PubMatic, Inc.

Investing in our common stock involves a high degree of risk. The Company’s business, operations, financial results, and our stock price can be affected by a number of factors, whether currently known or unknown, including those described in Part I, Item 1A, "Risk Factors" in our Annual Report on Form 10-K for the year ended December 31, 2025. When any one or more of these risks materialize from time to time, such developments could adversely affect our business, financial condition, results of operations, cash flows, and the trading price of our stock. These disclosures reflect the Company's beliefs and opinions as to factors that could materially and adversely affect the Company and its securities in the future. References to past events are provided by way of example only and are not intended to be a complete listing of such events or a representation as to whether or not such factors or similar events have occurred in the past or their likelihood of occurring in the future. Below are material changes to our risk factors since our Annual Report on Form 10-K for the year ended December 31, 2025.

Risks Related to Our Business, Results of Operations and Growth

Our revenue and results of operations are highly dependent on the overall demand for advertising.

Our business depends on the overall demand for advertising and on the economic health of our current and prospective publishers and buyers. In recent years, macroeconomic factors such as general economic volatility, recessionary fears, inflation, volatile interest rates and softening demand in certain verticals caused some advertisers to reduce their advertising budgets. Such macroeconomic factors, as well as broader economic downturns, recessions, transnational trade wars or disruptions, inflation, further volatility in interest rates or foreign exchange rates or any supply chain disruptions, changes in the tax treatment of advertising expenses, or general financial uncertainty in North America, Europe, and Asia, where we do most of our business; could adversely affect our business, results of operations, and financial condition. In addition, the conflict in Ukraine and the resumption of the conflict in Israel could cause unpredictable economic effects in Europe and EMEA, including potentially softening general consumer demand. Additionally, the imposition of significant tariffs and retaliatory trade measures by the United States and its trading partners, and any resulting trade war or prolonged disruption to global trade flows, could dampen advertiser budgets, increase operating costs, reduce consumer spending, and adversely affect economic conditions in the markets in which we operate, including North America, Europe, and Asia. Escalating geopolitical tensions, including in the Middle East, could compound these effects by disrupting energy markets, global supply chains, and general consumer and business confidence. Such conflicts may increase costs of labor and other items impacting our cost of revenue, and these factors and potential others may do so in the future. Reductions in overall advertising spending due to these factors or other factors could make it difficult to predict our revenue and could adversely affect our business, results of operations, and financial condition.

Our results of operations may fluctuate significantly and may not meet our expectations or those of securities analysts and investors.

We operate in an evolving industry with ever-changing customer needs and behavior, and, as a result, our business has evolved over time such that our operating history makes it difficult to evaluate our business and future prospects. Our results of operations have fluctuated in the past, and future results of operations are likely to fluctuate as well. Although we have experienced prolonged revenue growth, we may not be able to sustain this growth rate, current revenue levels, or profitability. In addition, because our business is evolving, our historical results of operations may be of limited utility in assessing our future prospects. We expect to face challenges, risks, and difficulties frequently experienced by growing companies in rapidly developing industries, including those relating to:

•changes in demand and pricing for ad impressions sold on our platform;

•changes in our access to valuable ad impressions from publishers;

•responding to evolving industry standards and government regulations that impact our business, particularly in the areas of data protection and consumer privacy;

•developing, maintaining, and expanding relationships with publishers, DSPs, agencies, advertisers, and buyers;

•seasonality in our business;

•changes in demand due to real or perceived economic stagnation or recession in certain markets;

•innovating and developing new solutions that are adopted by and meet the needs of publishers, DSPs, agencies, advertisers, and buyers;

•competing against companies with a larger customer base or greater financial or technical resources;

•changes in the structure of the buying and selling of ad impressions;

•changes in the pricing policies of publishers and competitors;

•changes in the bidding behavior of buyers of ad impressions;

•changes in buyer bidding algorithms, including the deployment of artificial intelligence or automated optimization technologies by buyers that reduce the volume or value of impressions purchased through our platform;

•disruption to the digital advertising ecosystem driven by artificial intelligence, including the displacement of traditional programmatic advertising channels or reduction in open-web publisher traffic resulting from AI-powered search features or large language model-based services;

•changes in demand due to changes in macroeconomic environment, including as a result of an economic downturn, recession, inflation, volatility in interest rates or foreign exchange rates, disruptions to supply chains, disruptions to global trade, or otherwise;

•further expanding our business internationally; and

•recruiting, integrating, and retaining qualified and motivated employees, particularly engineers.

