Digital Turbine (APPS) Risk Analysis

We provide a variety of products and services that enable carriers, manufacturers, application developers, advertisers, and users to engage in various mobile and online activities both domestically and internationally. Laws relating to the liability of providers of these mobile and online services and products for such activities is still unsettled and constantly evolving in the U.S. and internationally. Claims have been threatened and have been brought against us in the past for breaches of contract, copyright or trademark infringement, data privacy regulatory violations, tort, or other theories based on the provision of these products and services. In addition, we have been and may again in the future be subject to domestic or international actions alleging that certain content we have generated or third-party content that we have made available within our services violates laws in domestic and international jurisdictions. We may be subject to claims concerning these products, services, or content by virtue of our involvement in marketing, branding, broadcasting, or providing access to them, even if we do not ourselves host, operate, provide, own, or license these products, services, or content. While we routinely insert indemnification provisions into our contracts with these parties, such indemnities to us, when obtainable, may not cover all damages and losses suffered by us and our customers from covered products and services. In addition, recorded reserves and/or insurance coverage may be exceeded by unexpected results from such claims. Defending such actions could be costly and involve significant time and attention of our management and other resources, may result in monetary liabilities or penalties, and may require us to change our business in an adverse manner.

Malicious software like ransomware, viruses, and social engineering tactics such as phishing attacks are increasingly common in advertising and mobile app environments. Any successful or attempted security breaches could result in system disruptions, degrade user experiences, and impair our internal operations. Moreover, these incidents could damage our reputation, financial stability, and overall business performance. Despite our efforts to safeguard data and respond to threats, challenges like software bugs, human errors, cyberattacks, or physical breaches may undermine our defenses. Consequently, clients and users may lose confidence in our products, leading to reputational harm and market setbacks. As cyber threats advance in complexity and frequency, they may remain undetected for extended periods. While we've implemented systems and protocols to safeguard our data, user information, and collaborations, and to mitigate risks such as data loss and unauthorized activities, we cannot guarantee absolute security. Despite our efforts, we may not always identify breaches promptly or respond effectively. Therefore, we cannot always ensure the efficacy of our security measures or the success of our remedial actions. The expenses incurred to mitigate cyber or security issues, such as viruses, worms, and malware, could be substantial. Despite our efforts, resolving these issues may not always be successful and could lead to service interruptions, delays, or the loss of customers. We handle proprietary and sensitive data related to our operations, and any breaches or accidental disclosures of this information, including due to fraud or deception, could pose significant risks. Such incidents may result in litigation, liability, damage to our brand, or harm to our business and reputation. We are bound by numerous laws and regulations in the United States and internationally concerning cybersecurity and data protection. Some of these laws allow individuals to take legal action against us. Many regions have imposed obligations regarding breach notifications, and our agreements with specific customers or partners may necessitate us to inform them or fulfill other duties in case of a security breach. Individuals affected by breaches or governmental bodies may pursue legal or regulatory measures against us for actual or perceived breaches or unauthorized access or disclosure of data.

Our platform contains software modules by third-party authors that are publicly available under "open-source" licenses, and we expect to use open-source software in the future. While the use and distribution of open-source software is common in the industry, it may entail greater risks than use of third-party commercial software, as open-source licensors generally do not provide support, warranties, indemnification, or other contractual protections regarding infringement claims or the quality of the code. To the extent our platform depends on the successful operation of open-source software, any undetected errors or defects in such open-source software could prevent the deployment or impair the functionality of our platform, delay introductions of new solutions, result in a failure of any of our solutions, and injure our reputation. While our developed software undergoes testing, undetected errors or defects in open-source software could render it vulnerable to breaches or security attacks and make our systems more vulnerable to data breaches. The public availability of such software may make it easier for others to compromise our platform. Some open-source software licenses contain requirements that we make available source code for modifications or derivative works we create based on the type of open-source software we use or grant other licenses to our intellectual property. If we combine our proprietary software with open-source software in a certain manner, we could, under certain open-source licenses, be required to release the source code of our proprietary software to the public. While our open-source policies are meant to prevent such misuse, there can be no assurances such incidents will not occur. This would allow our competitors to create similar offerings with lower development effort and time and ultimately could result in a loss of our competitive advantages. Alternatively, to avoid the public release of the affected portions of our source code, we could be required to expend substantial time and resources to re-engineer our software. Although we monitor our use of open-source software to avoid subjecting our platform to conditions we do not intend, there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to provide or distribute our solutions. From time-to-time, there have been claims challenging the ownership of open-source software against companies that incorporate open-source software into their products or platforms. As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open-source software. Moreover, we cannot assure that our processes for controlling our use of open-source software in our platform will be effective. If we are held to have breached or failed to fully comply with all the terms and conditions of an open-source software license, we could face infringement or other liability, or be required to seek costly licenses from third parties to continue providing our solutions on terms that are not economically feasible, to re-engineer our solutions, to discontinue or delay the provision of our solutions if re-engineering could not be accomplished on a timely basis, or to make generally available, in source code form, our proprietary code, any of which could materially and adversely affect our business, financial condition, and results of operations.

