Trade Desk, Inc.

Previous wording

To sustain or increase our revenue, we must regularly add new clients and encourage existing clients to maintain or increase the amount of spend through our platform and adopt existing or new offerings that we make available. If competitors introduce lower cost or differentiated offerings that compete with or are perceived to compete with our offerings, our ability to sell our services to new or existing clients could be impaired. We have spent significant effort in cultivating our relationships with advertising agencies and advertisers, which has resulted in an increase in the budgets allocated to, and the amount of advertising purchased on, our platform. However, it is possible that we may reach a point of saturation at which we cannot continue to grow our revenue from such agencies or advertisers because of internal limits that advertisers may place on the allocation of their advertising budgets to digital media to a particular provider or otherwise. While we generally have master services agreements (“MSAs”) in place with our clients, such agreements allow our clients to choose the amount they spend through our platform and terminate our services with limited notice. We at times supplement our MSAs with joint business plans and other incentive programs designed to increase spend from existing clients; however, such increased spend may not materialize in the amounts we expect or at all. We do not typically have exclusive relationships with our clients and there is limited cost and difficulty to moving their media spend to our competitors. As a result, we have limited visibility to our future advertising revenue streams. We cannot assure you that our clients will continue to use our platform or related offerings to the extent that we expect or at all, or that we will be able to replace, in a timely or effective manner, departing clients with new clients that generate comparable revenue. If a major client representing a significant portion of our business decides to materially reduce its use of our platform or related offerings or to cease their use altogether, it is possible that our revenue or revenue growth rate could be significantly reduced, and our business negatively impacted.

Current wording

To sustain or increase our revenue, we must regularly add new clients and encourage existing clients to maintain or increase the amount of spend through our platform and adopt existing or new offerings that we make available. If competitors introduce lower cost or differentiated offerings that compete with or are perceived to compete with our offerings, our ability to sell our services to new or existing clients could be impaired. We focus on the value of our platform and related offerings. Agencies and advertisers may have an adverse reaction to the related pricing, which could impair our ability to maintain and attract existing and new clients and our share of their advertising budgets. We have spent significant effort in cultivating our relationships with advertising agencies and advertisers, which has resulted in an increase in the budgets allocated to, and the amount of advertising purchased on, our platform. However, it is possible that we may reach a point of saturation at which we cannot continue to grow our revenue from such agencies or advertisers because of internal limits that advertisers may place on the allocation of their advertising budgets to digital media to a particular provider or otherwise. While we generally have master services agreements (“MSAs”) in place with our clients, such agreements allow our clients to choose the amount they spend through our platform and terminate our services with limited notice. We at times supplement our MSAs with joint business plans and other incentive programs designed to increase spend from existing clients; however, such increased spend may not materialize in the amounts we expect or at all. We do not typically have exclusive relationships with our clients and there is limited cost and difficulty to moving their media spend to our competitors. As a result, we have limited visibility to our future advertising revenue streams. We cannot assure you that our clients will continue to use our platform or related offerings to the extent that we expect or at all, or that we will be able to replace, in a timely or effective manner, departing clients with new clients that generate comparable revenue. If a major client representing a significant portion of our business decides to materially reduce its use of our platform or related offerings or to cease their use altogether, it is possible that our revenue or revenue growth rate could be significantly reduced, and our business negatively impacted.

Previous wording

Our clients include advertising agencies, many of which are owned by holding companies, where decision making is decentralized such that purchasing decisions are made, and relationships with advertisers are located, at the agency, local branch or division level. If all of our individual client contractual relationships were aggregated at the holding company level, one holding company would have represented more than 10% of our gross billings for 2024.

Current wording

Our clients include advertising agencies, many of which are owned by holding companies, where decision making is decentralized such that purchasing decisions are made, and relationships with advertisers are located, at the agency, local branch or division level. If all of our individual client contractual relationships were aggregated at the holding company level, two holding companies would have each represented more than 10% of our gross billings for 2025.

Previous wording

In most cases, we enter into separate contracts and billing relationships with the individual agencies and account for them as separate clients. However, some holding companies for these agencies may choose to exert control over the individual agencies in the future. Additionally, a holding company may be acquired by, or consolidate with, another holding company that does not utilize our platform, or may otherwise reduce overall spend on our platform as a result of an acquisition or consolidation. If so, any consolidation of, or loss of relationships with such holding companies and consequently, of their agencies, local branches or divisions, as clients could significantly harm our business, financial condition and results of operations.

Current wording

In most cases, we enter into separate contracts and billing relationships with the individual agencies and account for them as separate clients. A holding company may be acquired by, or consolidate with, another holding company that does not utilize our platform, or a holding company may choose to exert control over its individual agencies in a way that may otherwise result in an overall reduction in our revenue. If so, any consolidation of, or loss of relationships with such holding companies and consequently, of their agencies, local branches or divisions, as clients could significantly harm our business, financial condition and results of operations.

Previous wording

Macroeconomic conditions beyond our control could harm the overall demand for advertising and the economic health of advertisers, which could adversely affect our business, financial condition and results of operations.

Current wording

Macroeconomic conditions beyond our control could harm the overall demand for advertising and the economic health of agencies and advertisers, which could adversely affect our business, financial condition and results of operations.

Previous wording

Our business depends on the overall demand for advertising and on the economic health of advertisers that benefit from our platform. Market uncertainties or downturns, whether global, local or industry or sector specific, and associated macroeconomic conditions, such as growing inflation, changes in interest rates, recessionary fears, changes in foreign currency exchange rates, supply chain disruptions, the impact of global instability in many parts of the world and public health crises, may disrupt the operations of our clients and partners and cause advertisers to decrease or pause their advertising budgets, which could reduce spend though our platform and adversely affect our business, financial condition and results of operations. As we explore new countries to expand our business, economic downturns or unstable market conditions in any of those countries could also result in our investments not yielding the returns we anticipate.

Current wording

Our business depends on the overall demand for advertising and on the economic health of the agencies and advertisers that use our platform. Market uncertainties or downturns, whether global, local or industry or sector specific, and any associated macroeconomic conditions, such as growing inflation, concerns around a potential recession, changes in interest rates, changes in foreign currency exchange rates, changes in trade policies and practices, supply chain disruptions, the impact of global instability in many parts of the world and public health crises, may disrupt the operations of our clients and partners and cause agencies and advertisers to decrease or pause their advertising budgets, which could reduce spend though our platform and adversely affect our business, financial condition and results of operations. As we explore new countries to expand our business, economic downturns or unstable market conditions in any of those countries could also result in our investments not yielding the returns we anticipate.

Previous wording

Inventory suppliers control the bidding process, rules and procedures for the inventory they supply. Such processes may not always work in our favor or for the benefit of our clients and may create inefficiencies in the supply chain for advertising inventory. Although we have in the past and may in the future undertake efforts to address these supply chain inefficiencies, we may not be successful in such efforts. Given the importance of ensuring access to quality inventory for our advertisers, we launched our OpenPath offering in order to give clients a simplified, direct connection to publishers. We have been investing in this offering and plan to continue to grow the amount of OpenPath inventory and publishers available through our platform, but we cannot guarantee that this or future offerings will prove attractive to our clients or otherwise be successful.

Current wording

Inventory suppliers control the bidding process, rules and procedures for the inventory they supply. Additionally, suppliers and other third parties in the programmatic supply chain may extract more value than they add. As a result, supply chains in the market for programmatic ad buying may not always work in our favor or for the benefit of our clients and may have inefficiencies and lack transparency. Although we have in the past and continue to undertake efforts to improve supply chain efficiency and transparency, we may not be successful in such efforts. Given the importance of ensuring access to quality inventory for our advertisers, we launched our OpenPath offering in order to give clients a simplified, direct connection to publishers. We have been investing in this offering and plan to continue to grow the amount of OpenPath inventory and publishers available through our platform, but we cannot guarantee that this or future offerings will prove attractive to our clients or otherwise be successful.

