MediaAlpha, Inc.

Current report

Our business is highly subject to business cycles and risks related to the property & casualty insurance, health insurance, and life insurance industries.

Current report

We derive a substantial majority of our revenue from sales of Consumer Referrals to property & casualty insurance carriers, health insurance carriers and brokers, and life insurance carriers. Revenue from our insurance verticals accounted for 99.4% and 98.0% of our total revenue for the three months ended March 31, 2025 and 2024, respectively, and 99.0% and 96.6% of our total revenue for the years ended December 31, 2024 and 2023, respectively. If insurance carriers experience large or unexpected losses through the offering of insurance, these carriers may choose to decrease the amount of money they spend on customer acquisition, including with us. These insurance markets, most notably the automobile insurance industry, have historically been cyclical in nature. These cycles are often characterized by periods of “soft” market conditions, when carriers’ loss ratios are relatively low and they tend to focus on investing to acquire customers and build market share, and “hard” market conditions, when their loss ratios are relatively high and they tend to prioritize profitability over growth and reduce their customer acquisition spending until they can obtain regulatory approval to raise premiums. As our insurance carrier partners go through these market cycles, our Demand Partners may increase or decrease their spending on Customer Referrals on our platform. These changes in spending may occur rapidly and without warning, and the duration of these market cycles can be difficult to predict accurately. Reductions in spending can have a material adverse impact on our operating results, causing them to fall short of the expectations of investors and securities analysts. For example, in the third quarter of 2021, many automobile insurers began to reduce their customer acquisition spending sharply in response to higher-than-expected loss ratios resulting from higher accident severity and increased repair costs due to global supply chain issues, and those reductions continued and in many cases worsened during 2022 and 2023 before beginning to recover in 2024. We will likely experience such insurance industry cycles again in the future, which could materially and adversely affect our business, financial condition, operating results, cash flows, and prospects. In 2025, the U.S. government has implemented new import tariffs and increases in existing tariff rates on imported automobiles and automobile parts, and may implement additional new tariffs or tariff increases in the future. These tariffs could cause a significant increase in the costs of imported automobile parts, as well as the costs of new and used automobiles, which are used for calculating loss payments by insurance carriers. These cost increases may increase automobile insurance claim costs and carrier loss ratios, which could result in a resumption of hard market conditions and a reduction in carrier spending on Consumer Referrals on our platform, which would materially and adversely affect our b…

Excerpt shortened here; the source contains the full paragraph.

Previous report

We are no longer a “controlled company” within the meaning of the NYSE rules. However, we may continue to rely on exemptions from certain corporate governance requirements during a one-year transition period.

Previous report

We are no longer a “controlled company” within the meaning of the NYSE corporate governance standards. The NYSE rules require that the nominating and corporate governance committee be composed entirely of independent directors within one year of the date that we no longer qualify as a “controlled company.” Our nominating and corporate governance committee is not currently comprised exclusively of independent directors. We will comply with this requirement prior to the end of the transition period, but until that occurs our shareholders will not have the same protections afforded to stockholders of companies that are subject to all of the corporate governance requirements of the NYSE. Furthermore, a change in our board of directors and committee membership may result in a change in our operation philosophies and deviations from our current corporate strategy.

Previous report

Operating and growing our business may require additional capital, and if capital is not available to us, our business, financial condition, operating results, cash flows, and prospects may suffer.

Previous report

Operating and growing our business is expected to require further investments in our technology and operations. We may be presented with opportunities that we want to pursue, and unforeseen challenges may present themselves, any of which could cause us to require additional capital beyond our internally generated cash flows. At any given time, if our cash needs exceed our expectations or we experience rapid growth, we could experience strain in our cash flow, which could adversely affect our operations in the event we were unable to obtain other sources of liquidity. As described in “Part I Item 1—Note 5—Commitments and Contingencies—Litigation and other matters” (the “FTC Matter”), the staff of the FTC that has been investigating the Company (the “FTC Staff”) has advised that they are considering recommending that the FTC pursue claims against us in connection with our business activities in the Healthcare vertical. In the event of an adverse outcome, we may not have adequate existing resources to cover any required material monetary relief and/or civil penalties imposed in connection with the FTC Matter, and may also not be able to obtain other sources of liquidity sufficient to cover such costs.

