ITEM 1A. RISK FACTORS
Investing in our common stock involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information in this Annual Report on Form 10-K, including our consolidated financial statements and related notes, before making an investment decision. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that affect us. If any of the following risks materializes, our business, financial condition, results of operations, and prospects could be materially harmed, which could cause the price of our Class A common stock to decline, and cause any investment in our Class A common stock to lose some or all of its value.
Risks Related to Our Business, Results of Operations and Growth
Our revenue and results of operations are highly dependent on the overall demand for advertising.
Our business depends on the overall demand for advertising and on the economic health of our current and prospective publishers and buyers. In recent years, macroeconomic factors such as general economic volatility, recessionary fears, inflation, volatile interest rates and softening demand in certain verticals caused some advertisers to reduce their advertising budgets. Such macroeconomic factors, as well as broader economic downturns, recessions, transnational trade wars or disruptions, inflation, further volatility in interest rates or foreign exchange rates or any supply chain disruptions, changes in the tax treatment of advertising expenses, or general financial uncertainty in North America, Europe, and Asia, where we do most of our business; could adversely affect our business, results of operations, and financial condition. In addition, the conflict in Ukraine and the resumption of the conflict in Israel could cause unpredictable economic effects in Europe and EMEA, including potentially softening general consumer demand. Such conflicts may increase costs of labor and other items impacting our cost of revenue, and these factors and potential others may do so in the future. Reductions in overall advertising spending due to these factors or other factors could make it difficult to predict our revenue and could adversely affect our business, results of operations, and financial condition.
If our existing customers do not expand their usage of our platform, or if we fail to attract new customers, our growth will suffer. Moreover, any decrease in the use of the advertising channels or formats that we primarily depend on, or failure to expand into emerging channels or formats, could adversely affect our business, results of operations, and financial condition.
We depend upon our buyer and publisher relationships, including channel partners, which aggregate large numbers of smaller publishers, to provide advertising space which we can offer to prospective buyers to continue to grow the usage of our platform. In doing so, we compete for both supply and demand with larger, well-established companies that may have technological or other advantages stemming from their broader experience in the market. We must continue to adapt and improve our technology to compete effectively, and customers have not always embraced our offerings due to various factors, including switching costs from moving away from pre-existing technology integrations, such as already implemented header bidding wrappers, and lack of awareness of our omnichannel offerings. Although we believe we provide superior transparency and accountability to such competitors, certain customers may make technological or financial demands that we are unable or unwilling to meet. These and other factors may make it difficult for us to increase our business with our publishers and buyers, cause some buyers to reduce their spending with us, or increase our costs of doing business, which could affect our business, results of operations, and financial condition.
We generally do not have minimum commitments from publishers. As a result, the amount, quality, and cost of ad impressions available to us can change at any time with little or no prior notice, and we cannot assure you that we will have access to a consistent volume or quality of ad impressions at a reasonable cost, or at all. We depend upon a relatively small number of premium publishers and channel partners and expect to continue to do so for the foreseeable future. To support our continued growth, we seek to add additional publishers and buyers to our platform and to expand current utilization with our existing publishers and buyers. Any disruptions in our relationships with premium publishers, buyers, or our largest channel partners could adversely affect our business, results of operations, and financial condition. If we cannot retain or add individual publishers with valuable ad impressions, or if such publishers decide not to make their valuable ad impressions available to us, then our buyers may be less inclined to use our platform, which could adversely affect our business, results of operations, and financial condition.
Table of Contents
A limited number of large demand side platforms (“DSPs”) – The Trade Desk and Google DV360 in particular – account for a significant portion of the ad impressions purchased on our platform. We depend upon these DSPs for a large percentage of impressions purchased and expect to do so for the foreseeable future. We have no minimum commitments from buyers to spend on our platform, so the amount of demand available to us can change at any time with little or no prior notice, and we cannot provide assurance that we will have access to a consistent volume or quality of ad campaigns or demand for our ad impressions at a reasonable price, or at all. Any disruptions in our relationships with DSPs, agencies, advertisers, or buyers could adversely affect our business, results of operations, and financial condition. If a buyer or group of buyers representing a significant portion of the demand in our marketplace decides to materially reduce use of our platform, it could cause an immediate and significant decline in our revenue and profitability and adversely affect our business, results of operations, and financial condition. In addition, our business results, including revenues, may be impacted by changes in their pricing strategies, bidding algorithms, or go-to-market efforts.
Historically, our buyers have predominantly used our platform to purchase mobile, display, and video advertising inventory from our publishers. We expect that these will continue to be significant channels used by our customers for digital advertising in the future. We also believe that our revenue growth may depend on our ability to expand within mobile, video, and in particular, CTV, and we are continuing to enhance such channels. We believe our ability to incorporate Artificial Intelligence, or “AI”, and specifically agentic AI, into our new and existing products will also be a key factor to encourage expanded use of our platform. We may not be able to accurately predict changes in overall advertiser demand for the channels in which we operate and cannot assure you that our investment in formats will correspond to any such changes or shifts in demand. Any decrease in the use of mobile, display, and video advertising, whether due to customers losing confidence in the value or effectiveness of such channels, regulatory restrictions or other causes, or any inability to further penetrate CTV or enter new and emerging advertising channels, could adversely affect our business, results of operations, and financial condition.
Our results of operations may fluctuate significantly and may not meet our expectations or those of securities analysts and investors.
We operate in an evolving industry with ever-changing customer needs and behavior, and, as a result, our business has evolved over time such that our operating history makes it difficult to evaluate our business and future prospects. Our results of operations have fluctuated in the past, and future results of operations are likely to fluctuate as well. Although we have experienced periods of prolonged revenue growth, we may not be able to sustain a consistent growth rate, current revenue levels, or profitability. In addition, because our business is evolving, our historical results of operations may be of limited utility in assessing our future prospects. We expect to face challenges, risks, and difficulties frequently experienced by growing companies in rapidly developing industries, including those relating to:
• changes in demand and pricing for ad impressions sold on our platform;
• changes in our access to valuable ad impressions from publishers;
• responding to evolving industry standards and government regulations that impact our business, particularly in the areas of data protection and consumer privacy;
• developing, maintaining, and expanding relationships with publishers, DSPs, agencies, advertisers, and buyers;
• seasonality in our business;
• changes in demand due to real or perceived economic stagnation or recession in certain markets;
• innovating and developing new solutions that are adopted by and meet the needs of publishers, DSPs, agencies, advertisers, and buyers;
• competing against companies with a larger customer base or greater financial or technical resources;
• changes in the structure of the buying and selling of ad impressions;
• changes in demand for certain formats of ad impressions;
• changes in the pricing policies of publishers and competitors;
• changes in the bidding behavior of buyers of ad impressions;
• changes in demand due to changes in macroeconomic environment, including as a result of an economic downturn, recession, inflation, volatility in interest rates or foreign exchange rates, disruptions to supply chains, disruptions to global trade, or otherwise;
Table of Contents
• further expanding our business internationally; and
• recruiting, integrating, and retaining qualified and motivated employees, particularly engineers.
Any one or more of the factors above may result in significant fluctuations in our results of operations. Past results should not be relied upon as an indicator of our future performance.
Because many of our expenses are based upon forecasted demand and may be difficult to reduce in the short term, volatility in quarterly revenue could cause significant variations in quarterly results of operations. We may not forecast our revenue or expenses accurately, causing our results of operations to diverge from our estimates or the expectations of securities analysts and investors. If we fail to meet or exceed such expectations for these or any other reasons, the trading price of our Class A common stock could fall, and we could face costly litigation, including securities class action lawsuits.
If we fail to make the right investment decisions in our platform, or if we fail to innovate and develop new solutions that are adopted by customers, we may not attract and retain customers, which could adversely affect our business, results of operations, and financial condition.
We face intense competition in the marketplace and are confronted by rapidly changing technology and artificial intelligence, evolving industry standards and consumer preferences, regulatory changes, and the frequent introduction of new solutions by our competitors that we must adapt and respond to. The pace of technological disruption in digital advertising is accelerating, and our ability to keep pace with or stay ahead of these changes is critical to our competitive position. We need to continuously update our platform and the technology we invest in and develop, including our machine learning and other proprietary algorithms, in order to attract customers and keep ahead of changes in technology, evolving industry standards and a rapidly changing regulatory environment.
Our platform is complex and new solutions can require a significant investment of time and resources to develop, test, introduce, and enhance. These activities can take longer than we expect and may require the hiring of employees or contractors with new skill sets, which we may not be able to do in a cost-effective manner or at all. In an environment where competitors and market expectations move quickly, delays in product development or feature delivery, or missteps in product launches, can have outsized negative effects that compound over time as customers shift spend to alternative platforms.
Moreover, we may not make the right decisions regarding these investments, and new product or feature launches may fail to meet partner expectations, resulting in reduced adoption, loss of customer confidence, and adverse impact on our results. For example, we have launched Activate and Commerce Media products to address evolving market opportunities. Additionally, newer formats and channels, such as mobile header bidding and CTV, present unique challenges that we must address to succeed. Our success in new formats and channels depends upon our ability to integrate our platform with these new formats and channels. If we fall behind in this rapidly evolving environment, the effects may be difficult to reverse, as customers, publishers, and buyers may establish relationships with competitors that are challenging to displace. If our mobile, video, or CTV solutions are not widely adopted by publishers and buyers, we may not retain such publishers and buyers. In addition, new demands from customers, offerings by competitors, changes in technology or format, or new industry standards or regulatory requirements could render our platform or our existing solutions less and require us to make changes to our platform or business model. Our to adapt to a rapidly changing market and regulatory environment, anticipate demand, or attract and retain customers would cause our revenue or revenue growth rate to , and affect our business, results of operations, and financial condition.
Our increasing reliance on artificial intelligence to operate our platform and differentiate our offerings creates new operational, competitive, and execution risks that may be difficult to predict or manage.
Our business has evolved from a traditional programmatic advertising exchange toward an AI-powered platform in which machine learning algorithms, generative AI, and agentic workflows are increasingly embedded in our core operations and commercial offerings. We describe ourselves as an “AI-powered advertising technology company” and have made AI a central element of our competitive positioning and growth strategy. Our AI capabilities now influence or automate a range of functions that affect customer outcomes, including real-time bid pricing, yield optimization through products such as Intelligent Yield, fraud detection, traffic shaping, demand allocation, and the planning and activation workflows available through our buyer and publisher platforms. While our revenue is not yet heavily dependent on AI-specific products, we expect AI to become an increasingly material contributor to our platform's value proposition, competitive differentiation, and revenue over time.
Table of Contents
As AI becomes more deeply embedded in our operations, errors, underperformance, or unintended behavior in our AI systems could directly reduce publisher yields, misallocate advertiser spend, or degrade auction efficiency, any of which could damage customer relationships and reduce platform utilization. Because AI model performance depends on the volume, quality, and diversity of the data on which models are trained, any reduction in the data available to us, whether due to privacy regulations, customer restrictions on data sharing, or competitive dynamics, could degrade the effectiveness of our AI capabilities relative to competitors with larger or more proprietary data sets. If our AI capabilities fail to deliver the performance improvements we and our customers expect, or if we are unable to develop and deploy AI-driven features at the pace required to remain competitive, customers may choose alternative platforms, which could adversely affect our business, results of operations, and financial condition.
Our investments in AI may not produce the competitive advantages we expect. We have committed meaningful engineering and infrastructure resources to AI product development, including Intelligent Yield, AI Insights, and agentic workflow capabilities. These investments may not achieve the adoption, performance, or margin contribution we anticipate, and may divert resources from other product development priorities that could have generated more immediate returns. The transition from a primarily transaction-processing business model to one in which AI-powered capabilities are a principal driver of competitive differentiation also introduces operational complexity and execution risk. Maintaining, updating, and scaling AI models requires specialized engineering talent and infrastructure capabilities, including access to GPU and other accelerated computing resources that are subject to market constraints and rising demand across industries. Our historical operating results, which were generated in a period when our business was primarily defined by programmatic header bidding and auction exchange services, may be of limited value in predicting our future performance as AI-driven products and workflows become a larger component of our business.
If we are unable to develop, deploy, and maintain AI capabilities that meet the evolving expectations of publishers and buyers, our business, results of operations, and financial condition could be materially and adversely affected.
The adoption of artificial intelligence by our customers, competitors, and other market participants may alter the competitive dynamics of the digital advertising ecosystem in ways that reduce demand for our platform or diminish our competitive position.
AI-driven platforms operated by large technology companies with closed ecosystems, extensive first-party data, and direct consumer relationships may capture an increasing share of advertising spend by offering AI-powered targeting, optimization, and measurement capabilities that reduce advertiser reliance on the open internet. AI-powered “zero-click” discovery environments and conversational assistants may reduce the volume of traditional web traffic and referral-based content consumption that currently supports programmatic advertising. If consumer engagement increasingly shifts to AI-mediated surfaces that do not generate conventional ad impressions or that operate outside of established programmatic transaction models, the addressable market for our platform could contract. These dynamics could disproportionately affect independent sell-side platforms like ours that depend on the health of the open internet advertising ecosystem.
The anticipated emergence of agentic buying, in which advertisers and agencies deploy AI agents to plan, negotiate, and execute media purchases with reduced human oversight, may also disrupt established demand patterns over time. While adoption of agentic buying remains in early stages across the industry, and we are actively investing in capabilities and industry standards to support it, including contributing to the development of the IAB Tech Lab’s Ad Creative Protocol (“AdCP”), there is no assurance that these efforts will position us favorably as AI-driven buying matures. AI buying agents, once widely deployed, may optimize spend toward platforms or inventory sources that offer the lowest cost or highest predicted performance, which could increase pricing pressure and diminish the value of our existing customer relationships and SPO agreements. These agents may prioritize direct publisher integrations, closed-loop measurement environments, or alternative transaction protocols over traditional SSP intermediation. The standards governing agent-based advertising transactions are still being defined and may evolve in ways that do not favor our platform architecture or business model.
