Trade Desk, Inc.

Previous wording

To sustain or increase our revenue, we must regularly add new clients and encourage existing clients to maintain or increase the amount of spend through our platform and adopt existing or new offerings that we make available. If competitors introduce lower cost or differentiated offerings that compete with or are perceived to compete with our offerings, our ability to sell our services to new or existing clients could be impaired. We have spent significant effort in cultivating our relationships with advertising agencies and advertisers, which has resulted in an increase in the budgets allocated to, and the amount of advertising purchased on, our platform. However, it is possible that we may reach a point of saturation at which we cannot continue to grow our revenue from such agencies or advertisers because of internal limits that advertisers may place on the allocation of their advertising budgets to digital media to a particular provider or otherwise. While we generally have master services agreements (“MSAs”) in place with our clients, such agreements allow our clients to choose the amount they spend through our platform and terminate our services with limited notice. We at times supplement our MSAs with joint business plans and other incentive programs designed to increase spend from existing clients; however, such increased spend may not materialize in the amounts we expect or at all. We do not typically have exclusive relationships with our clients and there is limited cost and difficulty to moving their media spend to our competitors. As a result, we have limited visibility to our future advertising revenue streams. We cannot assure you that our clients will continue to use our platform or related offerings to the extent that we expect or at all, or that we will be able to replace, in a timely or effective manner, departing clients with new clients that generate comparable revenue. If a major client representing a significant portion of our business decides to materially reduce its use of our platform or related offerings or to cease their use altogether, it is possible that our revenue or revenue growth rate could be significantly reduced, and our business negatively impacted.

Current wording

To sustain or increase our revenue, we must regularly add new clients and encourage existing clients to maintain or increase the amount of spend through our platform and adopt existing or new offerings that we make available. If competitors introduce lower cost or differentiated offerings that compete with or are perceived to compete with our offerings, our ability to sell our services to new or existing clients could be impaired. We focus on the value of our platform and related offerings. Agencies and advertisers may have an adverse reaction to the related pricing, which could impair our ability to maintain and attract existing and new clients and our share of their advertising budgets. We have spent significant effort in cultivating our relationships with advertising agencies and advertisers, which has resulted in an increase in the budgets allocated to, and the amount of advertising purchased on, our platform. However, it is possible that we may reach a point of saturation at which we cannot continue to grow our revenue from such agencies or advertisers because of internal limits that advertisers may place on the allocation of their advertising budgets to digital media to a particular provider or otherwise. While we generally have master services agreements (“MSAs”) in place with our clients, such agreements allow our clients to choose the amount they spend through our platform and terminate our services with limited notice. We at times supplement our MSAs with joint business plans and other incentive programs designed to increase spend from existing clients; however, such increased spend may not materialize in the amounts we expect or at all. We do not typically have exclusive relationships with our clients and there is limited cost and difficulty to moving their media spend to our competitors. As a result, we have limited visibility to our future advertising revenue streams. We cannot assure you that our clients will continue to use our platform or related offerings to the extent that we expect or at all, or that we will be able to replace, in a timely or effective manner, departing clients with new clients that generate comparable revenue. If a major client representing a significant portion of our business decides to materially reduce its use of our platform or related offerings or to cease their use altogether, it is possible that our revenue or revenue growth rate could be significantly reduced, and our business negatively impacted.

Previous wording

Our clients include advertising agencies, many of which are owned by holding companies, where decision making is decentralized such that purchasing decisions are made, and relationships with advertisers are located, at the agency, local branch or division level. If all of our individual client contractual relationships were aggregated at the holding company level, one holding company would have represented more than 10% of our gross billings for 2024.

Current wording

Our clients include advertising agencies, many of which are owned by holding companies, where decision making is decentralized such that purchasing decisions are made, and relationships with advertisers are located, at the agency, local branch or division level. If all of our individual client contractual relationships were aggregated at the holding company level, two holding companies would have each represented more than 10% of our gross billings for 2025.

Previous wording

We operate in a highly competitive and rapidly changing industry. We expect competition to persist and intensify in the future, which could harm our ability to increase revenue and maintain profitability. New technologies and methods of buying advertising present a dynamic competitive challenge, as market participants develop and offer new products and services aimed at capturing advertising spend or disrupting the digital marketing landscape, such as analytics, automated media buying and exchanges. Additionally, the impact of AI on our industry is still emerging and uncertain. We have been developing and implementing AI and machine learning models in our platform for nearly a decade and plan to continue such efforts, but there can be no assurance that our implementation of AI will continue to enhance our platform and related offerings in the manner we expect. To the extent we fail to adopt such technologies effectively or experience delays in integrating these technologies into our operations or our competitors successfully implement improved AI technologies into their products or services, our ability to compete effectively could be harmed and our growth prospects and results of operations could be adversely affected.

Current wording

We operate in a highly competitive and rapidly changing industry. We expect competition to persist and intensify in the future, which could harm our ability to increase revenue and maintain profitability. New technologies and methods of buying advertising present a dynamic competitive challenge, as market participants develop and offer new products and services aimed at capturing advertising spend or disrupting the digital marketing landscape, such as analytics, automated media buying and exchanges. Additionally, the impact of AI on our industry is still emerging and uncertain. We have been developing and implementing AI and machine learning models in our platform for nearly a decade and plan to continue such efforts, but there can be no assurance that our implementation of AI initiatives will continue to enhance our platform and related offerings in the manner we expect. We expect our AI initiatives will require increased investment in infrastructure and drive higher platform operations expense. To the extent we fail to adopt such technologies effectively or as intended, experience delays in integrating these technologies into our operations or our competitors successfully implement improved AI technologies into their products or services, our ability to compete effectively could be harmed and our growth prospects and results of operations could be adversely affected.

Previous wording

Historically, some of our competitors have sought to differentiate themselves to prospective customers primarily on the basis of artificially low surface-level fees, without accounting for the broader overall value delivered to customers, including the impact of hidden costs stemming from conflicts of interest and inefficiencies across the advertising supply chain. Our future success depends upon our continued ability to distinguish our offerings from competitors based on the value we provide our clients, including superior price discovery with respect to advertising opportunities, without the conflicts of interest and lack of objectivity that come with also selling advertising inventory. Although we believe that we offer differentiated offerings with superior value, there is no guarantee that new and existing customers will value our offerings as we intend, and they may perceive other offerings as competitive purely on the basis of price and results that are self-reported by such competitors.

Current wording

Historically, some of our competitors have sought to differentiate themselves to prospective clients primarily on the basis of artificially low prices, which are enabled by inherent conflicts of interest and a lack of objectivity, and do not account for the overall value delivered to clients. Our future success depends upon our continued ability to distinguish our offerings from competitors based on the value we provide our clients, including superior price discovery with respect to advertising opportunities, without the conflicts of interest and lack of objectivity that come with also selling advertising inventory. Although we believe that we offer differentiated offerings with superior value, some clients may be price sensitive and there is no guarantee that new and existing clients will value our offerings as we intend. They may perceive other offerings as competitive purely on the basis of price and results that are self-reported by such competitors.

