AdTheorent Holding (ADTH) Risk Analysis

As a demand side platform within the digital programmatic ecosystem, we receive, store and process certain personal information and other data from and about consumers in addition to personal information and other data from and about our customers, employees, and services providers. Our handling of this data is subject to a wide variety of federal, state, and foreign laws and regulations and is subject to regulation by various government authorities and consumer actions. Our data handling is also subject to contractual obligations and may be deemed to be subject to industry standards. The U.S. federal and various state and foreign governments have adopted or proposed laws relating to the collection, disclosure, processing, use, storage and security of data relating to individuals and households, including the use of contact information and other data for marketing, advertising and other communications with individuals and businesses. In the U.S., various laws and regulations apply to the collection, disclosure, processing, use, storage and security of certain types of data. Additionally, the FTC, many state attorneys general, and many courts are interpreting federal and state consumer protection laws as imposing standards for the collection, disclosure, process, use, storage and security of data. The regulatory framework for data privacy issues worldwide is complex, continually evolving and often conflicting, and is likely to remain uncertain for the foreseeable future. The occurrence of unanticipated events often rapidly drives the adoption of legislation or regulation affecting the use, collection or other processing of data and the manner in which we conduct our business. As a result, further restrictions could be placed upon the collection, disclosure, processing, use, storage and security of information, which could result in a material increase in the cost of obtaining certain kinds of data and could limit the ways in which we may collect, disclose, process, use, store or secure information. U.S. federal and state legislatures, along with federal regulatory authorities, have recently increased their focus on matters concerning the collection and use of consumer data, including relating to interest- based advertising, or the use of data to draw inferences about a user's interests and deliver relevant advertising to that user, and similar or related practices, such as cross-device data collection and aggregation, and steps taken to de-identify personal data and to use and distribute the resulting data, including for purposes of personalization and the targeting of advertisements. In the U.S., non-sensitive consumer data generally may be used under current rules and regulations, subject to certain restrictions, including relating to transparency and affirmative "opt-out" rights of the collection or use of such data in certain instances. To the extent additional opt-out rights are made available in the U.S., additional regulations are imposed, or if an "opt-in" model were to be adopted, less data would be available, the cost of data and compliance would be higher, or we could be required to modify our data processing practices and policies. For example, California recently enacted legislation, the CCPA, that became operative on January 1, 2020 and came under California Attorney General ("AG") enforcement on July 1, 2020. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and grant such consumers a new right to opt-out of "sales" of personal information, a concept that is defined broadly. The CCPA is also subject to regulations issued by the California AG, which were finalized and became effective in August 2020. The California Privacy Rights and Enforcement Act ("CPRA"), which was passed as a ballot initiative in November 2020 and came into effect on January 1, 2023, expanded upon the CCPA and, among other things, created new categories of personal information with additional protections, created new data subject rights such as a right of correction, created a new state rulemaking and enforcement agency for the CPRA, and expands potential liability for violations. The CPRA also gives California consumers a new right to opt-out of "sharing" consumer data, which is defined to include any data transfer for the purpose of cross-context behavioral advertising. This new right likely applies to us and many of our customers, vendors, publishers, and other partners when we receive and share consumer data as part of our advertising targeting practices. Other states-Colorado, Connecticut, Utah, and Virginia-have passed similar comprehensive privacy laws containing similar opt-out rights, which are either already in effect or will take effect this year. It remains unclear how aspects of the CCPA (as amended by the CPRA), its implementing regulations, or the current and pending laws in other states will be interpreted. We cannot yet fully predict the impact of these laws on our business or operations, but it or future federal or state laws or regulations (particularly any regulations using an "opt-in" model or imposing "universal" or automated opt-out rights) could require us or our customers to modify data processing practices and policies and to incur substantial costs and expenses in an effort to comply. Decreased availability and increased costs of information and costs of compliance could adversely affect our ability to meet our customers' expectations and requirements and could result in decreased revenue. While our platform and framework operate primarily in the U.S. and Canada, some of our operations may subject us to data privacy laws outside the U.S. In the EU, the GDPR took effect on May 25, 2018 and applies to our processing of personal data related to individuals who are in the EU. The GDPR includes significant penalties for noncompliance of up to the greater of €20 million or 4% of an enterprise's global turnover (or revenue) for the preceding fiscal year, and each EU Member State may provide for other penalties applicable to such noncompliance. We are subject to evolving laws and regulations that dictate whether, how, and under what circumstances we, or our data processors, may transfer, process and/or receive certain data, including data shared between countries or regions in which we operate and data shared among our products and services. For example, ongoing legal uncertainty in Europe regarding the transfer of data to the U.S. could result in further limitations, including in light of the recent Schrems II ruling from the Court of Justice of the European Union dated July 16, 2020. This ruling effectively invalidated the EU-U.S. Privacy Shield framework, and while it upheld the Standard Contractual Clauses ("SCCs") as an alternative mechanism, it requires the parties to the SCCs to ensure that the level of protection required by European Union law is respected, potentially by yet-to-be-clarified supplementary measures. Like other U.S. companies, our ability to comply with this decision may depend on the continued existence and applicability of certain U.S. surveillance laws, which is not within our control. Similarly, legal uncertainty could result in further limitations regarding the United Kingdom, which exited the European Union on January 31, 2020, in particular in relation to data transfers to and from the United Kingdom. Certain countries outside of the European Union have also passed (e.g. Russia, China) or are considering passing laws requiring local data residency or otherwise impeding the transfer of data across borders. If one or more of the legal bases for transferring data is invalidated, if we are unable to transfer or receive data between and among countries and regions in which we operate, or if we are prohibited from sharing data among our products and services, it could affect the manner in which we provide our services or adversely affect our financial results. In addition to government regulation, self-regulatory standards and other industry standards may legally or contractually apply to us or be argued to apply to us, or we may elect to comply with such standards or to facilitate our customers' compliance with such standards. Because privacy, data protection, and information security are competitive factors in our industry, we may make statements on our website, in marketing materials, or in other settings about our data security measures and our compliance with, or our ability to facilitate our customers' compliance with, these standards. We are a member of self-regulatory bodies that impose additional requirements related to the collection, use, and disclosure of consumer data. Under the requirements of these self-regulatory bodies, in addition to other compliance obligations, we are obligated to provide all consumers with notice about our use of cookies and other technologies to execute the collection of consumer data and of our collection and use of consumer data for certain purposes, and to provide consumers with certain choices relating to the use of consumer data. Some of these self-regulatory bodies have the ability to discipline members or participants, which could result in fines, penalties, and/or public censure (which could in turn cause reputational harm). Additionally, some of these self-regulatory bodies might refer violations of their requirements to the Federal Trade Commission or other regulatory bodies. Regulatory investigations and enforcement actions could also impact us. In the U.S., the FTC uses its enforcement powers under Section 5 of the Federal Trade Commission Act (which prohibits "unfair" and "deceptive" trade practices) to investigate companies engaging in online tracking and the processing of consumer personal information more generally. Advocacy organizations have also filed complaints with applicable data protection authorities against advertising technology companies, arguing that certain of these companies' practices do not comply with the GDPR or other applicable authorities. It is possible that investigations or enforcement actions will involve our practices or similar practices. Our legal risk depends in part on our customers' or other third parties' adherence to privacy laws and regulations and their use of our services in ways consistent with end user expectations. We rely on representations made to us by customers and data suppliers that they will comply with all applicable laws, including all relevant privacy and data protection regulations. Although we make reasonable efforts to enforce such representations and contractual requirements, we do not fully audit our customers' or data suppliers' compliance with our recommended disclosures or their adherence to privacy laws and regulations. If our customers or data suppliers fail to adhere to our expectations or contracts in this regard, we and our customers or data suppliers could be subject to adverse publicity, damages, and related possible investigation or other regulatory activity. Because the interpretation and application of privacy and data protection laws, regulations and standards are uncertain, it is possible that these laws, regulations and standards may be interpreted and applied in manners that are, or are asserted to be, inconsistent with our data management practices or the technological features of our products and services. If so, in addition to the possibility of fines, investigations, lawsuits and other claims and proceedings, it may be necessary or desirable for us to fundamentally change our business activities and practices or modify our products and services, which could have an adverse effect on our business. We may be unable to make such changes or modifications in a commercially reasonable manner or at all. Any inability to adequately address privacy concerns, even if unfounded, or any actual or perceived failure to comply with applicable privacy or data protection laws, regulations, standards or policies, could result in additional cost and liability to us, damage our reputation, inhibit sales and harm our business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, standards and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our platform. Privacy concerns, whether valid or not valid, may inhibit market adoption of our platform particularly in certain industries and foreign countries. Adapting our business to the CCPA and its implementing regulations and to the enhanced and evolving privacy obligations in the EU and elsewhere could continue to involve substantial expense and may cause us to divert resources from other aspects of our operations, all of which may adversely affect our business. Further, adaptation of the digital advertising marketplace requires increasingly significant collaboration between participants in the market, such as publishers and marketers. Failure of the industry to adapt to changes required for operating under laws including the CCPA and the GDPR and user response to such changes could negatively impact inventory, data, and demand. We cannot control or predict the pace or effectiveness of such adaptation, and we cannot currently predict the impact such changes may have on our business.