Publishers, buyers, and other participants in the digital advertising supply chain are also independently developing and deploying their own AI capabilities. Publishers may use AI to optimize yield, manage demand relationships, or execute transactions without intermediaries, reducing their reliance on our platform. Buyers may develop proprietary AI-driven media planning and execution tools that bypass sell-side platforms or that concentrate spend with a smaller number of preferred partners. Competitors with greater financial or technical resources, or with access to larger proprietary data sets, may deploy AI capabilities that are superior to ours or that achieve greater market adoption. New market entrants that build AI-native advertising platforms from the ground up, unburdened by legacy infrastructure or business models, may be able to compete effectively against established platforms like ours. If these trends accelerate and we are unable to position our platform as a preferred destination for AI-driven media execution, our market share, revenue, and results of operations could be adversely affected.
Table of Contents
If AI-driven changes in the competitive environment reduce the relevance of, or demand for, independent sell-side platforms, our business, results of operations, and financial condition could be materially and adversely affected.
We must scale our platform infrastructure to support anticipated growth and transaction volume. If we fail to do so, or doing so becomes too costly, we may limit our ability to process ad impressions, and we may lose revenue.
Our business depends on processing advertising impressions in milliseconds, and we must handle an increasingly large volume of such transactions. The demands on our platform infrastructure have increased over time due to, among other factors, the addition of new solutions, such as our Activate or Commerce Media offerings, the need to support evolving advertising formats, the handling and increased use of large amounts of data, support of AI-enabled offerings, and overall growth in impressions. Expanding our platform infrastructure and the number of ad impressions we can process requires resource commitment over a period of months or years, and we may not be able to scale quickly or efficiently enough if demand increases rapidly as short-term solutions may be too costly or unavailable. The increasing use of AI by consumers and businesses has also increased the cost to grow our infrastructure and secure colocation services on financially beneficial terms. If we are unable to grow our platform to support substantial increases in the number of transactions and in the amount of data we process, on a high-performance, cost-effective basis, or we are in growing our infrastructure compared to demand, our business, results of operations, and financial condition could be affected. We expect to continue to invest in our platform in order to meet these requirements, and that investment could affect our business, results of operations, and financial condition. Additionally, if we future usage of our platform, we may incur expense in adding infrastructure without a commensurate increase in revenue, which could affect our business, results of operations, and financial condition.
Our efforts to provide new or expanded offerings may not be successful, or we may not be able to scale our offerings to meet demand in a timely manner, and, as a result, we may not realize a return from our investments.
We believe there is significant and growing demand for our offerings and those we are developing, and we are making significant investments to meet that demand and grow our market share, including through the use of AI. That demand may not materialize and, even if it does, we may not be able to take advantage of that increased demand if we cannot scale our offerings in a timely manner or if the demand for one of our offerings cannibalizes the demand for another product we offer. In some cases, we have experienced fee pressure as we have built out our offerings, and we expect this fee pressure to increase as more competitors, including new entrants as well as publishers themselves, build their own technology and infrastructure to enter the markets in which we do business. Even if the market for these offerings develops as we anticipate, publishers and buyers might not embrace our offerings to the degree we expect due to various factors such as inertia from usage of existing implementations of competitive products or technological advances by our competitors. While continued investment in and use of our products has allowed us to achieve efficiencies, the investment cost to gain such efficiencies may grow over time, especially with our existing products which may be closer to technical and economic maturity, and the potential expansion of our business or offerings may increase regulatory of our company. Additionally, even if publishers and buyers embrace our new or expanded offerings, the effect of these new or expanded offerings on our results of operations may be offset or negated if such adoption cannibalizes business from our existing solutions, if we are to scale our offerings to keep up with demand, if we are to hire or retain personnel with the requisite skills and experience related to our new or expanded offerings, if publishers and buyers prefer similar offerings from our competitors, or by other developments.
Our litigation with Google LLC presents several risks to our business that could adversely affect our business, results of operations and financial condition.
On September 8, 2025, we filed a lawsuit against Google LLC ("Google"), seeking damages and injunctive relief in connection with Google's alleged anticompetitive behavior in the publisher ad server and ad exchange markets for open-web display (the "Google Lawsuit"). The Google Lawsuit followed an April 2025 ruling in a case brought against Google by the U.S. Department of Justice, where the U.S. District Court found that Google engaged in anticompetitive and monopolistic behavior in certain digital advertising markets.
Google is a significant participant in the digital advertising ecosystem and both a major partner and competitor to PubMatic. A material portion of our revenue is generated through our relationship with Google and the Google DV360 DSP. The Google Lawsuit is in its early stages, and the outcome and timing of the Google Lawsuit is uncertain and difficult to predict.
The Google Lawsuit presents several risks to our business, including the potential for retaliatory actions by Google. Such actions could include, but are not limited to, altering our access to their platforms, seeking to modify commercial terms between PubMatic and Google in a manner unfavorable to us, deprioritizing our services or offerings, or otherwise using their market position to negatively impact our operations. Any such actions could disrupt our ability to serve our customers and partners, reduce our revenue, and harm our relationships with publishers and advertisers.
Table of Contents
The Google Lawsuit may be costly, protracted, and divert management's attention and resources from our business operations. Any damages awarded may not be commensurate with our expectations, and we may not receive any monetary damages at all. The injunctive relief sought in the Google Lawsuit may not be granted, or may not be granted to the extent we have requested or in a manner that adequately protects us in the future. The existence of the Google Lawsuit and any potential retaliatory measures could also negatively affect our reputation and our ability to compete, potentially causing our business, financial condition, and results of operations to be materially and adversely affected.
Risk Related to Data Collection and the Use of Collected Data
The rejection of targeted advertising by consumers, through opt-in, opt-out or ad-blocking technologies or other means or the restriction on the use of third party-cookies, mobile advertising identifiers or other tracking technologies, could adversely affect our business, results of operations, and financial condition.
We use “cookies,” or small text files placed on consumer devices when an Internet browser is used, as well as mobile advertising identifiers, and other permitted tracking or contextual signals to gather data that enables our platform to better serve our customers. These signals do not identify consumers directly, but allow for our customers to provide us insight into factors , such as ad exposure, engagement, device characteristics, approximate location, and usage patterns that are used to improve relevance, measurement, and pricing efficiency. Publishers, buyers, third-party data providers, and partners may also choose to share their information about consumers’ interests or give us permission to use their cookies and mobile advertising identifiers. We then use this data to help advertisers decide whether to bid on, and how to price, an ad impression in a certain location, at a given time, for a particular consumer.
Without cookies, mobile advertising identifiers, and other tracking technology data, transactions processed through our platform would be executed with less insight into consumer preferences, reducing the precision of advertisers' decisions about which impressions to purchase for an advertising campaign. This could make advertising through our platform less valuable and decrease our revenue as advertising budgets may be decreased or directed to alternatives that are not exclusively reliant on cookies, mobile advertising identifiers, and other tracking technology data, or favor platforms that rely more heavily on first-party data, authenticated users, or closed ecosystems. If our ability to use cookies, mobile advertising identifiers or other tracking technologies is limited as a result of consumers rejecting targeted advertising, we may be required to develop or obtain additional applications and technologies to compensate for the lack of cookies, mobile advertising identifiers and other tracking technology data, which may not be available to us or could be time consuming or costly to develop, less effective than current services, and subject to additional regulation.
Additionally, consumers can, with increasing ease, implement technologies that limit our ability to collect and use data to deliver targeted advertisements or otherwise limit the effectiveness of our platform. Cookies may be deleted or blocked by consumers. The most commonly used Internet browsers allow consumers to modify their browser settings to block first-party cookies (placed directly by the publisher or website owner that the consumer intends to interact with) or third-party cookies (placed by parties, like us, that have no direct relationship with the consumer), and some browsers block third-party cookies by default, or implement browser-level or operating system level privacy controls (including global privacy control or similar mechanisms) that may restrict data collection or use, as a result of changes to a growing list of US state privacy laws.
Some consumers also download “ad blocking” software on their computers or mobile devices, not only for privacy reasons, but also to counteract the adverse effect advertisements can have on the consumer experience, including increased load times, data consumption, and screen overcrowding. Ad-blocking technologies and other global privacy controls may prevent some third-party cookies, or other tracking technologies, from being stored on a consumer's computer or mobile device. If more consumers adopt these measures, or more regulators mandate the use of specific controls, it could reduce the volume or effectiveness and value of targeted advertising, which could adversely affect our business, results of operations, and financial condition. In addition, some ad blocking technologies block only ads that are targeted through use of third-party data, while allowing ads based on first-party data (i.e., data owned by the publisher). These ad blockers could place us at a disadvantage relative to competitors with extensive first-party data assets, including companies that operate consumer-facing platforms. Even if ad blockers do not ultimately have an adverse effect on our business, investor concerns about ad blockers could cause our stock price to decline.
In mobile environments, advertising identifiers are governed by operating system‑level permission frameworks, and platform providers may modify or further restrict identifier access at their discretion. In emerging AI‑driven and “zero‑click” discovery environments, advertising may be delivered or measured through new mechanisms that reduce traditional referral traffic, alter attribution models, or require new forms of consent and governance. If we are unable to adapt our platform, measurement, and data‑governance capabilities to these evolving environments, our business, financial performance, and growth prospects could be adversely affected.
Table of Contents
The continued restriction, reduced utility, or future deprecation of tracking technologies, or the potential development of proprietary or closed alternatives to cookies, could adversely affect our business, results of operations, and financial condition.
Some prominent technology companies, including Google, previously announced intentions to discontinue the use of third-party cookies, and to develop alternative methods and mechanisms for targeting advertisements, though the expected timeline for such changes is difficult to predict and has changed over time. While Google announced in July 2024 that it was discontinuing plans to phase out cookies in its Chrome browser, large technology platforms and other market participants continue to invest in, promote, and expand the use of alternative identity solutions, including deterministic identifiers, proprietary identity graphs, and authenticated user‑based tracking methods. These approaches may rely on login credentials, first‑party data collected across multiple owned properties, or closed technical systems that enable tracking and targeting outside of traditional cookie‑based mechanisms, including across devices and environments.
Additionally, some companies may build different and potentially proprietary consumer tracking methods into their widely used web browsers, which we may not be able to effectively use for our publishers and buyers. Such proprietary methods may favor closed or vertically integrated ecosystems, limit interoperability, or restrict independent ad-tech providers’ access to data or functionality, which could reduce demand for our services. Many applications and other content creators also allow consumers to avoid receiving advertisements by paying for subscriptions or other downloads. Although we believe our platform is well-positioned to adapt and continue to provide key data insights to our publishers without cookies, this transition could be more disruptive, slower, or more expensive than we currently anticipate, or publishers and buyers could elect to move a larger proportion of their advertising inventory or spend to these providers to take advantage of proprietary consumer tracking methods, any of which could materially affect our ability to serve our customers, publishers, and buyers, and our business, results of operations, and financial condition could be adversely affected.
Our business depends on the lawful availability and utility of data signals used to enable advertising transactions, support analytics, optimization, and automation features, including those incorporating machine-learning or artificial-intelligence-based functionality, and any limitations on our ability to collect, process, or share such data could diminish the value of our platform and our financial results.
As we process transactions through our platform, we collect large amounts of data about advertisements and where they are placed, such as advertiser and publisher preferences for media and advertising content. We also collect data on ad specifications such as placement, size and format, ad pricing, and auction activity such as price floors, bid response behavior, and clearing prices. Further, we collect data on consumers that does not directly identify the individual, but includes pseudonymous identifiers and data regarding browser, device location and characteristics, online browsing behavior, exposure to and interaction with advertisements, and inferential data about purchase intentions, and preferences. We collect this data through various means, including from our own systems, pixels that publishers allow us to place on their websites to track consumer visits, software development kits installed in mobile applications, cookies, and other tracking technologies. Our publishers, buyers, and data providers may also choose to provide us with their proprietary data about consumers.
The collection, use, and sharing of these data signals are subject to an increasingly complex and fragmented global regulatory environment, as well as evolving technical and policy restrictions imposed by browsers, operating systems, and other platform providers. Regulatory developments, enforcement actions, private litigation, platform policy changes, or increased exercise of consumer privacy controls may restrict the types of data that may be collected, the purposes for which data may be used, the duration for which data may be retained, or the parties with whom data may be shared.
Our ability to collect, use and share data about advertising transactions and consumer behavior is critical to the value of our services. Internet users can, with increasing ease, implement practices or technologies that may limit our ability to collect and use data to deliver targeted advertisements, or otherwise inhibit the effectiveness of our platform. Although our publishers and buyers generally permit us to aggregate and use data from advertising placements, subject to certain restrictions, publishers or buyers might decide to restrict our collection or use of their data based on their own regulatory, commercial, or risk considerations. Any limitations on this ability could impair our ability to deliver effective solutions, which could adversely affect our business, results of operations, and financial condition.
Table of Contents
If publishers, buyers, and data providers do not obtain necessary and requisite consents from consumers for us to process their personal data, we could be subject to fines and liability.