Any one or more of the factors above may result in significant fluctuations in our results of operations. You should not rely on our past results as an indicator of our future performance.

Risks Related to Artificial Intelligence and Machine Learning

We rely on machine learning and artificial intelligence technologies that may produce inaccurate or biased outputs, and our models may become less effective over time.

Our core platform operations, including real-time bidding, auction optimization, yield management, and audience targeting, depend on machine learning and artificial intelligence technologies that require large volumes of high-quality data. These models may produce inaccurate, incomplete, biased, or otherwise flawed outputs. If our training data contains errors, biases, or inconsistencies, or if market conditions, consumer behavior, or buyer and publisher dynamics change in ways not reflected in our historical training data, our models may perform below expectations. Poor model performance could result in suboptimal auction outcomes for our publishers and buyers, degraded platform competitiveness, loss of customer trust, and revenue decline. Our model validation and monitoring procedures may not detect all failures or performance degradation in a timely manner, particularly under novel or unanticipated conditions. Retraining or replacing models could be costly and time-consuming. Additionally, if our AI systems produce or inform decisions that are perceived as biased or unfair, we could face reputational harm, legal liability, or regulatory action. Any of these outcomes could adversely affect our business, results of operations, and financial condition.

Generative artificial intelligence and AI-powered search features may reduce open-web publisher traffic and disrupt the programmatic advertising ecosystem.

Generative artificial intelligence technologies, including AI-powered search features, large language model-based assistants, and agentic AI systems, may reduce the volume of user traffic directed to publisher websites by providing direct answers to user queries and bypassing traditional web navigation. As publishers experience traffic declines resulting from AI-mediated content consumption, the volume and value of advertising inventory available on our platform may decrease. This risk is particularly acute for open-web publishers that rely on search-driven and algorithmically distributed traffic to monetize their content through programmatic advertising. Additionally, the emergence of AI agents—autonomous systems that act on behalf of consumers—could further disrupt traditional web browsing behavior and the programmatic advertising ecosystem in ways we cannot fully anticipate. If these shifts reduce advertiser and publisher reliance on programmatic supply-side platforms, we may be unable to develop alternative revenue streams or adapt our platform sufficiently to offset the disruption. Any such development could have a material adverse effect on our business, revenues, and results of operations.

Competition from companies with greater artificial intelligence capabilities may adversely affect our business and market position.

We compete with large technology platforms and other companies that have significantly greater resources to invest in artificial intelligence and machine learning capabilities. These competitors are deploying generative AI and advanced machine learning systems to build advertising solutions, expand closed ecosystems, and develop identity-independent targeting approaches that may reduce the value of independent supply-side platforms. If our competitors develop AI capabilities that are superior to ours, or if AI-driven consolidation accelerates buyer and publisher preferences for closed ecosystems or vertically integrated platforms, we could lose market share, experience pricing pressure, or face reduced demand for our services. Competition for engineers and data scientists with AI and machine learning expertise is intense, and our ability to attract and retain such talent is essential to our competitive position. If we are unable to develop, acquire, or retain competitive AI capabilities, our business, results of operations, and financial condition could be adversely affected.

Evolving laws and regulations governing artificial intelligence may impose significant compliance obligations and expose us to liability.

Regulatory frameworks governing the development and use of artificial intelligence are evolving rapidly across the United States, the European Union, and other jurisdictions in which we operate. In particular, the European Union’s Artificial Intelligence Act (“EU AI Act”) imposes obligations on providers and deployers of AI systems, with key provisions applicable to general-purpose AI and higher-risk applications taking effect on August 2, 2026. Compliance with the EU AI Act may require us to classify our AI systems, conduct conformity assessments, implement risk management and human oversight procedures, maintain technical documentation, and provide transparency to affected parties. Failure to comply could expose us to penalties of up to €15 million or 3% of worldwide annual turnover, as well as operational disruptions and reputational harm. In the United States, numerous states are considering or have enacted legislation governing AI systems, automated decision-making, and algorithmic transparency, and the regulatory landscape continues to evolve. The cost of compliance with AI regulations, individually and in the aggregate, may be substantial, and evolving requirements could require us to modify product design, data practices, or business operations in ways that are difficult to predict. Any failure to comply with applicable AI laws and regulations could adversely affect our business, financial condition, and results of operations.

