QUINSTREET INC

Previous wording

Furthermore, a substantial portion of our revenue is generated from a limited number of clients, including two clients that accounted for 23% and 18% of our net revenue for three months ended December 31, 2024, and 21% and 16% of our net revenue for six months ended December 31, 2024. Our clients can generally terminate their contracts with us at any time or pause marketing spending without contract termination, and they do not have minimum spend requirements. Clients may also fail to renew their contracts or reduce their level of business with us, leading to lower revenue.

Current wording

Furthermore, a substantial portion of our revenue is generated from a limited number of clients, including one client that accounted for 27% of our net revenue for three months ended March 31, 2025, and two clients that accounted 23% and 13% of our net revenue for nine months ended March 31, 2025. Our clients can generally terminate their contracts with us at any time or pause marketing spending without contract termination, and they do not have minimum spend requirements. Clients may also fail to renew their contracts or reduce their level of business with us, leading to lower revenue.

Previous wording

Nearly all of our products and services are web-based, and online performance marketing is data-driven. As a result, the amount of data stored on our servers is substantial. We gather, transmit, store and otherwise process confidential and proprietary information about our users and marketing and media partners, including personal information. This information may include social security numbers, credit scores, credit card information, and financial and health information, some of which is held, managed or otherwise processed by our third-party vendors. As a result, we are subject to certain contractual terms, including third-party security reviews, as well as federal, state and foreign laws and regulations designed to protect personal information. Complying with these contractual terms and various laws and regulations is expensive and could cause us to incur substantial additional costs or require us to change our business practices in a manner adverse to our business. In addition, cybersecurity incidents, cyber-attacks and other breaches have been occurring globally at a more frequent and severe level, are evolving in nature and will likely continue to increase in frequency and severity in the future. Additionally, some actors are using artificial intelligence technology to launch more automated, targeted and coordinated attacks. Our existing security measures may not be successful in preventing security breaches, cyber-attacks or other similar incidents. As we grow our business, we expect to continue to invest in technology services, hardware and software, such as our QRP product. Creating the appropriate security support for our technology platforms is expensive and complex, and our execution could result in inefficiencies or operational failures and increased vulnerability to security breaches, cyber-attacks and other similar incidents. We may also make commitments to our clients regarding our security practices in connection with clients’ due diligence. If we do not adequately implement and enforce these security policies to the satisfaction of our clients, we could be in violation of our commitments to our clients and this could result in a loss of client confidence, damage to our reputation and loss of business. Despite our implementation of security measures and controls, our information technology and infrastructure are susceptible to circumvention by an internal party or third-party, such as electronic or physical computer break-ins, security breaches, attacks, malware, ransomware, viruses, social engineering (including phishing attacks), denial of service or information, fraud, employee error and other disruptions or similar incidents, including those perpetrated by criminals or nation state actors, that could result in, among other things, third parties gaining unauthorized access to our systems and data (including confidential, proprietary and personal information). Moreover, retaliatory acts by Russia in response to economic sancti…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Nearly all of our products and services are web-based, and online performance marketing is data-driven. As a result, the amount of data stored on our servers is substantial. We gather, transmit, store and otherwise process confidential and proprietary information about our users and marketing and media partners, including personal information. This information may include social security numbers, credit scores, credit card information, and financial and health information, some of which is held, managed or otherwise processed by our third-party vendors. As a result, we are subject to certain contractual terms, including third-party security reviews, as well as federal, state and foreign laws and regulations designed to protect personal information. Complying with these contractual terms and various laws and regulations is expensive and could cause us to incur substantial additional costs or require us to change our business practices in a manner adverse to our business. In addition, cybersecurity incidents, cyber-attacks and other breaches have been occurring globally at a more frequent and severe level, are evolving in nature and will likely continue to increase in frequency and severity in the future. Additionally, some actors are using artificial intelligence technology to launch more automated, targeted and coordinated attacks. Our existing security measures may not be successful in preventing security breaches, cyber-attacks or other similar incidents. As we grow our business, we expect to continue to invest in technology services, hardware and software, such as our QRP product. Creating the appropriate security support for our technology platforms is expensive and complex, and our execution could result in inefficiencies or operational failures and increased vulnerability to security breaches, cyber-attacks and other similar incidents. We may also make commitments to our clients regarding our security practices in connection with clients’ due diligence. If we do not adequately implement and enforce these security policies to the satisfaction of our clients, we could be in violation of our commitments to our clients and this could result in a loss of client confidence, damage to our reputation and loss of business. Despite our implementation of security measures and controls, our information technology and infrastructure are susceptible to circumvention by an internal party or third-party, such as electronic or physical computer break-ins, security breaches, attacks, malware, ransomware, viruses, social engineering (including phishing attacks), denial of service or information, fraud, employee error and other disruptions or similar incidents, including those perpetrated by criminals or nation state actors, that could result in, among other things, third parties gaining unauthorized access to our systems and data (including confidential, proprietary and personal information). Additionally, the use of artificial intelligence by external partie…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Adverse macroeconomic conditions could cause decreases or delays in spending by our clients in response to consumer demand and could harm our ability to generate revenue and our results of operations. Changes in the macroeconomic or market conditions and changes in the regulatory environment have in the past affected, and may continue to negatively affect, our clients’ businesses, marketing practices and budgets and, therefore, impact our business, financial condition, operating results and cash flows.