Previous wording

We operate in a highly competitive and rapidly changing industry. We expect competition to persist and intensify in the future, which could harm our ability to increase revenue and maintain profitability. New technologies and methods of buying advertising present a dynamic competitive challenge, as market participants develop and offer new products and services aimed at capturing advertising spend or disrupting the digital marketing landscape, such as analytics, automated media buying and exchanges.

Current wording

We operate in a highly competitive and rapidly changing industry. We expect competition to persist and intensify in the future, which could harm our ability to increase revenue and maintain profitability. New technologies and methods of buying advertising present a dynamic competitive challenge, as market participants develop and offer new products and services aimed at capturing advertising spend or disrupting the digital marketing landscape, such as analytics, automated media buying and exchanges. Additionally, the impact of AI on our industry is still emerging and uncertain. We have been developing and implementing AI and machine learning models in our platform for nearly a decade and plan to continue such efforts, but there can be no assurance that our implementation of AI initiatives will continue to enhance our platform and related offerings in the manner we expect. We expect our AI initiatives will require increased investment in infrastructure. To the extent we fail to adopt such technologies effectively or as intended, experience delays in integrating these technologies into our operations or our competitors successfully implement improved AI technologies into their products or services, our ability to compete effectively could be harmed and our growth prospects and results of operations could be adversely affected.

Previous wording

Our current and potential competitors may have significantly more financial, technical, marketing, and other resources than we have, which may allow them to devote greater resources to the development, promotion, sale and support of their products and services. They may also have more extensive advertiser bases and broader publisher relationships than we have, rich first-party data sets, and may be better positioned to execute on advertising conducted over certain channels, such as social media, mobile, and video. Some of our competitors may have a longer operating history and greater name recognition. As a result, these competitors may be better able to respond quickly to new technologies, develop superior solutions, develop deeper advertiser relationships or offer services at lower prices. Any of these developments would make it more difficult for us to sell our platform or related offerings and could result in increased pricing pressure, increased development, sales and marketing expense, or the loss of market share.

Current wording

Furthermore, our current and potential competitors may have significantly more financial, technical, marketing, and other resources than we have, which may allow them to devote greater resources to the development, promotion, sale and support of their products and services. They may also have more extensive advertiser bases and broader publisher relationships than we have, rich first party data sets, may be better positioned to execute on advertising conducted over certain channels, such as social media, mobile, and video and in the case of “walled garden” inventory providers, may exclusively sell their own inventory directly to advertisers, which prevents us from competing with them entirely for such inventory. Some of our competitors may have a longer operating history and greater name recognition. As a result, these competitors may be better able to respond quickly to new technologies, develop superior solutions, develop deeper advertiser relationships or offer services at lower prices. Any of these developments would make it more difficult for us to sell our platform or related offerings and could result in increased pricing pressure, increased development, sales and marketing expense, or the loss of market share.

Previous wording

The substantial majority of our revenue has been derived from clients that programmatically purchase advertising through our platform. We expect that spend on programmatic ad buying will continue to be our primary source of revenue for the foreseeable future and that our revenue growth will largely depend on increasing spend through our platform. The market for programmatic ad buying is a relatively new market, and our current and potential clients may not shift to programmatic ad buying from other buying methods as quickly as we expect, which would reduce our growth potential. If the market for programmatic ad buying deteriorates or develops more slowly than we expect, it could reduce demand for our platform, and our business, growth prospects and financial condition would be adversely affected.

Current wording

The substantial majority of our revenue has been derived from clients that programmatically purchase advertising through our platform. We expect that programmatic ad buying will continue to be our primary source of revenue for the foreseeable future and that our revenue growth will largely depend on increasing spend on our platform and related offerings. The market for programmatic ad buying is a relatively new market, and our current and potential clients may not shift to programmatic ad buying from other buying methods as quickly as we expect, which would reduce our growth potential. If the market for programmatic ad buying deteriorates or develops more slowly than we expect, it could reduce demand for our platform, and our business, growth prospects and financial condition would be adversely affected.

Previous wording

Our industry is subject to rapid and frequent changes in technology and laws governing our activities, evolving client needs and expectations and the frequent introduction by our competitors of new and enhanced offerings. If new or existing competitors have more attractive offerings, we may lose clients or clients may decrease their use of our platform. New client demands, superior competitive offerings or new industry standards could require us to make unanticipated and costly changes to our platform or business model. We must constantly make investment decisions regarding offerings and technology to meet client demand and evolving industry and legal standards. We may make bad decisions regarding these investments. Furthermore, even if we believe that our investments improve upon our platform and related offerings, such as updates to our various platform features and user interface, they may nevertheless fail to meet new or existing client expectations or preferences, which could result in decreased client adoption or use of our platform.

Current wording

Our industry is subject to rapid and frequent changes in technology and laws governing our activities, evolving client needs and expectations and the frequent introduction by our competitors of new and enhanced offerings. If new or existing competitors have more attractive offerings, we may lose clients or clients may decrease their use of our platform. New client demands, superior competitive offerings or new industry standards could require us to make unanticipated and costly changes to our platform or business model. We must constantly make investment decisions regarding new and existing offerings and technology to meet client demand and evolving industry and legal standards. We may make bad decisions regarding these investments, and our efforts to introduce new or upgraded platform features or related offerings, including, for example, those related to third-party data marketplace features, may not function as intended or result in the improvements we expect. Furthermore, even if we believe that our investments improve or supplement our platform and related offerings, such as updates to our various platform features and user interface, they may nevertheless fail to meet new or existing client expectations or preferences, which could result in decreased client adoption or use of our platform and related offerings.

Previous wording

In addition, as we develop and introduce new offerings, including those incorporating or utilizing artificial intelligence and machine learning and new processing of personal information, including identifiable information, they may raise new, or heighten existing, technological, security, legal and other risks and challenges, which may cause unintended consequences, and they may not function properly or may be misused by our clients. If we fail to adapt to our rapidly changing industry or to evolving client needs or expectations, or we provide new or updated offerings that exacerbate technological, security, legal or other challenges, the reputation of and demand for our platform or related offerings could decrease and our business, financial condition and operations may be adversely affected.

Current wording

In addition, as we introduce new offerings and further develop existing ones, including in both cases those that increasingly incorporate or utilize AI and machine learning or the processing of personal information, including identifiable information, they may raise new, or heighten existing, technological, security, legal, commercial and other risks and challenges, which may cause unintended consequences, and they may not function properly or may be misused by our clients. If we fail to adapt to our rapidly changing industry or to evolving client needs or expectations, or we provide new or updated offerings that exacerbate technological, security, legal or other challenges, the reputation of and demand for our platform or related offerings could decrease and our business, financial condition and operations may be adversely affected. In addition to competitive, regulatory and marketplace uncertainties in the ecosystem, we also anticipate that evolution of the use of AI and machine learning in digital advertising may create challenges and further ecosystem uncertainty, which can be difficult to predict.

Previous wording

We face various and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our systems and the data that we process. Our offerings involve the storage and transmission of significant amounts of data from users, clients, and inventory and data providers, a large volume of which is hosted by third-party service providers. Our services and the data on our platform, related offerings and in our systems could be exposed to unauthorized access due to activities that breach or undermine security measures, including: negligence or malfeasance by internal or external actors; attempts by outside parties to fraudulently induce employees, clients or vendors to disclose information or data, including personal information; or errors or vulnerabilities in our systems, offerings or processes or in those of our service providers, clients, and vendors.