Because we do not generally have direct relationships with consumers, we rely on publishers, buyers, and data providers, as applicable, to obtain the consent of the consumer on our behalf to process their data and deliver interest-based advertisements, and to implement any notice or choice mechanisms required under applicable laws. Our reliance on third parties for consent and notice creates inherent compliance risk, including situations where regulatory authorities or plaintiffs seek to impose liability on multiple participants in the advertising supply chain regardless of contractual allocations of responsibility. If publishers, buyers, or data providers do not follow the applicable requirements and processes or otherwise fail to secure any legally-required consents or provide required notice and choice mechanisms, which can be difficult given the rapidly evolving regulatory consent frameworks being promulgated, we could be subject to fines and liability. Additionally, if our data, privacy, or consent practices are found to be inadequate, or we make errors in the deployment of existing and future policies or technical safeguards, we may be subject to regulatory enforcement action or named in class-action lawsuits. We may not have adequate insurance or contractual indemnity arrangements to protect us any such , , , and .
Privacy-related class-action litigation poses increasing financial and operational risk.
The advertising technology industry has experienced a significant increase in privacy‑related class‑action litigation in recent years, and the focus of these claims has shifted from consumer‑facing publishers to intermediaries within the digital advertising supply chain. Plaintiff counsel have increasingly pursued novel and expansive legal theories alleging improper data collection, use, or sharing by intermediaries, often seeking to impose liability based on the operation of complex programmatic advertising systems rather than direct relationships with end users.
Claims may involve allegations relating to consent, transparency, data sharing practices, or the use of identifiers and tracking technologies across web, mobile, CTV, or other environments. Even where such claims lack merit, class‑action litigation is inherently costly, time‑consuming, and unpredictable, and may require substantial management attention, diversion of internal resources, and significant legal expense over extended periods of time.
The outcomes of privacy‑related class actions are uncertain and may result in adverse judgments, settlements, fines, penalties, or injunctive relief that could require changes to our products, data‑processing practices, or business operations. In addition, defending against such litigation may necessitate increased investment in compliance infrastructure, documentation, discovery processes, and external advisors, which could increase operating costs and negatively impact margins.
Privacy‑related litigation may also have broader consequences beyond direct financial exposure. Public allegations of non‑compliance, even if ultimately unfounded, could damage our reputation with publishers, buyers, regulators, and partners, reduce trust in our platform, and negatively affect our ability to attract or retain customers. Increased litigation risk may also cause publishers, buyers, or data partners to restrict or reconsider their participation in our marketplace, limit data sharing, or impose additional contractual requirements, which could reduce platform liquidity and revenue opportunities.
Furthermore, the evolving and fragmented nature of privacy regulation increases the likelihood that litigation will continue to be brought under differing legal standards across jurisdictions. Courts and regulators may adopt interpretations of privacy and data‑protection laws that are inconsistent, expansive, or difficult to reconcile with existing industry practices. As a result, we may be required to make business decisions or accept certain risks in an environment where legal standards remain unsettled, and there can be no assurance that our mitigation efforts or defenses will be successful.
If privacy‑related class‑action litigation continues to increase in frequency or severity, or if we are unable to effectively defend against or resolve such claims, our business, results of operations, financial condition, and long‑term growth prospects could be materially and adversely affected.
Table of Contents
Risk Related to the Advertising Industry and Competition
The digital advertising industry is intensely competitive, and if we do not effectively compete against current and future competitors, our business, results of operations, and financial condition could be adversely affected.
The digital advertising ecosystem is competitive and complex due to a variety of factors. While programmatic header bidding and other digital advertising has enabled the purchasing and selling of vast amounts of digital advertising inventory, there are significant challenges related to proliferation of media across platforms, including maintaining competitive transaction speed, increased costs, transparency, and evolving regulatory requirements. To address these issues at scale for both buyers and sellers, we provide specialized software and hardware infrastructure to optimally power technology-driven transactions. To successfully grow our business, we compete with a range of SSPs, including large, publicly-traded SSPs and smaller private SSPs in markets around the world, as well as divisions of larger companies like Google.
Some of our competitors have greater financial, technical, sales, and marketing resources, longer operating histories, and greater name recognition. In addition, some competitors, particularly those with greater scale or a more diversified revenue base and a broader offering, have greater flexibility than we do to compete aggressively on the basis of price and other contract terms, or to compete with us by including in their product offerings services that we may not be able to provide. Competitors that are larger or more well-funded than our Company may be able to invest greater resources than we can in technological development and innovation, particularly in the area of AI where investments can be capital intensive without a guarantee of a return on the investment. Some of our competitors may also choose to sell products or services competitive to ours at lower prices by accepting lower margins and profitability, or they may be able to sell competitive products or services at lower prices given proprietary ownership of data, technical superiority, or economies of scale. The introduction of competitive products, pricing strategies, or other technologies by our competitors that are to or that market acceptance than our products and services could affect our business.
We experience requests from publishers and buyers for discounts, fee concessions, rebates, refunds, and greater levels of pricing transparency, in some cases as a condition to maintain the relationship or to increase the amount of advertising spend that the buyer sends to our platform. In addition, we may decide to offer discounts or other pricing concessions in order to attract more inventory or demand, or to compete effectively with other providers that have different or lower pricing structures and may be able to undercut our pricing due to greater scale or other factors. Our revenue, take rate, business, results of operations and financial condition could be adversely affected if we cannot maintain and grow our revenue and profitability through volume increases that compensate for any price reductions, or if we are forced to make significant fee concessions, rebates, or refunds.
Some of our competitors are also able or willing to agree to contract terms that expose them to risks that might be more appropriately allocated to publishers or buyers (including inventory risk and the risk of having to pay publishers for unsold advertising impressions, among others), and in order to compete effectively we might need to accommodate risks that could be costly to manage or insure against. Some existing and potential buyers have their own relationships with publishers or are seeking to establish such relationships, and many publishers are investing in capabilities that enable them to connect more effectively directly with buyers. Our business suffers when publishers and buyers purchase and sell advertising inventory directly from one another or through other intermediaries other than us, reducing the amount of advertising spend on our platform. If we are unable to compete effectively for publishers’ ad impressions and buyer’s advertising spend, we could experience a decline in market share and revenues and be forced to reduce our prices, resulting in lower profit margins for us. of existing or future market share to new competitors and increased price competition could substantially our business, results of operations, and financial condition.
There has also been rapid evolution and consolidation in the advertising technology industry, and we expect these trends to continue, increasing the capabilities and competitive posture of larger companies, particularly those that already are dominant or have a greater market share than us, and enabling new or stronger competitors to emerge. Many publishers and buyers are large, consolidated organizations that may need to acquire other companies in order to grow. Smaller publishers and buyers may need to consolidate to compete effectively. There is a finite number of large publishers and buyers in our target markets, and any consolidation of publishers or buyers may give the resulting enterprises greater bargaining power or result in the loss of publishers and buyers that use our platform, reducing our potential base of publishers and buyers, each of which would lead to erosion of our revenue and financial condition.
Table of Contents
Market pressure may reduce our revenues.
Our revenue can be affected by market changes, new demands by publishers and buyers, new solutions, and competitive pressure. Our solutions may be priced too high or too low, or our pricing approaches may not be accepted, any of which may carry adverse consequences to our business and results of operations. We may receive requests from publishers for discounts, fee revisions, rebates, and refunds, or from DSPs, agencies and advertisers for volume discounts, fee revisions, and rebates. Any of these pressures from publishers or buyers can adversely affect our business, results of operations, and financial condition.
Seasonal fluctuations or market changes in digital advertising activity could adversely affect our business, results of operations, and financial condition.
Our revenue, net cash provided by operating activities, results of operations, and other key operating and performance metrics vary from quarter to quarter due to the seasonal nature of digital advertising spending. For example, digital advertisers historically tend to devote a large portion of their budgets to campaigns in the fourth quarter of the year, to coincide with consumer holiday spending, and then have a significantly smaller advertising budget in the first calendar quarter. Pricing of digital ad impressions in the fourth quarter is likely to be higher due to increased demand. The degree of seasonality in digital advertising spending can vary and be difficult to predict on a year-to-year or quarter-to-quarter basis. In addition, adverse economic conditions, inflation, changes in foreign exchange rates or interest rates, international trade tensions, or general economic uncertainty may cause advertisers to decrease purchases of digital ad impressions, adversely affecting our business, results of operation and financial condition. A decline in the market for programmatic advertising or the failure of that market to grow as expected could also adversely affect our business, results of operations, and financial condition.
If changes in ad formats, delivery mechanisms, or platform policies prevent advertisements from being delivered to consumers, our business, results of operations, and financial condition may be adversely affected.
Our success depends upon the ability of our platform to provide advertising for a variety of digital devices, the major operating systems or Internet browsers that run on them, and the thousands of applications that are downloaded onto them. The design of digital devices and operating systems or browsers is controlled by third parties that may also introduce new devices and operating systems or modify existing ones, including by implementing technical, contractual, or policy-based restrictions on advertising, data access, or interoperability, and our access to content on certain devices may be limited. If our platform cannot operate effectively with popular devices, operating systems, or Internet browsers, including, for example, as a result of Google’s deactivation of cookies or other similar events, our business, results of operations, and financial condition could be adversely affected. as a result of browser- or operating system-level privacy controls, restrictions on identifiers, limitations on APIs, or other platform policy changes, our business, results of operations, and financial condition could be adversely affected.
Risks Related to our Operations
If we fail to detect or prevent fraud on our platform, or malware intrusion into the systems or devices of our publishers and their consumers, publishers could lose confidence in our platform, and we could face legal claims.
We may be subject to fraudulent or malicious activities undertaken by persons seeking to use our platform for improper purposes. For example, someone may attempt to divert or artificially inflate advertiser purchases through our platform, or to disrupt or divert the operation of our systems and the devices of our publishers and their consumers in order to misappropriate information, generate fraudulent billings, stage cyberattacks, or for other illicit purposes. For example, sophisticated bot-nets and other complex forms of click fraud might be used to generate fraudulent impressions and divert advertising revenue from legitimate websites of publishers. Those activities could also introduce malware through our platform to commandeer or access to information on consumers’ computers. We use third-party tools and proprietary technology to identify non-human traffic and malware, and we may reduce or relationships with publishers that we find to be engaging in such activities. Although we continuously assess the quality and performance of advertising on publishers’ digital media properties, it may be to detect or activity quickly or at all. Further, perpetrators of impressions and malware frequently change their tactics and can become more sophisticated over time, requiring both us and third parties to processes for assessing the quality of publisher inventory and controlling activity. If we to timely detect or prevent or activity of this sort, our reputation could be , publishers may contest payment, demand refunds, or to give us future business, or we could face legal . Even if we are not directly involved in or activity, any sustained of others in our industry to detect and prevent could generate the perception that programmatic advertising is and lead our publishers to avoid programmatic advertising.
Table of Contents
Our success depends on our ability to retain key members of our management team, and on our ability to hire, train, retain, and motivate new employees.
Our success depends upon the continued service of members of our senior management team and other key employees. Our Co-Founder and Chief Executive Officer, Rajeev K. Goel, is critical to our overall management, as well as the continued development of our platform and relationships with publishers, DSPs, and agencies, and our strategic direction. Our success also depends on our ability to hire, train, retain, and motivate new employees that align with our corporate culture that has fostered innovation, creativity, and teamwork across our business. Competition for employees in our industry can be intense, and we compete for experienced personnel with many companies that have greater resources than we have. Further, as our business grows and we introduce new offerings, we may need to hire employees with skills and experience that we have not historically required. This is especially true as our business increases focus and resources on emerging revenue streams or other offerings that were not historically a material part of our business. The market for talent in our key areas of operations, especially in engineering, and competition for qualified personnel is particularly intense in the San Francisco Bay Area, Pune, India, and New York, where we maintain offices. As we expand and evolve, in particular across multiple geographies or following acquisitions, it may be to preserve our corporate culture, which could increase employee turnover or reduce our ability to , create, and operate effectively.
We are subject to payment-related risks if DSP buyers dispute or do not pay their invoices, and if DSPs file for bankruptcy protection or there are any decreases in payments, it could adversely affect our reputation, business, results of operations, and financial condition.
We generate revenue primarily through revenue share agreements with our publishers. We invoice DSPs and collect the full purchase price for the digital ad impressions they purchase, retain our fees, and remit the balance to the publisher. However, in some cases, we are required to pay publishers for digital ad impressions delivered even if we are unable to collect from the buyer that purchased the digital ad impressions. In the past, certain buyers have sought to slow their payments to us or have filed for bankruptcy protection, resulting in us not receiving payment. These challenges may be exacerbated by the overall market and economic volatility, inflation, changes in foreign exchange rates or interest rates, disruptions to supply chains, pandemics, epidemics or other public health crises, and the resulting economic impacts, as our buyers may experience financial difficulties and liquidity constraints. Some DSPs have historically carried relatively high debt obligations, and the maturity of that debt or changes in interest rates may negatively impact the liquidity of those DSPs and their ability to timely pay us. In certain cases, buyers have been to timely make payments and we have financial , including in June 2023 when MediaMath declared , which led us to record a debt expense of $5.7 million. While our contracts generally do not contain such exposure, there are certain agreements under which we may be responsible for the whole amount of contracted spending, whether or not ultimately paid by the buyer.
In addition, a prolonged economic downturn or prolonged period of elevated interest rates may lead additional buyers to slow or default on payments or in some cases seek bankruptcy protection. We cannot provide assurance that we will not experience bad debt in the future, and write-offs for bad debt could adversely affect our business, results of operations, and financial condition in the periods in which the write-offs occur. If our cash collections are significantly diminished as a result of these dynamics, our revenue and/or cash flow could be adversely affected, and we may need to use working capital to fund our accounts payable pending collection from the buyers. This may result in additional costs and cause us to forgo or defer more strategic uses of that working capital.
Table of Contents
Our international operations subject us to additional costs and risks, and our continued international expansion may not be successful.
