Zeta Global Holdings Corp.

Previous wording

• Our success and revenue growth depends on our ability to add and retain scaled customers and convert our scaled customers into super-scaled customers.

Current wording

• Our success and revenue growth depends on our ability to add, grow and retain super-scaled customers.

Previous wording

• We may experience fluctuations in our operating results, including during presidential elections years where we generally generate higher revenues, which could make our future operating results difficult to compare and predict.

Current wording

• We may experience fluctuations in our operating results, including during presidential and, to a lesser extent, midterm election years where we generally generate higher revenues, which could make our future operating results difficult to compare and predict.

Previous wording

Acquisitions or strategic investments could be difficult to identify and integrate (including the integration of our recent acquisition of LiveIntent), divert the attention of management and disrupt our business, dilute stockholder value and adversely affect our business, operating results and financial condition.

Current wording

• Acquisitions or strategic investments could be difficult to identify and integrate (including the integration of our recent acquisition of Marigold’s Enterprise Business), divert the attention of management and disrupt our business, dilute stockholder value and adversely affect our business, operating results and financial condition.

Previous wording

• The technology industry is subject to increasing scrutiny that could result in U.S. federal or state government actions that could negatively affect our business.

Current wording

• The technology industry is subject to increasing scrutiny that could result in U.S. federal or state government, or international regulatory actions that could negatively affect our business.

Previous wording

Any actual or perceived failure to comply with evolving regulatory frameworks around the development and use of artificial intelligence could adversely affect our business, results of operations, and financial condition.

Current wording

• Any actual or perceived failure to comply with evolving regulatory frameworks around the development and use of machine learning and AI technologies and our use of artificial intelligence technologies may expose us to technical, legal, and regulatory risks, which could adversely affect our business, results of operations, and financial condition.

Previous wording

• The impact of our business and financial condition of incurring additional debt or issuing new debt or equity securities.

Current wording

• The incurrence of additional debt or the issuance of new debt or equity securities.

Previous wording

Our success and revenue growth depends on our ability to add and retain scaled customers and convert our scaled customers into super-scaled customers.

Current wording

Our success and revenue growth depends on our ability to add, grow and retain super-scaled customers.

Previous wording

Our success is dependent on regularly adding new customers, in particular new scaled customers, and increasing our existing customers’ usage of our platform in order to convert our scaled customers into super-scaled customers. We also continually work on converting our non-scaled customers into scaled customers. Many of our contracts and relationships with customers do not include automatic renewal or exclusive obligations requiring them to use our platform or maintain or increase their use of our platform. Our customers, in particular our scaled customers, typically have relationships with numerous providers and can use both our platform and those of our competitors without incurring significant costs or disruption. Our customers may also choose to decrease their overall marketing spend for any reason, including if they do not believe they are generating a sufficient return on their marketing spend. Further, we may not be successful at educating and training our new and existing customers on how to use our platform, in particular our advanced reporting tools, in order for them to benefit from it and generate revenues. Accordingly, we must continually work to win new scaled customers and educate and retain existing scaled customers, increase their usage of our platform and capture a larger share of their marketing spend, which may lead to an increase in our super-scaled customers.

Current wording

Our success is dependent on regularly adding new customers, in particular new super-scaled customers, and increasing our existing customers’ usage of our platform in order to convert our customers into super-scaled customers. Many of our contracts and relationships with customers do not include automatic renewal or exclusive obligations requiring them to use our platform or maintain or increase their use of our platform. Our customers, in particular our super-scaled customers, typically have relationships with numerous providers and can use both our platform and those of our competitors without incurring significant costs or disruption. Our customers may also choose to decrease their overall marketing spend for any reason, including if they do not believe they are generating a sufficient return on their marketing spend. Further, we may not be successful at educating and training our new and existing customers on how to use our platform, in particular our advanced reporting tools, in order for them to benefit from it and generate revenues. Accordingly, we must continually work to win new super-scaled customers and educate and retain existing super-scaled customers, increase their usage of our platform and capture a larger share of their marketing spend.

Previous wording

In 2024, our top ten customers accounted for more than one-third of our total revenue, and no customer accounted for more than 10% of our total revenue. Occasionally, we enter into separate contracts and billing relationships with individual marketing agencies that are owned by the same holding company and account for them as separate customers. However, if a holding company of multiple marketing agencies chooses to exert control over the individual agencies in the future and terminate their relationship with us, it could result in a disproportionate loss of revenue.

Current wording

In 2025, our top ten customers accounted for more than one-third of our total revenue, and one customer accounted for more than 10% of our total revenue. Occasionally, we enter into separate contracts and billing relationships with individual marketing agencies that are owned by the same holding company and account for them as separate customers. However, if a holding company of multiple marketing agencies chooses to exert control over the individual agencies in the future and terminate their relationship with us, it could result in a disproportionate loss of revenue.

Previous wording

A substantial portion of our revenue is derived from usage-based pricing, which is less stable than subscription-based pricing. If our customers, in particular our scaled customers, decide not to continue to use our platform or decrease their usage of our platform for any reason, or if we fail to attract new customers and turn them into scaled customers or super-scaled customers, our revenue could decline, which would materially and adversely harm our business, operating results and financial condition. We cannot assure that our scaled customers will continue to use and increase their spend on our platform or that we will be able to attract a sufficient number of new scaled customers to continue to grow our revenue. If scaled customers representing a significant portion of our business decide to materially reduce their use of our platform or cease using our platform altogether, our revenue could be significantly reduced, which could have a material adverse effect on our business, operating results and financial condition. We may not be able to replace scaled customers who decrease or cease their usage of our platform with new scaled customers that will use our platform to the same extent.