Previous report

If we raise additional funds through future issuances of equity or convertible debt securities, our stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock. Any debt financing that we may secure in the future could involve debt service obligations and restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities. If we are unable to obtain adequate financing or financing on terms satisfactory to us, when we require it, our ability to continue to pursue our business objectives and to respond to business opportunities, challenges or unforeseen circumstances could be significantly limited, and our business, financial condition, operating results, cash flows, and prospects could be materially and adversely affected.

Previous report

We may from time to time be subject to litigation, which may be extremely costly to defend, could result in substantial judgment or settlement costs or subject us to other remedies.

Previous report

We have in the past and may from time to time in the future be involved in various legal proceedings, including, but not limited to, actions relating to claims of violations of laws or regulations, breach of contract, and intellectual property infringement, misappropriation or other violation. In addition to the FTC matter, there are other sources of litigation risk. For example, insurance regulators have in the past and may in the future make claims that certain of our proprietary properties, particularly in our health insurance vertical, do not comply with one or more regulations governing marketing of insurance products in that state. Claims may be expensive to defend, may divert management’s time away from our operations, and may affect the availability and premiums of our liability insurance coverage, regardless of whether they are meritorious or ultimately lead to a judgment against us. We cannot assure you that we will be able to successfully defend or resolve any current or future litigation matters, in which case those litigation matters could have a material and adverse effect on our business, financial condition, operating results, cash flows, and prospects.

Previous report

Sellers, vendors, or their respective affiliates may engage in unauthorized or unlawful acts that could subject us to significant liability or cause us to lose demand partners and revenue.

Previous report

We generate a majority of our Consumer Referrals from online media that we source directly from our supply partners’ websites, as well as indirectly from the affiliates of our supply partners. We also rely on third-party call centers and email marketers. Although we require third parties with whom we contract to agree to comply with applicable law and regulation and endeavor to monitor and enforce these requirements, we ultimately cannot control the activities of third parties with whom we directly contract or who otherwise play a role in the generation, sale or purchase of our Consumer Referrals. Therefore, our programs and requirements to ensure compliance by these direct or indirect third parties may not be successful. In the past, we have identified and taken action to address instances of noncompliance with law, regulation or our code of conduct by these third parties, and while our compliance program is designed to detect, prevent and stop such noncompliance, our compliance efforts may not be successful.

Previous report

Some of these third parties, vendors, and their respective affiliates are authorized to use our demand partners’ brands, subject to contractual restrictions. Any activity by suppliers, vendors, or their respective affiliates which violates the marketing guidelines of our demand partners or that our demand partners view as potentially damaging to their brands, whether or not permitted by our contracts with our demand partners, could harm our relationships and cause demand partners to terminate their relationship with us, resulting in a loss of revenue. Moreover, because we do not have a direct contractual relationship with the affiliates of our suppliers, we may not be able to monitor the compliance activity of such affiliates. If we are unable to cause our Supply Partners to monitor and enforce our Demand Partners’ contractual restrictions on such affiliates, our Demand Partners may terminate their relationships with us or decrease their customer acquisition budgets with us. In addition, we may also face liability for any failure of our suppliers, vendors or their respective affiliates to comply with regulatory requirements (including, for example, in connection with the FTC Matter).

Previous report

The law is unsettled on the extent of liability that an advertiser has for the activities of sellers or vendors. Insurance regulations may impose liability on us and our Demand Partners for misrepresentations made by their marketing service providers. In addition, certain of our contracts impose liability on us, including indemnification obligations, for the acts of our sellers or vendors. We could be subject to costly litigation and, if we are unsuccessful in defending ourselves or in obtaining indemnity from our vendors, we could incur damages for the unauthorized or unlawful acts of sellers or vendors.

