Google Search, and the operation and distribution of Android operating system and Play Store. Adverse rulings in these or related competition proceedings have resulted, and may in the future result, in court-ordered remedies that mandate substantial alterations to our commercial agreements, product integrations and functionality, and business models. These remedies could include prohibitions or restrictions on default distribution arrangements and revenue-sharing agreements, requirements to share or license search data and provide syndication services to rivals, changes to app store billing and distribution practices, or structural relief such as the required divestiture of certain advertising technology assets or other business units. Implementing any such operational changes, product modifications, or structural separations could significantly impair our distribution reach, reduce user engagement and advertising revenues, increase compliance and operating costs, and harm our business, reputation, financial condition, and operating results. For additional information about such lawsuits, see Legal Matters in Note 10 of the Notes to Consolidated Financial Statements included in Part I, Item 1 of this Quarterly Report on Form 10-Q.
Current report
In addition to these regulatory proceedings, private individual and collective actions that overlap with claims pursued by regulators are pending in the US and in several other jurisdictions. Adverse results in these or similar future lawsuits may include awards of monetary damages and remedies that could harm our business, reputation, financial condition, and operating results. Other regulatory agencies in the US and around the world, including competition enforcers, consumer protection agencies, and data protection authorities, have challenged and may continue to challenge our business practices and compliance with laws and regulations. We are cooperating with these investigations and defending litigation or appealing decisions where appropriate.
Current report
We are, and will continue to be, subject to a variety of claims including product warranty, product liability, and consumer protection claims related to alleged inaccuracies or omissions in product, service, or marketing disclosures and product defects, among other litigation. We are also, and will continue to be, subject to claims involving health and safety, hazardous materials usage, other environmental effects, AI training, development, and commercialization, or service disruptions or failures. Claims have been brought, and we expect will continue to be brought, against us for defamation, negligence, breaches of contract, patent, copyright, and trademark infringement, trade secret misappropriation, unfair competition, violation of the Computer Fraud and Abuse Act and similar laws, unlawful activity, torts, product liability, privacy rights violations, fraud, misrepresentations, or other legal theories based on the nature and content of information available on or via our services, the design and effect of our products and services, or due to our involvement in hosting, transmitting, marketing, branding, or providing access to content created by third parties. We are also defending claims and responding to inquiries and suits relating to our platforms and services, including allegations and trials involving youth-related issues, which could result in substantial fines, settlements, or operational restrictions.
Current report
Various laws, regulations, investigations, enforcement lawsuits, and regulatory actions have involved in the past, and may in the future result in substantial fines and penalties, injunctive relief, ongoing monitoring and auditing obligations, changes to our products and services, alterations to our business models and operations, including divestiture, and collateral-related civil litigation or other adverse consequences. Any of these legal proceedings could also result in legal costs, diversion of management resources, and negative publicity, all of which could harm our business, reputation, financial condition, and operating results.
Current report
Estimating liabilities for our pending proceedings is a complex, fact-specific, and speculative process that requires significant judgment, and the amounts we are ultimately liable for may differ from our estimates. The resolution of one or more such proceedings has resulted in, and may in the future result in, additional substantial fines, penalties, injunctions, and other sanctions that could harm our business, reputation, financial condition, and operating results.
Removed paragraphs (1)
Previous report
On June 4, 2026, the company completed a $10.0 billion private placement of 14 million Class A and 14 million Class C shares to an affiliate of Berkshire Hathaway Inc. pursuant to an exemption from registration under section 4(a)(2) of the Securities Act of 1933, as amended.
Reworded paragraphs (5)
Previous wording
Within Google Services, we continue to invest in devices, including our smartphones, home devices, and wearables, which is a highly competitive market with frequent introduction of new products and services, rapid adoption of technological advancements by competitors, increased market saturation in developed countries, short product life cycles, evolving industry standards, continual improvement in performance characteristics, and price and feature sensitivity on the part of consumers and businesses. There can be no assurance we will be able to provide devices that compete effectively.
Current wording
Within Google Services, we continue to invest in consumer devices, including our smartphones, home devices, and wearables, which is a highly competitive market with frequent introduction of new products and services, rapid adoption of technological advancements by competitors, increased market saturation in developed countries, short product life cycles, evolving industry standards, continual improvement in performance characteristics, and price and feature sensitivity on the part of consumers and businesses. There can be no assurance we will be able to provide devices that compete effectively.
Previous wording
To meet the AI compute capacity demands of our customers, we are engaging in the supply of TPU systems which may increase our costs and operational complexity. We also have a number of large, long-duration commercial agreements, which could increase our liabilities and obligations in the event of nonperformance by us, our counterparties, or vendors. These include certain financial guarantees, such as backstops to support the build-out of third-party data centers and power infrastructure. In the event of such nonperformance or industry challenges, we may incur additional liabilities, have excess capacity that we cannot easily redeploy, and not receive payments from our counterparties or customers.
Current wording
To meet both internal and customer AI compute capacity demands, we have entered into significant long-term supply agreements, energy service agreements, and leasing arrangements with third parties, which involve substantial obligations and increased operational complexity. We also have a number of large, long-duration commercial agreements, which could increase our liabilities and obligations. These include certain contingent commitments, such as backstops and financial guarantees to support the build-out of third-party data centers and power infrastructure, and contingent repurchase obligations for certain hardware and embedded software at prices below original cost. In the event of nonperformance by us, our counterparties, or vendors, the exercise of repurchase rights, or industry challenges, we may incur additional liabilities, have excess capacity or inventory that we cannot easily redeploy, and not receive payments from our counterparties or customers. Depending upon market conditions, these additional costs or exposures could be significant.