Previous wording

We face various and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our systems and the data that we process. Our offerings involve the storage and transmission of significant amounts of data from users, clients, and inventory and data providers, a large volume of which is hosted by third-party service providers. Our services and the data on our platform, related offerings and in our systems could be exposed to unauthorized access due to activities that breach or undermine security measures, including: negligence or malfeasance by internal or external actors; attempts by outside parties to fraudulently induce employees, clients or vendors to disclose information or data, including personal information; or errors or vulnerabilities in our systems, offerings or processes or in those of our service providers, clients, and vendors.

Current wording

We face various and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our systems and the data that we process. Our offerings involve the storage and transmission of significant amounts of data, including personal information from users, clients, and inventory and data providers, a large volume of which is hosted by third-party service providers. Our services and the data on our platform, related offerings and in our systems could be exposed to unauthorized access due to activities that breach or undermine security measures, including: negligence or malfeasance by internal or external actors; attempts by outside parties to fraudulently induce employees, clients or vendors to disclose information or data, including personal information; or errors or vulnerabilities in our systems, offerings or processes or in those of our service providers, clients, and vendors.

Previous wording

For example, from time to time, we experience cyberattacks of varying degrees and other attempts to obtain unauthorized access to our systems, including to employee mailboxes. We have dedicated and expect to continue to dedicate resources toward security protections that shield data from these activities, including worldwide incident response teams and dedicated resources to incident response processes. However, such measures cannot provide absolute security and could, among other issues, fail to be adequate or accurately assess the incident severity, not proceed quickly enough, or fail to sufficiently remediate an incident. Further, we can expect that the deployment of techniques to circumvent our security measures may occur with more frequency and sophistication and may not be recognized until launched against a target. Accordingly, we may be unable to anticipate or detect these techniques or to implement adequate preventative measures.

Current wording

For example, from time to time, we experience cyberattacks of varying degrees and other attempts to obtain unauthorized access to our systems, including to employee mailboxes. We have dedicated and expect to continue to dedicate resources toward security protections that are designed to shield our systems and data from these activities, including worldwide incident response teams and dedicated resources to incident response processes. However, such measures cannot provide absolute security and could, among other issues, fail to be adequate or accurately assess the incident severity, not proceed quickly enough, or fail to sufficiently remediate an incident. Further, we can expect that the deployment of techniques to circumvent our security measures may occur with more frequency and sophistication and may not be recognized until launched against a target, including through the use of AI. Accordingly, we may be unable to anticipate or detect these techniques or to implement adequate preventative measures.

Previous wording

A breach of our security, a flawed design, and/or our failure to respond sufficiently to a security incident could disrupt our services and result in theft, misuse, loss, corruption, or improper use or disclosure of data. This could result in government investigations, lawsuits (including class actions), enforcement actions and other legal and financial liability, and/or loss of confidence in the availability and security of our offerings, all of which could seriously harm our reputation and brand and impair our ability to attract and retain clients. As some of our newer offerings involve the receipt and processing of identifiable information, the risks associated with data, including risks to breach of our systems increases, and we could be subject to contractual breach and indemnification claims from other clients and partners and otherwise suffer damage to our reputation, brand, and business. We could also be required to notify regulators, customers or other third parties. Our platform may also receive data in aggregated or pseudonymized form, and if our systems are breached and such data or information is compromised, it could be damaging to our brand, reputation, and business. Cyberattacks could also compromise our own trade secrets and other confidential information and result in such information being disclosed to others and becoming less valuable, which could negatively affect our business. Although we maintain errors or omissions and cyber liability insurance, the costs related to an incident or other security threats or disruptions may not be fully insured or indemnified by other means and insurance and other safeguards might only partially reimburse us for our losses, if at all. We also cannot guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all.

Current wording

A breach of our security, a flawed design, and/or our failure to respond sufficiently to a security incident could disrupt our services and result in theft, misuse, loss, corruption, or improper use or disclosure of our systems or data. This could result in government investigations, lawsuits (including class actions), enforcement actions and other legal and financial liability, and/or loss of confidence in the availability and security of our offerings, all of which could seriously harm our reputation and brand and impair our ability to attract and retain clients. As some of our offerings involve the receipt and processing of identifiable information, the risks associated with data, including risks related to a breach of our systems increases, and we could be subject to contractual breach and indemnification claims from other clients and partners and otherwise suffer damage to our reputation, brand, and business. We could also be required to notify regulators, clients or other third parties. Our platform may also receive data in aggregated or pseudonymized form, and if our systems are breached and such data or information is compromised, it could be damaging to our brand, reputation, and business. Cyberattacks could also compromise our own trade secrets and other confidential information and result in such information being disclosed to others and becoming less valuable, which could negatively affect our business. Although we maintain errors or omissions and cyber liability insurance, the costs related to an incident or other security threats or disruptions may not be fully insured or indemnified by other means and insurance and other safeguards might only partially reimburse us for our losses, if at all. We also cannot guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all.

Previous wording

Privacy and data protection laws to which we and our clients, inventory partners, and third-party data providers are subject may cause us to incur additional or unexpected costs, subject us to investigations or enforcement actions for alleged compliance failures, result in less demand for our offerings, or cause us to change our platform, related offerings or business model, which may have a material adverse effect on our business.

Current wording

Privacy and data protection laws to which we and our clients, inventory partners, and third-party data providers are subject may cause us to incur additional or unexpected costs, subject us to litigation, investigations or enforcement actions for alleged compliance failures, result in less demand for our offerings, or cause us to change our platform, related offerings or business model, which may have a material adverse effect on our business.

Previous wording

Information relating to individuals and their devices (commonly called “personal information” or “personal data”) is regulated under a wide variety of local, state, national and international laws and regulations that apply to its collection, use, retention, protection, disclosure, transfer (including across national boundaries) and other processing. We typically collect and store IP addresses and other device identifiers (such as unique cookie identifiers and mobile advertising identifiers), which are or may be considered personal data or personal information in many jurisdictions or otherwise subject to regulation. In connection with certain of our offerings, including Unified ID 2.0, EUID and OpenPass, we receive information that directly identifies individuals, such as email addresses and phone numbers, both directly from consumers and from our clients or others. We deploy technical and security measures, internal policy controls, and contractual measures to limit how such identifying information is used and shared. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws. Some of our offerings, including those that entail some use of directly identifying information, may also increase our exposure to potential claims by plaintiffs’ attorneys, including by attempting to apply various legal theories – such as alleging violations of wiretapping statutes – to certain of our activities. For example, in March 2025, suits alleging various wiretapping and privacy tort theories were filed against us in the Northern District of California. For additional information regarding the pending legal proceedings, refer to “Item 1. Legal Proceedings.”

Current wording

Information relating to individuals, households and their devices (commonly called “personal information” or “personal data”) is regulated under a wide variety of local, state, national and international laws and regulations that apply to its collection, use, retention, protection, disclosure, transfer (including across national boundaries) and other processing. We typically collect and store IP addresses and other device identifiers (such as unique cookie identifiers and mobile advertising identifiers), which are or may be considered personal data or personal information in many jurisdictions or otherwise subject to regulation. In connection with certain of our offerings, including Unified ID 2.0, EUID and OpenPass, we receive information that directly identifies individuals, such as email addresses and phone numbers, both directly from consumers and from our clients or others. We deploy technical and security measures, internal policy controls, and contractual measures designed to limit how such identifying information is used and shared. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws. Some of our offerings, including those that entail some use of directly identifying information, may also increase our exposure to potential claims by plaintiffs’ attorneys (discussed further below), including by attempting to apply various legal theories – such as alleging violations of wiretapping statutes – to certain of our activities.