Current wording

A substantial portion of our revenue is derived from usage-based pricing, which is less stable than subscription-based pricing. If our customers, in particular our super-scaled customers, decide not to continue to use our platform or decrease their usage of our platform for any reason, or if we fail to attract new customers and turn them into super-scaled customers, our revenue could decline, which would materially and adversely harm our business, operating results and financial condition. We cannot assure that our super-scaled customers will continue to use and increase their spend on our platform or that we will be able to attract a sufficient number of new super-scaled customers to continue to grow our revenue. If customers representing a significant portion of our business decide to materially reduce their use of our platform or cease using our platform altogether, our revenue could be significantly reduced, which could have a material adverse effect on our business, operating results and financial condition. We may not be able to replace super-scaled customers who decrease or cease their usage of our platform with new super-scaled customers that will use our platform to the same extent.

Previous wording

We may spend substantial time and resources prospecting for new business or responding to requests for proposals from potential customers, and these efforts may not result in us ultimately generating any revenue from a potential customer. It is possible that we will be unable to recover any of these expenses.

Current wording

As part of our sales efforts, we invest considerable time and expense evaluating the specific organizational needs of our potential customers and educating these potential customers about the technical capabilities and value of our platforms and solutions. We may spend substantial time and resources prospecting for new business or responding to requests for proposals from potential customers, and these efforts may not result in us ultimately generating any revenue from a potential customer. It is possible that we will be unable to recover any of these expenses.

Previous wording

We may experience fluctuations in our operating results, including during presidential elections years where we generally generate higher revenues, which could make our future operating results difficult to compare and predict. Consequently, we may not be able to meet our expectations or those of securities analysts and investors.

Current wording

We may experience fluctuations in our operating results, including during presidential and, to a lesser extent, midterm election years where we generally generate higher revenues, which could make our future operating results difficult to compare and predict. Consequently, we may not be able to meet our expectations or those of securities analysts and investors.

Previous wording

Our quarterly and annual operating results have fluctuated in the past, and we expect our future operating results to fluctuate due to a variety of factors, many of which are beyond our control. Our liquidity and revenue can fluctuate quarter to quarter as certain of our customers have seasonal marketing activity. Historically, marketing activity is higher in the fourth quarter of the calendar year to coincide with the holiday shopping season as compared to the first quarter. As a result, the subsequent first quarter tends to reflect lower activity levels and lower performance. Our revenues are also impacted by political cycles in which we generally generate higher revenues in congressional elections years, and particularly presidential election years. In addition, the varying nature of our pricing mix between periods, customers and products may also make it more difficult for us to forecast our future operating results. Further, these factors may make it more difficult to make comparisons between prior, current and future periods. As a result, period-to-period comparisons of our operating results should not be relied upon as an indication of our future performance.

Current wording

Our quarterly and annual operating results have fluctuated in the past, and we expect our future operating results to fluctuate due to a variety of factors, many of which are beyond our control. Our liquidity and revenue can fluctuate quarter to quarter as certain of our customers have seasonal marketing activity. Historically, marketing activity is higher in the fourth quarter of the calendar year to coincide with the holiday shopping season as compared to the first quarter. As a result, the subsequent first quarter tends to reflect lower activity levels and lower performance. Our revenues are also impacted by political cycles in which we generally generate higher revenues in congressional elections years, and particularly presidential election years and, to a lesser extent, midterm election years. In addition, the varying nature of our pricing mix between periods, customers and products may also make it more difficult for us to forecast our future operating results. Further, these factors may make it more difficult to make comparisons between prior, current and future periods. As a result, period-to-period comparisons of our operating results should not be relied upon as an indication of our future performance.

Previous wording

• the U.S. presidential election cycles potentially leading to higher revenue generation compared to non-election years;

Current wording

• the U.S. presidential and midterm election cycles potentially leading to higher revenue generation compared to non-election years;

Previous wording

We expect to continue to rely on significant cost savings obtained by concentrating our technology and development and engineering work in India and other non-U.S. locations, but difficulties resulting from the factors noted above and other risks related to our operations in India or such other non-U.S. locations could increase our expenses and harm our competitive position. The historical rate of wage inflation has been higher in India than in the U.S. In addition, if the Rupee strengthens against the U.S. Dollar, our costs would increase. If the cost of technology and development work in India significantly increases or the labor environment in

Current wording

We expect to continue to rely on significant cost savings obtained by concentrating our technology and development and engineering work in India and other non-U.S. locations, but difficulties resulting from the factors noted above and other risks related to our operations in India or such other non-U.S. locations could increase our expenses and harm our competitive position. The historical rate of wage inflation has been higher in India than in the U.S. In addition, if the Rupee strengthens against the U.S. Dollar, our costs would increase. If the cost of technology and development work in India significantly increases or the labor environment in India changes unfavorably, our cost savings may be diminished. Any such developments could adversely affect our business, operating results and financial condition.

