Trade Desk Inc

Previous wording

If we fail to maintain and grow our client base and spend through our platform, our revenue and business may be negatively impacted.

Current wording

If we fail to maintain and grow our client base and spend through our platform and related offerings, our revenue and business may be negatively impacted.

Previous wording

To sustain or increase our revenue, we must regularly add new clients and encourage existing clients to maintain or increase the amount of spending through our platform and adopt existing or new features and functionalities that we make available. If competitors introduce lower cost or differentiated offerings that compete with or are perceived to compete with our offerings, our ability to sell our services to new or existing clients could be impaired. We have spent significant effort in cultivating our relationships with advertising agencies, which has resulted in an increase in the budgets allocated to, and the amount of advertising purchased on, our platform. However, it is possible that we may reach a point of saturation at which we cannot continue to grow our revenue from such agencies because of internal limits that advertisers may place on the allocation of their advertising budgets to digital media to a particular provider or otherwise. While we generally have master services agreements (“MSAs”) in place with our clients, such agreements allow our clients to choose the amount they spend through our platform and terminate our services with limited notice. We at times supplement our MSAs with joint business plans and other incentive programs designed to increase spending from existing clients; however, such increased spending may not materialize in the amounts we expect or at all. We do not typically have exclusive relationships with our clients and there is limited cost and difficulty to moving their media spend to our competitors. As a result, we have limited visibility to our future advertising revenue streams. We cannot assure you that our clients will continue to use our platform or related offerings to the extent that we expect or at all, or that we will be able to replace, in a timely or effective manner, departing clients with new clients that generate comparable revenue. If a major client representing a significant portion of our business decides to materially reduce its use of our platform or related offerings or to cease their use altogether, it is possible that our revenue or revenue growth rate could be significantly reduced, and our business negatively impacted.

Current wording

To sustain or increase our revenue, we must regularly add new clients and encourage existing clients to maintain or increase the amount of spend through our platform and adopt existing or new offerings that we make available. If competitors introduce lower cost or differentiated offerings that compete with or are perceived to compete with our offerings, our ability to sell our services to new or existing clients could be impaired. We have spent significant effort in cultivating our relationships with advertising agencies and advertisers, which has resulted in an increase in the budgets allocated to, and the amount of advertising purchased on, our platform. However, it is possible that we may reach a point of saturation at which we cannot continue to grow our revenue from such agencies or advertisers because of internal limits that advertisers may place on the allocation of their advertising budgets to digital media to a particular provider or otherwise. While we generally have master services agreements (“MSAs”) in place with our clients, such agreements allow our clients to choose the amount they spend through our platform and terminate our services with limited notice. We at times supplement our MSAs with joint business plans and other incentive programs designed to increase spend from existing clients; however, such increased spend may not materialize in the amounts we expect or at all. We do not typically have exclusive relationships with our clients and there is limited cost and difficulty to moving their media spend to our competitors. As a result, we have limited visibility to our future advertising revenue streams. We cannot assure you that our clients will continue to use our platform or related offerings to the extent that we expect or at all, or that we will be able to replace, in a timely or effective manner, departing clients with new clients that generate comparable revenue. If a major client representing a significant portion of our business decides to materially reduce its use of our platform or related offerings or to cease their use altogether, it is possible that our revenue or revenue growth rate could be significantly reduced, and our business negatively impacted.

Previous wording

The loss of advertising agencies as clients could significantly harm our business, financial condition and results of operations.

Current wording

The loss of advertising agencies, advertisers or holding companies as clients could significantly harm our business, financial condition and results of operations.

Previous wording

Our client base consists primarily of advertising agencies. We do not have exclusive relationships with advertising agencies, and we depend on agencies to work with us to build and maintain advertiser relationships and execute advertising campaigns.

Current wording

Our client base consists primarily of advertising agencies and advertisers. We do not have exclusive relationships with advertising agencies or advertisers, and we depend on agencies to work with us to build and maintain advertiser relationships and execute advertising campaigns.

Previous wording

The loss of agencies as clients could significantly harm our business, financial condition and results of operations. If we fail to maintain satisfactory relationships with an advertising agency, we risk losing business from the current and future advertisers represented by that agency.

Current wording

The loss of agencies or advertisers as clients could significantly harm our business, financial condition and results of operations. If we fail to maintain satisfactory relationships with an advertising agency, we risk losing business from the current and future advertisers represented by that agency.

Previous wording

We had over 1,100 clients, consisting primarily of advertising agencies, as of December 31, 2023. Many of these agencies are owned by holding companies, where decision making is decentralized such that purchasing decisions are made, and relationships with advertisers are located, at the agency, local branch or division level. If all of our individual client contractual relationships were aggregated at the holding company level, Publicis Groupe would have represented more than 10% of our gross billings for 2023.

Current wording

Our clients include advertising agencies, many of which are owned by holding companies, where decision making is decentralized such that purchasing decisions are made, and relationships with advertisers are located, at the agency, local branch or division level. If all of our individual client contractual relationships were aggregated at the holding company level, one holding company would have represented more than 10% of our gross billings for 2024.

Previous wording

In most cases, we enter into separate contracts and billing relationships with the individual agencies and account for them as separate clients. However, some holding companies for these agencies may choose to exert control over the individual agencies in the future. If so, any loss of relationships with such holding companies and consequently, of their agencies, local branches or divisions, as clients could significantly harm our business, financial condition and results of operations.

Current wording

In most cases, we enter into separate contracts and billing relationships with the individual agencies and account for them as separate clients. However, some holding companies for these agencies may choose to exert control over the individual agencies in the future. Additionally, a holding company may be acquired by, or consolidate with, another holding company that does not utilize our platform, or may otherwise reduce overall spend on our platform as a result of an acquisition or consolidation. If so, any consolidation of, or loss of relationships with such holding companies and consequently, of their agencies, local branches or divisions, as clients could significantly harm our business, financial condition and results of operations.

Previous wording

The substantial majority of our revenue has been derived from clients that programmatically purchase advertising through our platform. We expect that spending on programmatic ad buying will continue to be our primary source of revenue for the foreseeable future and that our revenue growth will largely depend on increasing spend through our platform. The market for programmatic ad buying is a relatively new market, and our current and potential clients may not shift to programmatic ad buying from other buying methods as quickly as we expect, which would reduce our growth potential. If the market for programmatic ad buying deteriorates or develops more slowly than we expect, it could reduce demand for our platform, and our business, growth prospects and financial condition would be adversely affected.

Current wording

The substantial majority of our revenue has been derived from clients that programmatically purchase advertising through our platform. We expect that spend on programmatic ad buying will continue to be our primary source of revenue for the foreseeable future and that our revenue growth will largely depend on increasing spend through our platform. The market for programmatic ad buying is a relatively new market, and our current and potential clients may not shift to programmatic ad buying from other buying methods as quickly as we expect, which would reduce our growth potential. If the market for programmatic ad buying deteriorates or develops more slowly than we expect, it could reduce demand for our platform, and our business, growth prospects and financial condition would be adversely affected.

Previous wording

In addition, our revenue may not necessarily grow at the same rate as spend on our platform. As the market for programmatic buying for advertising matures, growth in spend may outpace growth in our revenue due to a number of factors, including pricing competition, quantity discounts and shifts in product, media, client and channel mix. A significant change in revenue as a percentage of spend could reflect an adverse change in our business and growth prospects. In addition, any such fluctuations, even if they reflect our strategic decisions, could cause our performance to fall below the expectations of securities analysts and investors, and adversely affect the price of our common stock.