Previous wording

The global regulatory landscape regarding the privacy and protection of personal information is evolving, and U.S. (state, federal and local) and foreign governments continue to consider and enact additional legislation and rulemaking related to privacy and data protection, often with a particular focus on intermediaries in the online advertising ecosystem, including those that engage in targeted advertising, “sell” or “share” personal data, and act as “data brokers.” We expect to see an increase in, or changes to, privacy and data protection legislation and regulation in this area for the foreseeable future. For example, the FTC uses its enforcement powers under Section 5 of the Federal Trade Commission Act (the “FTC Act”) (which prohibits “unfair” and “deceptive” trade practices) to investigate companies engaging in online tracking. For example, in the preceding few years, the FTC has been very active in bringing enforcement actions against companies that handle personal data it views as sensitive for advertising purposes, including location data brokers and companies that process health-related data. The Commission could continue to build on this trend under its authority to enforce a relatively new federal law focused on disclosures of certain “sensitive” information by companies operating as data brokers to certain restricted countries or entities “controlled” by such countries, and the Department of Justice could act on authority granted under an executive order restricting similar practices, for which regulations and guidance have recently been issued. Other companies in the advertising technology space have been subject to government investigation by regulatory bodies; advocacy organizations have also filed complaints with data protection authorities against advertising technology companies, arguing that certain of these companies’ practices do not comply with data privacy laws, or consumer protection laws such as the FTC Act. As noted above, plaintiffs’ attorneys are also increasingly exploring theories under which to pursue claims against advertising technology companies related to their data collection, use and disclosure practices, as well as advertisers and publishers that rely on services provided by these companies. For example, in March 2025, suits alleging various privacy tort theories were filed against us in the Northern District of California. For additional information regarding the pending legal proceedings, refer to “Item 1. Legal Proceedings.” We cannot avoid the possibility that one of these investigations or enforcement actions will require us to alter our practices. In addition, a potential federal omnibus privacy law remains a possibility. If ultimately passed, such a law would likely substantially impact the online advertising ecosystem.

Current wording

The global regulatory landscape regarding the privacy and protection of personal information is evolving, and U.S. (state, federal and local) and foreign governments continue to consider and enact additional legislation and rulemaking related to privacy and data protection, often with a particular focus on intermediaries in the online advertising ecosystem, including those that engage in targeted advertising, “sell” or “share” personal data, and act as “data brokers.” While a significant volume of laws has already been enacted, we expect to see additional data protection legislation and regulation in this area for the foreseeable future. For example, the FTC uses its enforcement powers under Section 5 of the Federal Trade Commission Act (the “FTC Act”) (which prohibits “unfair” and “deceptive” trade practices) to investigate companies engaging in online tracking. In the preceding few years, the FTC has been very active in bringing enforcement actions against companies that handle personal data it views as sensitive for advertising purposes, including location data brokers and companies that process health-related data. The FTC could continue to build on this trend under its authority to enforce a relatively new federal law focused on disclosures of certain “sensitive” information by companies operating as data brokers to certain restricted countries or entities “controlled” by such countries, and the Department of Justice could act on authority granted under an executive order restricting similar practices. Other companies in the advertising technology space have been subject to government investigation by regulatory bodies; advocacy organizations have also filed complaints with data protection authorities against advertising technology companies, arguing that certain of these companies’ practices do not comply with data privacy laws, or consumer protection laws such as the FTC Act. As noted above, plaintiffs’ attorneys are also increasingly pursuing claims against advertising technology companies related to their data collection, use and disclosure practices, as well as advertisers and publishers that rely on services provided by these companies. For example, lawsuits alleging various privacy tort theories have been filed against us. For additional information regarding the pending legal proceedings, refer to Note 11—Commitments and Contingencies—Litigation. We cannot avoid the possibility that one of these investigations or enforcement actions will require us to alter our practices. In addition, a potential federal omnibus privacy law remains a possibility. If ultimately passed, such a law would likely substantially impact the online advertising ecosystem.

Previous wording

State lawmakers are also actively addressing consumer data privacy issues. Many states have adopted omnibus consumer privacy laws, a host of which are already enforceable, while others will take effect over the coming years. These state laws define “personal information” broadly enough to include many online identifiers provided by individuals’ devices, applications, and protocols (such as IP addresses, mobile advertising identifiers and unique cookie identifiers), individuals’ location data, and hashed versions of email addresses and phone numbers. These laws generally require covered businesses to meet numerous data privacy-related obligations and establish data privacy rights for consumers in such states (including rights to opt out of certain processing of their personal data and to request correction, deletion of and access to personal data), imposing special rules on the collection of personal data from minors, precise location data and other personal data deemed “sensitive” under the laws, and creating new notice and consent obligations. Many also impose data minimization requirements, mandating that companies only collect and process data for certain purposes. In a recent enforcement action, the California Attorney General employed these data minimization standards to attack advertising-related disclosures by a publisher of health-related information. Perhaps most significant for the advertising industry, however, these laws require businesses that engage in certain advertising uses of personal data to offer and honor an opt-out of such activities, including, in some states, through browser or device-based preference signals. (Terminology varies slightly among some of the state laws, tying the opt-out requirement to “targeted advertising,” “sales” or “sharing” of personal data.) Because of these obligations, the availability of data within our platform, our related offerings and the advertising ecosystem more broadly may decline, potentially making our platform and related offerings less valuable to our clients.

Current wording

State lawmakers are also actively addressing consumer data privacy issues. Many states have adopted omnibus consumer privacy laws. These state laws define “personal information” broadly enough to include many online identifiers provided by individuals’ devices, applications, and protocols (such as IP addresses, mobile advertising identifiers and unique cookie identifiers), individuals’ location data, and hashed versions of email addresses and phone numbers. These laws generally require covered businesses to meet numerous data privacy-related obligations and establish data privacy rights for consumers in such states (including rights to opt out of certain processing of their personal data and to request correction, deletion of and access to personal data), impose special rules on the collection of personal data from minors, precise location data and other personal data deemed “sensitive” under the laws, and create new notice and consent obligations. Many also impose data minimization requirements, mandating that companies only collect and process personal information for certain purposes. The California Attorney General has employed these data minimization standards in the context of advertising-related disclosures and it and other regulators may continue to pursue such theories. Perhaps most significant for the advertising industry, however, these laws require businesses that engage in certain advertising uses of personal data to offer and honor an opt-out of such activities. (Terminology varies slightly among some of the state laws, tying the opt-out requirement to “targeted advertising,” “sales” or “sharing” of personal data.)