Previous wording

We believe our corporate culture has been critical to our success, and we plan to continue to invest time and resources to continue building it. In particular, our human capital initiatives are a strategic imperative at Zeta. Our team is focused on driving inclusiveness, innovation and stronger business results by attracting a broader talent pool and creating a more inclusive work environment for all our employees around the world. Although we have adopted policies to promote compliance with laws and regulations as well as to foster a respectful workplace for all employees, our employees may fail to abide by these policies, relevant laws and regulations, or any new laws or regulations or interpretations of existing legal requirements. In addition to damaging our reputation, actual or alleged misconduct could affect the confidence of our stockholders, regulators and other parties and could have a material adverse effect on our business, operating results and financial condition.

Current wording

We believe our corporate culture has been critical to our success, and we plan to continue to invest time and resources to continue building it. In particular, our human capital initiatives are a strategic imperative at Zeta. Although we have adopted policies to promote compliance with laws and regulations as well as to foster a respectful workplace for all employees, our employees may fail to abide by these policies, relevant laws and regulations, or any new laws or regulations or interpretations of existing legal requirements. In addition to damaging our reputation, actual or alleged misconduct could affect the confidence of our stockholders, regulators and other parties and could have a material adverse effect on our business, operating results and financial condition.

Previous wording

• Acquisitions or strategic investments could be difficult to identify and integrate (including the integration of our recent acquisition of LiveIntent, Inc.), divert the attention of management and disrupt our business, dilute stockholder value and adversely affect our business, operating results and financial condition.

Current wording

Acquisitions or strategic investments could be difficult to identify and integrate (including the integration of our recent acquisition of Marigold’s Enterprise Business), divert the attention of management and disrupt our business, dilute stockholder value and adversely affect our business, operating results and financial condition.

Previous wording

As part of our growth strategy, we have acquired and may continue to acquire or invest in other businesses, assets or technologies that are complementary to and fit within our strategic goals. Acquisitions are inherently risky and if they fail, they can result in costly remediating steps such as litigation and divesture. Any acquisition or investment may divert the attention of management and require us to use significant amounts of cash, issue dilutive equity securities or incur debt. The anticipated benefits of any acquisition (including our recent acquisition of LiveIntent) or investment may not be realized, and we may be exposed to unknown risks, any of which could adversely affect our business, operating results and financial condition, including risks arising from:

Current wording

As part of our growth strategy, we have acquired and may continue to acquire or invest in other businesses, assets or technologies that are complementary to and fit within our strategic goals. Acquisitions are inherently risky and if they fail, they can result in costly remediating steps such as litigation and divesture. Any acquisition or investment may divert the attention of management and require us to use significant amounts of cash, issue dilutive equity securities or incur debt. The anticipated benefits of any acquisition (including our recent acquisition of Marigold’s Enterprise Business) or investment may not be realized, and we may be exposed to unknown risks, any of which could adversely affect our business, operating results and financial condition, including risks arising from:

Previous wording

• difficulties in integrating the operations, technologies, product or service offerings, administrative systems and personnel of LiveIntent or any other acquired businesses, especially if those businesses operate outside of our core competency or geographies in which we currently operate;

Current wording

• difficulties in integrating the operations, technologies, product or service offerings, administrative systems and personnel of Marigold’s Enterprise Business or any other acquired businesses, especially if those businesses operate outside of our core competency or geographies in which we currently operate;

Previous wording

• complications in the integration of LiveIntent or any other acquired businesses or diminished prospects;

Current wording

• complications in the integration of our recent acquisition of Marigold’s Enterprise Business or any other businesses we may acquire, or diminished prospects;

Previous wording

• failure to generate the expected financial results related to the LiveIntent acquisition or other future acquisitions on a timely manner or at all;

Current wording

• failure to generate the expected financial results related to the recent acquisition of Marigold’s Enterprise Business or other future acquisitions on a timely manner or at all;

Previous wording

To fund acquisitions, we have in the past and may in the future pay cash, which would diminish our cash reserves, or issue additional shares of our Class A Common Stock, which could dilute current stockholders’ holdings in our company. Borrowing to fund an acquisition would result in increased fixed obligations and could also subject us to covenants or other restrictions that could limit our ability to effectively run our business.

Current wording

To fund acquisitions, we have in the past and may in the future pay cash, including in connection with the recent acquisition of Marigold’s Enterprise Business, which would diminish our cash reserves, or issue additional shares of our Class A Common Stock, which would dilute current stockholders’ holdings in our company. Borrowing to fund an acquisition would result in increased fixed obligations and could also subject us to covenants or other restrictions that could limit our ability to effectively run our business.

Previous wording

• compliance with foreign data privacy laws, such as the EU ePrivacy Directive, GDPR, UK data protection laws, and Brazil’s General Data Protection Law (“LGPD”), which could materially diminish our ability to collect data and/or the effectiveness of our platform;

Current wording

• compliance with foreign data privacy laws, such as the EU ePrivacy Directive (and its local implementations), the UK Privacy and Electronic Communications Regulation (“PECR”), EU and UK GDPR, and Brazil’s General Data Protection Law (“LGPD”), which could materially diminish our ability to collect data and/or the effectiveness of our platform;

Previous wording

The technology industry is subject to increasing scrutiny that could result in U.S. government actions that could negatively affect our business.

Current wording

The technology industry is subject to increasing scrutiny that could result in U.S. government and/or international regulatory actions that could negatively affect our business.