Current wording

In addition, our revenue may not necessarily grow at the same rate as spend on our platform. As the market for programmatic buying for advertising matures, growth in spend may outpace growth in our revenue due to a number of factors, including pricing competition, volume discounts and shifts in media, client and channel mix, and the composition of offerings provided to our clients. A significant change in revenue as a percentage of spend could reflect an adverse change in our business and growth prospects. In addition, any such fluctuations, even if they reflect our strategic decisions, could cause our performance to fall below the expectations of securities analysts and investors, and adversely affect the price of our common stock.

Previous wording

Historically, our clients have predominantly used our platform to purchase mobile, display and video advertising inventory. In particular, the CTV market is quickly evolving and the demand for CTV inventory on our platform has been a significant driver of growth. We expect that these will continue to be significant channels used by our clients for digital advertising in the future. We also believe that our revenue growth may depend on our ability to expand within social, native, audio, and especially CTV, and we have been, and are continuing to, enhance such channels. Any decrease in the use of mobile, display and video advertising, whether due to clients losing confidence in the value or effectiveness of such channels, regulatory restrictions, consumer choices, or other causes, or any inability to further penetrate social, native, audio or CTV, or enter new and emerging advertising channels, could harm our growth prospects, financial condition and results of operations.

Current wording

Historically, our clients have predominantly used our platform to purchase CTV and other video, mobile and display advertising inventory. In particular, the CTV market is quickly evolving and the demand for CTV inventory on our platform has been a significant driver of growth. We expect that these will continue to be significant channels used by our clients for digital advertising in the future. We also believe that our revenue growth may depend on our ability to expand within our channels, especially CTV, and we have been, and are continuing to, enhance such channels. Any decrease in the use of video, mobile and display advertising, whether due to clients losing confidence in the value or effectiveness of such channels, regulatory restrictions, consumer choices, or other causes, or any inability to further penetrate certain channels including CTV, or enter new and emerging advertising channels, could harm our growth prospects, financial condition and results of operations.

Previous wording

Each advertising channel presents distinct and substantial risk and, in many cases, requires us to continue to develop additional functionality or features to address the particular requirements of the channel. Our ability to provide capabilities across multiple advertising channels, which we refer to as omnichannel, may be constrained if we are not able to maintain or grow advertising inventory for such channels, and some of our omnichannel offerings may not gain market acceptance. If we fail to maintain a diversified channel mix, a decrease in the demand for any channel or channels that we become primarily dependent upon could harm our business, financial condition and results of operations. We may not be able to accurately predict changes in overall advertiser demand for the channels in which we operate and cannot assure you that our investment in channel development will correspond to any such changes. Furthermore, if our channel mix changes due to a shift in client demand, such as clients shifting their spending more quickly or more extensively than expected to channels in which we have relatively less functionality, features, or inventory, then demand for our platform could decrease, and our business, financial condition, and results of operations could be adversely affected.

Current wording

Each advertising channel presents distinct and substantial risk and, in many cases, requires us to continue to develop additional functionality or features to address the particular requirements of the channel. Our ability to provide capabilities across multiple advertising channels, which we refer to as omnichannel, may be constrained if we are not able to maintain or grow advertising inventory for such channels, and some of our omnichannel offerings may not gain market acceptance. If we fail to maintain a diversified channel mix, a decrease in the demand for any channel or channels that we become primarily dependent upon could harm our business, financial condition and results of operations. We may not be able to accurately predict changes in overall advertiser demand for the channels in which we operate and cannot assure you that our investment in channel development will correspond to any such changes. Furthermore, if our channel mix changes due to a shift in client demand, such as clients shifting their spend more quickly or more extensively than expected to channels in which we have relatively less functionality, features, or inventory, then demand for our platform could decrease, and our business, financial condition, and results of operations could be adversely affected.

Previous wording

Current or future global market uncertainties or downturns and associated macroeconomic conditions beyond our control could harm the overall demand for advertising and the economic health of advertisers, which could adversely affect our business, financial condition and results of operations.

Current wording

Macroeconomic conditions beyond our control could harm the overall demand for advertising and the economic health of agencies and advertisers, which could adversely affect our business, financial condition and results of operations.

Previous wording

Our business depends on the overall demand for advertising and on the economic health of advertisers that benefit from our platform. Current or future global market uncertainties or downturns and associated macroeconomic conditions, such as growing inflation, rising interest rates, recessionary fears, changes in foreign currency exchange rates, supply chain disruptions, the impact of global instability in many parts of the world and public health crises, may disrupt the operations of our clients and partners and cause advertisers to decrease or pause their advertising budgets, which could reduce spend though our platform and adversely affect our business, financial condition and results of operations. As we explore new countries to expand our business, economic downturns or unstable market conditions in any of those countries could also result in our investments not yielding the returns we anticipate.

Current wording

Our business depends on the overall demand for advertising and on the economic health of the agencies and advertisers that use our platform. Market uncertainties or downturns, whether global, local or industry or sector specific, and any associated macroeconomic conditions, such as growing inflation, concerns around a potential recession, changes in interest rates, changes in foreign currency exchange rates, changes in trade policies and practices, supply chain disruptions, the impact of global instability in many parts of the world, and public health crises, may disrupt the operations of our clients and partners and cause agencies and advertisers to decrease or pause their advertising budgets, which could reduce spend though our platform and adversely affect our business, financial condition and results of operations. As we explore new countries to expand our business, economic downturns or unstable market conditions in any of those countries could also result in our investments not yielding the returns we anticipate.

Previous wording

We must maintain a consistent supply of quality ad inventory that is attractive to our clients. Our success depends on our ability to secure quality inventory on reasonable terms across a broad range of advertising networks and exchanges and social media platforms, including video, display, CTV, audio and mobile inventory. The amount, quality and cost of inventory available to us can change at any time, including as publishers and other inventory suppliers respond to changes in the legal and regulatory landscape. A few inventory suppliers hold a significant portion of the programmatic inventory either generally or concentrated in a particular channel, such as audio and social media. In addition, we compete with companies with which we have business relationships. For example, Google is one of our largest advertising inventory suppliers in addition to being one of our competitors. If Google or any other company with attractive advertising inventory limits our access to its advertising inventory, our business could be adversely affected. If our relationships with certain of our suppliers were to cease, or if the material terms of these relationships were to change unfavorably, our business would be negatively impacted. Our suppliers are generally not bound by long-term contracts. As a result, there is no guarantee that we will have access to a consistent supply of quality inventory on favorable terms or at all. If we are unable to compete favorably for advertising inventory available on real-time advertising exchanges, or if real-time advertising exchanges decide not to make their advertising inventory available to us, we may not be able to place advertisements or find alternative sources of inventory with comparable traffic patterns and consumer demographics in a timely manner. Furthermore, the inventory that we access through real-time advertising exchanges may be of low quality or misrepresented to us, despite attempts by us and our suppliers to prevent fraud and conduct quality assurance checks.