Previous report

The FTC Matter could have a material adverse effect on our business.

Previous report

On February 21, 2023, we received a civil investigative demand from the Federal Trade Commission (FTC) regarding compliance with the FTC Act and the Telemarketing Sales Rule, as they relate to the advertising, marketing, promotion, offering for sale, or sale of healthcare-related products, the collection, sale, transfer or provision to third parties of consumer data, telemarketing practices, and/or consumer privacy or data security. On October 30, 2024, following our earnings call, we received an initial settlement demand from the staff of the FTC (the “FTC Staff”) stating that the FTC Staff is prepared to recommend that the FTC approve the filing of a complaint against the Company for violations of Section 5(a) of the FTC Act, the FTC’s Telemarketing Sales Rule ("TSR") and the Government and Business Impersonation Rule (the “Impersonation Rule”).

Previous report

The FTC Staff alleges that, in connection with our lead generation and telemarketing activities, we have represented ourselves as affiliated with government entities, made misleading claims (in particular regarding health insurance products and our use of consumers’ personal information) and utilized deceptive advertising, in violation of Section 5(a) of the FTC Act. The FTC Staff further alleges that we have violated the Impersonation Rule in representing ourselves to be affiliated with government entities and the TSR in connection with telemarketing activities.

Previous report

The FTC Staff proposes to seek injunctive and monetary relief and civil penalties. If obtained in whole or in part, the monetary relief and penalties proposed by the FTC Staff would have an adverse, and potentially material, effect on our liquidity, financial condition, and results of operations. The total amount of these proposed items significantly exceeds our existing liquidity and financial resources. Any such costs above our existing resources would require the Company to seek additional capital, incur debt or otherwise take significant actions in order to satisfy the claims, and there can be no assurances that such financing could be obtained on acceptable terms, or at all. In addition, the proposed injunctive terms, if obtained in whole or in part, could adversely, and potentially materially, affect our ability to operate business in our Health insurance vertical, including by restricting how we conduct our marketing activities and by requiring enhancements to our compliance program.

Previous report

Changes in laws or regulations relating to privacy, data protection or the protection or transfer of personal data could materially and adversely affect our business, financial condition, operating results, cash flows, and prospects.

Previous report

We are subject to a variety of federal, state, local, and international laws, directives, and regulations, as well as contractual obligations, relating to privacy and the collection, protection, use, retention, security, disclosure, transfer, and other processing of personal information and other data, including the California Online Privacy Protection Act, the California Consumer Privacy Act (the “CCPA”), the California Privacy Rights Act (the “CPRA”) and other state privacy laws, the Personal Information Protection and Electronic Documents Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act (the “CAN-SPAM Act”), Canada’s Anti-Spam Law, the Telephone Consumer Protection Act of 1991 (the “TCPA”), the U.S. Federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Section 5(c) of the Federal Trade Commission Act, the TSR, the EU’s General Data Protection Regulation, supplemented by national laws (such as, in the United Kingdom, the Data Protection Act 2018) and further implemented through binding guidance from the European Data Protection Board. These laws, rules and regulations evolve frequently and their scope may continually change, through new, or amendments to existing, legislation or regulations and changes in enforcement, and may be inconsistent from one jurisdiction to another. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. Although we endeavor to comply with our published policies and documentation and ensure their compliance with current laws, rules and regulations, we (and other parties with whom we do business) may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policy and other documentation that provide promises and assurances about privacy and security can subject us to potential state and federal action in the U.S. if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Any failure by us or other parties with whom we do business to comply with this documentation or with federal, state, local or international regulations could result in proceedings against us by governmental entities, private parties or others (including, without limitation, the FTC Matter, where the FTC Staff has alleged that certain of our conduct and business practices violate Section 5(a) of the FTC Act and the TSR). In many jurisdictions, enforcement actions and consequences for non-compliance are rising.