We operate in a highly competitive and rapidly changing industry that is subject to changing technology and customer demands and that includes many companies providing competing solutions. With the introduction of new technologies and the influx of new entrants into the market, we expect competition to persist and intensify in the future, which could harm our ability to increase revenue and maintain profitability. New technologies and methods of buying advertising present a dynamic competitive challenge, as market participants offer multiple new products and services aimed at capturing advertising spend. We compete with smaller, privately held companies, with public companies such as The Trade Desk, as well as with divisions of large, well-established companies such as Google. Our current and potential competitors may have significantly more financial, technical, marketing and other resources than we have, allowing them to devote greater resources to the development, promotion, sale and support of their products and services. They may also have more extensive customer bases and broader supplier relationships than we have. As a result, these competitors may be better able to respond quickly to new technologies, develop deeper marketer relationships or offer services at lower prices. Increased competition may result in reduced pricing for our platform and services, increased sales and marketing expense, longer sales cycles or a decrease of our market share, any of which could negatively affect our revenue and future operating results and our ability to grow our business. These companies may also have greater brand recognition and longer histories than we have and may actively seek to serve our market and have the power to significantly change the nature of the marketplace to their advantage. Some of our larger competitors, particularly those that are divisions of large companies, have substantially broader product offerings and may leverage their relationships based on other products or incorporate functionality into existing products to gain business in a manner that may discourage customers from using our platform and services, including through selling at zero or negative margins or product bundling with other services they provide at reduced prices. Customers may prefer to purchase advertising from social medial platforms or other closed platforms, which they cannot acquire through our platform. Potential customers may also prefer to purchase from their existing platform rather than a new platform regardless of product performance or features. Larger competitors often have broader product lines and market focus than us and may therefore not be as susceptible to downturns in a particular market. We may also experience negative market perception as a result of being a smaller company than our larger competitors. In addition, we derive a significant portion of our revenue from advertising in the desktop, tablet, mobile and CTV channels, which are rapidly evolving, highly competitive, complex and fragmented. We face significant competition in these markets which we expect will intensify in the future.