Current wording

We face various and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our systems and the data that we process. Our offerings involve the storage and transmission of significant amounts of data, including personal information from users, clients, and inventory and data providers, a large volume of which is hosted by third-party service providers. Our services and the data on our platform, related offerings and in our systems could be exposed to unauthorized access due to activities that breach or undermine security measures, including: negligence or malfeasance by internal or external actors; attempts by outside parties to fraudulently induce employees, clients or vendors to disclose information or data, including personal information; or errors or vulnerabilities in our systems, offerings or processes or in those of our service providers, clients, and vendors.

Previous wording

For example, from time to time, we experience cyberattacks of varying degrees and other attempts to obtain unauthorized access to our systems, including to employee mailboxes. We have dedicated and expect to continue to dedicate resources toward security protections that shield data from these activities, including worldwide incident response teams and dedicated resources to incident response processes. However, such measures cannot provide absolute security and could, among other issues, fail to be adequate or accurately assess the incident severity, not proceed quickly enough, or fail to sufficiently remediate an incident. Further, we can expect that the deployment of techniques to circumvent our security measures may occur with more frequency and sophistication and may not be recognized until launched against a target. Accordingly, we may be unable to anticipate or detect these techniques or to implement adequate preventative measures.

Current wording

For example, from time to time, we experience cyberattacks of varying degrees and other attempts to obtain unauthorized access to our systems, including to employee mailboxes. We have dedicated and expect to continue to dedicate resources toward security protections that are designed to shield our systems and data from these activities, including worldwide incident response teams and dedicated resources to incident response processes. However, such measures cannot provide absolute security and could, among other issues, fail to be adequate or accurately assess the incident severity, not proceed quickly enough, or fail to sufficiently remediate an incident. Further, we can expect that the deployment of techniques to circumvent our security measures may occur with more frequency and sophistication and may not be recognized until launched against a target, including through the use of AI. Accordingly, we may be unable to anticipate or detect these techniques or to implement adequate preventative measures.

Previous wording

A breach of our security, a flawed design, and/or our failure to respond sufficiently to a security incident could disrupt our services and result in theft, misuse, loss, corruption, or improper use or disclosure of data. This could result in government investigations, lawsuits (including class actions), enforcement actions and other legal and financial liability, and/or loss of confidence in the availability and security of our offerings, all of which could seriously harm our reputation and brand and impair our ability to attract and retain clients. As some of our newer offerings involve the receipt and processing of identifiable information, the risks associated with data, including risks to breach of our systems increases, and we could be subject to contractual breach and indemnification claims from other clients and partners and otherwise suffer damage to our reputation, brand, and business. We could also be required to notify regulators, customers or other third parties. Our platform may also receive data in aggregated or pseudonymized form, and if our systems are breached and such data or information is compromised, it could be damaging to our brand, reputation, and business. Cyberattacks could also compromise our own trade secrets and other confidential information and result in such information being disclosed to others and becoming less valuable, which could negatively affect our business. Although we maintain errors or omissions and cyber liability insurance, the costs related to an incident or other security threats or disruptions may not be fully insured or indemnified by other means and insurance and other safeguards might only partially reimburse us for our losses, if at all. We also cannot guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all.

Current wording

A breach of our security, a flawed design, and/or our failure to respond sufficiently to a security incident could disrupt our services and result in theft, misuse, loss, corruption, or improper use or disclosure of our systems or data. This could result in government investigations, lawsuits (including class actions), enforcement actions and other legal and financial liability, and/or loss of confidence in the availability and security of our offerings, all of which could seriously harm our reputation and brand and impair our ability to attract and retain clients. As some of our offerings involve the receipt and processing of identifiable information, the risks associated with data, including risks related to a breach of our systems increases, and we could be subject to contractual breach and indemnification claims from other clients and partners and otherwise suffer damage to our reputation, brand, and business. We could also be required to notify regulators, clients or other third parties. Our platform may also receive data in aggregated or pseudonymized form, and if our systems are breached and such data or information is compromised, it could be damaging to our brand, reputation, and business. Cyberattacks could also compromise our own trade secrets and other confidential information and result in such information being disclosed to others and becoming less valuable, which could negatively affect our business. Although we maintain errors or omissions and cyber liability insurance, the costs related to an incident or other security threats or disruptions may not be fully insured or indemnified by other means and insurance and other safeguards might only partially reimburse us for our losses, if at all. We also cannot guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all.

Previous wording

Privacy and data protection laws to which we and our clients, inventory partners, and third-party data providers are subject may cause us to incur additional or unexpected costs, subject us to investigations or enforcement actions for alleged compliance failures, result in less demand for our offerings, or cause us to change our platform, related offerings or business model, which may have a material adverse effect on our business.

Current wording

Privacy and data protection laws to which we and our clients, inventory partners, and third-party data providers are subject may cause us to incur additional or unexpected costs, subject us to litigation, investigations or enforcement actions for alleged compliance failures, result in less demand for our offerings, or cause us to change our platform, related offerings or business model, which may have a material adverse effect on our business.

Previous wording

Information relating to individuals and their devices (commonly called “personal information” or “personal data”) is regulated under a wide variety of local, state, national and international laws and regulations that apply to its collection, use, retention, protection, disclosure, transfer (including transfer across national boundaries) and other processing. We typically collect and store IP addresses and other device identifiers (such as unique cookie identifiers and mobile application identifiers), which are or may be considered personal data or personal information in many jurisdictions or otherwise subject to regulation. In connection with certain of our offerings, including Unified ID 2.0, EUID and OpenPass, we receive information that directly identifies individuals, such as email addresses and phone numbers, both directly from consumers and from our clients or others. We deploy technical and security measures, internal policy controls, and contractual measures to limit how such identifying information is used and shared and to help honor consumer choices. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws.

Current wording

Information relating to individuals, households and their devices (commonly called “personal information” or “personal data”) is regulated under a wide variety of local, state, national and international laws and regulations that apply to its collection, use, retention, protection, disclosure, transfer (including across national boundaries) and other processing. We typically collect and store IP addresses and other device identifiers (such as unique cookie identifiers and mobile advertising identifiers), which are or may be considered personal data or personal information in many jurisdictions or otherwise subject to regulation. In connection with certain of our offerings, including Unified ID 2.0, EUID and OpenPass, we receive information that directly identifies individuals, such as email addresses and phone numbers, both directly from consumers and from our clients or others. We deploy technical and security measures, internal policy controls, and contractual measures designed to limit how such identifying information is used and shared. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws. Some of our offerings, including those that entail some use of directly identifying information, may also increase our exposure to potential claims by plaintiffs’ attorneys, including by attempting to apply various legal theories – such as alleging violations of wiretapping statutes – to certain of our activities.

Previous wording

The global regulatory landscape regarding the privacy and protection of personal information is evolving, and U.S. (state, federal and local) and foreign governments continue to consider and enact additional legislation and rulemaking related to privacy and data protection, often with a particular focus on intermediaries in the online advertising ecosystem, including those that engage in targeted advertising, “sell” or “share” personal data, and act as “data brokers.” We expect to see an increase in, or changes to, privacy and data protection legislation and regulation in this area for the foreseeable future. For example, in the United States, the FTC continues to propose updates to existing regulations, including those governing collection of data from children online and related to “commercial surveillance” generally. Further, the FTC uses its enforcement powers under Section 5 of the Federal Trade Commission Act (the “FTC Act”) (which prohibits “unfair” and “deceptive” trade practices) to investigate companies engaging in online tracking. For example, the FTC has been very active in bringing enforcement actions against companies that handle personal data it views as sensitive for advertising purposes, including location data brokers and companies that process health-related data. These enforcement announcements signal ongoing regulatory scrutiny of advertising practices that involve “sensitive” categories of personal data such as health data and precise location information. The Commission could continue to build on this trend under its recently granted authority to enforce a federal law focused on disclosures of certain “sensitive” information by companies operating as data brokers to certain restricted countries or entities “controlled” by such countries. Other companies in the advertising technology space have been subject to government investigation by regulatory bodies; advocacy organizations have also filed complaints with data protection authorities against advertising technology companies, arguing that certain of these companies’ practices do not comply with data privacy laws, or consumer protection laws such as the FTC Act. We cannot avoid the possibility that one of these investigations or enforcement actions will require us to alter our practices. In addition, a potential federal omnibus privacy law remains a possibility. If ultimately passed, such a law would likely substantially impact the online advertising ecosystem.