Current wording

Adverse macroeconomic conditions could cause decreases or delays in spending by our clients in response to consumer demand and could harm our ability to generate revenue and our results of operations. Changes in the macroeconomic or market conditions and changes in the regulatory environment have in the past affected, and may continue to negatively affect, our clients’ businesses, marketing practices and budgets and, therefore, impact our business, financial condition, operating results and cash flows. In 2025, the U.S. government imposed tariffs on a variety of products which are expected to increase costs faced by our insurance and home services clients. Although our clients continually monitor economic and regulatory developments, these tariffs, or reciprocal tariffs imposed on U.S. products by other countries, could result in these clients decreasing or delaying their marketing efforts, which could have a material adverse impact on our revenue and results of operations.

Previous wording

February 2024, the FCC adopted new rules governing the ability of call and text message recipients to revoke consent previously given and thereby “opt-out” of receiving future calls and text messages from a sender. These new rules specify when a call or text message recipient’s consent must be considered revoked and create certain presumptions about other forms of consent revocation that a sender of a call or text message can rebut pursuant to a totality of circumstances test administered by the FCC or a court. They also require valid consent revocations to be honored within a reasonable period not to exceed ten business days from receipt of such request. Additionally, when a recipient has consented to several categories of text messages from a sender and opt-out of a text message from that sender, the new rules permit a sender to seek to clarify the scope of the opt-out request through a one-time opt-out confirmation text message. This rule permitting a sender to seek such clarification through a one-time opt-out confirmation text message took effect on April 4, 2024. The remaining consent revocation rules are expected to take effect on April 11, 2025.

Current wording

February 2024, the FCC adopted new rules governing the ability of call and text message recipients to revoke consent previously given and thereby “opt-out” of receiving future calls and text messages from a sender. These new rules specify when a call or text message recipient’s consent must be considered revoked and create certain presumptions about other forms of consent revocation that a sender of a call or text message can rebut pursuant to a totality of circumstances test administered by the FCC or a court. They also require valid consent revocations to be honored within a reasonable period not to exceed ten business days from receipt of such request. Additionally, when a recipient has consented to several categories of text messages from a sender and opt-out of a text message from that sender, the new rules permit a sender to seek to clarify the scope of the opt-out request through a one-time opt-out confirmation text message. This rule permitting a sender to seek such clarification through a one-time opt-out confirmation text message took effect on April 4, 2024. On April 7, 2025, the FCC issued a stay of the portion of the consent revocation rules requiring opt-outs across all channels and for all purposes in response to a consumer’s “STOP” request. The remaining proposed consent revocation rules regarding the ten-day revocation window and text responses took effect on April 11, 2025.

Previous wording

tariffs and other trade barriers, fluctuations in currency exchange rates and potentially adverse tax consequences;

Current wording

tariffs and other trade barriers, fluctuations in currency exchange rates and changes in tax laws or exposure to additional income or other tax liabilities could affect our future profitability generating potentially adverse tax consequences;