Previous wording

We may face claims relating to the information or content that is made available through our platform. Though we contractually require our customers to represent that they will follow our policies with respect to all information or content they upload to our systems, we may be exposed to potential liability if our customers do not abide by such policies. In particular, the nature of our business may expose us to claims related to defamation, dissemination of misinformation or news hoaxes, discrimination, harassment, intellectual property right infringement, rights of publicity and privacy, personal injury torts, laws regulating hate speech or other types of content, and breach of contract, among others. The technology industry is subject to intense media, political and regulatory scrutiny, including on issues related to antitrust and artificial intelligence, which exposes us to government investigations, legal actions and penalties. For instance, various regulatory agencies, including competition and consumer protection authorities, have active proceedings and investigations concerning multiple technology companies on antitrust and other issues. If we become subject to such investigations, we could be liable for substantial fines and penalties, be required to change our products or alter our business operations, receive negative publicity, or be subject to civil litigation, all of which could harm our business. Lawmakers also have proposed new laws and regulations, and modifications to existing laws and regulations, that affect the activities of technology companies such as the recent efforts to eliminate or modify Section 230 of the Communications Decency Act. If such laws and regulations are enacted or modified, they could negatively impact us, even if they are not specifically intended to affect our company. In addition, the introduction of new products, expansion of our activities in certain jurisdictions, or other actions that we may take may subject us to additional laws, regulations and other scrutiny. The increased scrutiny of certain acquisitions in the technology industry also could affect our ability to enter into strategic transactions of our own or to acquire other businesses.

Current wording

We may face claims relating to the information or content that is made available through our platform. Though we contractually require our customers to represent that they will follow our policies with respect to all information or content they upload to our systems, we may be exposed to potential liability if our customers do not abide by such policies. In particular, the nature of our business may expose us to claims related to defamation, dissemination of misinformation or news hoaxes, discrimination, harassment, intellectual property right infringement, rights of publicity and privacy, personal injury torts, laws regulating hate speech or other types of content, and breach of contract, among others. The technology industry is subject to intense media, political and regulatory scrutiny, including on issues related to antitrust and AI, which exposes us to regulatory and government investigations, legal actions and penalties. For instance, various regulatory agencies, including competition and consumer protection authorities, have active proceedings and investigations concerning multiple technology companies on antitrust and other issues. If we become subject to such investigations, we could be liable for substantial fines and penalties, be required to change our products or alter our business operations, receive negative publicity, or be subject to civil litigation, all of which could harm our business. Lawmakers also have proposed new laws and regulations, and modifications to existing laws and regulations, that affect the activities of technology companies such as the recent efforts to eliminate or modify Section 230 of the Communications Decency Act. If such laws and regulations are enacted or modified, they could negatively impact us, even if they are not specifically intended to affect our company. In addition, the introduction of new products, expansion of our activities in certain jurisdictions, or other actions that we may take may subject us to additional laws, regulations and other scrutiny. The increased scrutiny of certain acquisitions in the technology industry also could affect our ability to enter into strategic transactions of our own or to acquire other businesses.

Previous wording

We have one of the largest compilations of personal data relating to U.S. and international consumers in the world. The ability of our platform to deliver high quality solutions to our customers is based on our technology’s capability to derive relevant, actionable insights from the data that we ingest into our systems and our ability to execute marketing programs across digital channels such as email, social media, website and other touchpoints to engage consumers. The principal way that we collect individual data is directly from the consumers when they register or interact with our platform (such as the DISQUS commenting system), or with partners’ services. We also use various tracking technologies, both proprietary and those provided through third-party suppliers in order to connect to individuals across marketing channels for the purpose of targeting consumers and delivering campaigns. The future of these and other digital data collection practices is evolving, with some prominent companies in the industry recently announcing that they will implement their own individual data collection tools and phase out others. This approach may or may not be compatible with our current operations in those channels and platforms. It is yet to be determined if there will be an industry-wide framework for targeting consumers in a digital environment. Furthermore, regulatory and legislative actions may influence which data collection tools are permitted in various jurisdictions and may further restrict our data collection efforts. Without this incremental data, we may not have sufficient insight into the consumer’s activity to provide some of our current tools, which may impact our capacity to execute our customers’ programs efficiently and effectively.

Current wording

We have one of the largest compilations of personal data relating to U.S. and international consumers in the world. The ability of our platform to deliver high quality solutions to our customers is based on our technology’s capability to derive relevant, actionable insights from the data that we ingest into our systems and our ability to execute marketing programs across digital channels such as email, social media, website and other touchpoints to engage consumers. The principal way that we collect individual data is directly from the consumers when they register or interact with our platform (such as the DISQUS commenting system and LiveIntent inbox advertising), or with partners’ services. We also use various tracking technologies, both proprietary and those provided through third-party suppliers in order to connect to individuals across marketing channels for the purpose of targeting consumers and delivering campaigns. The future of these and other digital data collection practices is evolving, with some prominent companies in the industry recently announcing that they will implement their own individual data collection tools and phase out others. This approach may or may not be compatible with our current operations in those channels and platforms. It is yet to be determined if there will be an industry-wide framework for targeting consumers in a digital environment. Furthermore, regulatory and legislative actions may influence which data collection tools are permitted in various jurisdictions and may further restrict our data collection efforts. Without this incremental data, we may not have sufficient insight into the consumer’s activity to provide some of our current tools, which may impact our capacity to execute our customers’ programs efficiently and effectively.