Current wording

The global regulatory landscape regarding the privacy and protection of personal information is evolving, and U.S. (state, federal and local) and foreign governments continue to consider and enact additional legislation and rulemaking related to privacy and data protection, often with a particular focus on intermediaries in the online advertising ecosystem, including those that engage in targeted advertising, “sell” or “share” personal data, and act as “data brokers.” While a significant volume of laws has already been enacted, we expect to see additional data protection legislation and regulation in this area for the foreseeable future. For example, the FTC uses its enforcement powers under Section 5 of the Federal Trade Commission Act (the “FTC Act”) (which prohibits “unfair” and “deceptive” trade practices) to investigate companies engaging in online tracking. In the preceding few years, the FTC has been very active in bringing enforcement actions against companies that handle personal data it views as sensitive for advertising purposes, including location data brokers and companies that process health-related data. The FTC could continue to build on this trend under its authority to enforce a relatively new federal law focused on disclosures of certain “sensitive” information by companies operating as data brokers to certain restricted countries or entities “controlled” by such countries, and the Department of Justice could act on authority granted under an executive order restricting similar practices, for which regulations and guidance have recently taken effect. Other companies in the advertising technology space have been subject to government investigation by regulatory bodies; advocacy organizations have also filed complaints with data protection authorities against advertising technology companies, arguing that certain of these companies’ practices do not comply with data privacy laws, or consumer protection laws such as the FTC Act. As noted above, plaintiffs’ attorneys are also increasingly pursuing claims against advertising technology companies related to their data collection, use and disclosure practices, as well as advertisers and publishers that rely on services provided by these companies. For example, in March 2025, suits alleging various privacy tort theories were filed against us in the Northern District of California. For additional information regarding the pending legal proceedings, refer to Note 13—Commitments and Contingencies—Litigation. We cannot avoid the possibility that one of these investigations or enforcement actions will require us to alter our practices. In addition, a potential federal omnibus privacy law remains a possibility. If ultimately passed, such a law would likely substantially impact the online advertising ecosystem.

Previous wording

State lawmakers are also actively addressing consumer data privacy issues. Many states have adopted omnibus consumer privacy laws, a host of which are already enforceable, while others will take effect over the coming years. These state laws define “personal information” broadly enough to include many online identifiers provided by individuals’ devices, applications, and protocols (such as IP addresses, mobile application identifiers and unique cookie identifiers), individuals’ location data, and hashed versions of email addresses and phone numbers. These laws generally require covered businesses to meet numerous data privacy-related obligations and establish data privacy rights for consumers in such states (including rights to opt out of certain processing of their personal data and to request correction, deletion of and access to personal data), imposing special rules on the collection of personal data from minors and other personal data deemed “sensitive” under the laws, and creating new notice obligations. Many also impose data minimization requirements, mandating that companies only collect and process data for certain purposes. Most significant for the advertising industry, however, these laws require businesses that engage in certain advertising uses of personal data to offer and honor an opt-out of such activities, including, in some states, through browser or device-based preference signals. (Terminology varies slightly among some of the state laws, tying the opt-out requirement to “targeted advertising,” “sales” or “sharing” of personal data.) Because of these obligations, the availability of data within our platform, our related offerings and the advertising ecosystem more broadly may decline, potentially making our platform and related offerings less valuable to our clients.

Current wording

State lawmakers are also actively addressing consumer data privacy issues. Many states have adopted omnibus consumer privacy laws. These state laws define “personal information” broadly enough to include many online identifiers provided by individuals’ devices, applications, and protocols (such as IP addresses, mobile advertising identifiers and unique cookie identifiers), individuals’ location data, and hashed versions of email addresses and phone numbers. These laws generally require covered businesses to meet numerous data privacy-related obligations and establish data privacy rights for consumers in such states (including rights to opt out of certain processing of their personal data and to request correction, deletion of and access to personal data), imposing special rules on the collection of personal data from minors, precise location data and other personal data deemed “sensitive” under the laws, and creating new notice and consent obligations. Many also impose data minimization requirements, mandating that companies only collect and process data for certain purposes. In a recent enforcement action, the California Attorney General employed these data minimization standards to attack advertising-related disclosures by a publisher of health-related information. Perhaps most significant for the advertising industry, however, these laws require businesses that engage in certain advertising uses of personal data to offer and honor an opt-out of such activities. (Terminology varies slightly among some of the state laws, tying the opt-out requirement to “targeted advertising,” “sales” or “sharing” of personal data.)

Previous wording

These laws and their implementing regulations will likely also increase compliance costs and obligations on us, our clients, and other companies in the advertising industry. Although we have attempted to mitigate certain risks posed by these laws through contractual, platform and offering changes, we cannot predict with certainty the effect of these laws and their implementing regulations, many of which are not yet finalized, on our business, nor the share of consumers who will carry out their opt-out and other rights and how these actions will impact us, our clients, inventory sources, and our industry. Further, enforcement activity under such laws already in effect, particularly in California, reflects an ongoing focus on online advertising activities and signals regulators’ willingness to pursue in-depth investigations and impose substantial penalties on entities allegedly operating in violation of the statute. Thus, we expect that continuing to maintain compliance with states’ varying legal requirements, including monitoring and adjusting to new regulations and interpretations that emerge through enforcement actions, will require significant time, resources, and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Current wording

These laws and their implementing regulations have and will likely also increase compliance costs and obligations on us, our clients, and other companies in the advertising industry. Although we have attempted to mitigate certain risks posed by these laws through contractual, platform and offering changes, we cannot predict with certainty the effect of these laws and their implementing regulations, some of which are not yet finalized, on our business, nor the share of consumers who will carry out their opt-out and other rights and how these actions will impact us, our clients, inventory sources, and our industry. Further, enforcement activity under such laws already in effect, particularly in California, reflects an ongoing focus on online advertising activities and signals regulators’ willingness to pursue in-depth investigations and impose substantial penalties on entities allegedly operating in violation of the statute. Thus, we expect that continuing to maintain compliance with states’ varying legal requirements, including monitoring and adjusting to new regulations and interpretations that emerge through enforcement actions, will require significant time, resources, and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Previous wording

In addition to these broad-based consumer privacy laws, lawmakers and regulators continue to focus on activities that involve use of categories of personal data perceived as especially sensitive, such as health data and children’s data. For example, the FTC has recently finalized an update to the Children Online Privacy Protection Act, modifying requirements regarding the use of children’s data for targeted advertising and several states have enacted laws that would substantially impact activities that involve showing targeted advertisements to individuals under 18 through a variety of new restrictions, or in some cases prohibit it altogether. Further, several states have enacted laws, updated existing laws or have introduced bills to impose new privacy obligations related to health-related personal information beyond that governed by federal and state laws governing medical records and similar information, such as HIPAA. For example, Washington’s My Health, My Data Act (“MHMD”) introduced a host of requirements related to a very broadly-defined notion of consumer health data that impacts the advertising industry in part because MHMD is subject to a private right of action (unlike other state privacy laws), so plaintiffs’ attorneys could explore claims that stretch the bounds of the law’s text. These laws and the heightened scrutiny associated with the enforcement of such laws may, in turn, ultimately lead to increased compliance and defense costs, and more obligations on us, our clients and other companies in the advertising industry.