We have entered into several international markets and we expect to continue to expand our international operations. Further expansion may require significant management attention and financial resources and may place burdens on our management, administrative, operational, legal, compliance, and financial infrastructure. The costs and risks inherent in conducting business internationally include, but are not limited to:
• difficulties and costs associated with maintaining effective controls at foreign locations;
• foreign currency fluctuations and controls;
• adapting our platform and solutions to non-U.S. publishers’ preferences and customs;
• regulatory and other delays and difficulties in setting up foreign operations, including difficulties in hiring personnel with skill sets and experience that match our international expansion efforts;
• compliance with anti-bribery laws and regulations, export and import control and economic sanctions, laws and regulations;
• compliance with foreign data privacy laws;
• compliance with domestic and foreign bulk data transfer laws;
• economic and political instability in some countries, including as a result of the conflict in Ukraine or a resumption of the conflict between Israel and Palestine;
• trade disputes among countries, and changes in international trade volumes or pricing; and
• compliance with the laws of numerous taxing jurisdictions.
As we continue to expand our business globally, our success will depend, in large part, on our ability to anticipate and effectively manage these risks. These factors and others, and the costs associated with any failure to effectively manage risks and comply with local laws and regulations, could harm our ability to increase international revenues and, consequently, could adversely affect our business, results of operations, and financial condition.
Our use and reliance upon technology and development resources in India may expose us to unanticipated costs and liabilities, which could affect our ability to realize cost savings from our operations in India.
Most of our technology and development work is conducted in Pune, India. We cannot assure you that our reliance upon development resources in India will enable us to achieve meaningful cost reductions or greater resource efficiency. Further, our development efforts and other operations in India involve significant risks, including, but not limited to:
• difficulty hiring and retaining engineering and management resources due to intense competition for such resources and resulting wage inflation;
• heightened exposure to changes in economic, health, security, and political conditions in India; and
• fluctuations in currency exchange rates and tax compliance in India.
In addition, enforcement of intellectual property rights and confidentiality protections in India may not be as effective as in the United States or other countries. Policing unauthorized use of proprietary technology is difficult and expensive, and we may need to resort to litigation to protect our trade secrets and confidential information. The experience and capabilities of Indian courts in handling intellectual property litigation vary, and outcomes are unpredictable. Further, such litigation may require significant expenditures of cash and management efforts and could harm our business, financial condition, and results of operations.
We expect to continue to rely on significant cost savings obtained by concentrating our technology and development and engineering work in India, rather than in the United States, but difficulties resulting from the factors noted above and other risks related to our operations in India could increase our expenses and harm our competitive position. The historical rate of wage inflation has been higher in India than in the United States. Accordingly, it may be harder in the future to achieve labor-related cost efficiencies that we have historically benefited from. In addition, if the Rupee strengthens against the U.S. Dollar, our costs would increase. If the cost of technology and development work in India significantly increases or the labor environment in India changes unfavorably, our cost savings may be diminished. Any such developments could adversely affect our business, results of operations, and financial condition.
Table of Contents
We depend on third-party data centers, the disruption of which could adversely affect our business, results of operations, and financial condition.
We host our company-owned infrastructure at third-party data centers. Any damage to or failure of our systems generally would prevent us from operating our business. We rely on the Internet and, accordingly, depend upon the continuous, reliable, and secure operation of Internet servers, related hardware and software, and network infrastructure. While we control and have access to our servers and all of the components of our network that are located in our external data centers, we do not control the operation or costs of these facilities.
The owners of our data center facilities have no obligation to renew their agreements with us on commercially reasonable terms, or at all. If we are unable to renew these agreements on commercially reasonable terms, or if one of our data center operators is acquired, we may be required to transfer our servers and other infrastructure to new data center facilities, and we may incur significant costs and possible service interruption in connection with doing so. As the demand for compute power and data center usage grows as a result of AI and other technological advancements, our ability to secure data center or colocation space at financially reasonable terms may be challenged, which could adversely affect our business, results of operations, and financial condition.
Problems faced by our third-party data center operations, with the telecommunications network providers with whom we or they contract, or with the systems by which our telecommunications providers allocate capacity among their customers, including us, could adversely affect the experience of publishers on our platform. Additionally, improving our platform’s infrastructure and expanding its capacity in anticipation of growth in new channels and formats, as well as implementing technological enhancements to our platform to improve its efficiency and cost-effectiveness, are key components of our business strategy, and if our data centers are unable to keep up with our growing needs for capacity, this could have an adverse effect on our business. Increasing data center capacity requires physical plant expansion and the procurement of additional equipment, which can take a year or more to accomplish. Accordingly, if there is a rapid increase in our need for data center capacity, we may not be able to increase our capacity quickly enough to meet the needs of publishers or our business, which could affect our business, results of operations, and financial condition. Any changes in third-party service levels at our data centers or any , , , or other performance could affect our reputation, us to liability, cause us to customers, or otherwise affect our business, results of operations, and financial condition. Service might reduce our revenue, trigger refunds to publishers, subject us to potential liability, or affect our business, results of operations, and financial condition.
The occurrence of a natural disaster, an act of terrorism, vandalism or sabotage, or other unanticipated problems at these facilities could result in interruptions in the availability of our platform. While we have disaster recovery arrangements in place, they have not been tested under actual disasters or similar events and may not effectively permit us to continue to provide our products and services in the event of any problems with respect to our data centers. Moreover, because we do not currently have full redundancy with respect to the services at each data center, if one of our data centers shuts down there may be a period of time that our products or services, or some of our products or services, will be unavailable to publishers served by that data center. If any of these events were to occur to our business, our business, results of operations, or financial condition could be affected.
Platform outages or disruptions, including due to cyberattacks or our failure to maintain adequate security and supporting infrastructure, could adversely affect our business, results of operations, and financial condition.
As we grow our business, we expect to continue to invest in our platform infrastructure, including hardware and software solutions, network services, and database technologies, as well as potentially increase our reliance on open source software. Without these improvements, our operations might suffer from unanticipated system disruptions, slow transaction processing, unreliable service levels, impaired quality, or delays in reporting accurate information regarding transactions on our platform, any of which could negatively affect our reputation and ability to attract and retain publishers. The steps we take to enhance the reliability, integrity, and security of our platform as it scales are expensive and complex, and poor execution could result in operational failures. In addition, cyberattack techniques are constantly evolving and becoming increasingly diverse and sophisticated as attackers deploy AI, and could involve -of-service attacks or other maneuvers that have the effect of the availability of services on our platform.
Other types of cyberattacks could harm us even if our platform operations are left undisturbed. For example, attacks may be designed to deceive employees into releasing control of their systems to a hacker, while others may aim to introduce computer viruses or malware into our systems with a view to stealing confidential or proprietary data. Additionally, we rely on third party software providers for the delivery of certain of our services and offerings, and a disruption to those providers, whether an outage, cybersecurity attack, or otherwise, could adversely affect our business, results of operations, and financial condition.
Table of Contents
We are also vulnerable to unintentional errors or malicious actions by persons with authorized access to our systems that exceed the scope of their access rights, distribute data erroneously, or, unintentionally or intentionally, interfere with the intended operations of our platform. Although we maintain insurance coverage, it may be insufficient to protect us against all losses and costs stemming from security breaches, cyberattacks and other types of unlawful activity, or any resulting disruptions from such events. Outages and disruptions of our platform, including any caused by , may our reputation and affect our business, results of operations, and financial condition.
Our software platform could be susceptible to errors, defects, or unintended performance problems that could adversely affect our business, results of operations, and financial condition.
We depend upon the sustained and uninterrupted performance of our platform to operate our business. Software bugs, faulty algorithms, technical or infrastructure problems, or system updates could lead to an inability to process data to place advertisements or price inventory effectively, or cause advertisements to display improperly or be placed in proximity to inappropriate content, which could adversely affect our business, results of operations, and financial condition. These risks are compounded by the complexity of our technology and the large amounts of data we utilize. Because our software is complex, undetected material defects, errors and failures may occur. Despite testing, errors or bugs in our software may not be found until the software is in our live operating environment.
For example, changes to our solution have in the past caused errors in the measurements of transactions conducted through our platform, resulting in disputes raised by publishers. Errors or failures in our offerings, even if caused by the implementation of changes by publishers or partners to their systems, could also result in negative publicity, damage to our reputation, loss of or delay in market acceptance of our offerings, increased costs or loss of revenue, or loss of competitive position. As a result, defects or errors in our products or services could harm our reputation, result in significant costs to us, impair the ability of publishers to sell and for buyers to purchase inventory, and our ability to fulfill obligations with publishers and partners. Any significant could affect our business, results of operations, and financial condition.
Our continued business success depends upon our ability to offer high-quality inventory with appropriate viewability capabilities.
We must address quality concerns of both advertisers and publishers. Publishers require ad quality tools that enable granular control over the characteristics of the ads that run on their ad impressions, including those relating to the advertiser, industry and content for a particular ad. We must also provide automatic or ad hoc blocking of ads that contain malware or other ads the publisher deems undesirable. Our inventory quality tools must continue to help publishers demonstrate the value and quality of their ad impressions to DSPs, advertisers, and agencies with automated fraud detection and viewability reporting. Maintaining and upgrading our capabilities associated with ad quality and inventory quality is complex and costly. Maintaining high-quality inventory may become increasingly difficult with the advent and proliferation of “deep fake” video and other media produced using AI. If we fail to maintain high quality controls for our publishers and partners, our business, results of operations, and financial condition could be adversely affected.
In addition, the viewability of ad impressions is important to certain advertisers because it enables them to assess the value of particular ad impressions as a means to reach a target audience. However, there is no consensus regarding the definition of viewability or the minimum standard viewability thresholds and metrics that should apply for different ad formats. We cannot predict whether consensus views will emerge, or what they will be. Incorporating accepted viewability approaches fully into our business as they evolve will require us to incur additional costs to integrate relevant technologies and process additional information through our platform. In addition, ad impressions that are well differentiated on the basis of viewability will also typically be differentiated on the basis of value, with those that are less viewable valued lower. In this context, if we are not able to effectively transact ad impressions with higher viewability and to incorporate appropriate viewability capabilities into our platform, we could be competitively disadvantaged and our business, results of operations, and financial condition could be adversely affected.
Future acquisitions or strategic investments could be difficult to identify and integrate, divert the attention of management, and could disrupt our business, dilute stockholder value and adversely affect our business, results of operations, and financial condition.
As part of our growth strategy, we may acquire or invest in other businesses, assets, or technologies that we believe fit within our strategic goals. Any acquisition or investment may divert the attention of management and require us to use significant amounts of cash, issue dilutive equity securities, or incur debt. An acquisition or investment may not ultimately bring the anticipated benefits to the Company that we intended or anticipated. Any additional capital raised through the sale of equity or convertible debt securities would dilute your stock ownership, and any new equity securities we issue could have rights, preferences, and privileges superior to those of holders of our common stock.
Table of Contents
Any debt financing we secure in the future could involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions. In addition, the anticipated benefits of any acquisition or investment may not be realized, and we may be exposed to unknown risks, any of which could adversely affect our business, results of operations, and financial condition, including risks arising from:
• difficulties in integrating the operations, technologies, product or service offerings, administrative systems, and personnel of acquired businesses;
• ineffectiveness or incompatibility of acquired technologies or solutions;
• potential loss of key employees of the acquired business;
• inability to maintain key business relationships and reputation of the acquired business;
• litigation arising from the acquisition or the activities of the acquired business;
• failure to generate the expected financial results related to an acquisition in a timely manner or at all;
• failure to accurately forecast the impact of an acquisition; and
• implementation or remediation of effective controls, procedures, and policies for acquired businesses.
Accordingly, any acquisition or investment would be subject to a risk of partial or total loss of invested capital
We rely on customers, publishers, buyers, and partners to abide by contractual requirements and relevant laws, rules, and regulations when using our platform, and legal claims or enforcement actions resulting from their actions could expose us to liabilities, damage our reputation, and be costly to defend.
The customers, publishers, buyers, and partners engaging in transactions through our platform impose various requirements upon each other, and they and the underlying advertisers are subject to regulatory requirements by governments and standards bodies applicable to their activities. We may assume responsibility for satisfying or facilitating the satisfaction of some of these requirements through the contracts we enter into with customers, publishers, buyers, and partners. In addition, we may have responsibility for some acts or omissions of customers, publishers, buyers, or partners transacting business through our platform under applicable laws or regulations or as a result of common law duties, even if we have not assumed responsibility contractually. These responsibilities could expose us to significant liabilities and we may not have the ability to impose effective mitigating controls upon, or to recover from, publishers and buyers. Moreover, for those third parties who are both publishers and buyers on our platform, it is feasible that they could use our platform to buy and sell advertisements in an effort to inflate their own revenue. We could be subject to litigation as a result of such actions, and, if we were sued, we would incur legal costs in our defense and cannot guarantee that a court would not attribute some liability to us. Regulators, , and class action may seek to hold multiple participants in the advertising supply chain liable regardless of contractual allocations of responsibility. Even where we have indemnification rights, recovery may be uncertain if counterparties resources to pay or coverage.
We contractually require our customers, publishers, buyers, data providers, and partners to abide by relevant laws, rules and regulations, and restrictions by their counterparties, when transacting on our platform, and we generally attempt to obtain representations from buyers that the advertising they place through our platform complies with applicable laws and regulations and does not violate third-party intellectual property rights, and from publishers about the quality and characteristics of the impressions they provide. We also generally receive representations from publishers, buyers, and data providers about their privacy practices and compliance with applicable laws and regulations, including their maintenance of adequate privacy policies that disclose and permit our data collection and transfer practices. Nonetheless, there are many circumstances in which it is difficult or impossible for us to monitor or evaluate compliance by our publishers, buyers, data providers, and partners. For example, we cannot control the content of publisher’s media properties, and we are often unable to determine exactly what information a partner collects after an ad has been placed, and how the buyer uses any such collected information. Moreover, we are unable to prevent DSPs from aggregating bid requests from publishers and directing it to their own buying platforms or even reselling such bid data to advertisers or third parties.