With the growth of digital advertising and e-commerce, there is increasing awareness and concern among the general public, privacy advocates, mainstream media, governmental bodies and others regarding marketing, advertising, and data privacy matters, particularly as they relate to individual privacy interests and the global reach of the online marketplace. Concerns about industry practices with regard to the collection, use, and disclosure of personal information, whether or not valid and whether driven by applicable laws and regulations, industry standards, customer or inventory provider expectations, or the broader public, may harm our reputation, result in loss of goodwill, and inhibit use of our platform and services by current and future customers. Any unfavorable publicity or negative public perception about us, our industry, including our competitors, or even other data focused industries can affect our business and results of operations, and may lead to digital publishers or our customers changing their business practices or additional regulatory scrutiny or lawmaking that affects us or our industry. For example, in recent years, consumer advocates, mainstream media and elected officials have increasingly and publicly criticized the data and marketing industry for our collection, storage and use of personal data. Additional public scrutiny may lead to general distrust of our industry, consumer reluctance to share and permit use of personal data, increased consumer opt-out rates or increased private class actions, any of which could negatively influence, change or reduce our current and prospective customers' demand for our products and services, subject us to liability and adversely affect our business and operating results.

We do not provide or control the content of the advertisements we serve or that of the websites providing the inventory. Our customers provide the advertising content and inventory suppliers provide the inventory. Both customers and inventory suppliers are concerned about being associated with content they consider inappropriate, competitive or inconsistent with their brands, or illegal, and they are hesitant to spend money without guaranteed brand security. Consequently, our reputation depends in part on providing services that our customers and inventory suppliers trust. We prohibits the misuse of our platform by our agency and their brand marketer customers, and certain suppliers. Additionally, we use our proprietary technology and third-party services to, and we participate in industry co- ops that work to, detect malware and other content issues as well as click fraud (whether by humans or software known as "bots") and to block fraudulent inventory. Despite such efforts, our customers may inadvertently purchase inventory that proves to be unacceptable for their campaigns, in which case we may not be able to recoup the amounts paid to inventory suppliers. Preventing and combating fraud is an industry-wide issue that requires constant vigilance, as well as a balancing of cost effectiveness and risk, and we cannot guarantee that we will be fully successful in our efforts to combat fraud. We may provide access to inventory that is objectionable to our customers or we may serve advertising that contains malware or objectionable content to our inventory suppliers, which could harm our or our customers' brands and reputation, cause customers to decrease or terminate their relationship with us or otherwise negatively impact our business, operating results and financial condition.

Our business and operations have been and could in the future be adversely affected by health epidemics, such as the global COVID-19 pandemic, and could in the future be adversely affected by similar sustained adverse market events, such as a recession, depression, or similar event. Such adverse market events could materially and adversely affect our business and that of our customers or potential customers. Our customers' and potential customers' businesses or cash flows have been and may in the future be negatively impacted by adverse macroeconomic events, which may lead them to reduce their advertising spending and delay their advertising initiatives or technology spending, which may materially and negatively impact our business, operating results and financial condition. Our customers may also seek adjustments to their payment terms, delay making payments or default on their payables, any of which may impact the timely receipt and/or collectability of our receivables. As a result, our financial condition and results of operations may be adversely impacted if the business or financial condition of our customers and marketers is negatively affected by a sustained adverse market event. Economic uncertainty has made and may continue to make it difficult for us to forecast revenue and operating results and to make decisions regarding operational cost structures and investments. Our business depends on the overall demand for advertising and on the economic health of our customers that benefit from our platform and services. Economic downturns or unstable market conditions may cause our customers to decrease their advertising budgets, which could reduce usage of our platform and services and adversely affect our business, operating results and financial condition. We have committed, and we plan to continue to commit, resources to grow our business, including to expand our employee base and develop our platform, service offerings and systems, and such investments may not yield anticipated returns.