Previous report

In the U.S., these include enforcement actions in response to rules and regulations promulgated under the authority of federal agencies and state attorneys general and legislatures and consumer protection agencies. A number of federal and state laws and regulations relating to privacy affect and apply to the insurance industry specifically, including those imposed by the New York Department of Financial Services. In addition, privacy advocates and industry groups have proposed and may propose new and different self-regulatory standards that either legally or contractually apply to us. If we fail to follow these security standards even if no customer information is compromised, we may incur significant fines or experience a significant increase in costs.

Previous report

Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal framework with which we or our customers must comply, including, but not limited to the EU. Complying with these regulations may cause us to incur substantial operational costs or require us to change our business practices. Despite our efforts, we may not be successful in our efforts to achieve compliance either due to internal or external factors such as resource allocation limitations or a lack of vendor cooperation. Non-compliance could result in proceedings against us by governmental entities, customers, data subjects or others. We may also experience difficulty retaining or obtaining new European or multi-national customers due to the legal requirements, compliance cost, potential risk exposure, and uncertainty for these entities, and we may experience significantly increased liability with respect to these customers pursuant to the terms set forth in our engagements with them.

Previous report

Domestic laws in this area are also complex and developing rapidly. Many state legislatures have adopted or are currently considering legislation that regulates how businesses operate online, including measures relating to privacy, data security, and data breaches. Laws in all 50 states require businesses to provide notice to customers whose personally identifiable information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly. States are also frequently amending existing laws, requiring attention to frequently changing regulatory requirements. For example, the CCPA, among other things, requires new disclosures to California consumers and affords such consumers new abilities to access and delete their personal information, opt-out of certain sales of personal information and receive detailed information about how their personal information is used. The CCPA provides for fines of up to $7,500 per violation, as well as a private right of action for data breaches that is expected to increase the frequency of data breach litigation. While the CCPA has already been amended multiple times, it is unclear how this legislation will be further modified or how it will be interpreted. The effects of this legislation potentially are far-reaching, however, and may require us to modify our data processing practices and policies and incur substantial compliance-related costs and expenses. Additionally, the CPRA, which became effective in most material respects on January 1, 2023, modifies the CCPA significantly, including by expanding consumers’ rights with respect to certain sensitive personal information and creating a new state agency to oversee implementation and enforcement efforts, which may result in further uncertainty and require us to incur additional costs and expenses in an effort to comply. The CCPA, CPRA and other changes in laws or regulations relating to privacy, data protection and information security, particularly any new or modified laws or regulations that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer or disclosure, could greatly increase the cost of providing our offerings, require significant changes to our operations or even prevent us from providing certain offerings in jurisdictions in which we currently operate and in which we may operate in the future.

Previous report

Further, as we continue to expand our platform offerings and user base, we may become subject to additional privacy-related laws and regulations. For example, the collection and storage of healthcare data by health insurance carriers subject them to compliance requirements under HIPAA. HIPAA and its implementing regulations contain substantial restrictions and requirements regarding the use, collection, security, storage, and disclosure of individuals’ protected health information. In 2009, HIPAA was amended by the HITECH Act to impose certain of HIPAA’s privacy and security requirements directly upon business associates of covered entities. Health insurance carriers are covered entities under HIPAA. In the event we are deemed to be a business associate of such carriers, we may be bound by compliance obligations under HIPAA, including security breach notification obligations, and subject to increased liability as a possible liable party. In such instance, if we knowingly breach the HITECH Act’s requirements, we could be exposed to criminal liability. A breach of our safeguards and processes could expose us to civil penalties up to $1.5 million for identical incidences and the possibility of civil litigation.