Current wording

In addition to these broad-based consumer privacy laws, lawmakers and regulators continue to focus on activities that involve use of categories of personal data perceived as especially sensitive, such as health data and children’s data. For example, the FTC finalized an update to rules adopted pursuant to the Children Online Privacy Protection Act, modifying some requirements relating to the use of children’s data for targeted advertising and several states have enacted laws that would substantially impact activities that involve showing targeted advertisements to individuals under 18 years of age through a variety of new restrictions, or in some cases prohibit it altogether. Further, several states have enacted laws, updated existing laws or have introduced bills to impose new privacy obligations related to health-related personal information beyond that governed by federal and state laws governing medical records and similar information, such as HIPAA. For example, Washington’s My Health, My Data Act (“MHMD”) introduced a host of requirements related to a very broadly-defined notion of consumer health data that impacts the advertising industry in part because MHMD is subject to a private right of action (unlike most other state privacy laws), so plaintiffs’ attorneys could explore claims that stretch the bounds of the law’s text. A somewhat similar law enacted in Virginia is also backed by a private right of action. These laws and the heightened scrutiny associated with the enforcement of such laws may, in turn, ultimately lead to increased compliance and defense costs, and more obligations on us, our clients and other companies in the advertising industry.

Previous wording

Laws governing the processing of personal data in Europe (including the U.K. and EEA) also continue to impact us and continue to evolve. For example, the GDPR defines “personal data” broadly and enhances data protection obligations for controllers of such data and for service providers processing the data. It also provides certain rights, such as access and deletion, to the individuals about whom the personal data relates. IAB Europe previously collaborated with the digital advertising industry to create a user-facing framework (the Transparency and Control Framework, or “TCF”) for establishing and managing legal bases under the GDPR and other U.K. and EU privacy laws including the ePrivacy Directive. Although the TCF is actively in use, its viability as a compliance mechanism remains under review by European authorities and we cannot predict its effectiveness over the long term. Because we are under the supervision of relevant data protection authorities in both the EEA and the U.K., we may be fined under both the EU GDPR and the UK GDPR for the same breach, with penalties up to the greater of €20 million/BP 17.5 million or 4% of total worldwide annual turnover. Continuing to maintain compliance with the requirements of the GDPR, including monitoring and adjusting to rulings and interpretations that affect our approach to compliance, requires significant time, resources and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Current wording

Laws governing the processing of personal data in Europe (including the U.K. and EEA) also continue to impact us and to evolve. For example, the GDPR defines “personal data” broadly and enhances data protection obligations for controllers of such data and for service providers processing the data. It also provides certain rights, such as access and deletion, to the individuals about whom the personal data relates. IAB Europe previously collaborated with the digital advertising industry to create a user-facing framework (the Transparency and Control Framework, or “TCF”) for establishing and managing legal bases under the GDPR and other U.K. and EU privacy laws, including the ePrivacy Directive. Although the TCF is actively in use, its viability as a compliance mechanism remains under review by European authorities and we cannot predict its effectiveness over the long term. Because we are under the supervision of relevant data protection authorities in both the EEA and the U.K., we may be fined under both the EU GDPR and the UK GDPR for the same breach, with penalties up to the greater of €20 million/BP 17.5 million or 4% of total worldwide annual turnover. In addition to fines, breach of the GDPR can also result in regulatory investigations, enforcement notices, reputational harm and civil claims. Continuing to maintain compliance with the requirements of the GDPR, including monitoring and adjusting to rulings and interpretations that affect our approach to compliance, requires significant time, resources and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Previous wording

Data residency and cross-border transfer restrictions also impact our operations. For the transfer of personal data from Europe to the U.S., we rely upon, and are certified under, the EU-U.S. and Swiss-U.S. Data Privacy Frameworks (“DPF”) and the U.K. extension to the EU-U.S. DPF. The DPF replaced the Privacy Shield Framework as an adequate mechanism by which EU companies may pass personal data to the U.S. However, the DPF is already subject to legal challenge in Europe. Relatedly, whether and how other transfer mechanisms, such as standard contractual clauses, can be used to transfer personal data to the U.S. is in question. While the adequacy decision for the DPF helps to reduce the legal uncertainty of cross-border transfers of personal data, the long-term validity of these transfer mechanisms remains uncertain. If all or some jurisdictions within the EU or the U.K. determine that the latest standard contractual clauses also cannot be used to transfer personal data to the U.S. and if the DPF is ultimately struck down in a manner similar to the Privacy Shield Framework, we could be left with no reasonable option for the lawful cross-border transfer of personal data. In such circumstances, continuing to transfer personal data from the EU to the U.S. could lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative data transfer mechanisms under the GDPR or take additional compliance and operational measures, such as establishing systems to maintain certain data in the EEA, potentially involving substantial expense and causing us to divert resources from other aspects of our operations, all of which may adversely affect our business. Other jurisdictions have adopted or are considering cross-border or data residency restrictions, which could reduce the amount of data we can collect or process and, as a result, significantly impact our business.

Current wording

Data residency and cross-border transfer restrictions also impact our operations. For the transfer of personal data from Europe to the U.S., we rely upon, and are certified under, the EU-U.S. and Swiss-U.S. Data Privacy Frameworks (“DPF”) and the U.K. extension to the EU-U.S. DPF. In relation to such cross border transfers of personal information, we expect the existing legal complexity and uncertainty regarding international personal information transfers to continue. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative data transfer mechanisms under the GDPR or take additional compliance and operational measures, such as establishing systems to maintain certain data in the EEA, potentially involving substantial expense and causing us to divert resources from other aspects of our operations, all of which may adversely affect our business. Other jurisdictions have adopted or are considering cross-border or data residency restrictions, which could reduce the amount of data we can collect or process and, as a result, significantly impact our business.

Previous wording

Further, our legal risk depends in part on our clients’ or other third parties’ adherence to data privacy laws and regulations and their use of our services in ways consistent with end user expectations. There can be no assurances that the privacy and security-related measures and safeguards we have put into place in relation to these third parties will be effective to protect us and/or the relevant personal information from the risks associated with the third-party processing of such data. We rely on representations made to us by clients, partners and providers that they will comply with all applicable laws, including all relevant data privacy and data protection regulations. Although we make reasonable efforts to enforce such representations and contractual requirements, we do not fully audit our clients’ compliance with our recommended disclosures or their adherence to data privacy laws and regulations. If our clients, partners or providers fail to adhere to our expectations or contracts in this regard, we and our clients could be subject to adverse publicity, damages and related possible investigation or other regulatory activity.

Current wording

Further, our legal risk depends in part on our clients’ or other third parties’ adherence to data privacy laws and regulations and their use of our services in ways consistent with end user expectations. There can be no assurances that the privacy and security-related measures and safeguards we have put into place in relation to these third parties will be effective to protect us and/or the relevant personal information from the risks associated with the third-party processing of such data. We rely on representations made to us by clients, partners and providers that they will comply with all applicable laws, including all relevant data privacy and data protection regulations. Although we make reasonable efforts to enforce such representations and contractual requirements, we do not fully audit our clients’ compliance with our recommended disclosures nor can we be certain that our clients, partners and providers will adhere to data privacy laws and regulations. If our clients, partners or providers fail to adhere to our expectations or contracts in this regard, we and our clients could be subject to adverse publicity, damages and related possible investigation or other regulatory activity.

Previous wording

Adapting our business to enhanced and evolving privacy obligations across relevant jurisdictions could continue to involve substantial expense and may cause us to divert resources from other aspects of our operations, all of which may adversely affect our business. Additionally, as the advertising industry evolves, and new ways of collecting, combining and using data are created, governments may enact legislation in response to technological advancements and changes that could result in our having to re-design features or functions of our platform and related offerings, therefore incurring unexpected compliance costs. Further, adaptation of the digital advertising marketplace requires increasingly significant collaboration between participants in the market, such as publishers and advertisers. Failure of the industry to adapt to changes required for operating under existing and future data privacy laws, industry approaches that disfavor our platform and related offerings, and user response to such changes could negatively impact inventory, data, and demand. We cannot control or predict the pace or effectiveness of such adaptation, and we cannot currently predict the impact such changes may have on our business.