Current wording

We must maintain a consistent supply of quality ad inventory that is attractive to our clients. Our success depends on our ability to secure quality inventory on reasonable terms across a broad range of advertising networks and exchanges and social media platforms, including CTV and other video, mobile, display and audio inventory. The amount, quality and cost of inventory available to us can change at any time, including as publishers and other inventory suppliers respond to changes in the legal and regulatory landscape. A few inventory suppliers hold a significant portion of the programmatic inventory either generally or concentrated in a particular channel, such as audio and social media. In addition, we compete with companies with which we have business relationships. For example, Google is one of our largest advertising inventory suppliers in addition to being one of our competitors. If Google or any other company with attractive advertising inventory limits our access to its advertising inventory, our business could be adversely affected. If our relationships with certain of our suppliers were to cease, or if the material terms of these relationships were to change unfavorably, our business would be negatively impacted. Our suppliers are generally not bound by long-term contracts. As a result, there is no guarantee that we will have access to a consistent supply of quality inventory on favorable terms or at all. If we are unable to compete favorably for advertising inventory available on real-time advertising exchanges, or if real-time advertising exchanges decide not to make their advertising inventory available to us, we may not be able to place advertisements or find alternative sources of inventory with comparable traffic patterns and consumer demographics in a timely manner. Furthermore, the inventory that we access through real-time advertising exchanges may be of low quality or misrepresented to us, despite attempts by us and our suppliers to prevent fraud and conduct quality assurance checks.

Previous wording

Inventory suppliers control the bidding process, rules and procedures for the inventory they supply. Such processes may not always work in our favor or for the benefit of our clients and may create inefficiencies in the supply chain for advertising inventory. Given the importance of ensuring access to quality inventory for our advertisers, we launched our OpenPath offering, in order to give clients a simplified, direct connection to publishers. Although we have been investing in this offering and have grown the amount of OpenPath inventory and publishers available through our platform, we cannot guarantee that this offering will prove attractive to our clients or that we will otherwise be successful in our efforts.

Current wording

Inventory suppliers control the bidding process, rules and procedures for the inventory they supply. Such processes may not always work in our favor or for the benefit of our clients and may create inefficiencies in the supply chain for advertising inventory. Although we have in the past and may in the future undertake efforts to address these supply chain inefficiencies, we may not be successful in such efforts. Given the importance of ensuring access to quality inventory for our advertisers, we launched our OpenPath offering in order to give clients a simplified, direct connection to publishers. We have been investing in this offering and plan to continue to grow the amount of OpenPath inventory and publishers available through our platform, but we cannot guarantee that this or future offerings will prove attractive to our clients or otherwise be successful.

Previous wording

If we fail to innovate or make the right investment decisions in our offerings and platform, we may fail to attract and retain advertisers and advertising agencies and our revenue and results of operations may decline.

Current wording

If we fail to innovate or make the right investment decisions in our platform and related offerings, we may fail to attract and retain advertisers and advertising agencies and our revenue and results of operations may decline.

Previous wording

Our industry is subject to rapid and frequent changes in technology and laws governing our activities, evolving client needs and expectations and the frequent introduction by our competitors of new and enhanced offerings. If new or existing competitors have more attractive offerings, we may lose clients or clients may decrease their use of our platform. New client demands, superior competitive offerings or new industry standards could require us to make unanticipated and costly changes to our platform or business model. We must constantly make investment decisions regarding offerings and technology to meet client demand and evolving industry and legal standards. We may make bad decisions regarding these investments. Furthermore, even if we believe that our investments improve upon our platform and offerings, such as updates to our various platform features and user interface, they may nevertheless fail to meet new or existing client expectations or preferences, which could result in decreased client adoption or use of our platform.

Current wording

Our industry is subject to rapid and frequent changes in technology and laws governing our activities, evolving client needs and expectations and the frequent introduction by our competitors of new and enhanced offerings. If new or existing competitors have more attractive offerings, we may lose clients or clients may decrease their use of our platform. New client demands, superior competitive offerings or new industry standards could require us to make unanticipated and costly changes to our platform or business model. We must constantly make investment decisions regarding offerings and technology to meet client demand and evolving industry and legal standards. We may make bad decisions regarding these investments. Furthermore, even if we believe that our investments improve upon our platform and related offerings, such as updates to our various platform features and user interface, they may nevertheless fail to meet new or existing client expectations or preferences, which could result in decreased client adoption or use of our platform.

Previous wording

In addition, as we develop and introduce new products and services, including those incorporating or utilizing artificial intelligence and machine learning and new processing of personal information, including identifiable information, they may raise new, or heighten existing, technological, security, legal and other risks and challenges, which may cause unintended consequences, and they may not function properly or may be misused by our clients. If we fail to adapt to our rapidly changing industry or to evolving client needs or expectations, or we provide new or updated products and services that exacerbate technological, security, legal or other challenges, the reputation of and demand for our platform or related offerings could decrease and our business, financial condition and operations may be adversely affected.

Current wording

In addition, as we develop and introduce new offerings, including those incorporating or utilizing artificial intelligence and machine learning and new processing of personal information, including identifiable information, they may raise new, or heighten existing, technological, security, legal and other risks and challenges, which may cause unintended consequences, and they may not function properly or may be misused by our clients. If we fail to adapt to our rapidly changing industry or to evolving client needs or expectations, or we provide new or updated offerings that exacerbate technological, security, legal or other challenges, the reputation of and demand for our platform or related offerings could decrease and our business, financial condition and operations may be adversely affected.

Previous wording

We face various and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our systems and the data that we process. Our products and services involve the storage and transmission of significant amounts of data from users, clients, and inventory and data providers, a large volume of which is hosted by third-party service providers. Our services and the data on our platform, related offerings and in our systems could be exposed to unauthorized access due to activities that breach or undermine security measures, including: negligence or malfeasance by internal or external actors; attempts by outside parties to fraudulently induce employees, clients or vendors to disclose information or data, including personal information; or errors or vulnerabilities in our systems, products or processes or in those of our service providers, clients, and vendors.

Current wording

We face various and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our systems and the data that we process. Our offerings involve the storage and transmission of significant amounts of data from users, clients, and inventory and data providers, a large volume of which is hosted by third-party service providers. Our services and the data on our platform, related offerings and in our systems could be exposed to unauthorized access due to activities that breach or undermine security measures, including: negligence or malfeasance by internal or external actors; attempts by outside parties to fraudulently induce employees, clients or vendors to disclose information or data, including personal information; or errors or vulnerabilities in our systems, offerings or processes or in those of our service providers, clients, and vendors.

Previous wording

A breach of our security, a flawed design, and/or our failure to respond sufficiently to a security incident could disrupt our services and result in theft, misuse, loss, corruption, or improper use or disclosure of data. This could result in government investigations, lawsuits (including class actions), enforcement actions and other legal and financial liability, and/or loss of confidence in the availability and security of our products and services, all of which could seriously harm our reputation and brand and impair our ability to attract and retain clients. As some of our newer offerings involve the receipt and processing of identifiable information, the risks associated with data, including risks to breach of our systems increases, and we could be subject to contractual breach and indemnification claims from other clients and partners and otherwise suffer damage to our reputation, brand, and business. Our platform may also receive data in aggregated or pseudonymized form, and if our systems are breached and such data or information is compromised, it could be damaging to our brand, reputation, and business. Cyberattacks could also compromise our own trade secrets and other confidential information and result in such information being disclosed to others and becoming less valuable, which could negatively affect our business. Although we maintain errors or omissions and cyber liability insurance, the costs related to an incident or other security threats or disruptions may not be fully insured or indemnified by other means and insurance and other safeguards might only partially reimburse us for our losses, if at all. We also cannot guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all.