The proliferation of AI-generated content may create brand safety risks and inventory quality challenges that adversely affect our business.

The rapid proliferation of AI-generated content across publisher websites presents emerging brand safety and inventory quality challenges. AI-generated content may contain inaccurate information, biases, or inappropriate material that advertisers may consider unsuitable for association with their brand. If advertisements served through our platform are placed alongside AI-generated content that harms an advertiser’s brand reputation, our customers may reduce their spending on our platform, seek alternative solutions, or pursue claims against us. Our ability to accurately identify and classify AI-generated content in real time as part of our inventory quality and brand safety processes is still developing, and we cannot guarantee that our detection and mitigation tools will be effective against all forms of AI-generated content. In addition, emerging regulatory requirements for the disclosure and labeling of AI-generated content may impose additional compliance obligations on us and our publisher customers. If we are unable to adequately address AI-generated content risks, our business, results of operations, and financial condition could be adversely affected.

Risk Related to our Operations

We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance long-term stockholder value. Share repurchases could also increase the volatility of the trading price of our stock and diminish our cash reserves.

In February 2023, our board of directors authorized and approved a program pursuant to which we could repurchase up to $75.0 million in aggregate of shares of our Class A common stock, with the authorization to expire on December 31, 2024 (as amended, the “2023 Repurchase Program”). On February 22, 2024, our board of directors authorized an increase and extension to the 2023 Repurchase Program from $75.0 million to $175.0 million through December 31, 2025. On May 7, 2025, our board of directors authorized a further increase and extension to the 2023 Repurchase Program, increasing the total amount authorized for repurchase from $175.0 million to $275.0 million and extending the 2023 Repurchase Program through December 31, 2026 (the “2025 Repurchase Program Extension”). As of March 31, 2026, we have repurchased approximately $189.9 million of our Class A common stock in aggregate under the 2023 Repurchase Program. Although our board of directors authorized the 2025 Repurchase Program Extension, the program does not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares of our Class A common stock. The actual timing and amount of repurchases remain subject to a variety of factors, including stock price, trading volume, market conditions and other general business considerations, all of which may be negatively impacted by macroeconomic conditions and factors, including, for example, volatile interest rates, inflation, and geopolitical uncertainty. The 2023 Repurchase Program may be modified, suspended, or terminated at any time, and we cannot guarantee that the 2023 Repurchase Program will be fully consummated or that it will enhance long-term stockholder value. The program could affect the trading price of our Class A common stock, increase volatility and diminish our cash and cash equivalents and marketable securities, and any announcement of a termination of this program may result in a decrease in the trading price of our stock.

Risks Related to Regulations

We are subject to constantly evolving laws, regulations and industry requirements related to data privacy, data protection, information security, and consumer protection across the markets we operate in.

We receive, store, and process data about or related to consumers in addition to publisher, buyer, partner, employee, and services provider or vendor data. Our handling of this data is subject to numerous federal, state, and foreign laws and regulations that are constantly evolving and not always consistent across jurisdictions. We are also subject to regulation by various governmental authorities in addition to federal and state regulations. Our data handling is further subject to contractual obligations and may be deemed to be subject to industry standards and trade associations.

The U.S. federal government and various state and foreign governments have adopted or proposed limitations on the collection, distribution, use, and storage of data relating to individuals, including the use of contact information, precise geolocation information, and other data for marketing, advertising and other communications with individuals and businesses. In the United States, various laws and regulations apply to the collection, processing, disclosure, and security of certain types of data. Additionally, the U.S. Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the online collection, use, dissemination, and security of data. These regulatory regimes are constantly evolving and not always interpreted in a consistent manner. If we fail to comply with any such laws or regulations, we may be subject to enforcement actions that may not only expose us to litigation, fines, and civil and/or criminal penalties, but also require us to change our business practices, each of which could adversely affect our business, results of operations, and financial condition.