Current wording

Adapting our business to enhanced and evolving privacy obligations across relevant jurisdictions could continue to involve substantial expense and may cause us to divert resources from other aspects of our operations, all of which may adversely affect our business. Additionally, as the advertising industry evolves, and new ways of collecting, combining and using data are created, governments may enact legislation and plaintiffs may explore novel legal theories that could result in us deciding to re-design features or functions of our platform and related offerings, therefore incurring unexpected compliance costs. Further, adaptation of the digital advertising marketplace requires increasingly significant collaboration between participants in the market, such as publishers and advertisers. Failure of the industry to adapt to changes required for operating under existing and future data privacy laws, industry approaches that disfavor our platform and related offerings, and user response to such changes could negatively impact inventory, data, and demand. We cannot control or predict the pace or effectiveness of such adaptation, and we cannot currently predict the impact such changes may have on our business.

Previous wording

We deploy technical and organizational measures, internal policy controls, and contractual measures to limit how identifying information is used and shared and to help honor consumer choices. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws. These laws and other obligations may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our platform and related offerings. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our offerings, which could have an adverse effect on our business. In addition, public perception regarding data protection and privacy are significant in the programmatic advertising buying industry. Concerns about industry practices regarding the collection, use, and disclosure of personal data, whether or not valid and whether driven by applicable laws and regulations, industry standards, client or inventory provider expectations, or the broader public, may harm our reputation, result in loss of goodwill, and inhibit use of our platform or related offerings by current and future clients. For example, perception that our practices involve an invasion of privacy or are designed with insufficient protections, whether or not such practices are consistent with current or future laws, regulations, or industry practices, may subject us to public criticism, private class actions, reputational harm, or claims by regulators, which could disrupt our business and expose us to increased liability. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new offerings or certain features could be limited. All of this could impair our or our clients’ ability to collect, use, or disclose information relating to consumers, which could decrease demand for our platform and related offerings, increase our costs, and impair our ability to maintain and grow our client base and increase our revenue.

Current wording

We deploy technical and organizational measures, internal policy controls, and contractual measures to limit how identifying information is used and shared and to help honor consumer choices. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws. These laws and other obligations may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our platform and related offerings. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our offerings, which could have an adverse effect on our business. In addition, public perception regarding data protection and privacy are significant in the programmatic advertising buying industry. Concerns about industry practices regarding the collection, use, and disclosure of personal data, whether or not valid and whether driven by applicable laws and regulations, industry standards, client or inventory provider expectations, or the broader public, may harm our reputation, result in loss of goodwill, and inhibit use of our platform or related offerings by current and future clients. For example, perception that our practices involve an invasion of privacy or are designed with insufficient protections, whether or not such practices are consistent with current or future laws, regulations, or industry practices, may subject us to public criticism, additional private class actions, reputational harm, or claims by regulators, which could disrupt our business and expose us to increased liability. We may be unable to make changes and modifications to our business and offerings in a commercially reasonable manner or at all, and our ability to develop new offerings or certain features could be limited. All of this could impair our or our clients’ ability to collect, use, or disclose information relating to consumers, which could decrease demand for our platform and related offerings, increase our costs, and impair our ability to maintain and grow our client base and increase our revenue.

Previous wording

Our ability to successfully leverage user data and generate revenue from opportunities to serve advertisements could be impacted by restrictions imposed by laws or by third parties, including restrictions on our ability to use or read cookies, device identifiers, or other tracking features or our ability to use real-time bidding networks or other bidding networks. For example, if publishers or supply-side platforms decide to limit the data that we receive in order to comply (in their view) with state privacy laws or a potential federal privacy law, then our service may prove to be less valuable to our clients and we may find it more difficult to generate revenue. That is, if third parties on which we rely for data or opportunities to serve advertisements impose limitations (for whatever reason) or are restricted by other ecosystem participants or applicable regulations, then we may lose the ability to access data, bid on opportunities or purchase digital ad space, which could have a substantial impact on our revenue.

Current wording

Our ability to successfully leverage user data and generate revenue from opportunities to serve advertisements could be impacted by restrictions imposed by laws or by third parties, including restrictions on our ability to use or read cookies, device identifiers, or other tracking features or our ability to use real-time bidding networks or other bidding networks. For example, if publishers or supply-side platforms decide to limit the data that we receive in order to comply (in their view) with state privacy laws, a potential federal privacy law or in response to other legal or industry developments, then our service may prove to be less valuable to our clients and we may find it more difficult to generate revenue. That is, if third parties on which we rely for data or opportunities to serve advertisements impose limitations (for whatever reason) or are restricted by other ecosystem participants or applicable regulations, then we may lose the ability to access data, bid on opportunities or purchase digital ad space, which could have a substantial impact on our revenue.

Previous wording

Today, digital advertising, including our platform, makes significant use of cookies to store device identifiers for the advertising activities described above. When we use cookies, they are generally considered third-party cookies, which are cookies owned and used by parties other than the owners of the website visited by the Internet user. The most commonly used Internet browsers—Chrome, Firefox, Internet Explorer and Safari—allow Internet users to modify their browser settings to prevent some or all cookies from being accepted by their browsers. Internet users can delete cookies from their computers at any time. Additionally, some browsers currently, or may in the future, block or limit some third-party cookies by default or may implement user control settings that algorithmically block or limit some cookies. Today, three major web browsers—Apple’s Safari, Mozilla’s Firefox and Microsoft’s Edge—block third-party cookies by default. Google’s web browser, Chrome, has introduced new controls over third-party cookies and had announced plans to deprecate support for third-party cookies and user agent strings entirely beginning in 2025. In July 2024, Google announced that it was updating its plan for deprecation of cookies and would, at some point in the future, introduce a new experience in Chrome that allows users to indicate a preference of an undefined type that would apply in an unstated way to the user’s web browsing activity. Google has stated it will continue making its investments and testing various technologies under its label of “Privacy Sandbox” which may provide modified targeting and measurement functionality to digital advertising ecosystem participants as a limited replacement for the functionality currently provided through the use of third-party cookies. We believe that Google’s to-be-defined framework for browser-based user choice and its ongoing development of these technologies, which we expect to be technically complex and designed in a manner that does not favor us or our partners, has created and will likely continue to create industry uncertainty regarding the potential effects on user experience and advertiser targeting and measurement. Although we believe our platform is well-positioned to adapt to such changes, particularly with our Unified ID 2.0 offering, the impact of such changes remains uncertain and could be more disruptive than we anticipate, including to the display advertising ecosystem in particular, where such changes could adversely impact our growth in that channel.

Current wording

Today, digital advertising, including our platform, makes significant use of cookies to store device identifiers for the advertising activities described above. When we use cookies, they are generally considered third-party cookies, which are cookies owned and used by parties other than the owners of the website visited by the Internet user. The most commonly used Internet browsers—Chrome, Safari, Internet Explorer and Firefox —allow Internet users to modify their browser settings to prevent some or all cookies from being accepted by their browsers. Internet users can delete cookies from their computers at any time. Additionally, some browsers currently, or may in the future, block or limit some third-party cookies by default or may implement user control settings that algorithmically block or limit some cookies. Today, three major web browsers—Apple’s Safari, Mozilla’s Firefox and Microsoft’s Edge—block third-party cookies by default. Google’s web browser, Chrome, has introduced, and is likely to continue to introduce, controls over third-party cookies. However, on April 22, 2025, Google announced that it would maintain its current approach to offering users third-party cookie choice in Chrome (thus, presumably, ending its efforts to deprecate third-party cookies in Chrome), and will not be rolling out a new standalone prompt for third-party cookies in Chrome. Finally, other participants in the real-time bidding ecosystem could decline to provide certain identifiers or introduce user settings that reduce the number of identifiers provided to us that help us to optimize supply paths, target audiences and measure outcomes. Although we believe our platform is well-positioned to adapt to browsers’ blocking or limitation of some cookies, particularly with our Unified ID 2.0 offering, the impact of such changes — and broader scrutiny on the advertising technology ecosystem — remains uncertain and could be more disruptive than we anticipate, including to the display advertising ecosystem in particular, where such changes could adversely impact our growth in that channel.