Table of Contents
If publishers, buyers, data providers, or partners fail to abide by relevant laws, rules and regulations, or contractual requirements when transacting over our platform, or after such a transaction is completed, we could potentially face liability to consumers for such misuse. Potential sources of liability to consumers include malicious activities, such as the introduction of malware into consumers’ computers through advertisements served through our platform, and code that redirects consumers to sites other than the ones consumers sought to visit, potentially resulting in malware downloads or use charges from the redirect site. In such an event, consumers may look to us to recover any alleged damages as a result of publishers’ use of limitations or disclaimers of liability through their terms of use with consumers. Similarly, if such misconduct results in enforcement action by a regulatory body or other governmental authority, we could become involved in a potentially time-consuming and costly investigation or we could be subject to or some form of sanction or . We may not have adequate indemnity to protect us , and our insurance policies, may not cover, such and .
We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance long-term stockholder value. Share repurchases could also increase the volatility of the trading price of our stock and diminish our cash reserves.
In February 2023, our board of directors authorized and approved a program pursuant to which we could repurchase up to $75.0 million in aggregate of shares of our Class A common stock, with the authorization to expire on December 31, 2024 (the “2023 Repurchase Program”). On February 22, 2024, our board of directors authorized an increase and extension to the 2023 Repurchase Program from $75.0 million to $175.0 million through December 31, 2025. On May 7, 2025, our board of directors authorized a further increase and extension to the 2023 Repurchase Program, increasing the total amount authorized for repurchase from $175.0 million to $275.0 million and extending the 2023 Repurchase Program through December 31, 2026 (the “2025 Repurchase Program Extension”). As of December 31, 2025, we have repurchased approximately $181.1 million of our Class A common stock in aggregate under the 2023 Repurchase Program. Although our board of directors authorized the 2025 Repurchase Program Extension, the program does not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares of our Class A common stock. The actual timing and amount of repurchases remain subject to a variety of factors, including stock price, trading volume, market conditions and other general business considerations, all of which may be negatively impacted by macroeconomic conditions and factors, including, for example, volatile interest rates, inflation, and geopolitical uncertainty. The 2023 Repurchase Program may be modified, suspended, or terminated at any time, and we cannot guarantee that the 2023 Repurchase Program will be fully consummated or that it will long-term stockholder value. The program could affect the trading price of our Class A common stock, increase and our cash and cash equivalents and marketable securities, and any announcement of a of this program may result in a decrease in the trading price of our stock.
Our business is subject to the risk of catastrophic events such as pandemics, earthquakes, flooding, fire, and power outages, and to interruption by man-made problems such as acts of war and terrorism.
Our business is vulnerable to damage or interruption from pandemics, earthquakes, flooding, fire, power outages, telecommunications failures, terrorist attacks, acts of war, human errors, break-ins, and similar events. A significant natural disaster could have a material adverse effect on our business, results of operations, and financial condition, and our insurance coverage may be insufficient to compensate us for losses that may occur. We have office and data center facilities located in California, a state known for seismic activity. Significant portions of our development and advertising operations work is located in Pune, India, which is susceptible to earthquakes and flooding. In addition, economic or political instability or international responses thereto could adversely affect our business, results of operations, and financial condition. Furthermore, acts of terrorism, which may be targeted at metropolitan areas that have higher population density than rural areas, could cause in our or our publishers’ and partners’ businesses or the economy as a whole. Our servers may also be to computer viruses, -ins, -of-service attacks, and similar from tampering with our computer systems, which could lead to , , and of data. We may not have sufficient protection or recovery plans in some circumstances, such as natural affecting California, New York, Virginia, or Pune, India. As we rely heavily on our data center facilities, computer and communications systems, and the Internet to conduct our business and provide high-quality customer service, these could impact our ability to operate our business and either directly or indirectly publishers’ and partners’ businesses, which could affect our business, results of operations, and financial condition.
Table of Contents
We use artificial intelligence in our business, and challenges with properly managing its use could result in reputational harm, competitive harm, and legal liability, and adversely affect our results of operations.
We incorporate AI solutions into our development efforts, external product offerings, and optimization capabilities, and these applications and the use of AI will become more important in our operations over time. We are making significant investments in AI, and we may not be successful in generating revenue or profit from these efforts. Our ability to develop and deploy AI solutions also depends on our ability to attract and retain employees with specialized AI expertise, and competition for such talent is intense.
AI-powered features, including our machine learning algorithms for bid optimization, fraud detection, and audience targeting, are important to our competitive position and our ability to deliver value to publishers and buyers. However, AI technologies are complex and rapidly evolving, and we face significant competition from other companies as well as an evolving regulatory landscape. These efforts, including the introduction of new products or changes to existing products, may result in new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications that could adversely affect our business, operating results and financial condition. Additionally, the European Union’s Artificial Intelligence Act, which entered into force in August 2024 with phased compliance obligations extending through 2027, may classify certain AI-driven advertising technology uses as subject to transparency, documentation, or conformity assessment requirements, and the scope and application of these obligations to our business remains uncertain.
Our competitors or other third parties may incorporate AI into their products and offerings more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations. Our AI-enabled solutions rely on third-party equipment, technology, and other technical and physical infrastructure, such as processing hardware, network capacity or models, and any limitations, changes, or disruptions associated with such third-party technologies could adversely affect our ability to develop, deploy, or enhance our AI services. In particular, the integration of third-party AI models with our products and services relies on certain safeguards implemented by the third-party developers of the underlying AI models. Our reliance on a limited number of third-party AI model providers creates concentration risk; if such providers experience service disruptions, materially change their terms or pricing, or discontinue offerings we depend upon, our ability to deliver AI-powered features could be . If the content, analyses, optimization decisions or recommendations that AI applications assist in producing are or are to be , , or biased, our business, financial condition, and results of operations may be affected. Additionally, the development of our AI solutions depends on access to data to effectively train and operate our models, and on our access to data, whether due to cost, availability, regulatory restrictions, or other factors, could affect the effectiveness of our AI products and solutions.
AI applications generally state they do not use personal data or other classes of protected data, but we may not know the source of data used by an AI application and may inadvertently incorporate personal information, or data derived from personal data, in the course of using an AI application. The use of AI applications has resulted in, and may in the future result in, cybersecurity incidents that implicate the sensitive data of customers analyzed within such applications. Any such cybersecurity incidents related to our use of AI applications for analysis of sensitive data could adversely affect our reputation and results of operations.
If we include portions of our proprietary information when using AI tools, that information may enter the public domain and we may lose the ability to protect such proprietary information. AI also presents emerging ethical issues and if our use of AI becomes controversial, we may experience brand or reputational harm, competitive harm, or legal liability. The rapid evolution of AI, including potential government regulation of AI and its various uses, will require significant resources to develop, test, and maintain our intelligence cloud platform, offerings, services, and features to help us implement AI ethically in order to minimize unintended, harmful impact. In addition, inconsistent or evolving AI-related legal and regulatory frameworks across jurisdictions may require us to incur additional compliance costs and to modify our offerings or operations in certain jurisdictions.
Finally, as AI enabled services become popular across industries, we may find ourselves competing for scarce compute capacity. Demand for data‑center capacity and related infrastructure has increased significantly, driven in part by the rapid adoption of AI‑driven technologies across industries. Constraints on the availability, geographic distribution, or cost of such infrastructure—whether due to market conditions, energy availability, regulatory requirements, or actions by third‑party providers—could limit our ability to scale AI-enabled operations efficiently or maintain performance levels as our platform grows, which could adversely impact our business or results of operations.
Table of Contents
Risks Related to Regulations
We are subject to frequently evolving laws, regulations and industry requirements related to data privacy, data protection, information security, and consumer protection across the markets we operate in.
We receive, store, and process data about or related to consumers in addition to publisher, buyer, partner, employee, and services provider or vendor data. Our handling of this data is subject to numerous federal, state, and foreign laws and regulations that are constantly evolving and not always consistent across jurisdictions. We are also subject to regulation by various governmental authorities in addition to federal and state regulations. Our data handling is further subject to contractual obligations and may be deemed to be subject to industry standards and trade associations.
The U.S. federal government and various state and foreign governments have adopted or proposed limitations on the collection, distribution, use, and storage of data relating to individuals, including the use of contact information, precise geolocation information, and other data for marketing, advertising and other communications with individuals and businesses. In the United States, various laws and regulations apply to the collection, processing, disclosure, and security of certain types of data. Additionally, the U.S. Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the online collection, use, dissemination, and security of data. These regulatory regimes are constantly evolving and not always interpreted in a consistent manner. If we fail to comply with any such laws or regulations, we may be subject to enforcement actions that may not only expose us to litigation, fines, and civil and/or criminal penalties, but also require us to change our business practices, each of which could adversely affect our business, results of operations, and financial condition.
The regulatory framework for data privacy worldwide is evolving and is likely to remain uncertain for the foreseeable future. The occurrence of unanticipated events often rapidly drives the adoption of legislation or regulation affecting the use, collection, or other processing of data and manners in which we conduct our business. Restrictions have been placed upon the collection, management, aggregation, transfer, and use of information, and compliance with those restrictions may require us to change how we collect, manage, aggregate, transfer, and use data in the future, which could result in a material increase in the cost of collecting or otherwise obtaining certain kinds of data. These restrictions could further limit the ways in which we may use or disclose information or may require us to make changes to our offerings, which could adversely affect our business, results of operations, and financial condition. In particular, interest-based advertising, or the use of data to draw inferences about a user’s interests and deliver relevant advertising to that user, and similar or related practices (sometimes referred to as behavioral advertising or personalized advertising), such as cross-device data collection and aggregation, have come under increasing scrutiny by legislative, regulatory, and self-regulatory bodies in the United States and abroad that focus on consumer protection or data privacy. In addition, the steps taken by companies to de-identify personal data, to use and distribute the resulting data, including for purposes of personalization and the targeting of advertisements, have also been a frequent target of by these authorities. Much of the related regulatory activity has focused on the use of cookies and other technology to collect information about Internet users’ online browsing activity on web browsers, mobile devices, and other devices, to associate such data with user or mobile advertising identifiers or de-identified identities across devices and channels. There is also increased regulatory focus on the use of geolocation data that aims to limit what can be collected, what kind of consent may be required with respect to the same, and how such data may be used, exchanged, or to others.
In the United States, the U.S. Congress and state legislatures, along with federal regulatory authorities, have increased their attention on matters concerning the collection and use of consumer data. In the United States, non-sensitive consumer data generally may be used under current rules and regulations, subject to certain restrictions, so long as the person does not affirmatively “opt-out” of the collection or use of such data. If an “opt-in” model or other more restrictive regulations were to be adopted in the United States, less data would be available, and the cost of data would be higher. It is uncertain what steps the second Trump Administration in the United States may take to expand, curtail, or alter the current federal regulatory regime in which we operate.
California enacted the California Consumer Privacy Act (as amended, “CCPA”) which took effect in January 2020. The CCPA created individual privacy rights for California residents, including rights of deletion and access, and increased the privacy and security obligations of businesses handling personal data. The CCPA is also still enforceable by the California Attorney General, and there is a CCPA private right of action relating to certain data security incidents. The CCPA generally requires covered businesses to, among other things, provide disclosures to California consumers regarding the collection, use and disclosure of their personal data. The CCPA also affords California consumers the ability to opt-out of certain sales of personal data, a concept that is defined broadly and is subject to evolving regulations promulgated initially by the California Attorney General, and now the California Privacy Protection Agency (“CPPA”), newly renamed “CalPrivacy,” and the agency charged with CCPA rulemaking and enforcement.
Table of Contents
CCPA amendments have also imposed additional data protection obligations on companies doing business in California, including additional consumer rights processes and opt-outs for certain uses of sensitive data and “sharing” of personal data for cross-context behavioral advertising. The effects of the CCPA, including from expected but not yet promulgated regulations, are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply, which will increase our potential exposure to regulatory enforcement and/or litigation. Decreased availability and increased costs of information due to implementing the CCPA, could adversely affect our ability to meet our customers’ requirements and could have an adverse effect on our business, results of operations, and financial condition.
In addition to regulations under the CCPA, CalPrivacy has also promulgated regulations as a result of the California Delete Act, which applies to those entities defined as ‘data brokers’ under the CCPA amendments. The Delete Act has required CalPrivacy to establish an accessible data deletion mechanism by January 1, 2026, to allow California consumers to submit a single verifiable consumer request to delete their data across all data brokers. By providing an opportunity for mass data subject requests, the Delete Act imposes compliance and operational costs and has the potential to limit the availability of personal data that PubMatic may utilize for targeted advertising.
The California Invasion of Privacy Act (as amended, “CIPA”) has become the basis for a growing number of lawsuits against digital advertising companies, including PubMatic. Plaintiffs have argued that CIPA prohibits certain forms of interception of communications and the use of pen registers or similar tracking devices without the consent of all parties to the communication. Plaintiffs in several recent cases have alleged that adtech intermediaries—including supply side platforms (SSPs)—have violated CIPA by participating in the interception of communications between consumers and websites through the use of tracking pixels, cookies, session replay scripts, or real-time bidding signals. Although we believe our practices comply with applicable laws, the legal framework surrounding CIPA is unsettled and continues to evolve through litigation and courts have issued conflicting decisions regarding the scope of CIPA’s application to modern internet technologies. Should plaintiffs successfully argue that our participation in the adtech ecosystem constitutes a of CIPA, we could be subject to significant statutory , , , or other regulatory actions. Even can result in substantial legal expenses and management attention. If similar are adopted by courts in other jurisdictions, or if regulators issue guidance interpreting these practices as under CIPA or other statutes, our financial exposure and liability could increase and our business, results of operations, and financial condition could be affected.