Current wording

A breach of our security, a flawed design, and/or our failure to respond sufficiently to a security incident could disrupt our services and result in theft, misuse, loss, corruption, or improper use or disclosure of data. This could result in government investigations, lawsuits (including class actions), enforcement actions and other legal and financial liability, and/or loss of confidence in the availability and security of our offerings, all of which could seriously harm our reputation and brand and impair our ability to attract and retain clients. As some of our newer offerings involve the receipt and processing of identifiable information, the risks associated with data, including risks to breach of our systems increases, and we could be subject to contractual breach and indemnification claims from other clients and partners and otherwise suffer damage to our reputation, brand, and business. We could also be required to notify regulators, customers or other third parties. Our platform may also receive data in aggregated or pseudonymized form, and if our systems are breached and such data or information is compromised, it could be damaging to our brand, reputation, and business. Cyberattacks could also compromise our own trade secrets and other confidential information and result in such information being disclosed to others and becoming less valuable, which could negatively affect our business. Although we maintain errors or omissions and cyber liability insurance, the costs related to an incident or other security threats or disruptions may not be fully insured or indemnified by other means and insurance and other safeguards might only partially reimburse us for our losses, if at all. We also cannot guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all.

Previous wording

Privacy and data protection laws to which we and our clients, inventory partners, and third-party data providers are subject may cause us to incur additional or unexpected costs, subject us to investigations or enforcement actions for alleged compliance failures, result in less demand for our products and services, or cause us to change our platform, related offerings or business model, which may have a material adverse effect on our business.

Current wording

Privacy and data protection laws to which we and our clients, inventory partners, and third-party data providers are subject may cause us to incur additional or unexpected costs, subject us to investigations or enforcement actions for alleged compliance failures, result in less demand for our offerings, or cause us to change our platform, related offerings or business model, which may have a material adverse effect on our business.

Previous wording

Information relating to individuals and their devices (commonly called “personal information” or “personal data”) is regulated under a wide variety of local, state, national and international laws and regulations that apply to its collection, use, retention, protection, disclosure, transfer (including transfer across national boundaries) and other processing. We typically collect and store IP addresses and other device identifiers (such as unique cookie identifiers and mobile application identifiers), which are or may be considered personal data or personal information in many jurisdictions or otherwise subject to regulation. In connection with certain of our offerings, including Unified ID 2.0, EUID and OpenPass, we receive information that directly identifies individuals, such as email addresses and phone numbers, both directly from consumers and from our clients or others. We deploy technical and security measures, internal policy controls, and contractual measures to limit how such identifying information is used and shared and to help honor consumer choices. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws.

Current wording

Information relating to individuals and their devices (commonly called “personal information” or “personal data”) is regulated under a wide variety of local, state, national and international laws and regulations that apply to its collection, use, retention, protection, disclosure, transfer (including transfer across national boundaries) and other processing. We typically collect and store IP addresses and other device identifiers (such as unique cookie identifiers and mobile advertising identifiers), which are or may be considered personal data or personal information in many jurisdictions or otherwise subject to regulation. In connection with certain of our offerings, including Unified ID 2.0, EUID and OpenPass, we receive information that directly identifies individuals, such as email addresses and phone numbers, both directly from consumers and from our clients or others. We deploy technical and security measures, internal policy controls, and contractual measures to limit how such identifying information is used and shared. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws. Some of our offerings, including those that entail some use of directly identifying information, may also increase our exposure to potential claims by plaintiffs’ attorneys, including by attempting to apply various legal theories – such as alleging violations of wiretapping statutes – to certain our activities. For example, in March 2025, suits alleging various wiretapping and privacy tort theories were filed against us in the Northern District of California. For additional information regarding the pending legal proceedings, refer to “Item 1. Legal Proceedings.”

Previous wording

The global regulatory landscape regarding the privacy and protection of personal information is evolving, and U.S. (state, federal and local) and foreign governments continue to consider and enact additional legislation and rulemaking related to privacy and data protection, often with a particular focus on intermediaries in the online advertising ecosystem, including those that engage in targeted advertising, “sell” or “share” personal data, and act as “data brokers.” We expect to see an increase in, or changes to, privacy and data protection legislation and regulation in this area for the foreseeable future. For example, in the U.S., the FTC continues to propose updates to existing regulations, including those governing collection of data from children online and related to “commercial surveillance” generally. Further, the FTC uses its enforcement powers under Section 5 of the Federal Trade Commission Act (the “FTC Act”) (which prohibits “unfair” and “deceptive” trade practices) to investigate companies engaging in online tracking. For example, the FTC has been very active in bringing enforcement actions against companies that handle personal data it views as sensitive for advertising purposes, including location data brokers and companies that process health-related data. These enforcement announcements signal increased regulatory scrutiny of advertising practices that involve “sensitive” categories of personal data such as health data and precise location information. Other companies in the advertising technology space have been subject to government investigation by regulatory bodies; advocacy organizations have also filed complaints with data protection authorities against advertising technology companies, arguing that certain of these companies’ practices do not comply with data privacy laws, or consumer protection laws such as the FTC Act. We cannot avoid the possibility that one of these investigations or enforcement actions will require us to alter our practices. In addition, a potential federal omnibus privacy law remains a possibility. Although the initial momentum surrounding it has waned, if ultimately passed, such a law would likely substantially impact the online advertising ecosystem.

Current wording

The global regulatory landscape regarding the privacy and protection of personal information is evolving, and U.S. (state, federal and local) and foreign governments continue to consider and enact additional legislation and rulemaking related to privacy and data protection, often with a particular focus on intermediaries in the online advertising ecosystem, including those that engage in targeted advertising, “sell” or “share” personal data, and act as “data brokers.” We expect to see an increase in, or changes to, privacy and data protection legislation and regulation in this area for the foreseeable future. For example, the FTC uses its enforcement powers under Section 5 of the Federal Trade Commission Act (the “FTC Act”) (which prohibits “unfair” and “deceptive” trade practices) to investigate companies engaging in online tracking. For example, in the preceding few years, the FTC has been very active in bringing enforcement actions against companies that handle personal data it views as sensitive for advertising purposes, including location data brokers and companies that process health-related data. The Commission could continue to build on this trend under its authority to enforce a relatively new federal law focused on disclosures of certain “sensitive” information by companies operating as data brokers to certain restricted countries or entities “controlled” by such countries, and the Department of Justice could act on authority granted under an executive order restricting similar practices, for which regulations and guidance have recently been issued. Other companies in the advertising technology space have been subject to government investigation by regulatory bodies; advocacy organizations have also filed complaints with data protection authorities against advertising technology companies, arguing that certain of these companies’ practices do not comply with data privacy laws, or consumer protection laws such as the FTC Act. As noted above, plaintiffs’ attorneys are also increasingly exploring theories under which to pursue claims against advertising technology companies related to their data collection, use and disclosure practices, as well as advertisers and publishers that rely on services provided by these companies. For example, in March 2025, suits alleging various privacy tort theories were filed against us in the Northern District of California. For additional information regarding the pending legal proceedings, refer to “Item 1. Legal Proceedings.” We cannot avoid the possibility that one of these investigations or enforcement actions will require us to alter our practices. In addition, a potential federal omnibus privacy law remains a possibility. If ultimately passed, such a law would likely substantially impact the online advertising ecosystem.