Previous wording

These laws and their implementing regulations will likely also increase compliance costs and obligations on us, our clients, and other companies in the advertising industry. Although we have attempted to mitigate certain risks posed by these laws through contractual, platform and offering changes, we cannot predict with certainty the effect of these laws and their implementing regulations, some of which are not yet finalized, on our business, nor the share of consumers who will carry out their opt-out and other rights and how these actions will impact us, our clients, inventory sources, and our industry. Further, enforcement activity under such laws already in effect, particularly in California, reflects an ongoing focus on online advertising activities and signals regulators’ willingness to pursue in-depth investigations and impose substantial penalties on entities allegedly operating in violation of the statute. Thus, we expect that continuing to maintain compliance with states’ varying legal requirements, including monitoring and adjusting to new regulations and interpretations that emerge through enforcement actions, will require significant time, resources, and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Current wording

These laws and their implementing regulations have and will likely also increase compliance costs and obligations on us, our clients, and other companies in the advertising industry. Although we have attempted to mitigate certain risks posed by these laws through contractual, platform and offering changes, we cannot predict with certainty the effect of these laws and their implementing regulations, some of which are not yet finalized, on our business, nor the share of consumers who will carry out their opt-out and other rights and how these actions will impact us, our clients, inventory sources, and our industry. Further, enforcement activity under such laws already in effect, particularly in California, reflects an ongoing focus on online advertising activities and signals regulators’ willingness to pursue in-depth investigations and impose substantial penalties on entities allegedly operating in violation of the statute. Thus, we expect that continuing to maintain compliance with states’ varying legal requirements, including monitoring and adjusting to new regulations and interpretations that emerge through enforcement actions, will require significant time, resources, and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Previous wording

In addition to these broad-based consumer privacy laws, lawmakers and regulators continue to focus on activities that involve use of categories of personal data perceived as especially sensitive, such as health data and children’s data. For example, the FTC has finalized an update to rules adopted pursuant to the Children Online Privacy Protection Act, modifying some requirements relating to the use of children’s data for targeted advertising and several states have enacted laws that would substantially impact activities that involve showing targeted advertisements to individuals under 18 years of age through a variety of new restrictions, or in some cases prohibit it altogether. Further, several states have enacted laws, updated existing laws or have introduced bills to impose new privacy obligations related to health-related personal information beyond that governed by federal and state laws governing medical records and similar information, such as HIPAA. For example, Washington’s My Health, My Data Act (“MHMD”) introduced a host of requirements related to a very broadly-defined notion of consumer health data that impacts the advertising industry in part because MHMD is subject to a private right of action (unlike most other state privacy laws), so plaintiffs’ attorneys could explore claims that stretch the bounds of the law’s text. A somewhat similar law recently enacted in Virginia also contains a private right of action. These laws and the heightened scrutiny associated with the enforcement of such laws may, in turn, ultimately lead to increased compliance and defense costs, and more obligations on us, our clients and other companies in the advertising industry.

Current wording

In addition to these broad-based consumer privacy laws, lawmakers and regulators continue to focus on activities that involve use of categories of personal data perceived as especially sensitive, such as health data and children’s data. For example, the Children Online Privacy Protection Act restricts the use of children’s data for targeted advertising and several states have enacted laws that would substantially impact advertising to individuals under 18 years of age through a variety of new restrictions and prohibitions. Further, several states have enacted laws, updated existing laws or have introduced bills to impose new privacy obligations related to health-related personal information beyond that governed by federal and state laws governing medical records and similar information, such as HIPAA. For example, Washington’s My Health, My Data Act (“MHMD”) introduced a host of requirements related to a very broadly-defined notion of consumer health data that impacts the advertising industry and is backed by a private right of action. Other states have also adopted laws protecting “consumer health data” as well as information related to reproductive health care. These laws and the heightened scrutiny associated with the enforcement of such laws may, in turn, ultimately lead to increased compliance and defense costs, and more obligations on us, our clients and other companies in the advertising industry.

Previous wording

Laws governing the processing of personal data in Europe (including the U.K. and EEA) also continue to impact us and to evolve. For example, the GDPR defines “personal data” broadly and enhances data protection obligations for controllers of such data and for service providers processing the data. It also provides certain rights, such as access and deletion, to the individuals about whom the personal data relates. IAB Europe previously collaborated with the digital advertising industry to create a user-facing framework (the Transparency and Control Framework, or “TCF”) for establishing and managing legal bases under the GDPR and other U.K. and EU privacy laws including the ePrivacy Directive. Although the TCF is actively in use, its viability as a compliance mechanism remains under review by European authorities and we cannot predict its effectiveness over the long term. Because we are under the supervision of relevant data protection authorities in both the EEA and the U.K., we may be fined under both the EU GDPR and the UK GDPR for the same breach, with penalties up to the greater of €20 million/BP 17.5 million or 4% of total worldwide annual turnover. In addition to fines, breach of the GDPR can also result in regulatory investigations, enforcement notices, and civil claims. Continuing to maintain compliance with the requirements of the GDPR, including monitoring and adjusting to rulings and interpretations that affect our approach to compliance, requires significant time, resources and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Current wording

Laws governing the processing of personal data in Europe (including the U.K. and EEA) also continue to impact us and to evolve. For example, the GDPR defines “personal data” broadly and enhances data protection obligations for controllers of such data and for service providers processing the data. It also provides certain rights, such as access and deletion, to the individuals about whom the personal data relates. IAB Europe previously collaborated with the digital advertising industry to create a user-facing framework (the Transparency and Control Framework, or “TCF”) for establishing and managing legal bases under the GDPR and other U.K. and EU privacy laws, including the ePrivacy Directive. Although the TCF is actively in use, its viability as a compliance mechanism remains under review by European authorities and we cannot predict its effectiveness over the long term. Because we are under the supervision of relevant data protection authorities in both the EEA and the U.K., we may be fined under both the EU GDPR and the UK GDPR for the same breach, with penalties up to the greater of €20 million/BP 17.5 million or 4% of total worldwide annual turnover. In addition to fines, breach of the GDPR can also result in regulatory investigations, enforcement notices, reputational harm and civil claims. Continuing to maintain compliance with the requirements of the GDPR, including monitoring and adjusting to rulings and interpretations that affect our approach to compliance, requires significant time, resources and expense, as will the effort to monitor whether additional changes to our business practices and our backend configuration are needed, all of which may increase operating costs, or limit our ability to operate or expand our business.

Previous wording

Data residency and cross-border transfer restrictions also impact our operations. For the transfer of personal data from Europe to the U.S., we rely upon, and are certified under, the EU-U.S. and Swiss-U.S. Data Privacy Frameworks (“DPF”) and the U.K. extension to the EU-U.S. DPF. In relation to such cross border transfers of personal information, we expect the existing legal complexity and uncertainty regarding international personal information transfers to continue. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative data transfer mechanisms under the GDPR or take additional compliance and operational measures, such as establishing systems to maintain certain data in the EEA, potentially involving substantial expense and causing us to divert resources from other aspects of our operations, all of which may adversely affect our business. Other jurisdictions have adopted or are considering cross-border or data residency restrictions, which could reduce the amount of data we can collect or process and, as a result, significantly impact our business.