Previous wording
•Various US federal, US state, and foreign privacy laws related to the processing and security of personal data, including (1) comprehensive privacy laws that provide data privacy rights (including, in California, a private right of action in the event of a data breach resulting from our failure to implement and maintain reasonable security procedures and practices) and impose significant obligations on controllers and processors of consumer data; (2) laws imposing obligations on businesses that collect or disclose biometric information (including, in Colorado, Illinois, Texas, and Washington); (3) laws governing the collection and processing of children and minor's data and how companies provide age-appropriate online experiences
Current wording
•Various US federal, US state, and foreign privacy laws related to the processing and security of personal data, including (1) comprehensive privacy laws that provide data privacy rights (including, in California, a private right of action in the event of a data breach resulting from our failure to implement and maintain reasonable security procedures and practices) and impose significant obligations on controllers and processors of consumer data; (2) laws imposing obligations on businesses that collect or disclose biometric information (including, in Colorado, Illinois, Texas, and Washington); (3) laws governing the collection and processing of children and minor's data and how companies provide age-appropriate online experiences (including, in the US, the Children's Online Privacy Protection Act of 1998; the pending Children and Teens' Online Privacy Protection Act (COPPA 2.0); similar US state laws related to children's privacy, such as the New York Child Data Protection Act; and the UK's Age-Appropriate Design Code); and (4) laws regulating internet-connected devices (such as, in California, the Internet of Things Security Law).
Previous wording
The market prices of our Class A stock or Class C stock is likely to be influenced by any sales under our ATM Program, the issuance of additional Class A stock or Class C stock in connection with the conversion of or dividend payments on our Mandatory Convertible Preferred Stock and our depositary shares, or any other future sales or other issuances of our Class A stock or Class C stock. Market prices could be depressed as a result of: (1) investors’ anticipation of the potential sale or resale, as applicable, under the ATM Program or received upon conversion of our Mandatory Convertible Preferred Stock or our depositary shares; (2) possible sales of our Class A stock or Class C stock by investors who view the Mandatory Convertible Preferred Stock or our depositary shares as a more attractive means of equity participation in us than owning shares of Class A stock or Class C stock; and (3) any hedging or arbitrage trading activity involving the Mandatory Convertible Preferred Stocks or our depositary shares and our Class A stock or Class C stock. There is no assurance that any depression in the market price from such dilution will only be in the short-term or temporary.
Current wording
The market prices of our Class A stock or Class C stock are likely to be influenced by any sales under our ATM Program, the issuance of additional Class A stock or Class C stock in connection with the conversion of or dividend payments on our Mandatory Convertible Preferred Stock and our depositary shares, or any other future sales or other issuances of our Class A stock or Class C stock. Market prices could be depressed as a result of: (1) investors’ anticipation of the potential sale or resale, as applicable, under the ATM Program or received upon conversion of our Mandatory Convertible Preferred Stock or our depositary shares; (2) possible sales of our Class A stock or Class C stock by investors who view the Mandatory Convertible Preferred Stock or our depositary shares as a more attractive means of equity participation in us than owning shares of Class A stock or Class C stock; and (3) any hedging or arbitrage trading activity involving the Mandatory Convertible Preferred Stocks or our depositary shares and our Class A stock or Class C stock. There is no assurance that any depression in the market price from such dilution will only be in the short-term or temporary.
Previous wording
Delaware General Corporation Law. Our common stock cash dividend program does not require, and our Board of Directors may decide not to declare, a cash dividend each quarter, and does not obligate our Board of Directors to declare a dividend at any specific dollar amount per share. Any such decision by our Board of Directors may depend on a variety of factors that it may deem relevant, including but not limited to our earnings, liquidity, financial condition, other capital deployment opportunities, level of indebtedness and general market conditions. Separately, we are contractually required to make regular dividend payments on our Mandatory Convertible Preferred Stock, which will diminish our cash reserves or cause dilution if we elect to settle in shares.
Current wording
Our cash dividend program pays regular cash dividends to our Class A, Class B, and Class C stockholders. Any and all future cash dividends on our common stock are subject to declaration by our Board of Directors in its sole discretion, and in accordance with the requirements of any applicable laws, rules and regulations, including the Delaware General Corporation Law. Our common stock cash dividend program does not require, and our Board of Directors may decide not to declare, a cash dividend each quarter, and does not obligate our Board of Directors to declare a dividend at any specific dollar amount per share. Any such decision by our Board of Directors may depend on a variety of factors that it may deem relevant, including but not limited to our earnings, liquidity, financial condition, other capital deployment opportunities, level of indebtedness and general market conditions. Separately, we are contractually required to make regular dividend payments on our Mandatory Convertible Preferred Stock, which will diminish our cash reserves or cause dilution if we elect to settle in shares.
Rearranged previous paragraphs (2)
Previous report — wording carried elsewhere
(including, in the US, the Children's Online Privacy Protection Act of 1998; the pending Children and Teens' Online Privacy Protection Act (COPPA 2.0); similar US state laws related to children's privacy, such as the New York Child Data Protection Act; and the UK's Age-Appropriate Design Code); and (4) laws regulating internet-connected devices (such as, in California, the Internet of Things Security Law).
Previous report — wording carried elsewhere
Our cash dividend program pays regular cash dividends to our Class A, Class B and Class C stockholders. Any and all future cash dividends on our common stock are subject to declaration by our Board of Directors in its sole discretion, and in accordance with the requirements of any applicable laws, rules and regulations, including the