Previous wording

Consumers can, with increasing ease, implement technologies that limit our ability to collect and use data to track and deliver our solutions across different marketing channels and platforms. Various digital tracking tools may be deleted or blocked by consumers. The most commonly used internet browsers also allow consumers to modify their browser settings to block first-party cookies (placed directly by the publisher or website owner that the consumer intends to interact with), which are not affected by changes from web browsers and operating systems, or third-party cookies (placed by parties that do not have direct relationship with the consumer), which some browsers may block by default. Mobile devices using Android and iOS operating systems limit the ability of cookies, or similar technology, to track consumers while they are using applications other than their web browser on the device. Even if cookies and ad blockers do not ultimately have an adverse effect on our business, investor concerns about the utility and robustness of these tracking technologies could limit demand for our stock and cause its price to decline.

Current wording

Consumers can, with increasing ease, implement technologies that limit our ability to collect and use data to track and deliver our solutions across different marketing channels and platforms. Various digital tracking tools may be deleted or blocked by consumers. Several internet browsers also allow consumers to modify their browser settings to block first-party cookies (placed directly by the publisher or website owner that the consumer intends to interact with), which are not affected by changes from web browsers and operating systems, or third-party cookies (placed by parties that do not have direct relationship with the consumer), which some browsers may block by default. Mobile devices using Android and iOS operating systems limit the ability of cookies, or similar technology, to track consumers while they are using applications other than their web browser on the device. Even if cookies and ad blockers do not ultimately have an adverse effect on our business, investor concerns about the utility and robustness of these tracking technologies could limit demand for our stock and cause its price to decline.

Previous wording

Actual or perceived failures to comply with applicable data protection, privacy and security laws, regulations, standards and other requirements could adversely affect our business, results of operations, and financial condition and the price of our Class A Common Stock.

Current wording

Actual or perceived failures to comply with applicable data protection, privacy, security and technology laws, regulations, standards and other requirements could adversely affect our business, results of operations, and financial condition and the price of our Class A Common Stock.

Previous wording

The global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security of personal information. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business. For example, a short seller report published in November 2024 included claims around a perceived failure of our data collection practices to comply with potential changes to applicable laws, adversely impacting the price of our Class A Common Stock. See “Risks Related to Public Reporting Matters and an Investment in Our Class A Common Stock–Short sellers of our stock may be manipulative and may drive down the market price of our Class A Common Stock, harm our brand and reputation, and negatively impact our business, operating results and financial condition.”

Current wording

The global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security of personal information and the regulation of technology more broadly. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, regulatory and government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business. For example, a short seller report published in November 2024 included claims around a perceived failure of our data collection practices to comply with potential changes to applicable laws, adversely impacting the price of our Class A Common Stock. See “Risks Related to Public Reporting Matters and an Investment in Our Class A Common Stock–Short sellers of our stock may be manipulative and may drive down the market price of our Class A Common Stock, harm our brand and reputation, and negatively impact our business, operating results and financial condition.”

Previous wording

In the U.S., numerous state laws impose standards relating to the privacy, security, transmission and breach reporting of personal information. Such laws and regulations are subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us, our customers and our strategic partners. For example, the CCPA creates individual privacy rights for California consumers and imposes privacy and security obligations on entities handling personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches suffered as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices, and this may lead to breach litigation. Further, as amended by the California Privacy Rights Act, the CCPA imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations, which could result in increased privacy and information security enforcement. Similar laws are now in effect and enforceable in other states. Additionally, state regulators may exercise greater scrutiny regarding the collection and processing of personal information for purposes of online advertising, marketing, and analytics. These laws and their requirements could have a material adverse effect on our financial performance, and any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Current wording

In the U.S., numerous state laws impose standards relating to the privacy, security, transmission and breach reporting of personal information. Such laws and regulations are subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us, our customers and our strategic partners. For example, the CCPA requires in-scope businesses to, among other things: provide certain disclosures to California residents regarding the business’s collection, use, and disclosure of their personal information; receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt-out of certain disclosures of their personal information; and enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf. The CCPA also provides for civil penalties for violations, as well as a private right of action for certain data breaches suffered as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices, and this may lead to breach litigation. Similar state comprehensive data privacy laws are in effect and enforceable in other states and have been proposed in additional states, which creates a patchwork of overlapping but different state laws. Additionally, state regulators may exercise greater scrutiny regarding the collection and processing of personal information for purposes of online advertising, marketing, and analytics. These laws and their requirements could have a material adverse effect on our financial performance, and any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Beginning in 2026, the California Delete Act will require certain entities to delete data relating to California consumers at their request through a state-owned portal. The impacts of this law will not be fully known until late 2026, but it could potentially decrease our ability to reach California consumers.

Previous wording

Furthermore, the Federal Trade Commission (“FTC”) and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. The FTC sees failure to take appropriate steps to keep consumers’ personal information secure as constituting unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. The FTC has in recent years conducted enforcement actions against other companies that created new precedents that may require us to adjust our business practices. Future FTC enforcement actions against marketing companies could result in more material impacts to us.

Current wording

In addition, the Federal Trade Commission (“FTC”) and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. The FTC sees failure to take appropriate steps to keep consumers’ personal information secure as constituting unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. The FTC has in recent years conducted enforcement actions against other companies that created new precedents that may require us to adjust our business practices. Future FTC enforcement actions against marketing companies could result in more material impacts to us.