Previous wording

Some Internet users also download free or paid ad-blocking software that not only prevents third-party cookies from being stored on a user’s computer, but also blocks all interaction with a third-party ad server. In addition, Google has introduced ad-blocking software in its Chrome web browser that will block certain ads based on quality standards established under a multi-stakeholder coalition. If such a feature inadvertently or mistakenly blocks ads that are not within the established blocking standards, or if such capabilities become widely adopted and the advertising technology industry does not collaboratively develop alternative technologies, our business could be harmed. The Interactive Advertising Bureau and Digital Advertising Alliance have also developed frameworks that allow users to opt out of the “sale” or use of their personal data for targeted advertising purposes under U.S. state privacy laws in ways that stop or severely limit the ability to show targeted ads. Because many state privacy laws require businesses to permit end users to opt out of processing their personal data for purposes of targeted advertising, including, in some states through automated signals, we expect that more opt-out solutions will become available that may ultimately be used by end users, which may reduce our clients’ use of our platform and related offerings, and our business, financial condition, and results of operations could be adversely affected.

Current wording

Some Internet users also download free or paid ad-blocking software that not only prevents third-party cookies from being stored on a user’s computer, but also blocks all interaction with a third-party ad server. In addition, Google has introduced ad-blocking software in its Chrome web browser that will block certain ads based on quality standards established under a multi-stakeholder coalition. If such a feature inadvertently or mistakenly blocks ads that are not within the established blocking standards, or if such capabilities become widely adopted and the advertising technology industry does not collaboratively develop alternative technologies, our business could be harmed. The Interactive Advertising Bureau and Digital Advertising Alliance have also developed frameworks that allow users to opt out of the “sale” or use of their personal data for targeted advertising purposes under U.S. state privacy laws in ways that stop or severely limit the ability to show targeted ads. Because many state privacy laws require businesses to permit end users to opt out of processing their personal data for purposes of targeted advertising, including, in some states, through device-based preference signals, we expect that more opt-out solutions will become available that may ultimately be used by end users, which may reduce our clients’ use of our platform and related offerings, and our business, financial condition, and results of operations could be adversely affected.

Previous wording

Advertising shown on mobile applications can also be affected by blocking or restricting use of mobile device identifiers. Data regarding interactions between users and devices are tracked mostly through stable, pseudonymous advertising identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier. These identifiers and privacy controls are defined by the developers of the platforms through which the applications are accessed and could be changed by the platforms in a way that may negatively impact our business. For example, Apple has shifted to require user opt-in before permitting access to Apple’s unique identifier, or IDFA, and Google has announced that it will eventually deprecate the mobile advertising identifier used on Android devices entirely. These changes have had, and will likely continue to have, a substantial impact on the mobile advertising ecosystem and could adversely impact our growth in this channel.

Current wording

Advertising shown on mobile applications can also be affected by blocking or restricting use of mobile device identifiers. Data regarding interactions between users and devices are tracked mostly through stable, pseudonymous advertising identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier. These identifiers and privacy controls are defined by the developers of the platforms through which the applications are accessed and could be changed by the platforms in a way that may negatively impact our business. For example, Apple has shifted to require user opt-in before permitting access to Apple’s unique advertising identifier, or IDFA, and Google has announced that it will eventually deprecate the mobile advertising identifier used on Android devices entirely. These changes have had, and will likely continue to have, a substantial impact on the mobile advertising ecosystem and could adversely impact our growth in this channel.

Previous wording

In addition, in the EU, Directive 2002/58/EC (as amended by Directive 2009/136/EC), commonly referred to as the ePrivacy or Cookie Directive, directs EU member states to ensure that accessing information on an Internet user’s computer, such as through a cookie and other similar technologies, is allowed only if the Internet user has been informed about such access and given his or her consent. A replacement for the ePrivacy Directive is currently under discussion by EU member states to complement and bring electronic communication services in line with the GDPR and force a harmonized approach across EU member states. Like the GDPR, the proposed ePrivacy Regulation applies extra-territorially to businesses established outside the EU who provide publicly available electronic communications services to, or gather data from the devices of, users in the EU. Though still subject to debate, the proposed ePrivacy Regulation may further raise the bar for the use of cookies and the fines and penalties for breach may be significant. We may be required to, or otherwise may determine that it is advisable to, make significant changes in our business operations and offerings to obtain user opt-in for cookies and use of cookie data, or develop or obtain additional tools and technologies to compensate for a lack of cookie data.

Current wording

In addition, in the EU and UK, national laws derived from Directive 2002/58/EC (as amended by Directive 2009/136/EC), commonly referred to as the ePrivacy or Cookie Directive, provide that accessing information on an Internet user’s computer, such as through a cookie and other similar technologies, is allowed only if the Internet user has been informed about such access and given his or her consent. Recent European court and regulator decisions are driving increased attention to cookies and similar tracking technologies. We may be required to, or otherwise may determine that it is advisable to, make significant changes in our business operations and offerings to obtain user opt-in for cookies and use of cookie data, or develop or obtain additional tools and technologies to compensate for a lack of cookie data.

Previous wording

Increased transparency into the collection and use of data for digital advertising, introduced both through features in browsers and devices and regulatory requirements, such as the GDPR, U.S. state privacy laws and regulations, “Global Privacy Control” or similar opt-out signals and the ePrivacy Directive, as well as compliance with such requirements, may create operational burdens to implement and may lead more users to choose to block the collection and use of data about them. Adapting to these and similar changes has in the past and may in the future require significant time, resources and expense, which may increase our cost of operation or limit our ability to operate or expand our business.

Current wording

Increased transparency and scrutiny regarding the collection and use of data for digital advertising, introduced both through features in browsers and devices and regulatory requirements, such as the GDPR, U.S. state privacy laws and regulations, “Global Privacy Control” or similar opt-out signals and the ePrivacy Directive, as well as compliance with such requirements, may create operational burdens to implement and may lead more users to choose to block the collection and use of data about them. Adapting to these and similar changes has in the past and may in the future require significant time, resources and expense, which may increase our cost of operation or limit our ability to operate or expand our business.

Previous wording

•changes to availability of and pricing of competitive products and services, and their effects on our pricing;

Current wording

•changes to our pricing or to the availability of and pricing of competitive products and services;

Previous wording

•changes in the pricing, cost or availability of supplier-provided components of value-added services and data, including pricing structure changes and the alignment of our pricing model with our data partners;

Current wording

•changes in the pricing, cost or availability of third-party supplier-provided components of value-added services and data, including pricing structure changes and the alignment of our pricing model with our data partners, and our ability to successfully implement and rollout such changes;

Previous wording

•changes in our platform or related offerings, their features, and the mix of offerings that are adopted by our clients;

Current wording

•changes in our platform or related offerings, their features or their underlying components and design, and the mix of offerings that are adopted by our clients;

Previous wording

Employee turnover, including changes in our management team or failure to manage executive succession effectively, could disrupt our business. None of our key employees have an employment agreement for a specific term, and all of our employees may terminate their employment with us at any time. The loss of one or more of our executive officers or our inability to attract and retain highly skilled employees could have an adverse effect on our business, financial condition and results of operations.