Previous report

Additionally, we have incurred, and may continue to incur, significant expenses in an effort to comply with privacy, data protection and information security standards and protocols imposed by law, regulation, industry standards or contractual obligations. Despite our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection, and information security, it is possible that our practices, offerings or platform could be inconsistent with, or fail or be alleged to fail to meet all requirements of, such laws, regulations or obligations. Our failure, or the failure by our third-party providers or partners, to comply with applicable laws or regulations or any other obligations relating to privacy, data protection or information security, or any compromise of security that results in unauthorized access to, or use or release of personally identifiable information or other data, or the perception that any of the foregoing types of failure or compromise has occurred, could damage our reputation, discourage new and existing partners from using our platform, delay planned uses, and disclosures of data or result in fines or proceedings by governmental agencies and private claims and litigation, any of which could materially and adversely affect our business, financial condition, operating results, cash flows, and prospects. Even if not subject to legal challenge, the perception of privacy concerns, whether or not valid, may harm our reputation and brand and materially and adversely affect our business, financial condition, operating results, cash flows, and prospects.

Previous report

Our and our partners’ communications with potential and existing consumers are subject to laws regulating telephone and email marketing practices.

Previous report

We and our partners make telephone calls and send emails and text messages to potential and existing consumers, which are subject to various state and federal laws regulating telemarketing communications (including SMS or text messaging), including the TCPA and TSR. In connection with the FTC Matter, the staff of the FTC has alleged that we have violated the TSR.

Previous report

The TCPA prohibits companies from making telemarketing calls using an automated telephone dialing system (ATDS) or artificial or prerecorded voice technology (collectively, “robocalls”), or to numbers listed in the Federal Do-Not-Call Registry, and imposes other obligations and limitations on making phone calls and sending text messages to consumers, in either case without the prior consent of the consumer. The TSR prohibits robocalls unless the caller has obtained prior express written consent directly from the consumer following clear and conspicuous disclosure. The CAN-SPAM Act regulates commercial email messages and specifies penalties for the transmission of commercial email messages that do not comply with certain requirements, such as providing an opt-out mechanism for stopping future emails from senders. Failure of our partners to comply with these and similar laws, rules and regulations may subject us to claims by regulatory authorities and/or private plaintiffs. However, because our Supply Partners may acquire Consumer Referrals from third-party suppliers, and our Demand Partners may resell Consumer Referrals to third-party advertisers, with whom we do not have direct contractual relationships, we may not be able to monitor their compliance activity effectively. Our failure to comply with obligations and restrictions related to telephone, text message, and email marketing, or similar failures by our Supply Partners or Demand Partners (or third parties with whom they work), could subject us and them to lawsuits, fines, statutory damages, consent decrees, injunctions, adverse publicity, and other losses that could harm, directly or indirectly, our business, financial condition, operating results, cash flows, and prospects.

Previous report

The laws and regulations governing the use of emails and telephone calls for marketing purposes continue to evolve, and changes in technology, the industry, regulatory priorities or consumer preferences may lead to the adoption of additional laws or regulations or changes in the manner in which existing laws and regulations are interpreted or enforced, which could have a material adverse effect on our business.

Previous report

For example, in 2023 the FTC started taking a new position (in public statements and enforcement actions) that consent to receive robocalls under the TSR must be received directly from the consumer, rather than through a third party such as a lead generator, and it appears that the staff of the FTC continues to assert this position in relation to the FTC Matter. In addition, in December 2023, the FCC adopted new rules which, among other things, amend the consent requirements of the TCPA to require that prior express written consent to receive robocalls made for telemarketing purposes may only be given to one caller at a time, and that such robocalls be “logically and topically associated” with the interaction that prompted the consent. The new rules will be effective starting January 27, 2025, and will further restrict our and our partners’ ability to contact potential and existing consumers by phone and text, as well as subject us and our partners to increased costs, technological compliance challenges and additional legal risks, including potential liabilities or claims relating to compliance. This may have an adverse impact on the demand for leads and calls by Demand Partners and the ability of Supply Partners to generate such leads on a cost-effective basis. A reduction in the volume of leads and calls supplied to our marketplaces, or a reduction in the ability of our owned and operated lead generation websites to generate such leads and calls profitably, could harm our business, financial condition, operating results, cash flows, and prospects. In addition, the new rules could increase the risk of claims made against us or our partners by private plaintiffs alleging violations of the TCPA, which could have a material and adverse effect on our business, financial condition, operating results, cash flows, and prospects.