The federal Video Privacy Protection Act (“VPPA”) has also been the basis for a growing number of lawsuits involving the alleged disclosure of consumers’ video-viewing information to third parties through pixels or similar technologies. As courts address these lawsuits, adverse decisions could increase VPPA-related litigation (including class actions), expand statutory damages exposure, reduce available defenses for companies that host, embed, or monetize video content and use common analytics or advertising technologies, and require changes to industry practices, any of which could adversely affect our business, results of operations, and financial condition.
The CCPA has encouraged “copycat” laws in other states across the country. Following California’s lead, over a third of other U.S. states have enacted comprehensive consumer privacy laws as well as privacy laws targeted at specific industries or types of data, and at data brokers specifically. Numerous other states have or are in the process of passing their own privacy or privacy-adjacent laws. Compliance with new privacy legislation adds complexity and may require investment in additional resources for compliance programs, thus potentially resulting in additional costs and expense of resources to maintain compliance. We cannot yet fully predict the impact of such state laws or subsequent guidance on our business or operations, but it may require us to further modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply, including the opportunity cost of devoting resources to developing compliance solutions over expanded platform capabilities. New and proposed legislation has added and may in the future add additional complexity, variation in requirements, restrictions, and potential legal risk, require additional investment in resources to compliance programs, and could impact strategies and availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. In some cases, different regulatory regimes may interpret certain practices differently, and there may be contradiction among the regimes in which we operate. Although proposals are regularly introduced in Congress, it remains to be seen whether the U.S. will implement comprehensive federal consumer privacy legislation.
Table of Contents
In Europe, the GDPR took effect on May 25, 2018, and applies to products and services that we provide in Europe, as well as the processing of personal data of European Union (“EU”) citizens, wherever that processing occurs. The United Kingdom (“U.K.”) implemented the Data Protection Act, effective May 2018, and statutorily amended it in 2019 to contain provisions, including its own derogations, for how GDPR is applied in the U.K. post-Brexit (the “UK GDPR”). The GDPR includes operational requirements for companies that receive or process personal data of residents of the EU. For example, we are required to offer consent mechanisms to data subjects in Europe before processing data for certain aspects of our service. Failure to comply with GDPR may result in significant penalties for non-compliance of up to the greater of €20 million (£17.5 million in the U.K.) or 4% of an enterprise’s global annual revenue. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease/ change our processing of our data, enforcement notices, and/ or assessment notices (for a compulsory audit). We may also face civil including representative actions and other class action type (where individuals have ), potentially amounting to significant compensation or liabilities, as well as associated costs, of internal resources, and reputational .
Further, European regulators continue to be focused on compliance with requirements in the online behavioral advertising ecosystem and enforcing national laws that implement the ePrivacy Directive (commonly called the “Cookie Directive”) in those ecosystems. European court decisions and regulators’ recent guidance continue to drive increased attention to cookies and tracking technologies. As regulators start to enforce a stricter approach (which has already begun to occur in multiple EU member states, where data protection authorities have initiated a probe on third-party cookies), this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs, and subject us to additional liabilities.
IAB Europe previously collaborated with the digital advertising industry to create a user-facing framework (the Transparency and Consent Framework, or “TCF”) for establishing and managing legal bases under the GDPR and other U.K. and EU privacy laws including the ePrivacy Directive. In February 2022, the Belgian Data Protection Authority (“DPA”) issued an order against IAB Europe that imposes specific remedies on IAB Europe and its operation of TCF. IAB Europe appealed the Belgian DPA’s decision, and the Belgian Market Court issued an interim ruling on the appeal and referred preliminary questions to the CJEU for guidance. IAB Europe subsequently issued an updated version of the TCF, and following the CJEU’s March 2024 ruling, the appeal remains in the Belgian Market Court on the substantive questions posed.
In addition, some countries, including India, Brazil, Thailand, and Japan, are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our services or force us to change business practices to conform to local law. The U.S. federal government has additionally added restrictions on the flow of certain data to China and other so called “countries of concern” which has the potential to limit with whom we may partner or the data we are able to share with certain partners. Any failure to achieve required data protection standards (which are not currently clear when applied to the online advertising ecosystem) may result in lawsuits, regulatory fines, or other actions or liability, all of which may harm our results of operations and revenue opportunities. Because the interpretation and application of privacy and data protection laws, such as the CCPA and GDPR, and their related regulations and standards, are potentially uncertain and may be different across jurisdictions, it is possible that these laws, regulations and standards may be interpreted and applied in manners that are, or are asserted to be, with our data management practices or the technological features of our solutions.
We are also subject to laws and regulations that dictate whether, how, and under what circumstances we can transfer, process and/or receive certain data that is critical to our operations, including data shared between countries or regions in which we operate, and data shared among our products and services.
Table of Contents
We are also subject to regulation with respect to political advertising activities, which are governed by various federal and state laws in the United States, EU, and national and provincial laws worldwide. Online political advertising laws are rapidly evolving, and our publishers may impose restrictions on receiving political advertising, especially in light of recent elections both in the United States, EU. and in foreign jurisdictions. The lack of uniformity and increasing compliance requirements around political advertising may adversely impact the amount of political advertising spent through our platform, increase our operating and compliance costs, and subject us to potential liability from regulatory agencies. Moreover, in the European Union, the Regulation on the Transparency and Targeting of Political Advertising (“TTPA”) introduces new obligations for participants in the digital political advertising ecosystem, including enhanced transparency, labeling, and recordkeeping requirements, as well as restrictions on the use of personal data and inferred characteristics for targeting or amplifying political advertisements. Although the precise scope and application of the TTPA will depend on implementing guidance and national enforcement practices, it may be interpreted to apply to multiple participants in the advertising supply chain, including intermediaries such as supply-side platforms. Compliance with the TTPA may require changes to our products, processes, contractual arrangements, or data flows, increase compliance and operational costs, reduce demand for political advertising in the EU, or us to regulatory , , or other liability.
The collection and processing of health-related data presents heightened compliance risks due to the broad and ambiguous language of emerging privacy laws such as Washington’s My Health My Data Act (“MHMD”) and the Nevada Consumer Health Data Law. These laws expand the definition of “consumer health data” far beyond traditional medical information, potentially encompassing data points that are commonly used in digital advertising, such as location data, app usage, and browsing history when linked to health-related interests. Unlike HIPAA, which applies to specific entities such as healthcare providers, these new state laws cast a wider net, creating uncertainty around what constitutes health data and how it must be handled. Compliance obligations, including obtaining explicit consumer consent, offering broad deletion rights, and imposing strict contractual restrictions on data sharing, introduce operational complexity and potential liability for companies such as ours. Additionally, these laws contain private rights of action, exposing businesses to costly class action lawsuits even in cases where health-related data is inadvertently inferred rather than explicitly collected. As enforcement of these regulations ramps up, our company must continuously assess and adapt our data practices to mitigate risk, which may require limiting certain data-driven advertising use cases or investing in additional compliance infrastructure, impacting operational efficiency and revenue .
In addition to government regulation, privacy advocacy and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us or our customers. We are members of self-regulatory bodies that impose additional requirements related to the collection, use, and disclosure of consumer data. Under the requirements of these self-regulatory bodies, in addition to other compliance obligations, we are obligated to provide consumers with notice about our use of cookies and other technologies to collect consumer data and of our collection and use of consumer data for certain purposes, and to provide consumers with certain choices relating to the use of consumer data. Some of these self-regulatory bodies have the ability to discipline members or participants, which could result in fines, penalties, and/or public censure (which could in turn cause reputational harm) being imposed on us. Additionally, some of these self-regulatory bodies might refer violations of their requirements to the U.S. Federal Trade Commission or other regulatory bodies. If we were to be found responsible for such a violation, it could adversely affect our reputation, as well as our business, results of operations, and financial condition.
Legal uncertainty and industry unpreparedness for new regulations may mean substantial disruption and inefficiency, demand constraints, and reduced inventory supply and value.
Some of our publishers may be unprepared to comply with the evolving complexity established as a result of an abundance of state, national, and other privacy laws and regulations which are no longer solely limited to the CCPA, GDPR, and the UK GDPR, and which may result in removing or limiting personal data from their inventory before passing it into the bid stream. This may lower the value of their inventory, at least temporarily, resulting in loss of ad spend and revenue for us.
Table of Contents
As privacy and data protection laws continue to evolve, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our safeguards and practices that could result in fines, lawsuits, and other penalties, and significant changes to our publishers’ business practices and inventory. Even well-prepared publishers and buyers may be confronted with difficult choices and administrative and technical hurdles as they implement compliance programs and integrate with multiple other parties in the ecosystem. Further, compliance program design and implementation will be an ongoing process as understanding of the CCPA, CPRA, GDPR, UK GDPR, increasing numbers of U.S. state privacy laws, or other emerging regulations and industry compliance standards (such as those related to the use of Artificial Intelligence), evolves and companies address sometimes conflicting compliance guidance. In addition to California, approximately 20 U.S. states have enacted regulations that may apply to our business, and we expect more state legislatures or regulatory agencies to do the same. The resulting process friction could result in substantial inefficiency and loss of inventory and demand, as well as increased upon our organization as we seek to assist customers and adapt our own technology and processes as necessary to comply with laws and regulations and adapt to industry practice. The uncertain regulatory environment caused by the CCPA, GDPR, UK GDPR, increasing numbers of U.S. state privacy laws, or other emerging regulations may us in comparison to larger, integrated competitors such as Google and Meta (Facebook), which have compliance resources and can take of their direct relationships with end users to secure consent directly from those users. Changes in the business practices of such large integrated competitors could impose additional requirements with respect to the retention and security of our handling or ability to handle customer and end user data, could limit our marketing and core business activities, and have an effect on our business, results of operations, and financial condition.
Recent legal developments in Europe have introduced uncertainty for transferring personal data from the European Union to the United States, which may require us to change our EU data practices.
The GDPR generally prohibits the transfer of personal data of EU subjects outside of the European Union to another country that the European Commission does not recognize as offering an adequate level of data protection unless a lawful data transfer mechanism has been implemented or a data transfer derogation applies. On July 10, 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework (“DPF”) as a valid transfer mechanism for data transfers to the United States, and we have self-certified to comply with the EU - U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework as a mechanism to legally facilitate personal data transfers from the EU, the U.K., and Switzerland to the U.S. This new Data Privacy Framework could be subject to legal challenge in front of the Court of Justice for the European Union (the “CJEU”), where non-governmental organizations successfully litigated to invalidate previous framework, known as Privacy Shield, in 2020.
Specifically, recent developments have introduced potential challenges to the stability of the DPF. On January 27, 2025, the Trump administration dismissed all three Democratic members of the Privacy and Civil Liberties Oversight Board (PCLOB), the independent agency responsible for overseeing U.S. surveillance activities and ensuring they align with privacy and civil liberties standards. This action has left the PCLOB without a quorum, effectively incapacitating its ability to function and fulfill its oversight responsibilities.
The operational status of the PCLOB was a significant factor in the European Commission's decision to adopt the DPF. The current limited functionality of the PCLOB raises concerns about the continued viability of the DPF and may prompt legal challenges, including potential scrutiny by the Court of Justice of the European Union (CJEU).
The Standard Contractual Clauses (“SCCs”) is an alternative transfer measure that we also offer to our EU and UK customers for cross-border data transfers that was upheld as a valid legal mechanism for transnational data transfers by the CJEU in 2020. However, the ruling requires that organizations seeking to rely on the SCCs to export data out of the European Union must ensure the data is protected to a standard that is “essentially equivalent” to that in the European Union, including, where necessary, by taking “supplementary measures” to protect the data. Although “supplementary measures” are not explicitly defined, it is possible that European data protection authorities may determine that there are no supplementary measures that can legitimize EU-US data transfers. For the time being, we will rely on the DPF and SCCs for EU-US transfers of EU personal data and explore what “supplementary measures” can implemented to protect EU personal data that is transferred to us in the United States. SCCs also contemplate data received from a third party, but may not cover data that is collected directly on behalf of a third party. In June 2021, the European Commission further updated the SCCs to require additional information for cross-border data transfers. It remains possible that the SCCs may be later determined inadequate to cover our use of cookies and other tracking technologies placed directly on consumer’s browsers or devices through our publishers or buyers’ websites.
Table of Contents
Depending on evolving legal developments, we may need to restructure our transfers of European data via another European subsidiary and have such entity enter into SCCs with other group entities and implement “supplementary measures” to ensure the continuing flow of data from the European Union to the United States. In the event that use of the SCCs is subsequently invalidated as a solution for data transfers to the United States, or there are additional changes to the data protection regime in the European Union resulting in any inability to transfer personal data from the European Union to the United States in compliance with data protection laws, European customers may be more inclined to work with businesses that do not rely on such compliance mechanisms to ensure legal and regulatory compliance, such as EU-based companies or other competitors that do not need to transfer personal data to the United States in order to avoid the above-identified risks and legal issues. Such changes could cause us to incur penalties under GDPR and UK GDPR and could increase the cost and complexity of operating our business.
Our failure or the failure of third parties to protect our sites, networks and systems against security breaches, or otherwise to protect our confidential information, could damage our reputation and brand and substantially harm our business and operating results.
We collect, maintain, transmit and store data about consumers, employees, partners and others, including personal and other confidential information.