Previous wording

State lawmakers are also actively addressing consumer data privacy issues. Many states have adopted omnibus consumer privacy laws, some of which are already enforceable, while others will take effect over the coming years. These state laws define “personal information” broadly enough to include many online identifiers provided by individuals’ devices, applications, and protocols (such as IP addresses, mobile application identifiers and unique cookie identifiers), individuals’ location data, and hashed versions of email addresses and phone numbers. These laws generally require covered businesses to meet numerous data privacy-related obligations and establish data privacy rights for consumers in such states (including rights to opt out of certain processing of their personal data and to request correction, deletion of and access to personal data), imposing special rules on the collection of personal data from minors and other personal data deemed “sensitive” under the laws, and creating new notice obligations. Many also impose data minimization requirements, mandating that companies only collect and process data for certain purposes. Most significant for the advertising industry, however, these laws require businesses that engage in certain advertising uses of personal data to offer and honor an opt-out of such activities, including, in some states, through browser or device-based preference signals. (Terminology varies slightly among some of the state laws, tying the opt-out requirement to “targeted advertising,” “sales” or “sharing” of personal data.) Because of these obligations, the availability of data within our platform, our other offerings and the advertising ecosystem more broadly may decline, potentially making our platform and offerings less valuable to our clients.

Current wording

State lawmakers are also actively addressing consumer data privacy issues. Many states have adopted omnibus consumer privacy laws, a host of which are already enforceable, while others will take effect over the coming years. These state laws define “personal information” broadly enough to include many online identifiers provided by individuals’ devices, applications, and protocols (such as IP addresses, mobile advertising identifiers and unique cookie identifiers), individuals’ location data, and hashed versions of email addresses and phone numbers. These laws generally require covered businesses to meet numerous data privacy-related obligations and establish data privacy rights for consumers in such states (including rights to opt out of certain processing of their personal data and to request correction, deletion of and access to personal data), imposing special rules on the collection of personal data from minors and other personal data deemed “sensitive” under the laws, and creating new notice obligations. Many also impose data minimization requirements, mandating that companies only collect and process data for certain purposes. Most significant for the advertising industry, however, these laws require businesses that engage in certain advertising uses of personal data to offer and honor an opt-out of such activities, including, in some states, through browser or device-based preference signals. (Terminology varies slightly among some of the state laws, tying the opt-out requirement to “targeted advertising,” “sales” or “sharing” of personal data.) Because of these obligations, the availability of data within our platform, our related offerings and the advertising ecosystem more broadly may decline, potentially making our platform and related offerings less valuable to our clients.

Previous wording

The requirement under certain states’ laws to honor users’ requests to opt out of certain disclosures and uses of data for advertising purposes through preference signals, such as the Global Privacy Control (“GPC”) or similar signals, reflects a broader attention that privacy advocates, the media and some government regulators, such as the FTC, have devoted to digital advertising in recent years. If the use of the GPC or similar technical signals is adopted by many Internet users, is imposed by additional states or by federal or foreign legislation or is agreed upon by standard setting groups, we may have to change our business practices, our clients may reduce their use of our platform and offerings, and our business could be harmed.

Current wording

The requirement under certain states’ laws to honor users’ requests to opt out of certain disclosures and uses of data for advertising purposes through preference signals, such as the Global Privacy Control (“GPC”) or similar signals, reflects a broader attention that privacy advocates, the media and some government regulators, such as the FTC, have devoted to digital advertising in recent years. If the use of the GPC or similar technical signals is adopted by many Internet users, is imposed by additional states or by federal or foreign legislation or is agreed upon by standard setting groups, we may have to change our business practices, our clients may reduce their use of our platform and related offerings, and our business could be harmed.

Previous wording

These laws and their implementing regulations will likely also increase compliance costs and obligations on us, our clients, and other companies in the advertising industry. Although we have attempted to mitigate certain risks posed by these laws through contractual, platform and product changes, we cannot predict with certainty the effect of these laws and their implementing regulations, many of which are not yet finalized, on our business, nor the share of consumers who will carry out their opt-out and other rights and how these actions will impact us, our clients, inventory sources, and our industry. Further, enforcement activity under such laws already in effect, particularly in California, reflects an ongoing focus on online advertising activities and signals regulators’ willingness to pursue in-depth investigations and impose substantial penalties on entities allegedly operating in violation of the statute. Thus, we expect that continuing to maintain compliance with states’ varying legal requirements, including monitoring and adjusting to new regulations and interpretations that emerge through enforcement actions, will require significant time, resources, and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Current wording

These laws and their implementing regulations will likely also increase compliance costs and obligations on us, our clients, and other companies in the advertising industry. Although we have attempted to mitigate certain risks posed by these laws through contractual, platform and offering changes, we cannot predict with certainty the effect of these laws and their implementing regulations, some of which are not yet finalized, on our business, nor the share of consumers who will carry out their opt-out and other rights and how these actions will impact us, our clients, inventory sources, and our industry. Further, enforcement activity under such laws already in effect, particularly in California, reflects an ongoing focus on online advertising activities and signals regulators’ willingness to pursue in-depth investigations and impose substantial penalties on entities allegedly operating in violation of the statute. Thus, we expect that continuing to maintain compliance with states’ varying legal requirements, including monitoring and adjusting to new regulations and interpretations that emerge through enforcement actions, will require significant time, resources, and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Previous wording

In addition to these broad-based consumer privacy laws, lawmakers and regulators continue to focus on activities that involve use of categories of personal data perceived as especially sensitive, such as health data and children’s data. For example, several states have enacted laws that would substantially impact activities that involve showing targeted advertisements to individuals under 18 through a variety of new restrictions, or in some cases prohibit it altogether. In addition, several recent federal bills would likewise further regulate the processing of children’s data and other personal data perceived as especially sensitive. Further, several states have enacted laws, updated existing laws or have introduced bills to impose new privacy obligations related to health-related personal information beyond that governed by federal and state laws governing medical records and similar information, such as HIPAA. For example, Washington’s My Health, My Data Act (“MHMD”) introduced a host of requirements related to a very broadly-defined notion of consumer health data that impacts the advertising industry in part because MHMD is subject to a private right of action (unlike other state privacy laws), so plaintiffs’ attorneys could explore claims that stretch the bounds of the law’s text. These laws and the heightened scrutiny associated with the enforcement of such laws may, in turn, ultimately lead to increased compliance and defense costs, and more obligations on us, our clients and other companies in the advertising industry.

Current wording

In addition to these broad-based consumer privacy laws, lawmakers and regulators continue to focus on activities that involve use of categories of personal data perceived as especially sensitive, such as health data and children’s data. For example, the FTC has recently finalized an update to rules adopted pursuant to the Children Online Privacy Protection Act, modifying some requirements relating to the use of children’s data for targeted advertising and several states have enacted laws that would substantially impact activities that involve showing targeted advertisements to individuals under 18 years of age through a variety of new restrictions, or in some cases prohibit it altogether. Further, several states have enacted laws, updated existing laws or have introduced bills to impose new privacy obligations related to health-related personal information beyond that governed by federal and state laws governing medical records and similar information, such as HIPAA. For example, Washington’s My Health, My Data Act (“MHMD”) introduced a host of requirements related to a very broadly-defined notion of consumer health data that impacts the advertising industry in part because MHMD is subject to a private right of action (unlike other state privacy laws), so plaintiffs’ attorneys could explore claims that stretch the bounds of the law’s text. A somewhat similar law recently enacted in Virginia also contains a privacy right of action. These laws and the heightened scrutiny associated with the enforcement of such laws may, in turn, ultimately lead to increased compliance and defense costs, and more obligations on us, our clients and other companies in the advertising industry.