Previous wording

Our communications with consumers are also subject to certain laws and regulations, including the Controlling the Assault of Non-Solicited Pornography and Marketing (“CAN-SPAM”) Act of 2003, the Telephone Consumer Protection Act of 1991 (the “TCPA”), and the Telemarketing Sales Rule and analogous state laws, that could expose us to significant damages awards, fines and other penalties that could materially impact our business. For example, the TCPA imposes various consumer consent requirements and other restrictions in connection with certain telemarketing activity and other communication with consumers by phone, fax or text message. The FTC and the Federal Communications Commission have been active in expanding regulatory and enforcement activities related to TCPA-covered practices. State laws in Connecticut and Maryland created additional requirements and penalties for violations relating to telemarketing and SMS marketing. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the TCPA and related state laws impose significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. The CAN-SPAM Act and the Telemarketing Sales Rule and analogous state laws also impose various restrictions on marketing conducted using email, telephone, fax or text message. Additional laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet may be or become applicable to our business, such as the Communications Act, the Federal Wiretap Act, the Electronic Communications Privacy Act, and similar state consumer protection and communication privacy laws, such as California’s Invasion of Privacy Act. As laws and regulations, including FTC enforcement, rapidly evolve to govern the use of these communications and marketing platforms, the failure by us, our employees or third parties acting at our direction to abide by applicable laws and regulations could adversely impact our business, financial condition and results of operations or subject us to fines or other penalties.

Current wording

Our communications with consumers are also subject to certain laws and regulations, including the Controlling the Assault of Non-Solicited Pornography and Marketing (“CAN-SPAM”) Act, the Telephone Consumer Protection Act (the “TCPA”), and the Telemarketing Sales Rule and analogous state laws, that could expose us to significant damages awards, fines and other penalties that could materially impact our business. For example, the TCPA imposes various consumer consent requirements and other restrictions in connection with certain telemarketing activity and other communication with consumers by phone, fax or text message. As such, the actual or perceived improper calling of customer phones or sending of text messages may subject us to potential risks, including liabilities or claims relating to the TCPA. Further, the FTC and the Federal Communications Commission have been active in expanding regulatory and enforcement activities related to TCPA-covered practices. State laws have created additional requirements and penalties for violations relating to telemarketing and SMS marketing. Numerous class-action suits under federal and state laws have been filed against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the TCPA and related state laws impose significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. The CAN-SPAM Act and the Telemarketing Sales Rule and analogous state laws also impose various restrictions on marketing conducted using email, telephone, fax or text message. Additional laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet may be or become applicable to our business, such as the Communications Act, the Federal Wiretap Act, the Electronic Communications Privacy Act, and similar state consumer protection and communication privacy laws, such as California’s Invasion of Privacy Act. Litigation targeting standard commercial online marketing practices under such laws and other state or federal wiretapping, video privacy, or invasion of privacy statutes has proliferated since 2024, and is expected to continue through 2026. We or our clients have and may in the future have to defend or settle related lawsuits. As laws and regulations, including FTC enforcement, rapidly evolve to govern the use of these communications and marketing platforms, the failure by us, our employees or third parties acting at our direction to abide by applicable laws and regulations could adversely impact our business, financial condition and results of operations or subject us to fines or other penalties.

Previous wording

New requirements relating to automated, browser-based, or one-stop opt-out mechanisms (“OOMs”) such as the Global Privacy Control, the forthcoming opt-out mechanism for data brokers established under the California Delete Act, or other OOMs that will be established in the future may result in significantly larger numbers of consumers opting out of having their data used for marketing purposes versus historical averages. This could result in Zeta having less access to consumer data, impacting performance of our services or resulting in loss of business.

Current wording

New requirements relating to automated, browser-based, or one-stop opt-out mechanisms (“OOMs”) such as the Global Privacy Control, the Delete Request and Opt-Out Platform (“DROP”) established under the California Delete Act, or other OOMs that will be established in the future may result in significantly larger numbers of consumers opting out of having their data used for marketing purposes versus historical averages. This could result in Zeta having less access to consumer data, impacting performance of our services or resulting in loss of business.

Previous wording

Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. For example, in Europe, we are subject to the European Union General Data Protection Regulation (the “EU GDPR”) and the United Kingdom’s General Data Protection Regulation and the Data Protection Act 2018 (the “UK GDPR”) (the EU GDPR and UK GDPR, together referred to as the “GDPR”), which impose strict requirements for processing the personal data of individuals within the EEA. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance. Since we are subject to the supervision of relevant data protection authorities under both the EU GDPR and the UK GDPR, we could be fined under each of these regimes independently, in respect of the same breach. Penalties for certain breaches are up to €20 million / £17.5 million or 4% of the annual global revenues of the noncompliant company, whichever is greater.

Current wording

Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. For example, in Europe, we are subject to the European Union General Data Protection Regulation (the “EU GDPR”) and the United Kingdom’s General Data Protection Regulation and the Data Protection Act 2018 (the “UK GDPR”) (the EU GDPR and UK GDPR, together referred to as the “GDPR”), which impose strict requirements for processing the personal data of individuals within the EEA and the UK. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance. Since we are subject to the supervision of relevant data protection authorities under both the EU GDPR and the UK GDPR, we could be fined under each of these regimes independently, in respect of the same breach. Penalties for certain breaches are up to €20 million / £17.5 million or 4% of the annual global revenues of the noncompliant company, whichever is greater.