The regulatory framework for data privacy worldwide is evolving and is likely to remain uncertain for the foreseeable future. The occurrence of unanticipated events often rapidly drives the adoption of legislation or regulation affecting the use, collection, or other processing of data and manners in which we conduct our business. Restrictions have been placed upon the collection, management, aggregation, transfer, and use of information, and compliance with those restrictions may require us to change how we collect, manage, aggregate, transfer, and use data in the future, which could result in a material increase in the cost of collecting or otherwise obtaining certain kinds of data. These restrictions could further limit the ways in which we may use or disclose information or may require us to make changes to our offerings, which could adversely affect our business, results of operations, and financial condition. In particular, interest-based advertising, or the use of data to draw inferences about a user’s interests and deliver relevant advertising to that user, and similar or related practices (sometimes referred to as behavioral advertising or personalized advertising), such as cross-device data collection and aggregation, have come under increasing scrutiny by legislative, regulatory, and self-regulatory bodies in the United States and abroad that focus on consumer protection or data privacy. In addition, the steps taken by companies to de-identify personal data, to use and distribute the resulting data, including for purposes of personalization and the targeting of advertisements, have also been a frequent target of scrutiny by these authorities. Much of the related regulatory activity has focused on the use of cookies and other technology to collect information about Internet users’ online browsing activity on web browsers, mobile devices, and other devices, to associate such data with user or mobile advertising identifiers or de-identified identities across devices and channels. There is also increased regulatory focus on the use of geolocation data that aims to limit what can be collected, what kind of consent may be required with respect to the same, and how such data may be used, exchanged, or disclosed to others.

In addition to governmental authorities, providers of Internet browsers maintain significant control over cookies and similar technologies and the data collected using such technologies. Because we, and our customers, rely upon large volumes of such data collected primarily through cookies and similar technologies, it is possible that these providers could have a substantial impact on our ability to collect and use data from Internet users. It is essential that we engage in responsible privacy practices, including providing consumers with notice of the types of data we collect and how we use that data to provide our services.

In the United States, the U.S. Congress and state legislatures, along with federal regulatory authorities, have increased their attention on matters concerning the collection and use of consumer data. In the United States, non-sensitive consumer data generally may be used under current rules and regulations, subject to certain restrictions, so long as the person does not affirmatively “opt-out” of the collection or use of such data. If an “opt-in” model or other more restrictive regulations were to be adopted in the United States, less data would be available, and the cost of data would be higher. It is uncertain what steps the second Trump Administration in the United States may take to expand, curtail, or alter the current federal regulatory regime in which we operate.

California enacted the California Consumer Privacy Act (as amended, “CCPA”) which took effect in January 2020. The CCPA created individual privacy rights for California residents, including rights of deletion and access, and increased the privacy and security obligations of businesses handling personal data. The CCPA is also still enforceable by the California Attorney General, and there is a CCPA private right of action relating to certain data security incidents. The CCPA generally requires covered businesses to, among other things, provide disclosures to California consumers regarding the collection, use and disclosure of their personal data. The CCPA also affords California consumers the ability to opt-out of certain sales of personal data, a concept that is defined broadly and is subject to evolving regulations promulgated initially by the California Attorney General, and now the California Privacy Protection Agency (“CPPA”), a newly created agency charged with CCPA rulemaking and enforcement.

CCPA amendments have also imposed additional data protection obligations on companies doing business in California, including additional consumer rights processes and opt-outs for certain uses of sensitive data and “sharing” of personal data for cross-context behavioral advertising. The effects of the CCPA, including from expected but not yet promulgated regulations, are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply, which will increase our potential exposure to regulatory enforcement and/or litigation. Decreased availability and increased costs of information due to implementing the CCPA, could adversely affect our ability to meet our customers’ requirements and could have an adverse effect on our business, results of operations, and financial condition.

In addition to regulations under the CCPA, the California Privacy Protection Agency have also promulgated regulations as a result of the California Delete Act, which applies to those entities defined as ‘data brokers’ under the CCPA amendments. The Delete Act requires the CPPA to establish an accessible data deletion mechanism by January 1, 2026, to allow California consumers to submit a single verifiable consumer request to delete their data across all data brokers. By providing an opportunity for mass data subject requests, the Delete Act imposes compliance and operational costs and has the potential to limit the availability of personal data that PubMatic may utilize for targeted advertising.