Current wording

(“DPF”) and the U.K. extension to the EU-U.S. DPF. In relation to such cross border transfers of personal information, we expect the existing legal complexity and uncertainty regarding international personal information transfers to continue. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative data transfer mechanisms under the GDPR or take additional compliance and operational measures, such as establishing systems to maintain certain data in the EEA, potentially involving substantial expense and causing us to divert resources from other aspects of our operations, all of which may adversely affect our business. Other jurisdictions have adopted or are considering cross-border or data residency restrictions, which could reduce the amount of data we can collect or process and, as a result, significantly impact our business.

Previous wording

Further, our legal risk depends in part on our clients’ or other third parties’ adherence to data privacy laws and regulations and their use of our services in ways consistent with end user expectations. There can be no assurances that the privacy and security-related measures and safeguards we have put into place in relation to these third parties will be effective to protect us and/or the relevant personal information from the risks associated with the third-party processing of such data. We rely on representations made to us by clients, partners and providers that they will comply with all applicable laws, including all relevant data privacy and data protection regulations. Although we make reasonable efforts to enforce such representations and contractual requirements, we do not fully audit our clients’ compliance with our recommended disclosures or their adherence to data privacy laws and regulations. If our clients, partners or providers fail to adhere to our expectations or contracts in this regard, we and our clients could be subject to adverse publicity, damages and related possible investigation or other regulatory activity.

Current wording

Further, our legal risk depends in part on our clients’ or other third parties’ adherence to data privacy laws and regulations and their use of our services in ways consistent with end user expectations. There can be no assurances that the privacy and security-related measures and safeguards we have put into place in relation to these third parties will be effective to protect us and/or the relevant personal information from the risks associated with the third-party processing of such data. We rely on representations made to us by clients, partners and providers that they will comply with all applicable laws, including all relevant data privacy and data protection regulations. Although we make reasonable efforts to enforce such representations and contractual requirements, we do not fully audit our clients’ compliance with our recommended disclosures nor can we be certain that our clients, partners and providers will adhere to data privacy laws and regulations. If our clients, partners or providers fail to adhere to our expectations or contracts in this regard, we and our clients could be subject to adverse publicity, damages and related possible investigation or other regulatory activity.

Previous wording

We deploy technical and organizational measures, internal policy controls, and contractual measures to limit how identifying information is used and shared and to help honor consumer choices. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws. These laws and other obligations may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our platform and related offerings. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our offerings, which could have an adverse effect on our business. In addition, public perception regarding data protection and privacy are significant in the programmatic advertising buying industry. Concerns about industry practices regarding the collection, use, and disclosure of personal data, whether or not valid and whether driven by applicable laws and regulations, industry standards, client or inventory provider expectations, or the broader public, may harm our reputation, result in loss of goodwill, and inhibit use of our platform or related offerings by current and future clients. For example, perception that our practices involve an invasion of privacy or are designed with insufficient protections, whether or not such practices are consistent with current or future laws, regulations, or industry practices, may subject us to public criticism, additional private class actions, reputational harm, or claims by regulators, which could disrupt our business and expose us to increased liability. We may be unable to make changes and modifications to our business and offerings in a commercially reasonable manner or at all, and our ability to develop new offerings or certain features could be limited. All of this could impair our or our clients’ ability to collect, use, or disclose information relating to consumers, which could decrease demand for our platform and related offerings, increase our costs, and impair our ability to maintain and grow our client base and increase our revenue.

Current wording

We deploy technical and organizational measures, internal policy controls, and contractual measures designed to limit how identifying information is used and shared and to help honor consumer choices. Nevertheless, we cannot guarantee any such measures or controls will be effective and handling identifying information increases our exposure under privacy and data protection laws. These laws and other obligations may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our platform and related offerings. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our offerings, which could have an adverse effect on our business. In addition, public perception regarding data protection and privacy are significant in the programmatic advertising buying industry. Concerns about industry practices regarding the collection, use, and disclosure of personal data, whether or not valid and whether driven by applicable laws and regulations, industry standards, client or inventory provider expectations, or the broader public, may harm our reputation, result in loss of goodwill, and inhibit use of our platform or related offerings by current and future clients. For example, perception that our practices involve an invasion of privacy or are designed with insufficient protections, whether or not such practices are consistent with current or future laws, regulations, or industry practices, may subject us to public criticism, additional private class actions, reputational harm, or claims by regulators, which could disrupt our business and expose us to increased liability. We may be unable to make changes and modifications to our business and offerings in a commercially reasonable manner or at all, and our ability to develop new offerings or certain features could be limited. All of this could impair our or our clients’ ability to collect, use, or disclose information relating to consumers, which could decrease demand for our platform and related offerings, increase our costs, and impair our ability to maintain and grow our client base and increase our revenue.

Previous wording

Our ability to successfully leverage user data and generate revenue from opportunities to serve advertisements could be impacted by restrictions imposed by laws or by third parties, including restrictions on our ability to use or read cookies, device identifiers, or other tracking features or our ability to use real-time bidding networks or other bidding networks. For example, if publishers or supply-side platforms decide to limit the data that we receive in order to comply (in their view) with state privacy laws, a potential federal privacy law, or in response to other legal or industry development then our service may prove to be less valuable to our clients and we may find it more difficult to generate revenue. That is, if third parties on which we rely for data or opportunities to serve advertisements impose limitations (for whatever reason) or are restricted by other ecosystem participants or applicable regulations, then we may lose the ability to access data, bid on opportunities or purchase digital ad space, which could have a substantial impact on our revenue.

Current wording

Our ability to successfully leverage user data and generate revenue from opportunities to serve advertisements could be impacted by restrictions imposed by laws or by third parties, including restrictions on our ability to use or read cookies, device identifiers, or other tracking features or our ability to use real-time bidding networks or other bidding networks. For example, if publishers or supply-side platforms decide to limit the data that we receive in order to comply (in their view) with state privacy laws, a potential federal privacy law or in response to other legal or industry developments, then our service may prove to be less valuable to our clients and we may find it more difficult to generate revenue. That is, if third parties on which we rely for data or opportunities to serve advertisements impose limitations (for whatever reason) or are restricted by other ecosystem participants or applicable regulations, then we may lose the ability to access data, bid on opportunities or purchase digital ad space, which could have a substantial impact on our revenue.

Previous wording

Today, digital advertising, including our platform, makes significant use of cookies to store device identifiers for the advertising activities described above. When we use cookies, they are generally considered third-party cookies, which are cookies owned and used by parties other than the owners of the website visited by the Internet user. The most commonly used Internet browsers—Chrome, Firefox, Internet Explorer and Safari—allow Internet users to modify their browser settings to prevent some or all cookies from being accepted by their browsers. Internet users can delete cookies from their computers at any time. Additionally, some browsers currently, or may in the future, block or limit some third-party cookies by default or may implement user control settings that algorithmically block or limit some cookies. Today, three major web browsers—Apple’s Safari, Mozilla’s Firefox and Microsoft’s Edge—block third-party cookies by default. Google’s web browser, Chrome, has introduced, and is likely to continue to introduce, controls over third-party cookies. However, on April 22, 2025, Google announced that it would maintain its current approach to offering users third-party cookie choice in Chrome (thus, presumably, ending its efforts to deprecate third-party cookies in Chrome), and will not be rolling out a new standalone prompt for third-party cookies in Chrome. Finally, other participants in the real-time bidding ecosystem could decline to provide certain identifiers or introduce user settings that reduce the number of identifiers provided to us that help us to optimize supply paths, target audiences, and measure outcomes. Although we believe our platform is well-positioned to adapt to browsers’ blocking or limitation of some cookies, particularly with our Unified ID 2.0 offering, the impact of such changes — and broader scrutiny on the advertising technology ecosystem — remains uncertain and could be more disruptive than we anticipate, including to the display advertising ecosystem in particular, where such changes could adversely impact our growth in that channel.