We also engage third parties that store, process, and transmit these types of information on our behalf. We rely on encryption and authentication technology licensed from third parties in an effort to securely transmit confidential and sensitive information, including payment information. Advances in computer capabilities, new technological discoveries, or other developments may result in the whole or partial failure of this technology to protect transaction data or other confidential and sensitive information from being breached or compromised. In addition, ecommerce websites are often attacked through compromised credentials, including those obtained through phishing and credential stuffing. Our security measures, and those of our third-party service providers, might not detect or prevent all attempts to breach our systems, denial-of-service attacks, viruses, malicious software, break-ins, phishing attacks, social engineering, security breaches, ransomware, credential stuffing attacks, or other attacks and similar disruptions that may jeopardize the security of information stored in or transmitted by our websites, networks, and systems or that we or such third parties otherwise maintain, including payment card systems, which may subject us to , higher transaction fees, or limit or our access to certain payment methods. We and such third parties might not anticipate, prevent, or detect attacks until after they have already been launched. Further, techniques used to obtain access to, or , systems change frequently and might not be known until launched us or our third-party service providers. In addition, security can also occur as a result of non-technical issues, including or by our employees or by third parties. These risks can increase over time as the complexity and number of technical systems and applications we use also increases.
Breaches of our security measures or those of our third-party service providers on whom we rely or other cyber security incidents could result in unauthorized access to our mobile applications, sites, networks and systems; unauthorized access to and misappropriation of data and customer information, including customers’ personally identifiable information, or other confidential or proprietary information of ourselves or third parties; viruses, worms, spyware or other malware being served from our mobile applications, sites, networks or systems; deletion or modification of content or the display of unauthorized content on our mobile applications or sites; interruption, disruption or malfunction of operations; costs relating to breach remediation, deployment of additional personnel and protection technologies, response to governmental investigations and media inquiries and coverage; engagement of third-party experts and consultants; litigation; regulatory action; , or , and other potential liabilities. In the future, we or our third-party service providers may experience social engineering, ransomware, phishing, malware and similar attacks and of -of-service attacks and such attacks could have a material effect on our operations and financial condition. If any of these of security should occur, our reputation and brand could be , our business may , we could be required to expend significant capital and other resources to alleviate caused by such , and we could be to a risk of , or regulatory action and possible liability. We cannot guarantee that recovery protocols and backup systems will be sufficient to prevent data . Actual or anticipated attacks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants. In addition, any party who is to obtain a user’s password could access the user’s transaction data or personal data, resulting in the perception that our systems are .
Table of Contents
Many U.S. and foreign laws and regulations require companies to provide notice of data security breaches and/or incidents involving certain types of personal data to individuals, the media, government authorities or other third parties. In addition, some of our customers contractually require notification of data security breaches. Any compromise or breach of our security measures, or those of our third-party service providers, could cause significant legal and financial exposure, adverse publicity, and a loss of confidence in our security measures, which could have a material adverse effect on our business, results of operations, financial condition and prospects. There can be no assurance that any limitations of liability provisions in our contracts would be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim arising from a cyber incident. We also cannot be sure that our existing cyber insurance coverage, general liability insurance coverage, and coverage for or will fully cover such , will continue to be available on acceptable terms, or will be available in sufficient amounts to cover one or more large , or that insurers will not coverage as to any future claim. One or more large, us in excess of our available insurance coverage, or changes in our insurance policies, including premium increases or large deductible or co-insurance requirements, could have an effect on our business, operating results and financial condition.
Failure to comply with industry self-regulation could adversely affect our business, results of operations, and financial condition.
In addition to complying with government regulations, we participate in trade associations and industry self-regulatory groups such as the Interactive Advertising Bureau, the Trustworthy Accountability Group, the Digital Advertising Alliance, and the Networking Advertising Initiative that promote best practices or codes of conduct addressing privacy and consumer transparency in interest-based advertising. For example, we have undertaken to comply with industry codes of conduct in the United States and Europe. On our website, we offer consumers the ability to opt out of receiving advertisements based on cookies or other technologies. If we encounter difficulties implementing such guidelines, or our opt-out mechanisms fail to work as designed, we may experience negative publicity and be the subject of investigations or litigation.
Some of these self-regulatory bodies have the ability to discipline members or participants, which could result in fines, penalties, and/or public censure (which could in turn cause reputational harm) being imposed on us. Additionally, some of these self-regulatory bodies might refer violations of their requirements to the U.S. Federal Trade Commission or other regulatory bodies. Therefore, any representations that we make regarding our adherence to self-regulatory standards could result in regulatory action if we fail to meet such representations. Any regulatory action against us could be costly and time consuming, require us to change our business practices, cause us to divert management’s attention and our resources, and be damaging to our reputation and our business. New self-regulatory guidelines that are inconsistent with our practices or in conflict with applicable laws and regulations in the United States and other countries where we do business could arise. If we to abide by or are perceived as not operating in accordance with applicable laws, regulations, and industry practices, or any industry guidelines or codes with regard to privacy or the provision of Internet advertising, our reputation may and we could market share or relationships with our publishers, buyers, or others.
In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may apply to us, and are constantly evolving in the United States, European Union, and other jurisdictions. Because the interpretation and application of privacy and data protection laws, regulations, rules, and other standards are still uncertain, it is possible that these laws, rules, regulations, and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the functionality of our platform. If so, in addition to the possibility of fines, lawsuits, and other claims, we could be required to change our offerings or business activities and practices or modify our software, any of which could have an adverse effect on our business, results of operations, and financial condition.
We are subject to governmental economic sanctions requirements and export and import controls that could impair our ability to compete in international markets or subject us to civil or criminal liability.
We are subject to various U.S. export control and trade and economic sanctions laws and regulations, including the U.S. Export Administration Regulations and the various sanctions programs administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (collectively, “Trade Controls”). U.S. Trade Controls may prohibit the shipment of specified products and services to certain countries, governments, and persons. Although we endeavor to conduct our business in compliance with Trade Controls, our limited ability to oversee and control the inventory of our channel partners or our failure to successfully comply may expose us to negative legal and business consequences, including civil or criminal penalties, governmental investigations, and reputational harm.
Furthermore, if we export our technology or software, the exports may require authorizations, including a license, a license exception, or other appropriate government authorization or regulatory requirements. Complying with Trade Controls may be time-consuming and may result in the delay or loss of opportunities.
Table of Contents
In addition, various countries regulate the import of encryption technology, including the imposition of import permitting and licensing requirements, and have enacted laws that could limit our ability to offer our platform or could limit our customers’ ability to use our platform in those countries. Changes in our platform or future changes in export and import regulations may create delays in the introduction of our platform in certain markets or prevent our customers with international operations from deploying our platform globally. Any change in export or import regulations, global trade activity, economic sanctions or related legislation, or change in the countries, governments, persons, or technologies targeted by such regulations, could result in decreased use of our platform by, or in our decreased ability to export our technology and services to, existing or potential customers with international operations. Any decreased use of our platform or limitation on our ability to export our platform could adversely affect our business, results of operations, and financial condition.
Risks Related to Intellectual Property
We may be subject to intellectual property rights claims by third parties, which are costly to defend, could require us to pay significant damages, and could limit our ability to use technology or intellectual property.
We operate in an industry with extensive intellectual property litigation. There is a risk that our business, platform, and services may infringe or be alleged to infringe the trademarks, copyrights, patents, and other intellectual property rights of third parties, including patents held by our competitors or by non-practicing entities. We could be subject to third party claims if our publishers or buyers do not have sufficient rights to the content, technology, data, or other material associated with an ad impression that they provide, or if it infringes or is alleged to infringe the intellectual property rights of other parties. We may also face allegations that our employees have misappropriated or divulged the intellectual property of their former employers or other third parties. Regardless of whether claims that we are infringing on the intellectual property rights of others have any merit, the are time consuming, management attention and financial resources, and are to evaluate and . Some of our competitors have substantially resources than we do and are to sustain the cost of complex intellectual property to a extent and for longer periods of time than we could. Due to the cost of , we may choose to enter into license agreements with third parties even when we do not believe our business, platform, or services on third parties’ intellectual property rights. Results of intellectual property matters are to predict and may require us to stop offering some features, purchase licenses, which may not be available on terms or at all, or modify our technology or our platform while we develop non- substitutes, or incur significant settlement costs. Any of these events could have an effect on our business, results of operations, and financial condition.
Our intellectual property rights may be difficult to enforce and protect, which could enable others to copy or use aspects of our technology without compensating us, thereby eroding our competitive advantages and having an adverse effect on our business, results of operations, and financial condition.
We rely upon a combination of trade secrets protections, third-party confidentiality and non-disclosure agreements, contractual restrictions on disclosure and use, and trademark, copyright, patent, and other intellectual property laws to establish and protect our proprietary technology and intellectual property rights. We rely on copyright laws to protect computer programs related to our platform and our proprietary technologies, although to date we have not registered for statutory copyright protection. In order to bring a copyright infringement lawsuit in the United States, the copyright must be registered. Accordingly, the remedies and damages available to us for unauthorized use of our software or products may be limited. Historically, we have prioritized keeping our technology architecture, trade secrets, and engineering roadmap private and confidential, and as a general matter, have not patented our proprietary technology. As a result, we cannot look to patent enforcement rights to protect much of our proprietary technology. Any issued patents may be challenged, invalidated, or circumvented, and any rights granted under these patents may not actually provide adequate defensive protection or competitive advantages to us. Additionally, the process of obtaining patent protection is expensive and time-consuming, and we may not be to all necessary or patent applications at a reasonable cost or in a timely manner.
Table of Contents
We cannot guarantee that others will not independently develop technology with the same or similar functions to our proprietary technology that we rely on to conduct our business and differentiate ourselves from our competitors. Unauthorized parties may also attempt to copy or obtain and use our technology to develop applications with the same functionality as our offerings, and policing unauthorized use of our technology and intellectual property rights is difficult, time-consuming, and costly, and may not be effective. In addition, the laws of some foreign countries may not be as protective of intellectual property rights as those of the United States, and mechanisms for enforcement of our intellectual property rights in such countries may be inadequate. If we are unable to protect our intellectual property rights (including in particular, the proprietary aspects of our offerings) we may find ourselves at a competitive disadvantage to others who have not incurred the same level of expense, time, and effort to create and protect their intellectual property, which could adversely affect our business, results of operations, and financial condition.
While it is our policy to protect and defend our rights to our intellectual property, especially via trade secrets protections, we cannot predict whether steps taken by us to protect our intellectual property will be adequate to prevent infringement, misappropriation, dilution, or other violations of our intellectual property rights. Third parties may knowingly or unknowingly infringe our intellectual property rights, third parties may challenge intellectual property rights held by us, and pending and future trademark and patent applications may not be approved. These claims may result in restrictions on our use of our intellectual property or the conduct of our business. In any of these cases, we may be required to expend significant time and expense to prevent infringement or to enforce our rights.
Our customer agreements generally restrict the use of our confidential information solely to such customer’s use in connection with its use of our offerings. In spite of such limitations, reverse engineering our software and feature sets, or the theft or misuse of our confidential information, could occur by customers or other third parties who have access to our technology, and we may fail to detect such theft or misuse in a timely manner.
We also endeavor to enter into agreements with our employees and contractors in order to limit access to and disclosure of our confidential information, as well as to clarify rights to intellectual property and technology associated with our business. These agreements may not effectively grant all necessary rights to any inventions that may have been developed by such employees or consultants. In addition, these agreements may not effectively prevent unauthorized use or disclosure of our confidential information, intellectual property, or technology and may not provide an adequate remedy in the event of unauthorized use or disclosure of our confidential information, intellectual property, or technology. Furthermore, protecting our intellectual property is particularly challenging after our employees or contractors end their relationship with us, and, in some cases, decide to work for our competitors. Enforceability of the non-compete agreements that we have in place is not guaranteed, and contractual restrictions could be breached without us becoming aware of such breach or adequate remedies available to us.
We rely on licenses to use the intellectual property rights of third parties to conduct our business.
We rely on products, technologies, and intellectual property that we license from third parties for use in operating our business. We cannot assure you that these third-party licenses, or support for such licensed products and technologies, will continue to be available to us on commercially reasonable terms, if at all. We cannot be certain that our licensors are not infringing the intellectual property rights of others or that our suppliers and licensors have sufficient rights to the technology in all jurisdictions in which we may operate. Some of our license agreements may be terminated by our licensors for convenience. If we are unable to obtain or maintain rights to any of this technology because of intellectual property infringement claims brought by third parties against our suppliers and licensors or against us, or if we are unable to continue to obtain the technology or enter into new agreements on commercially reasonable terms, our ability to operate and expand our business could be adversely affected.
Table of Contents
Our platform relies on third-party open source software components. Failure to comply with the terms of the underlying open source software licenses could expose us to liabilities, and the combination of open source software with code that we develop could compromise the proprietary nature of our platform.
Our platform utilizes software licensed to us by third-party authors under “open source” licenses, and we expect to continue to utilize open source software in the future. The use of open source software may entail greater risks than the use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code. To the extent that our platform depends upon the successful operation of the open source software we use, any undetected errors or defects in this open source software could prevent the deployment or impair the functionality of our platform, delay new solutions introductions, result in a failure of our platform, and harm our reputation. For example, undetected errors or in open source software could render it to or security attacks, and, in conjunction, make our systems more to data . Furthermore, some open source licenses contain requirements that we make available source code for modifications or derivative works we create based upon the type of open source software we use. If we combine our proprietary software with open source software in a specific manner, we could, under some open source licenses, be required to release the source code of our proprietary software to the public. This would allow our competitors to create similar solutions with lower development cost, effort, and time, and ultimately put us at a competitive .
Although we monitor our use of open source software to avoid subjecting our platform to conditions we do not intend or requirements to disclose source code, we cannot assure you that our processes for controlling our use of open source software in our platform will be effective. If we are held to have breached the terms of an open source software license, we could be required to seek licenses from third parties to continue operating using our offerings on terms that are not economically feasible, to re-engineer our solution or the supporting computational infrastructure to discontinue use of code, or to make generally available, in source code form, portions of our proprietary code.