The California Invasion of Privacy Act (as amended, “CIPA”) has become the basis for a growing number of lawsuits against digital advertising companies. Plaintiffs have argued that CIPA prohibits certain forms of interception of communications and the use of pen registers or similar tracking devices without the consent of all parties to the communication. Plaintiffs in several recent cases have alleged that adtech intermediaries—including supply side platforms (SSPs)—have violated CIPA by participating in the interception of communications between consumers and websites through the use of tracking pixels, cookies, session replay scripts, or real-time bidding signals. Although we believe our practices comply with applicable laws, the legal framework surrounding CIPA is unsettled and continues to evolve through litigation and courts have issued conflicting decisions regarding the scope of CIPA’s application to modern internet technologies. Should plaintiffs successfully argue that our participation in the adtech ecosystem constitutes a violation of CIPA, we could be subject to significant statutory damages costly litigation, injunctions, or other regulatory actions. Even unmeritorious claims can result in substantial legal expenses and divert management attention. If similar claims are adopted by courts in other jurisdictions, or if regulators issue adverse guidance interpreting these practices as unlawful under CIPA or other statutes, our exposure could increase and our business, results of operations, and financial condition could be adversely affected.

The CCPA has encouraged “copycat” laws in other states across the country. Following California’s lead, over a third of other U.S. states have enacted comprehensive consumer privacy laws as well as privacy laws targeted at specific industries or types of data, and at data brokers specifically. Numerous other states have or are in the process of passing their own privacy or privacy-adjacent laws. Compliance with new privacy legislation adds complexity and may require investment in additional resources for compliance programs, thus potentially resulting in additional costs and expense of resources to maintain compliance. We cannot yet fully predict the impact of such state laws or subsequent guidance on our business or operations, but it may require us to further modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply, including the opportunity cost of devoting resources to developing compliance solutions over expanded platform capabilities. New and proposed legislation has added and may in the future add additional complexity, variation in requirements, restrictions, and potential legal risk, require additional investment in resources to compliance programs, and could impact strategies and availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. In some cases, different regulatory regimes may interpret certain practices differently, and there may be contradiction among the regimes in which we operate. Although proposals are regularly introduced in Congress, it remains to be seen whether the U.S. will implement comprehensive federal consumer privacy legislation.

In Europe, the GDPR took effect on May 25, 2018, and applies to products and services that we provide in Europe, as well as the processing of personal data of European Union (“EU”) citizens, wherever that processing occurs. The United Kingdom (“U.K.”) implemented the Data Protection Act, effective May 2018, and statutorily amended it in 2019 to contain provisions, including its own derogations, for how GDPR is applied in the U.K. post-Brexit (the “UK GDPR”). The GDPR includes operational requirements for companies that receive or process personal data of residents of the EU. For example, we are required to offer consent mechanisms to data subjects in Europe before processing data for certain aspects of our service. Failure to comply with GDPR may result in significant penalties for non-compliance of up to the greater of €20 million (£17.5 million in the U.K.) or 4% of an enterprise’s global annual revenue. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease/ change our processing of our data, enforcement notices, and/ or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.

Further, European regulators continue to be focused on compliance with requirements in the online behavioral advertising ecosystem and enforcing national laws that implement the ePrivacy Directive (commonly called the “Cookie Directive”) in those ecosystems. European court decisions and regulators’ recent guidance continue to drive increased attention to cookies and tracking technologies. As regulators start to enforce a stricter approach (which has already begun to occur in Germany, where data protection authorities have initiated a probe on third-party cookies), this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs, and subject us to additional liabilities.

In addition to the GDPR and ePrivacy Directive, the EU AI Act imposes further obligations on companies that develop or deploy AI systems that process personal data. Key provisions of the EU AI Act take effect on August 2, 2026, and may require us to document the data used to train and operate our AI and machine learning models, conduct assessments of AI system risks, implement human oversight mechanisms, and provide transparency to affected parties. These obligations intersect significantly with our existing GDPR compliance obligations and may require additional investment in compliance infrastructure, documentation, and personnel. Failure to comply with the EU AI Act could expose us to penalties of up to €15 million or 3% of worldwide annual turnover, reputational harm, or operational restrictions. As the EU AI Act is still being interpreted and guidance from regulators is developing, we cannot fully predict the compliance costs or operational impacts at this time.