Current wording

Today, digital advertising, including our platform, makes significant use of cookies to store device identifiers for the advertising activities described above. When we use cookies, they are generally considered third-party cookies, which are cookies owned and used by parties other than the owners of the website visited by the Internet user. The most commonly used Internet browsers—Chrome, Safari, Internet Explorer and Firefox —allow Internet users to modify their browser settings to prevent some or all cookies from being accepted by their browsers. Internet users can delete cookies from their computers at any time. Additionally, some browsers currently, or may in the future, block or limit some third-party cookies by default or may implement user control settings that algorithmically block or limit some cookies. Today, three major web browsers—Apple’s Safari, Mozilla’s Firefox and Microsoft’s Edge—block third-party cookies by default and other browsers could follow suit or prompt users to consent to the use of cookies. In addition, other participants in the real-time bidding ecosystem could decline to provide certain identifiers or introduce user settings that reduce the number of identifiers provided to us that help us to optimize supply paths, target audiences and measure outcomes. Although we believe our platform is well-positioned to adapt to browsers’ blocking or limitation of cookies and other identifiers, particularly with our Unified ID 2.0 offering, the impact of such changes — and broader scrutiny on the advertising technology ecosystem — remains uncertain and could be more disruptive than we anticipate, including to the display advertising ecosystem in particular, where such changes could adversely impact our growth in that channel.

Previous wording

Some Internet users also download free or paid ad-blocking software that not only prevents third-party cookies from being stored on a user’s computer, but also blocks all interaction with a third-party ad server. In addition, Google has introduced ad-blocking software in its Chrome web browser that will block certain ads based on quality standards established under a multi-stakeholder coalition. If such a feature inadvertently or mistakenly blocks ads that are not within the established blocking standards, or if such capabilities become widely adopted and the advertising technology industry does not collaboratively develop alternative technologies, our business could be harmed. The Interactive Advertising Bureau and Digital Advertising Alliance have also developed frameworks that allow users to opt out of the “sale” or use of their personal data for targeted advertising purposes under U.S. state privacy laws in ways that stop or severely limit the ability to show targeted ads. Because many state privacy laws require businesses to permit end users to opt out of processing their personal data for purposes of targeted advertising, including, in some states, through automated signals, we expect that more opt-out solutions will become available that may ultimately be used by end users, which may reduce our clients’ use of our platform and related offerings, and our business, financial condition, and results of operations could be adversely affected.

Current wording

Some Internet users also download free or paid ad-blocking software that not only prevents third-party cookies from being stored on a user’s computer, but also blocks all interaction with a third-party ad server. In addition, Google has introduced ad-blocking software in its Chrome web browser that will block certain ads based on quality standards established under a multi-stakeholder coalition. If such a feature inadvertently or mistakenly blocks ads that are not within the established blocking standards, or if such capabilities become widely adopted and the advertising technology industry does not collaboratively develop alternative technologies, our business could be harmed. The Interactive Advertising Bureau and Digital Advertising Alliance have also developed frameworks that allow users to opt out of the “sale” or use of their personal data for targeted advertising purposes under U.S. state privacy laws in ways that stop or severely limit the ability to show targeted ads. Because many state privacy laws require businesses to permit end users to opt out of processing their personal data for purposes of targeted advertising, including, in some states, through device-based preference signals, we expect that more opt-out solutions will become available that may ultimately be used by end users, which may reduce our clients’ use of our platform and related offerings, and our business, financial condition, and results of operations could be adversely affected.

Previous wording

Advertising shown on mobile applications can also be affected by blocking or restricting use of mobile device identifiers. Data regarding interactions between users and devices are tracked mostly through stable, pseudonymous advertising identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier. These identifiers and privacy controls are defined by the developers of the platforms through which the applications are accessed and could be changed by the platforms in a way that may negatively impact our business. For example, Apple has shifted to require user opt-in before permitting access to Apple’s unique advertising identifier, or IDFA, and Google has announced that it will eventually deprecate the mobile advertising identifier used on Android devices entirely. These changes have had, and will likely continue to have, a substantial impact on the mobile advertising ecosystem and could adversely impact our growth in this channel.

Current wording

Advertising shown on mobile applications can also be affected by blocking or restricting use of mobile device identifiers. Data regarding interactions between users and devices are tracked mostly through stable, pseudonymous advertising identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier. These identifiers and privacy controls are defined by the developers of the platforms through which the applications are accessed and could be changed by the platforms in a way that may negatively impact our business. For example, Apple has shifted to require user opt-in before permitting access to Apple’s unique advertising identifier, or IDFA, and Google could shift to an opt-in model or deprecate the mobile advertising identifier used on Android devices. These changes have had, and will likely continue to have, a substantial impact on the mobile advertising ecosystem and could adversely impact our growth in this channel.

Previous wording

•changes to availability of and pricing of competitive products and services, and their effects on our pricing;

Current wording

•changes to our pricing or to the availability of and pricing of competitive products and services;

Previous wording

•changes in the pricing, cost or availability of supplier-provided components of value-added services and data, including pricing structure changes and the alignment of our pricing model with our data partners, and our ability to successfully implement and rollout such changes;

Current wording

•changes in the pricing, cost or availability of third-party supplier-provided components of value-added services and data, including pricing structure changes and the alignment of our pricing model with our data partners, and our ability to successfully implement and rollout such changes;

Previous wording

Employee turnover, including changes in our management team or failure to manage executive succession effectively, could disrupt our business. None of our key employees have an employment agreement for a specific term, and all of our employees may terminate their employment with us at any time. The loss of one or more of our executive officers or our inability to attract and retain highly skilled employees could have an adverse effect on our business, financial condition and results of operations.

Current wording

Periods of significant change or transition, including leadership changes, organizational restructuring, or shifts in strategic priorities, can disrupt our operations and reduce efficiency. Such transitions may reduce continuity and create uncertainty that may delay decision-making and execution of key initiatives. In addition, these changes can affect our corporate culture, decrease employee morale, and lead to increased employee turnover, including among key personnel. Loss of institutional knowledge and challenges in attracting and retaining highly skilled talent may further hinder productivity and collaboration. None of our key employees have an employment agreement for a specific term, and all of our employees may terminate their employment with us at any time. If we are unable to manage these transitions or executive successions effectively, our business, financial condition and results of operations could be adversely affected.