Previous wording

Among other requirements, the GDPR also regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the U.S.; in July 2020, the Court of Justice of the EU (“CJEU”) limited how organizations could lawfully transfer personal data from the EU/European Economic Area (“EEA”) to the U.S. by invalidating the Privacy Shield for purposes of international transfers and imposing further restrictions on the use of standard contractual clauses (“SCCs”) by stating reliance on SCCs alone may not be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. European court and regulatory decisions subsequent to the CJEU decision have taken a restrictive approach to international data transfers. Further the European Commission published revised standard contractual clauses for data transfers from the EEA (mandatory for new transfers since September 27, 2021, and for existing transfers since December 27, 2022) and the UK Information Commissioner’s Office published its own new data transfer standard contracts for data transfers from the UK (mandatory for new transfers since September 21, 2022 and for existing transfers since March 21, 2024). We expect the existing legal complexity and uncertainty regarding international data transfers to continue and in particular, we expect international transfers to the U.S. and other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As supervisory authorities issue further guidance on personal data export mechanisms, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Current wording

Among other requirements, the GDPR also regulates transfers of personal data out of the EEA and/or the UK to third countries that have not been found to provide adequate protection to such personal data, including the U.S. In relation to such cross border transfers of personal data, we expect the existing legal complexity and uncertainty regarding international data transfers to continue and international transfers to the U.S. and other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Previous wording

We are also subject to evolving EU and UK privacy laws on cookies, tracking technologies and e-marketing. The GDPR also imposes conditions on obtaining valid consent for cookies, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. Recent European court and regulator decisions are driving increased attention to cookies and tracking technologies. In light of the complex and evolving nature of EU, EU Member State and UK privacy laws on cookies and tracking technologies, there can be no assurances that we will be successful in our efforts to comply with such laws and violations of such laws could result in regulatory investigations, fines, orders to cease / change our use of such technologies, as well as civil claims including class actions, and reputational damage. In July 2021, we received a notice from Norwegian authorities of an intent to impose a fine for our alleged failure to adhere to the GDPR with respect to the collection of personal data via cookies in their country. We challenged the Norwegian Data Protection Authority’s (“DPA”) decision, and in October 2024, the DPA issued a final order in the case citing a breach of the GDPR, but reducing the fine to zero.

Current wording

We are also subject to evolving EU and UK privacy laws on cookies, tracking technologies and e-marketing. The GDPR, ePrivacy Directive (and its local implementations) and PECR impose conditions on obtaining valid consent for cookies, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. Recent European court and regulator decisions are driving increased attention to cookies and tracking technologies as well as to standards for consent. If the trend of increasing enforcement by regulators of the strict approach to opt-in consent for all but essential use cases, as seen in recent guidance and decisions continues, this could lead to additional costs, require systems changes, limit the effectiveness of our marketing and personalization offerings, divert the attention of our technology personnel, adversely affect our margins, and subject us to additional liabilities. In light of the complex and evolving nature of EU, EU Member State and UK privacy laws on cookies and tracking technologies, there can be no assurances that we will be successful in our efforts to comply with such laws and violations of such laws could result in regulatory investigations, fines, orders to cease / change our use of such technologies, as well as civil claims including class actions, and reputational damage.

Previous wording

Increased scrutiny regarding the use of such technologies and the use of personal data for online advertising practices, together with adverse rulings on these issues, even if not directly against us, may have a direct impact on our ability to continue to collect and process personal data for the services that we provide and could adversely impact our business activities. Changes proposed by providers of major browsers to eliminate or restrict the usage of third-party cookies to track user behaviors, and to allow users to limit the collection of certain data generally or from specified websites, could impair our ability to collect user information, including personal data and usage information, that helps us provide more targeted advertising to our current and prospective consumers. The effectiveness of our platform relies in part on our ability to collect and use online data, so these changes could adversely affect our business.

Current wording

Increased scrutiny regarding the use of such technologies and the use of personal data for online advertising practices, together with adverse rulings on these issues, even if not directly against us, may have a direct impact on our ability to continue to collect and process personal data for the services that we provide and could adversely impact our business activities. Providers of major browsers could change, eliminate or restrict the usage of third-party cookies to track user behaviors, and allow users to limit the collection of certain data generally or from specified websites, which could impair our ability to collect user information, including personal data and usage information, that helps us provide more targeted advertising to our current and prospective consumers. The effectiveness of our platform relies in part on our ability to collect and use online data, so these changes could adversely affect our business.

Previous wording

Our data-driven platform may also be subject to laws and evolving regulations regarding the use of artificial intelligence and machine learning, controlling for data bias, and antidiscrimination. For example, in addition to enforcing Section 5 of the FTC Act, the FTC enforces the Fair Credit Reporting Act, and the Equal Credit Opportunity Act. These laws prohibit unfair and deceptive practices, including use of biased algorithms in artificial intelligence. The European Commission also recently published its proposal for a regulation implementing harmonized rules on artificial intelligence and amending certain union legislative acts. The proposed regulation would impose additional restrictions and obligations on providers of artificial intelligence systems, including increasing transparency so consumers know they are interacting with an artificial intelligence system, requiring human oversight in artificial intelligence, and prohibiting certain practices of artificial intelligence that could lead to physical or psychological harm. If federal or state regulators were to determine that the type of data we collect, the process we use for collecting this data or how we use it unfairly discriminates against some groups of people, laws and regulations could be interpreted or implemented to prohibit or restrict our collection or use of this data. Additionally, existing and future laws, and evolving attitudes about privacy protection may impair our ability to collect, use, and maintain data points of sufficient type or quantity to develop and train our artificial intelligence algorithms.