Previous wording

Laws governing the processing of personal data in Europe (including the U.K., EU and EEA, and the countries of Iceland, Liechtenstein, and Norway) also continue to impact us and continue to evolve. For example, the GDPR defines “personal data” broadly and enhances data protection obligations for controllers of such data and for service providers processing the data. It also provides certain rights, such as access and deletion, to the individuals about whom the personal data relates. IAB Europe previously collaborated with the digital advertising industry to create a user-facing framework (the Transparency and Control Framework, or “TCF”) for establishing and managing legal bases under the GDPR and other U.K. and EU privacy laws including the ePrivacy Directive. Although the TCF is actively in use, its viability as a compliance mechanism remains under review by European authorities and we cannot predict its effectiveness over the long term. Non-compliance with the GDPR can trigger steep fines of up to the greater of €20 million or 4% of total worldwide annual revenue. Relatedly, authorities enforcing the U.K. GDPR have the ability to separately fine up to the greater of £17.5 million or 4% of global turnover. Continuing to maintain compliance with the requirements of the GDPR, including monitoring and adjusting to rulings and interpretations that affect our approach to compliance, requires significant time, resources and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Current wording

Laws governing the processing of personal data in Europe (including the U.K. and EEA) also continue to impact us and continue to evolve. For example, the GDPR defines “personal data” broadly and enhances data protection obligations for controllers of such data and for service providers processing the data. It also provides certain rights, such as access and deletion, to the individuals about whom the personal data relates. IAB Europe previously collaborated with the digital advertising industry to create a user-facing framework (the Transparency and Control Framework, or “TCF”) for establishing and managing legal bases under the GDPR and other U.K. and EU privacy laws including the ePrivacy Directive. Although the TCF is actively in use, its viability as a compliance mechanism remains under review by European authorities and we cannot predict its effectiveness over the long term. Because we are under the supervision of relevant data protection authorities in both the EEA and the U.K., we may be fined under both the EU GDPR and the UK GDPR for the same breach, with penalties up to the greater of €20 million/BP 17.5 million or 4% of total worldwide annual turnover. In addition to fines, breach of the GDPR can also result in regulatory investigations, enforcement notices, and civil claims. Continuing to maintain compliance with the requirements of the GDPR, including monitoring and adjusting to rulings and interpretations that affect our approach to compliance, requires significant time, resources and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Previous wording

Data residency and cross-border transfer restrictions also impact our operations. For the transfer of personal data from Europe to the U.S., we rely upon, and are certified under, the EU-U.S. and Swiss-U.S. Data Privacy Frameworks (“DPF”) and the U.K. extension to the EU-U.S. DPF. The DPF replaced the Privacy Shield Framework as an adequate mechanism by which EU companies may pass personal data to the U.S. However, the DPF is already subject to legal challenge in Europe. Relatedly, whether and how other transfer mechanisms, such as standard contractual clauses, can be used to transfer personal data to the U.S. is in question. While the adequacy decision for the DPF helps to reduce the legal uncertainty of cross-border transfers of personal data, the long-term validity of these transfer mechanisms remains uncertain. If all or some jurisdictions within the EU or the U.K. determine that the latest standard contractual clauses also cannot be used to transfer personal data to the U.S. and if the DPF is ultimately struck down in a manner similar to the Privacy Shield Framework, we could be left with no reasonable option for the lawful cross-border transfer of personal data. In such circumstances, continuing to transfer personal data from the EU to the U.S. could lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity. Such consequences could have an adverse effect on our reputation and business, such as by requiring us to establish systems to maintain certain data in the EU, potentially involving substantial expense and causing us to divert resources from other aspects of our operations, all of which may adversely affect our business. Other jurisdictions have adopted or are considering cross-border or data residency restrictions, which could reduce the amount of data we can collect or process and, as a result, significantly impact our business.

Current wording

Data residency and cross-border transfer restrictions also impact our operations. For the transfer of personal data from Europe to the U.S., we rely upon, and are certified under, the EU-U.S. and Swiss-U.S. Data Privacy Frameworks (“DPF”) and the U.K. extension to the EU-U.S. DPF. The DPF replaced the Privacy Shield Framework as an adequate mechanism by which EU companies may pass personal data to the U.S. However, the DPF is already subject to legal challenge in Europe. Relatedly, whether and how other transfer mechanisms, such as standard contractual clauses, can be used to transfer personal data to the U.S. is in question. While the adequacy decision for the DPF helps to reduce the legal uncertainty of cross-border transfers of personal data, the long-term validity of these transfer mechanisms remains uncertain. If all or some jurisdictions within the EU or the U.K. determine that the latest standard contractual clauses also cannot be used to transfer personal data to the U.S. and if the DPF is ultimately struck down in a manner similar to the Privacy Shield Framework, we could be left with no reasonable option for the lawful cross-border transfer of personal data. In such circumstances, continuing to transfer personal data from the EU to the U.S. could lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative data transfer mechanisms under the GDPR or take additional compliance and operational measures, such as establishing systems to maintain certain data in the EEA, potentially involving substantial expense and causing us to divert resources from other aspects of our operations, all of which may adversely affect our business. Other jurisdictions have adopted or are considering cross-border or data residency restrictions, which could reduce the amount of data we can collect or process and, as a result, significantly impact our business.

Previous wording

Further, our legal risk depends in part on our clients’ or other third parties’ adherence to data privacy laws and regulations and their use of our services in ways consistent with end user expectations. We rely on representations made to us by clients, partners and providers that they will comply with all applicable laws, including all relevant data privacy and data protection regulations. Although we make reasonable efforts to enforce such representations and contractual requirements, we do not fully audit our clients’ compliance with our recommended disclosures or their adherence to data privacy laws and regulations. If our clients, partners or providers fail to adhere to our expectations or contracts in this regard, we and our clients could be subject to adverse publicity, damages and related possible investigation or other regulatory activity.

Current wording

Further, our legal risk depends in part on our clients’ or other third parties’ adherence to data privacy laws and regulations and their use of our services in ways consistent with end user expectations. There can be no assurances that the privacy and security-related measures and safeguards we have put into place in relation to these third parties will be effective to protect us and/or the relevant personal information from the risks associated with the third-party processing of such data. We rely on representations made to us by clients, partners and providers that they will comply with all applicable laws, including all relevant data privacy and data protection regulations. Although we make reasonable efforts to enforce such representations and contractual requirements, we do not fully audit our clients’ compliance with our recommended disclosures or their adherence to data privacy laws and regulations. If our clients, partners or providers fail to adhere to our expectations or contracts in this regard, we and our clients could be subject to adverse publicity, damages and related possible investigation or other regulatory activity.

Previous wording

Adapting our business to enhanced and evolving privacy obligations across relevant jurisdictions could continue to involve substantial expense and may cause us to divert resources from other aspects of our operations, all of which may adversely affect our business. Additionally, as the advertising industry evolves, and new ways of collecting, combining and using data are created, governments may enact legislation in response to technological advancements and changes that could result in our having to re-design features or functions of our platform and related offerings, therefore incurring unexpected compliance costs. Further, adaptation of the digital advertising marketplace requires increasingly significant collaboration between participants in the market, such as publishers and advertisers. Failure of the industry to adapt to changes required for operating under existing and future data privacy laws, industry approaches that disfavor our platform and offerings, and user response to such changes could negatively impact inventory, data, and demand. We cannot control or predict the pace or effectiveness of such adaptation, and we cannot currently predict the impact such changes may have on our business.