Current wording

Periods of significant change or transition, including leadership changes, organizational restructuring, or shifts in strategic priorities, can disrupt our operations and reduce efficiency. Such transitions may reduce continuity and create uncertainty that may delay decision-making and execution of key initiatives. In addition, these changes can affect our corporate culture, decrease employee morale, and lead to increased employee turnover, including among key personnel. Loss of institutional knowledge and challenges in attracting and retaining highly skilled talent may further hinder productivity and collaboration. None of our key employees have an employment agreement for a specific term, and all of our employees may terminate their employment with us at any time. If we are unable to manage these transitions or executive successions effectively, our business, financial condition and results of operations could be adversely affected.

Previous wording

In addition to laws, the online advertising ecosystem is subject to best practices and self-regulatory standards, such as those promulgated by the Network Advertising Initiative and the Digital Advertising Alliance, and similar organizations in Europe and Canada. If we or our clients or partners make mistakes in the implementation of these principles, if self-regulatory bodies expand these guidelines, if government authorities issue different guidelines regarding targeted advertising, if opt out mechanisms fail to work as designed, or if Internet users misunderstand our technology or our commitments with respect to these principles, we could be subject to negative publicity, government investigation, government or private litigation or investigation by self-regulatory bodies or other accountability groups. Any such action against us, or investigations, even if meritless, could be costly and time consuming, require us to change our business practices, cause us to divert management’s attention and our resources and be damaging to our brand, reputation and business. In addition, privacy advocates and industry groups may propose new and different standards that either legally or contractually apply to us. We cannot yet determine the impact such future standards may have on our business.

Current wording

In addition to laws, the online advertising ecosystem is subject to best practices and self-regulatory standards, such as those promulgated by the Network Advertising Initiative and the Digital Advertising Alliance, and similar organizations in Europe and Canada. If we or our clients or partners make mistakes in the implementation of these principles, if self-regulatory bodies expand these guidelines, if government authorities issue different guidelines regarding targeted advertising, if litigation results in changes to industry practices, if opt out mechanisms fail to work as designed, or if Internet users misunderstand our technology or our commitments with respect to these principles, we could be subject to negative publicity, government investigation, government or private litigation or investigation by self-regulatory bodies or other accountability groups. Any such action against us, or investigations, even if meritless, could be costly and time consuming, require us to change our business practices, cause us to divert management’s attention and our resources and be damaging to our brand, reputation and business. In addition, privacy advocates, plaintiffs’ attorneys and industry groups may advance new and different standards that either legally or contractually apply to us. We cannot yet determine the impact such future standards may have on our business.

Previous wording

•improve our technology infrastructure, including investing in internal technology development and acquiring outside technologies;

Current wording

•improve our technology, including investing in internal technology development and acquiring outside technologies and investing in hosting infrastructure in an environment where a shortage of hosting capacity and hardware components is causing costs to increase;

Previous wording

Spend on our platform primarily comes through our agency clients. Many of our contracts with advertising agencies provide that if the advertiser does not pay the agency, the agency is not liable to us, and we must seek payment solely from the advertiser, a type of arrangement called sequential liability. Contracting with these agencies, which in some cases have or may develop higher-risk credit profiles, may subject us to greater credit risk than if we were to contract directly with advertisers. This credit risk may vary depending on the nature of an advertising agency’s aggregated advertiser base. In addition, typically, we are contractually required to pay advertising inventory and data suppliers within a negotiated period of time, regardless of whether our clients pay us on time, or at all. In addition, we typically experience slow payment cycles by advertising agencies as is common in our industry. While we attempt to negotiate long payment periods with our suppliers and shorter periods from our clients, we are not always successful. As a result, we often face a timing issue with our accounts payable on shorter cycles than our accounts receivables, requiring us to remit payments from our own funds, and accept the risk of credit loss.

Current wording

Spend on our platform primarily comes through our agency clients. Many of our contracts with advertising agencies provide that if the advertiser does not pay the agency, the agency is not liable to us, and we must seek payment solely from the advertiser, a type of arrangement called sequential liability. Contracting with these agencies, which in some cases have or may develop higher-risk credit profiles, may subject us to greater credit risk than if we were to contract directly with advertisers. This credit risk may vary depending on the nature of an advertising agency’s aggregated advertiser base. In addition, typically, we are contractually required to pay advertising inventory and data suppliers within a negotiated period of time, regardless of whether our clients pay us on time, or at all. In addition, we typically experience slow payment cycles by advertising agencies as is common in our industry. While we attempt to negotiate long payment periods with our suppliers and shorter periods from our clients, we are not always successful. As a result, we generally pay our accounts payable on shorter cycles than we collect on our accounts receivables, requiring us to remit payments from our own funds, and accept the risk of credit loss.

Previous wording

We may also be involved in disputes with clients, and in the case of agencies, their advertisers, over the operation of our platform, the terms of our agreements or our billings for purchases made by them through our platform. If we are unable to resolve disputes with our clients, we may lose clients or clients may decrease their use of our platform and our financial performance and growth may be adversely affected. If we are unable to collect or make adjustments to bills to clients, we could incur write-offs for credit loss, which could harm our results of operations. In the future, credit loss may exceed reserves for such contingencies and our credit loss exposure may increase over time. Any increase in write-offs for credit loss could harm our business, financial condition and results of operations. Even if we are not paid by our clients on time or at all, we are still obligated to pay suppliers for the cost of advertising inventory, value-added services and data that clients purchase on our platform, and as a consequence, our business, financial condition and results of operations would be adversely impacted.

Current wording

We may also be involved in disputes with clients, and in the case of agencies, their advertisers, over the operation of our platform, the terms of our agreements or our billings for purchases made by them through our platform. If we are unable to resolve disputes with our clients, we may lose clients or clients may decrease their use of our platform and our financial performance and growth may be adversely affected. If we are unable to collect or make adjustments to bills to clients, we could incur write-offs for credit loss or reductions to revenue, respectively, which could harm our results of operations. In the future, credit loss may exceed reserves for such contingencies and our credit loss exposure may increase over time. Any increase in write-offs for credit loss could harm our business, financial condition and results of operations. Even if we are not paid by our clients on time or at all, we are still obligated to pay suppliers for the cost of advertising inventory, value-added services and data that clients purchase on our platform, and as a consequence, our business, financial condition and results of operations would be adversely impacted.

Previous wording

Campaigns are set up using several variables available to our clients on our platform. While our platform includes several checks and balances, it is possible for human error to result in significant overspending. The system requires a daily cap at the ad group level. We also provide for the client to input daily and overall caps at the advertising inventory campaign level at their discretion. Additionally, we set a credit limit for each user so that they cannot spend beyond the level of credit risk we are willing to accept. Despite these protections, the ability for overspend exists. For example, campaigns which last for a period of time can be set to pace evenly or as quickly as possible. If a client with a high credit limit enters the wrong daily cap with a campaign set to a rapid pace, it is possible for a campaign to accidently go significantly over budget. While our client contracts state that clients are responsible for media purchased through our platform, we are ultimately responsible for paying the inventory providers, and we may be unable to collect from clients facing such issues, in which case our results of operations would be harmed.

Current wording

Campaigns are set up using several variables available to our clients on our platform. While our platform includes several checks and balances, it is possible for human error to result in significant overspending. The system requires a daily cap at the ad group level. We also provide for the client to input daily and overall caps at the advertising inventory campaign level at their discretion. Additionally, we set a credit limit for each user so that they cannot spend beyond the level of credit risk we are willing to accept. Despite these protections, the ability for overspend exists. For example, campaigns which last for a period of time can be set to pace evenly or as quickly as possible. If a client with a high credit limit enters the wrong daily cap with a campaign set to a rapid pace, it is possible for a campaign to accidentally go significantly over budget. While our client contracts state that clients are responsible for media purchased through our platform, we are ultimately responsible for paying the inventory providers, and we may be unable to collect from clients facing such issues, in which case our results of operations would be harmed.