Previous wording

•improve our technology infrastructure, including investing in internal technology development and acquiring outside technologies;

Current wording

•improve our technology, including investing in internal technology development and acquiring outside technologies and investing in hosting infrastructure in an environment where a shortage of hosting capacity and hardware components is causing costs to increase;

Previous wording

Spend on our platform primarily comes through our agency clients. Many of our contracts with advertising agencies provide that if the advertiser does not pay the agency, the agency is not liable to us, and we must seek payment solely from the advertiser, a type of arrangement called sequential liability. Contracting with these agencies, which in some cases have or may develop higher-risk credit profiles, may subject us to greater credit risk than if we were to contract directly with advertisers. This credit risk may vary depending on the nature of an advertising agency’s aggregated advertiser base. In addition, typically, we are contractually required to pay advertising inventory and data suppliers within a negotiated period of time, regardless of whether our clients pay us on time, or at all. In addition, we typically experience slow payment cycles by advertising agencies as is common in our industry. While we attempt to negotiate long payment periods with our suppliers and shorter periods from our clients, we are not always successful. As a result, we often face a timing issue with our accounts payable on shorter cycles than our accounts receivables, requiring us to remit payments from our own funds, and accept the risk of credit loss.

Current wording

Spend on our platform primarily comes through our agency clients. Many of our contracts with advertising agencies provide that if the advertiser does not pay the agency, the agency is not liable to us, and we must seek payment solely from the advertiser, a type of arrangement called sequential liability. Contracting with these agencies, which in some cases have or may develop higher-risk credit profiles, may subject us to greater credit risk than if we were to contract directly with advertisers. This credit risk may vary depending on the nature of an advertising agency’s aggregated advertiser base. In addition, typically, we are contractually required to pay advertising inventory and data suppliers within a negotiated period of time, regardless of whether our clients pay us on time, or at all. In addition, we typically experience slow payment cycles by advertising agencies as is common in our industry. While we attempt to negotiate long payment periods with our suppliers and shorter periods from our clients, we are not always successful. As a result, we generally pay our accounts payable on shorter cycles than we collect on our accounts receivables, requiring us to remit payments from our own funds, and accept the risk of credit loss.

Previous wording

We may also be involved in disputes with clients, and in the case of agencies, their advertisers, over the operation of our platform, the terms of our agreements or our billings for purchases made by them through our platform. If we are unable to resolve disputes with our clients, we may lose clients or clients may decrease their use of our platform and our financial performance and growth may be adversely affected. If we are unable to collect or make adjustments to bills to clients, we could incur write-offs for credit loss, which could harm our results of operations. In the future, credit loss may exceed reserves for such contingencies and our credit loss exposure may increase over time. Any increase in write-offs for credit loss could harm our business, financial condition and results of operations. Even if we are not paid by our clients on time or at all, we are still obligated to pay suppliers for the cost of advertising inventory, value-added services and data that clients purchase on our platform, and as a consequence, our business, financial condition and results of operations would be adversely impacted.

Current wording

We may also be involved in disputes with clients, and in the case of agencies, their advertisers, over the operation of our platform, the terms of our agreements or our billings for purchases made by them through our platform. If we are unable to resolve disputes with our clients, we may lose clients or clients may decrease their use of our platform and our financial performance and growth may be adversely affected. If we are unable to collect or make adjustments to bills to clients, we could incur write-offs for credit loss or reductions to revenue, respectively, which could harm our results of operations. In the future, credit loss may exceed reserves for such contingencies and our credit loss exposure may increase over time. Any increase in write-offs for credit loss could harm our business, financial condition and results of operations. Even if we are not paid by our clients on time or at all, we are still obligated to pay suppliers for the cost of advertising inventory, value-added services and data that clients purchase on our platform, and as a consequence, our business, financial condition and results of operations would be adversely impacted.

Previous wording

Campaigns are set up using several variables available to our clients on our platform. While our platform includes several checks and balances, it is possible for human error to result in significant overspending. The system requires a daily cap at the ad group level. We also provide for the client to input daily and overall caps at the advertising inventory campaign level at their discretion. Additionally, we set a credit limit for each user so that they cannot spend beyond the level of credit risk we are willing to accept. Despite these protections, the ability for overspend exists. For example, campaigns which last for a period of time can be set to pace evenly or as quickly as possible. If a client with a high credit limit enters the wrong daily cap with a campaign set to a rapid pace, it is possible for a campaign to accidently go significantly over budget. While our client contracts state that clients are responsible for media purchased through our platform, we are ultimately responsible for paying the inventory providers, and we may be unable to collect from clients facing such issues, in which case our results of operations would be harmed.

Current wording

Campaigns are set up using several variables available to our clients on our platform. While our platform includes several checks and balances, it is possible for human error to result in significant overspending. The system requires a daily cap at the ad group level. We also provide for the client to input daily and overall caps at the advertising inventory campaign level at their discretion. Additionally, we set a credit limit for each user so that they cannot spend beyond the level of credit risk we are willing to accept. Despite these protections, the ability for overspend exists. For example, campaigns which last for a period of time can be set to pace evenly or as quickly as possible. If a client with a high credit limit enters the wrong daily cap with a campaign set to a rapid pace, it is possible for a campaign to accidentally go significantly over budget. While our client contracts state that clients are responsible for media purchased through our platform, we are ultimately responsible for paying the inventory providers, and we may be unable to collect from clients facing such issues, in which case our results of operations would be harmed.

Previous wording

We have a U.K. entity through which we have entered into international client and partner agreements, including with those in the EU, which are governed by English Law, and some of our clients and partners pay us in British Pounds and Euros.

Current wording

We have a U.K. entity through which we have entered into international client and partner agreements, including with those in the EU, which are governed by English Law, and some of our clients and partners pay us in Euros, British Pounds and other foreign currencies.

Previous wording

•incur, assume or permit additional indebtedness and guarantees;

Current wording

•permit our subsidiaries to incur or assume additional indebtedness and guarantees; and

Previous wording

In addition, if the stock market for technology companies, or the stock market generally, experiences a loss of investor confidence, the trading price of our Class A common stock could decline for reasons unrelated to our business, financial condition or results of operations. Stock prices of many technology companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. The trading price of our Class A common stock might also decline in reaction to events that affect other companies in our industry even if these events do not directly affect us. For example, in February and March 2025, securities class action litigation was filed against us following a drop in our stock price. For additional information regarding the pending legal proceedings, refer to “Item 1. Legal Proceedings.” Our involvement in securities litigation will subject us to substantial costs, divert resources and the attention of management from our core business, and may adversely affect our business.

Current wording

In addition, if the stock market for technology companies, or the stock market generally, experiences a loss of investor confidence, the trading price of our Class A common stock could decline for reasons unrelated to our business, financial condition or results of operations. Stock prices of many technology companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. The trading price of our Class A common stock might also decline in reaction to events that affect other companies in our industry even if these events do not directly affect us. For example, in February and March 2025, securities class action litigation was filed against us following a drop in our stock price. For additional information regarding the pending legal proceedings, refer to Note 11—Commitments and Contingencies—Litigation. Our involvement in securities litigation will subject us to substantial costs, divert resources and the attention of management from our core business and may adversely affect our business.