Current wording

Adapting our business to enhanced and evolving privacy obligations across relevant jurisdictions could continue to involve substantial expense and may cause us to divert resources from other aspects of our operations, all of which may adversely affect our business. Additionally, as the advertising industry evolves, and new ways of collecting, combining and using data are created, governments may enact legislation and plaintiffs may explore novel legal theories that could result in us deciding to re-design features or functions of our platform and related offerings, therefore incurring unexpected compliance costs. Further, adaptation of the digital advertising marketplace requires increasingly significant collaboration between participants in the market, such as publishers and advertisers. Failure of the industry to adapt to changes required for operating under existing and future data privacy laws, industry approaches that disfavor our platform and related offerings, and user response to such changes could negatively impact inventory, data, and demand. We cannot control or predict the pace or effectiveness of such adaptation, and we cannot currently predict the impact such changes may have on our business.

Previous wording

In addition to laws regulating the processing of personal data, we, our advertisers, and publishers are also subject to regulation with respect to political advertising activities, which are governed by various federal and state laws in the U.S., and national and provincial laws worldwide. Online political advertising laws are rapidly evolving and, in certain jurisdictions, impose varying substantive transparency and disclosure requirements on advertisers, publishers, and/or others in the ecosystem. We saw publishers impose varying prohibitions and restrictions on the types of political advertising and breadth of targeted advertising allowed on their platforms with respect to advertisements for the 2020 U.S. presidential election in response to political advertising scandals, such as the scandal involving Cambridge Analytica. The lack of uniformity and increasing restrictions and requirements on transparency and disclosure could adversely impact the inventory made available for political advertising and the demand for such inventory on our platform, and otherwise increase our operating and compliance costs. Concerns about political advertising or other advertising in areas deemed sensitive, whether or not valid and whether or not driven by applicable laws and regulations, industry standards, client or inventory provider expectations, or public perception, may harm our reputation, result in loss of goodwill, and inhibit use of our platform by current and future clients.

Current wording

In addition to laws regulating the processing of personal data, we, our advertisers, and publishers are also subject to regulation with respect to political advertising activities, which are governed by various federal and state laws in the United States, and national and provincial laws worldwide. Online political advertising laws are rapidly evolving and, in certain jurisdictions, impose varying substantive transparency and disclosure requirements on advertisers, publishers, and/or others in the ecosystem. Concerns about political advertising or other advertising in areas deemed sensitive, whether or not valid and whether or not driven by applicable laws and regulations, industry standards, client or inventory provider expectations, or public perception, may harm our reputation, result in loss of goodwill, and inhibit use of our platform by current and future clients.

Previous wording

We deploy technical and organizational measures, internal policy controls, and contractual measures to limit how identifying information is used and shared and to help honor consumer choices. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws. These laws and other obligations may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our platform and related offerings. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our products, which could have an adverse effect on our business. In addition, public perception regarding data protection and privacy are significant in the programmatic advertising buying industry. Concerns about industry practices regarding the collection, use, and disclosure of personal data, whether or not valid and whether driven by applicable laws and regulations, industry standards, client or inventory provider expectations, or the broader public, may harm our reputation, result in loss of goodwill, and inhibit use of our platform or related offerings by current and future clients. For example, perception that our practices involve an invasion of privacy or are designed with insufficient protections, whether or not such practices are consistent with current or future laws, regulations, or industry practices, may subject us to public criticism, private class actions, reputational harm, or claims by regulators, which could disrupt our business and expose us to increased liability. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited. All of this could impair our or our clients’ ability to collect, use, or disclose information relating to consumers, which could decrease demand for our platform and related offerings, increase our costs, and impair our ability to maintain and grow our client base and increase our revenue.

Current wording

We deploy technical and organizational measures, internal policy controls, and contractual measures to limit how identifying information is used and shared and to help honor consumer choices. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws. These laws and other obligations may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our platform and related offerings. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our offerings, which could have an adverse effect on our business. In addition, public perception regarding data protection and privacy are significant in the programmatic advertising buying industry. Concerns about industry practices regarding the collection, use, and disclosure of personal data, whether or not valid and whether driven by applicable laws and regulations, industry standards, client or inventory provider expectations, or the broader public, may harm our reputation, result in loss of goodwill, and inhibit use of our platform or related offerings by current and future clients. For example, perception that our practices involve an invasion of privacy or are designed with insufficient protections, whether or not such practices are consistent with current or future laws, regulations, or industry practices, may subject us to public criticism, additional private class actions, reputational harm, or claims by regulators, which could disrupt our business and expose us to increased liability. We may be unable to make changes and modifications to our business and offerings in a commercially reasonable manner or at all, and our ability to develop new offerings or certain features could be limited. All of this could impair our or our clients’ ability to collect, use, or disclose information relating to consumers, which could decrease demand for our platform and related offerings, increase our costs, and impair our ability to maintain and grow our client base and increase our revenue.

Previous wording

Third parties control our access to unique identifiers, and if the use of “third-party cookies” or other technology to uniquely identify devices or users is rejected by Internet users, restricted or otherwise subject to unfavorable regulation, blocked or limited by preference signals, technical changes on end users’ devices and web browsers, or our and our clients’ ability to use data, including on our platform or related offerings is otherwise restricted, our performance may decline, and we may lose advertisers and revenue.

Current wording

Third parties control our access to unique identifiers, and if the use of “third-party cookies” or other technology to uniquely identify devices or users is rejected by Internet users, restricted or otherwise subject to unfavorable regulation, blocked or limited by preference signals, technical changes on end users’ devices and web browsers, or our clients’ ability to use data, including on our platform or related offerings is otherwise restricted, our performance may decline, and we may lose advertisers and revenue.

Previous wording

Our ability to successfully leverage user data and generate revenue from opportunities to serve advertisements could be impacted by restrictions imposed by laws or by third parties, including restrictions on our ability to use or read cookies, device identifiers, or other tracking features or our ability to use real-time bidding networks or other bidding networks. For example, if publishers or supply-side platforms decide to limit the data that we receive in order to comply (in their view) with state privacy laws or a potential federal privacy law, then our service may prove to be less valuable to our clients and we may find it more difficult to generate revenue. That is, if third parties on which we rely for data or opportunities to serve advertisements impose limitations (for whatever reason) or are restricted by other ecosystem participants or applicable regulations, then we may lose the ability to access data, bid on opportunities or purchase digital ad space, which could have a substantial impact on our revenue.

Current wording

Our ability to successfully leverage user data and generate revenue from opportunities to serve advertisements could be impacted by restrictions imposed by laws or by third parties, including restrictions on our ability to use or read cookies, device identifiers, or other tracking features or our ability to use real-time bidding networks or other bidding networks. For example, if publishers or supply-side platforms decide to limit the data that we receive in order to comply (in their view) with state privacy laws, a potential federal privacy law, or in response to other legal or industry development then our service may prove to be less valuable to our clients and we may find it more difficult to generate revenue. That is, if third parties on which we rely for data or opportunities to serve advertisements impose limitations (for whatever reason) or are restricted by other ecosystem participants or applicable regulations, then we may lose the ability to access data, bid on opportunities or purchase digital ad space, which could have a substantial impact on our revenue.