Risks Related to Financial and Accounting Matters
If we fail to maintain effective internal controls, our ability to produce accurate financial statements and other disclosures on a timely basis could be impaired.
We are required, pursuant to Section 404 of the Sarbanes-Oxley Act (“SOX”), to furnish a report by management on, among other things, the effectiveness of our internal controls over financial reporting. The failure to implement and maintain effective internal controls over financial reporting, could adversely affect our business, results of operations, our financial condition and could have a negative effect on the trading price of our Class A common stock. Potential challenges, risks and difficulties could include:
• failure to meet our reporting obligations;
• restatement of our financial statements due to an undetected material weakness;
• loss of investor confidence in our reported financial information; and
• additional costs to remediate any identified material weaknesses.
If we are unable to continue to meet the reporting requirements per the SEC and SOX, we may not be able to remain listed on the Nasdaq Global Market.
In addition to our results determined in accordance with GAAP, we believe certain non-GAAP measures and key metrics may be useful in evaluating our operating performance. We present certain non-GAAP financial measures and key metrics in this report and intend to continue to present certain non-GAAP financial measures and key metrics in future filings with the SEC and other public statements. Any failure to accurately report and present our non-GAAP financial measures and key metrics could cause investors to lose confidence in our reported financial and other information, which could have a negative effect on the trading price of our Class A common stock.
Table of Contents
Our credit agreement contains operating and financial covenants that may restrict our business and financing activities.
As of December 31, 2025, we had no outstanding borrowings under our Senior Secured Credit Facilities Credit Agreement (the “Credit Agreement”) with Silicon Valley Bank (“SVB”). Borrowings under the Credit Agreement are secured by substantially all of our assets. The Credit Agreement contains customary representations and warranties as well as customary affirmative and negative covenants. Negative covenants include, among others, limitations on incurrence of, indebtedness, liens, dispositions of property and investments by us and our subsidiaries. In addition, the Credit Agreement requires us to maintain certain interest coverage, leverage and senior leverage ratios. The operating and financial restrictions and covenants in the Credit Agreement, as well as any future financing arrangements that we may enter into, may restrict our ability to finance our operations, engage in, expand, or otherwise pursue our business activities and strategies. Our ability to comply with these or other covenants may be affected by events beyond our control, and future breaches of these or other covenants could result in a default under the Credit Agreement. If not waived, future defaults could cause all of the outstanding indebtedness under our Credit Agreement to become immediately due and payable and all commitments to extend further credit.
If we do not have or are unable to generate sufficient cash to repay our debt obligations when they become due and payable, either upon maturity or in the event of a default, it could negatively impact our ability to operate and continue our business as a going concern. Additionally, if we are unable to repay our debt obligations under the Credit Agreement, we may not be able to obtain additional future debt or equity financing on favorable terms, if at all, which could negatively impact our ability to operate and continue our business as a going concern.
On March 10, 2023, SVB was closed by the California Department of Financial Protection and Innovation and subsequently appointed the Federal Deposit Insurance Corporation (“FDIC”) as receiver. Similarly, on March 12, 2023, Signature Bank and Silvergate Capital Corp. were each swept into receivership. While the FDIC has taken steps to make whole all depositors of SVB, there is no assurance that similar guarantees will be made in the event of further bank closures or instability in the global banking system. If other banks and financial institutions enter receivership or become insolvent in the future in response to financial conditions affecting the banking system and financial markets, then our ability to obtain financing may be threatened, which could have a material adverse effect on our business and financial condition. Moreover, events such as the closure of SVB, in addition to other global macroeconomic conditions, may cause further disruptions and uncertainty in the capital markets.
Our tax liabilities may be greater than anticipated.
The U.S. and non-U.S. tax laws applicable to our business activities are subject to interpretation and change. We are subject to audit by the Internal Revenue Service and by taxing authorities of the state, local and foreign jurisdictions in which we operate. Our tax obligations are based in part on our corporate operating structure, including the manner in which we develop, value, use and hold our intellectual property, the jurisdictions in which we operate, how tax authorities assess revenue-based taxes such as sales and use taxes, the scope of our international operations, and the value we ascribe to our intercompany transactions. Taxing authorities may challenge, and have challenged, our tax positions and methodologies for valuing developed technology or intercompany arrangements, positions regarding the collection of sales and use taxes, and the jurisdictions in which we are subject to taxes, which could expose us to additional taxes. Any adverse outcomes of such challenges to our tax positions could result in additional taxes for prior periods, interest and penalties, as well as higher future taxes.
In addition, our future tax expense could increase as a result of changes in tax laws, regulations or accounting principles, or as a result of earning income in jurisdictions that have higher tax rates. For example, various jurisdictions have threatened to impose laws that tax specified digital services, which may increase our tax obligations in such jurisdictions. Many countries have adopted changes to their tax laws based on the model rules adopted by The Organization for Economic Cooperation and Development defining a 15% global minimum tax (commonly referred to as Pillar 2) that could increase our tax obligations in countries where we do business or cause us to change the way we operate our business. Any increase in our tax expense could have a negative effect on our financial condition and results of operations. Moreover, the determination of our provision for income taxes and other tax liabilities requires significant estimates and judgment by management, and the tax treatment of certain transactions is uncertain.
Any changes, ambiguity, or uncertainty in taxing jurisdictions’ administrative interpretations, decisions, policies and positions, including the position of taxing authorities with respect to revenue generated by reference to certain digital services, could also materially impact our income tax liabilities. Although we believe we have made and will continue to make reasonable estimates and judgments, the ultimate outcome of any particular issue may differ from the amounts previously recorded in our financial statements and any such occurrence could adversely affect our business, results of operations, and financial condition.
Table of Contents
Tax changes could affect our effective tax rate and future profitability.
We are subject to federal, state, and local taxes in the United States, and we are subject to taxes in numerous foreign jurisdictions. Significant judgment is required in evaluating our tax positions and our worldwide provision for income taxes. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain. In addition, our future income tax obligations could be adversely affected by changes in, or interpretations of, tax laws in the United States or in other jurisdictions in which we operate. For example, the United States tax legislation commonly referred to as the Tax Cuts and Jobs Act of 2017 (the “Tax Act”) (as modified by the Coronavirus Aid, Relief, Economic Security Act, the Families First Coronavirus Response Act and the American Rescue Plan Act), significantly reformed the Internal Revenue Code of 1986, as amended, reducing U.S. federal tax rates, making sweeping changes to rules governing international business operations, and imposing significant additional limitations on tax benefits, including the deductibility of interest and the capitalization of research and development expenses. In addition, the Inflation Reduction Act of 2022 (the “Inflation Reduction Act”) imposes a 15% corporate alternative minimum tax and 1% excise tax on repurchases of corporate stock. We anticipate further changes in the tax laws of the United States in the future.
Tax proposals and enactments worldwide include changes to the existing framework in respect of income taxes, limitations on the ability of taxpayers to claim and utilize tax benefits, as well as new types of non-income taxes (such as taxes based on a percentage of revenue or taxes applicable to digital services). For example, the Organisation for Economic Co-operation and Development proposed introduction of the global minimum tax standard. Due to the large and expanding scale of our international business activities, these types of changes to the taxation of our activities could impact the tax treatment of our foreign earnings, increase our worldwide effective tax rate, increase the amount of taxes imposed on our business, and impact our financial position.
Risks Related to Ownership of Our Class A Common Stock
The trading price of the shares of our Class A common stock has been and may continue to be volatile and could subject us to litigation.
Technology stocks historically have experienced high levels of volatility. The trading price of our Class A common stock has fluctuated substantially and may continue to do so. These fluctuations could cause holders of our Class A common stock to incur substantial losses, including all of such investment in our Class A common stock. Factors that could cause fluctuations in the trading price of our Class A common stock, some of which are beyond our control and may not be related to our operational or financial performance, include, among others, the following:
• volatility in the market price and trading volume of technology companies in general and of companies in the digital advertising industry in particular;
• announcements of new solutions or technologies, commercial relationships, acquisitions, or other events by us or our competitors;
• the public’s reaction to our press releases, other public announcements, and filings with the SEC;
• fluctuations in the trading volume of our shares or the size of our public float;
• sales of large blocks of our common stock; actual or anticipated changes or fluctuations in our results of operations or financial projections;
• changes in actual or future expectations of investors or securities analysts;
• governmental or regulatory developments or actions, or litigation involving us, our industry, or both; and
• general economic conditions and trends or catastrophic events in our domestic and foreign markets.
In addition, if the market for technology stocks, the stock of digital advertising companies or the stock market, in general, experiences a loss of investor confidence, the trading price of our Class A common stock could decline for reasons unrelated to our business, results of operations, or financial condition. The trading price of our Class A common stock might also decline in reaction to events that affect other companies in the digital advertising industry even if these events do not directly affect us. In the past, following periods of volatility in the market price of a company’s securities, securities class action litigation has often been brought against that company. If litigation is instituted against us, it could subject us to substantial costs, divert management’s attention and resources, and adversely affect our business.
Table of Contents
Insiders have substantial control over our company, including as a result of the dual class structure of our common stock, which could limit or preclude investors’ ability to influence corporate matters, including the election of directors and the approval of any change of control transaction.
Our Class B common stock has ten votes per share, and our Class A common stock has one vote per share. Transfers of stock by holders of Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions. As of January 31, 2026, our directors and officers, and their respective affiliates, beneficially owned in the aggregate approximately 67.5% of the voting power of our capital stock. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval. This concentrated control will limit or preclude investors’ ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. The interests of this group of stockholders may not coincide with our interests or the interests of other stockholders. This concentration of ownership may also have the effect of deterring, delaying or a change of control of our company, could our stockholders of an to receive a premium for their common stock as part of a sale of our company and might ultimately affect the market price of our common stock. Having a dual-class common stock structure may make our Class A common stock less to some investors, such as funds and investment companies that attempt to track the performance of any indexes that prohibit or limit the inclusion of companies with such structures.
Sales of substantial amounts of our Class A common stock in the public markets, or the perception that they might occur, could cause the market price of our Class A common stock to decline.
Sales of a substantial number of shares of our Class A common stock into the public market, particularly sales by our directors and executive officers, or the perception that these sales might occur, could cause the market price of our Class A common stock to decline and may make it more difficult for shareholders to sell shares of our Class A common stock at a time and price they deem appropriate. Our directors, executive officers and employees hold options and restricted stock units under our equity incentive plans, and the common stock issuable upon the exercise of such options or vesting of such restricted stock units has been registered for public resale under the Securities Act. Accordingly, these shares of common stock will be able to be freely sold in the public market upon issuance subject to certain legal and contractual requirements.
Our charter documents and Delaware law could discourage takeover attempts and other corporate governance changes.
Our restated certificate of incorporation, as amended (the “restated certificate of incorporation”) and restated bylaws contain provisions that could delay or prevent a change in control of our company. These provisions could also make it difficult for stockholders to elect directors who are not nominated by the current members of our board of directors or take other corporate actions, including effecting changes in our management. These provisions include:
• a provision that our board of directors will be classified into three classes of directors with staggered three-year terms at such time as the outstanding shares of our Class B common stock represent less than a majority of the combined voting power of our common stock, which could delay the ability of stockholders to change the membership of our board;
• the ability of our board to issue shares of preferred stock without stockholder approval, which could be used to significantly dilute the ownership of a hostile acquirer;
• a prohibition on stockholder action by written consent effective upon such time as the outstanding shares of our Class B common stock represent less than a majority of the combined voting power of our common stock;
• the requirement that a special meeting of stockholders may be called only by the chairman of the board, our chief executive officer, our lead director, or a majority of our board;
• the requirement for the affirmative vote of holders of at least 66-2/3% of the voting power of all of the then outstanding shares of the voting stock, voting together as a single class, to amend provisions of our restated certificate of incorporation or our restated bylaws;
• the ability of our board to amend the bylaws, which may allow it to take additional actions to prevent an unsolicited takeover and inhibit the ability of an acquirer;
• the requirement that stockholders submitting notice of a nomination or proposal to be considered at an annual meeting of our stockholders must have continuously beneficially owned at least 1% of our outstanding common stock for a period of one year before giving such notice;
Table of Contents
• advance notice procedures with which stockholders must comply to nominate candidates to our board or to propose matters to be acted upon at a stockholders’ meeting; and
• the dual class common stock structure in which holders of our Class B common stock have the ability to control the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the outstanding shares of our common stock, including the election of directors and significant corporate transactions, such as a merger or other sale of our company or its assets.
In addition, our restated certificate of incorporation provides that the Court of Chancery of the State of Delaware will be the exclusive forum for derivative actions, actions asserting a breach of fiduciary duty, actions asserting a claim against us arising pursuant to the Delaware General Corporation Law, our restated certificate of incorporation or restated bylaws, or any action asserting a claim against us that is governed by the internal affairs doctrine. This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers, or other employees, which may discourage lawsuits with respect to such claims. Alternatively, if a court were to find the choice of forum provision contained in our restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could affect our business, results of operations, and financial condition.
In addition, because we are incorporated in Delaware, we are governed by the provisions of the anti-takeover provisions of the Delaware General Corporation Law, which may discourage, delay or prevent a change in control by prohibiting us from engaging in a business combination with an interested stockholder for a period of three years after the person becomes an interested stockholder, even if a change of control would be beneficial to our existing stockholders. Although we believe these provisions collectively provide for an opportunity to obtain greater value for stockholders by requiring potential acquirers to negotiate with our board, they would apply even if an offer rejected by our board was considered beneficial by some stockholders. In addition, these provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board, which is responsible for appointing the members of our management.