Previous wording

Our Class B common stock has ten votes per share and our Class A common stock has one vote per share. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively have substantial control of the combined voting power of our common stock. Our amended and restated articles of incorporation provide that all Class B common stock will convert automatically into Class A common stock on December 22, 2035, unless converted prior to such date. As of September 30, 2025, stockholders who held shares of Class B common stock, including our executive officers, employees, and directors and their affiliates, together held approximately 49.5% of the voting power of our outstanding capital stock. This concentrated control limits or precludes your ability to influence corporate matters, as the holders of Class B common stock are able to influence or substantially control matters requiring approval by our stockholders, including the election of the directors, excluding the director we have designated as a Class A director, and the approval of mergers, acquisitions or other extraordinary transactions. Their interests may differ from yours and they may vote in a manner that is adverse to your interests. This ownership concentration may deter, delay or prevent a change of control of our company, deprive our stockholders of an opportunity to receive a premium for their common stock as part of a sale of our company and may ultimately affect the market price of our common stock. Furthermore, in connection with the dual class nature of our common stock, we have become subject to legal proceedings and could become involved in additional litigation, including securities class action claims and/or derivative litigation. Any such legal proceedings, regardless of outcome or merit, may divert management’s time and attention and may result in the incurrence of significant expense, including legal fees. For additional information regarding the pending legal proceedings, refer to “Item 1. Legal Proceedings.”

Current wording

Our Class B common stock has ten votes per share and our Class A common stock has one vote per share. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively have substantial control of the combined voting power of our common stock. Our amended and restated articles of incorporation provide that all Class B common stock will convert automatically into Class A common stock on December 22, 2035, unless converted prior to such date. As of March 31, 2026, stockholders who held shares of Class B common stock, including our executive officers, employees, and directors and their affiliates, together held approximately 50.2% of the voting power of our outstanding capital stock. This concentrated control limits or precludes your ability to influence corporate matters, as the holders of Class B common stock are able to influence or substantially control matters requiring approval by our stockholders, including the election of the directors, excluding the director we have designated as a Class A director, and the approval of mergers, acquisitions or other extraordinary transactions. Their interests may differ from yours and they may vote in a manner that is adverse to your interests. This ownership concentration may deter, delay or prevent a change of control of our company, deprive our stockholders of an opportunity to receive a premium for their common stock as part of a sale of our company and may ultimately affect the market price of our common stock. Furthermore, in connection with the dual class nature of our common stock, we have become subject to legal proceedings and could become involved in additional litigation, including securities class action claims and/or derivative litigation. Any such legal proceedings, regardless of outcome or merit, may divert management’s time and attention and may result in the incurrence of significant expense, including legal fees. For additional information regarding the pending legal proceedings, refer to Note 11—Commitments and Contingencies—Litigation.

Previous wording

The U.S. and non-U.S. tax laws applicable to our business activities are subject to interpretation and are changing. We are subject to audit by the Internal Revenue Service and by taxing authorities of the state, local and foreign jurisdictions in which we operate. Our tax obligations are based in part on our corporate operating structure, including the manner in which we develop, value, use and hold our intellectual property, the jurisdictions in which we operate, how tax authorities assess revenue-based taxes such as sales and use taxes, the scope of our international operations and the value we ascribe to our intercompany transactions. Taxing authorities may challenge, and have challenged, our tax positions and methodologies for valuing developed technology or intercompany arrangements, positions regarding the collection of sales and use taxes, and the jurisdictions in which we are subject to taxes, which could expose us to additional taxes. Any adverse outcomes of such challenges to our tax positions could result in additional taxes for prior periods, interest and penalties, as well as higher future taxes. In addition, our future tax expense could increase as a result of changes in tax laws, regulations or accounting principles, or as a result of earning income in jurisdictions that have higher tax rates. For example, the European Commission has proposed, and various jurisdictions, including a number of states in the United States, are considering enacting or have enacted laws that impose separate taxes on specified digital services, which may increase our tax obligations in such jurisdictions. In addition, the Organization for Economic Cooperation and Development (“OECD”) announced an Inclusive Framework on Base Erosion and Profit Shifting, including Pillar Two Model Rules defining a global minimum tax, which calls for the taxation of large multinational corporations at a minimum rate of 15%. Further, on July 4, 2025, the United States enacted the One Big Beautiful Bill Act that changes or makes permanent certain tax laws for corporations. While the changes from these rules have not negatively impacted our financial condition or results of operations, they could increase our effective tax rate and cash tax payments in future periods. Any increase in our tax expense could have a negative effect on our financial condition and results of operations. Moreover, the determination of our provision for income taxes and other tax liabilities requires significant estimates and judgment by management, and the tax treatment of certain transactions is uncertain. Any changes, ambiguity, or uncertainty in taxing jurisdictions’ administrative interpretations, decisions, policies and positions, including, the position of taxing authorities with respect to revenue generated by reference to certain digital services, could also materially impact our income tax liabilities. Although we believe we will make reasonable estimates and judgments, the ultimate outcome…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The U.S. and non-U.S. tax laws applicable to our business activities are subject to interpretation and are changing. We are subject to audit by the Internal Revenue Service and by taxing authorities of the state, local and foreign jurisdictions in which we operate. Our tax obligations are based in part on our corporate operating structure, including the manner in which we develop, value, use and hold our intellectual property, the jurisdictions in which we operate, how tax authorities assess revenue-based taxes such as sales and use taxes, the scope of our international operations and the value we ascribe to our intercompany transactions. Taxing authorities may challenge, and have challenged, our tax positions and methodologies for valuing developed technology or intercompany arrangements, positions regarding the collection of sales and use taxes, and the jurisdictions in which we are subject to taxes, which could expose us to additional taxes. Any adverse outcomes of such challenges to our tax positions could result in additional taxes for prior periods, interest and penalties, as well as higher future taxes. In addition, our future tax expense could increase as a result of changes in tax laws, regulations or accounting principles, or as a result of earning income in jurisdictions that have higher tax rates. For example, the European Commission has proposed, and various jurisdictions, including a number of states in the United States, are considering enacting or have enacted laws that impose separate taxes on specified digital services, which may increase our tax obligations in such jurisdictions. In addition, the Organization for Economic Cooperation and Development announced an Inclusive Framework on Base Erosion and Profit Shifting, including Pillar Two Model Rules defining a global minimum tax, which calls for the taxation of large multinational corporations at a minimum rate of 15%. Further, on July 4, 2025, the United States enacted the One Big Beautiful Bill Act that changes or makes permanent certain tax laws for corporations. While the changes from these rules have not negatively impacted our financial condition or results of operations, they could increase our effective tax rate and cash tax payments in future periods. Any increase in our tax expense could have a negative effect on our financial condition and results of operations. Moreover, the determination of our provision for income taxes and other tax liabilities requires significant estimates and judgment by management, and the tax treatment of certain transactions is uncertain. Any changes, ambiguity, or uncertainty in taxing jurisdictions’ administrative interpretations, decisions, policies and positions, including, the position of taxing authorities with respect to revenue generated by reference to certain digital services, could also materially impact our income tax liabilities. Although we believe we will make reasonable estimates and judgments, the ultimate outcome of any p…

Excerpt shortened here; the source contains the full paragraph.