Current wording

Our data-driven platform may also be subject to laws and evolving regulations regarding the provision of digital services as well as the use of AI and machine learning in such digital services, controlling for data bias, and antidiscrimination. For example, in addition to enforcing Section 5 of the FTC Act, the FTC enforces the Fair Credit Reporting Act, and the Equal Credit Opportunity Act. These laws prohibit unfair and deceptive practices, including use of biased algorithms in AI. In Europe, the EU Artificial Intelligence Act (the “EU AI Act”) establishes a comprehensive, risk-based governance framework for AI in the EU market, and the EU Digital Services Act (“DSA”) and the UK Digital Markets, Competition and Consumer Act 2024 (“DMCCA”) include, among other obligations, requirements related to digital services including content hosting requirements. The EU Network and Information Security 2 Directive (“NIS 2”) and its EU Member State implementations impose requirements on cloud computing services (including SaaS) providers, and the EU Data Act establishes requirements for providers of data processing services (including cloud and SaaS) into the EU, including requirements to facilitate customers switching to other providers/on-premise solutions and porting their data within certain timeframes (and affecting potential charges as well as mandatory contract terms), which may also impact revenue recognition practices. These laws and regulations may increase compliance costs, require changes to our processes, operations, and business practices which may adversely affect our ability to attract, retain and provide our services to customers, and may otherwise adversely affect our business, operations and financial condition including by exposing us to liability to monetary penalties and some private rights of action. In addition, if federal, state or international regulators were to determine that the type of data we collect, the process we use for collecting this data or how we use it unfairly discriminates against some groups of people, laws and regulations could be interpreted or implemented to prohibit or restrict our collection or use of this data. Additionally, existing and future laws, and evolving attitudes about privacy protection and technology regulation may impair our ability to collect, use, and maintain data points of sufficient type or quantity to develop and train our AI algorithms.

Previous wording

A significant inadvertent disclosure or breach of confidential and/or personal information we process, or a security breach of our or our customers’, suppliers’, or other partners’ IT Systems could be detrimental to our business, reputation, financial performance and results of operations.

Current wording

An unauthorized or inadvertent disclosure or breach of confidential and/or personal information we process or control, or a security breach of our or our customers’, suppliers’, or other partners’ IT Systems could be detrimental to our business, reputation, financial performance and results of operations.

Previous wording

In addition to internal technology, including proprietary software, databases, and other intellectual property, we also rely on computer hardware purchased or leased from, software licensed from, content licensed from and services provided by a variety of third parties, which include databases, operating systems, virtualization software, tax requirement content and geolocation content and services (collectively, “IT Systems”). The nature of our business means that we process large databases of personal information, including maintaining and storing large databases of such information, not only on our own behalf, but also on our customers’ and others’ behalf. As a result, we face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems, and personal and confidential information. Such risks include the misappropriation of data by malicious insiders or unauthorized third parties, or other data breaches. Such parties could attempt to gain entry to our or our vendor’s IT Systems (including by gaining employment at Zeta) for the purpose of stealing data, including confidential information or personal information, or breaching our security systems or other IT Systems. In particular, we (and certain of our third-party providers), like other organizations, especially in the digital marketing industry and marketing technology industry, are routinely subject to attempts by such threat actors (e.g., cybersecurity threats, attempted data privacy breaches, or other incidents), which if successful, may result in either threatened or actual exposure leading to unauthorized access, disclosure and misuse of confidential information, personal information or other information regarding customers, suppliers, partners, vendors, employees, or our company and business. Cyberattacks are expected to accelerate on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools, including artificial intelligence, that circumvent security controls, evade detection and remove forensic evidence. As a result, we may be unable to detect, investigate, remediate or recover from future attacks or incidents, or to avoid a material adverse impact to our IT Systems or information.

Current wording

In addition to internal technology, including proprietary software, databases, and other intellectual property, we also rely on computer hardware purchased or leased from, software licensed from, content licensed from and services provided by a variety of third parties, which include databases, operating systems, virtualization software, tax requirement content and geolocation content and services (collectively, “IT Systems”). The nature of our business means that we process large databases of personal information, including maintaining and storing large databases of such information, not only on our own behalf, but also on our customers’ and others’ behalf. As a result, we face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems, and personal and confidential information. Such risks include the misappropriation of data by diverse threat actors such as malicious insiders, state-sponsored organizations, opportunistic hackers or hacktivists or other unauthorized third parties, or other data breaches. Such parties could attempt to gain entry to our or our vendor’s IT Systems (including by gaining employment at Zeta) for the purpose of stealing data, including confidential information or personal information, or breaching our security systems or other IT Systems. In particular, we (and certain of our third-party providers), like other organizations, especially in the digital marketing industry and marketing technology industry, are routinely subject to attempts by such threat actors (e.g., cybersecurity threats, attempted data privacy breaches, or other incidents), which if successful, may result in either threatened or actual exposure leading to unauthorized access, disclosure and misuse of confidential information, personal information or other information regarding customers, suppliers, partners, vendors, employees, or our company and business. Cyberattacks are expected to accelerate on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools, including AI, that circumvent security controls, evade detection and remove forensic evidence. As a result, we may be unable to detect, investigate, remediate or recover from future attacks or incidents, or to avoid a material adverse impact to our IT Systems or information.