IAB Europe previously collaborated with the digital advertising industry to create a user-facing framework (the Transparency and Consent Framework, or “TCF”) for establishing and managing legal bases under the GDPR and other U.K. and EU privacy laws including the ePrivacy Directive. In February 2022, the Belgian Data Protection Authority (“DPA”) issued an order against IAB Europe that imposes specific remedies on IAB Europe and its operation of TCF. IAB Europe appealed the Belgian DPA’s decision, and the Belgian Market Court issued an interim ruling on the appeal and referred preliminary questions to the CJEU for guidance. IAB Europe subsequently issued an updated version of the TCF, and following the CJEU’s March 2024 ruling, the appeal remains in the Belgian Market Court on the substantive questions posed.

In addition, some countries, including India, Brazil, Thailand, and Japan, are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our services or force us to change business practices to conform to local law. The U.S. federal government has additionally added restrictions on the flow of certain data to China and other so called “countries of concern” which has the potential to limit with whom we may partner or the data we are able to share with certain partners. Any failure to achieve required data protection standards (which are not currently clear when applied to the online advertising ecosystem) may result in lawsuits, regulatory fines, or other actions or liability, all of which may harm our results of operations and revenue opportunities. Because the interpretation and application of privacy and data protection laws, such as the CCPA and GDPR, and their related regulations and standards, are potentially uncertain and may be different across jurisdictions, it is possible that these laws, regulations and standards may be interpreted and applied in manners that are, or are asserted to be, inconsistent with our data management practices or the technological features of our solutions.

We are also subject to laws and regulations that dictate whether, how, and under what circumstances we can transfer, process and/or receive certain data that is critical to our operations, including data shared between countries or regions in which we operate, and data shared among our products and services.

We are also subject to regulation with respect to political advertising activities, which are governed by various federal and state laws in the United States, and national and provincial laws worldwide. Online political advertising laws are rapidly evolving, and our publishers may impose restrictions on receiving political advertising, especially in light of recent elections both in the United States and in foreign jurisdictions. The lack of uniformity and increasing compliance requirements around political advertising may adversely impact the amount of political advertising spent through our platform, increase our operating and compliance costs, and subject us to potential liability from regulatory agencies.

The collection and processing of health-related data presents heightened compliance risks due to the broad and ambiguous language of emerging privacy laws such as Washington’s My Health My Data Act (“MHMD”) and the Nevada Consumer Health Data Law. These laws expand the definition of “consumer health data” far beyond traditional medical information, potentially encompassing data points that are commonly used in digital advertising, such as location data, app usage, and browsing history when linked to health-related interests. Unlike HIPAA, which applies to specific entities such as healthcare providers, these new state laws cast a wider net, creating uncertainty around what constitutes health data and how it must be handled. Compliance obligations, including obtaining explicit consumer consent, offering broad deletion rights, and imposing strict contractual restrictions on data sharing, introduce operational complexity and potential liability for companies such as ours. Additionally, these laws contain private rights of action, exposing businesses to costly class action lawsuits even in cases where health-related data is inadvertently inferred rather than explicitly collected. As enforcement of these regulations ramps up, our company must continuously assess and adapt our data practices to mitigate risk, which may require limiting certain data-driven advertising use cases or investing in additional compliance infrastructure, impacting operational efficiency and revenue opportunities.

In addition to government regulation, privacy advocacy and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us or our customers. We are members of self-regulatory bodies that impose additional requirements related to the collection, use, and disclosure of consumer data. Under the requirements of these self-regulatory bodies, in addition to other compliance obligations, we are obligated to provide consumers with notice about our use of cookies and other technologies to collect consumer data and of our collection and use of consumer data for certain purposes, and to provide consumers with certain choices relating to the use of consumer data. Some of these self-regulatory bodies have the ability to discipline members or participants, which could result in fines, penalties, and/or public censure (which could in turn cause reputational harm) being imposed on us. Additionally, some of these self-regulatory bodies might refer violations of their requirements to the U.S. Federal Trade Commission or other regulatory bodies. If we were to be found responsible for such a violation, it could adversely affect our reputation, as well as our business, results of operations, and financial condition.