Previous wording

Today, digital advertising, including our platform, makes significant use of cookies to store device identifiers for the advertising activities described above. When we use cookies, they are generally considered third-party cookies, which are cookies owned and used by parties other than the owners of the website visited by the Internet user. The most commonly used Internet browsers—Chrome, Firefox, Internet Explorer and Safari—allow Internet users to modify their browser settings to prevent some or all cookies from being accepted by their browsers. Internet users can delete cookies from their computers at any time. Additionally, some browsers currently, or may in the future, block or limit some third-party cookies by default or may implement user control settings that algorithmically block or limit some cookies. Today, three major web browsers—Apple’s Safari, Mozilla’s Firefox and Microsoft’s Edge—block third-party cookies by default. Google’s web browser, Chrome, has introduced new controls over third-party cookies and had announced plans to deprecate support for third-party cookies and user agent strings entirely beginning in 2025. On July 22, 2024, Google announced that it was updating its plan for deprecation of cookies and would, at some point in the future, introduce a new experience in Chrome that allows users to indicate a preference of an undefined type that would apply in an unstated way to the user’s web browsing activity. Google has stated it will continue making its investments and testing various technologies under its label of “Privacy Sandbox” which may provide modified targeting and measurement functionality to digital advertising ecosystem participants as a limited replacement for the functionality currently provided through the use of third-party cookies. We believe that Google’s to-be-defined framework for browser-based user choice and its ongoing development of these technologies, which we expect to be technically complex and designed in a manner that does not favor us or our partners, has created and will likely continue to create industry uncertainty regarding the potential effects on user experience and advertiser targeting and measurement. Although we believe our platform is well-positioned to adapt to such changes, particularly with our Unified ID 2.0 offering, the impact of such changes remains uncertain and could be more disruptive than we anticipate, including to the display advertising ecosystem in particular, where such changes could adversely impact our growth in that channel.

Current wording

Today, digital advertising, including our platform, makes significant use of cookies to store device identifiers for the advertising activities described above. When we use cookies, they are generally considered third-party cookies, which are cookies owned and used by parties other than the owners of the website visited by the Internet user. The most commonly used Internet browsers—Chrome, Firefox, Internet Explorer and Safari—allow Internet users to modify their browser settings to prevent some or all cookies from being accepted by their browsers. Internet users can delete cookies from their computers at any time. Additionally, some browsers currently, or may in the future, block or limit some third-party cookies by default or may implement user control settings that algorithmically block or limit some cookies. Today, three major web browsers—Apple’s Safari, Mozilla’s Firefox and Microsoft’s Edge—block third-party cookies by default. Google’s web browser, Chrome, has introduced, and is likely to continue to introduce, controls over third-party cookies. However, on April 22, 2025, Google announced that it would maintain its current approach to offering users third-party cookie choice in Chrome (thus, presumably, ending its efforts to deprecate third-party cookies in the Chrome browser), and will not be rolling out a new standalone prompt for third-party cookies in Chrome. Although we believe our platform is well-positioned to adapt to such changes, particularly with our Unified ID 2.0 offering, the impact of such changes — and broader scrutiny on the advertising technology ecosystem — remains uncertain and could be more disruptive than we anticipate, including to the display advertising ecosystem in particular, where such changes could adversely impact our growth in that channel.

Previous wording

Advertising shown on mobile applications can also be affected by blocking or restricting use of mobile device identifiers. Data regarding interactions between users and devices are tracked mostly through stable, pseudonymous advertising identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier. These identifiers and privacy controls are defined by the developers of the platforms through which the applications are accessed and could be changed by the platforms in a way that may negatively impact our business. For example, Apple has shifted to require user opt-in before permitting access to Apple’s unique identifier, or IDFA, and Google has announced that it will eventually deprecate the mobile advertising identifier used on Android devices entirely. These changes have had, and will likely continue to have, a substantial impact on the mobile advertising ecosystem and could adversely impact our growth in this channel.

Current wording

Advertising shown on mobile applications can also be affected by blocking or restricting use of mobile device identifiers. Data regarding interactions between users and devices are tracked mostly through stable, pseudonymous advertising identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier. These identifiers and privacy controls are defined by the developers of the platforms through which the applications are accessed and could be changed by the platforms in a way that may negatively impact our business. For example, Apple has shifted to require user opt-in before permitting access to Apple’s unique advertising identifier, or IDFA, and Google has announced that it will eventually deprecate the mobile advertising identifier used on Android devices entirely. These changes have had, and will likely continue to have, a substantial impact on the mobile advertising ecosystem and could adversely impact our growth in this channel.

Previous wording

In addition, in the EU, Directive 2002/58/EC (as amended by Directive 2009/136/EC), commonly referred to as the ePrivacy or Cookie Directive, directs EU member states to ensure that accessing information on an Internet user’s computer, such as through a cookie and other similar technologies, is allowed only if the Internet user has been informed about such access and given his or her consent. A replacement for the ePrivacy Directive is currently under discussion by EU member states to complement and bring electronic communication services in line with the GDPR and force a harmonized approach across EU member states. Like the GDPR, the proposed ePrivacy Regulation applies extra-territorially to businesses established outside the EU who provide publicly available electronic communications services to, or gather data from the devices of, users in the EU. Though still subject to debate, the proposed ePrivacy Regulation may further raise the bar for the use of cookies and the fines and penalties for breach may be significant. We may be required to, or otherwise may determine that it is advisable to, make significant changes in our business operations and products and services to obtain user opt-in for cookies and use of cookie data, or develop or obtain additional tools and technologies to compensate for a lack of cookie data.

Current wording

In addition, in the EU, Directive 2002/58/EC (as amended by Directive 2009/136/EC), commonly referred to as the ePrivacy or Cookie Directive, directs EU member states to ensure that accessing information on an Internet user’s computer, such as through a cookie and other similar technologies, is allowed only if the Internet user has been informed about such access and given his or her consent. A replacement for the ePrivacy Directive is currently under discussion by EU member states to complement and bring electronic communication services in line with the GDPR and force a harmonized approach across EU member states. Like the GDPR, the proposed ePrivacy Regulation applies extra- territorially to businesses established outside the EU who provide publicly available electronic communications services to, or gather data from the devices of, users in the EU. Though still subject to debate, the proposed ePrivacy Regulation may further raise the bar for the use of cookies and the fines and penalties for breach may be significant. We may be required to, or otherwise may determine that it is advisable to, make significant changes in our business operations and offerings to obtain user opt-in for cookies and use of cookie data, or develop or obtain additional tools and technologies to compensate for a lack of cookie data.

Previous wording

Increased transparency into the collection and use of data for digital advertising, introduced both through features in browsers and devices and regulatory requirements, such as the GDPR, U.S. state privacy laws and regulations, “Global Privacy Control” or similar opt-out signals and the ePrivacy Directive, as well as compliance with such requirements, may create operational burdens to implement and may lead more users to choose to block the collection and use of data about them. Adapting to these and similar changes has in the past and may in the future require significant time, resources and expense, which may increase our cost of operation or limit our ability to operate or expand our business.

Current wording

Increased transparency and scrutiny regarding the collection and use of data for digital advertising, introduced both through features in browsers and devices and regulatory requirements, such as the GDPR, U.S. state privacy laws and regulations, “Global Privacy Control” or similar opt-out signals and the ePrivacy Directive, as well as compliance with such requirements, may create operational burdens to implement and may lead more users to choose to block the collection and use of data about them. Adapting to these and similar changes has in the past and may in the future require significant time, resources and expense, which may increase our cost of operation or limit our ability to operate or expand our business.

Previous wording

•changes in demand for programmatic advertising and for our platform, including related to the seasonal nature of our clients’ spending on digital advertising campaigns;

Current wording

•changes in demand for programmatic advertising and for our platform, including those related to the seasonal nature of our clients’ spend on digital advertising campaigns;