Our platform relies on our ability to process the information of our customers and end users. These activities are regulated by a variety of federal, state, local, and international privacy, data governance, and data security laws and regulations, which have become increasingly stringent in recent years. Most jurisdictions in which we or our customers operate have enacted or are in the process of enacting privacy, data governance, and data security laws and regulations. In this regard, it is important to highlight the European Union's GDPR and the UK GDPR that regulate the processing of personal data in the European Economic Area ("EEA") member states and in the UK. Both impose a strict data protection compliance regime. We are subject to the supervision of local data protection and data governance authorities in those EEA and UK jurisdictions where we are established or otherwise subject to the GDPR and the UK GDPR. Fines for certain breaches of the GDPR are significant. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease or change our processing of personal data, enforcement notices, or assessment notices for a compulsory audit. We may also face civil claims including representative actions and other class action type litigation, potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm. This private right of action may increase the likelihood of, and risks associated with data breach litigation. In addition to increasing our compliance costs and potential liability, the California Consumer privacy Act ("CCPA") created restrictions on "sales" of personal information that may restrict the disclosure of personal information for advertising purposes. Our advertising business relies, in part, on such disclosure and could be materially and adversely affected by the CCPA's restrictions. Data privacy legislation imposes restrictions on cross-border personal data transfers, with some countries enacting data localization laws. Notably, the GDPR, UK GDPR, and other European and UK data protection statutes generally bar personal data transfer from the EEA, UK, and Switzerland to the U.S. and many other nations, except to entities in countries offering adequate protection or with specific safeguards in place. When transferring personal data outside the EEA or UK to non-"adequate" countries, we ensure compliance with relevant laws, potentially utilizing derogation or implementing standard contractual clauses. Since November 2023, we've participated in the EU-US Data Privacy Framework ("EU-US DPF"), UK Extension to the EU-US DPF ("UK Extension"), and Swiss-US Data Privacy Framework ("Swiss-US DPF") per the US Department of Commerce. We've certified adherence to the EU-US DPF Principles for data received from the EU and UK (including Gibraltar) and to the Swiss-US DPF Principles for data received from Switzerland. Should the DPF be invalidated by the Court of Justice of the European Union ("CJEU") in the future, we may face challenges in EU-US data transfers, necessitating the implementation of a CJEU-approved framework. Children's online privacy has been a focus of recent enforcement activity under longstanding privacy laws as well as privacy and data protection laws enacted in recent years worldwide. With increased enforcement of children's online privacy in the EU and the UK, the U.S. Federal Trade Commission ("FTC") and state attorneys general have also, in recent years, increased enforcement of the Children's Online Privacy Protection Act ("COPPA"), and other US State laws that restrict the processing of children's personal information without a parental consent. We are also subject to Regulation (EU) 2022/2065 (the Digital Services Act, or "DSA"), effective as of November 2022 and was fully implemented on February 17, 2024, which is a comprehensive piece of legislation for consumer protection. The DSA focuses on content governance and moderation and applies to various online services. The DSA addresses several critical aspects related to online services, including providing a consistent framework for digital services offered in the EU, preventing illegal and harmful online activities, and protecting service recipients' fundamental rights. Apart from the requirements of privacy, data governance, and data security laws, we have obligations relating to privacy, data governance and data security under our published policies, contracts, and applicable industry standards. Although we endeavor to comply with these obligations, we may have failed to do so in the past and may be subject to allegations that we have failed to do so or have otherwise processed data improperly. We could be subject to enforcement action or litigation alleging that our methods of data collection or our other data processing practices violate our published policies, federal or state laws prohibiting unfair or deceptive business practices or other privacy laws. In response to the increasing restrictions of global privacy and data security laws, our customers have sought and may continue to seek increasingly stringent contractual assurances regarding our handling of personal information and may adopt internal policies that limit their use of our platform. In addition, privacy advocates and industry groups have regularly proposed, and may propose in the future, self-regulatory standards upon which we may be legally or contractually bound. If we fail to comply with these contractual obligations or standards, we may face substantial contractual liability or fines. Various jurisdictions around the world continue to propose new laws that regulate the privacy, data governance and/or security of certain types of data or information. Complying with these laws, if enacted, would require significant resources, and leave us vulnerable to possible fines and penalties if we are unable to comply. Our obligations under privacy and data security laws, our contracts and applicable industry standards (including requirements by operating system platforms or app stores) are increasing, becoming more complex and changing rapidly, which has increased and may continue to increase the cost and effort required to comply with them. The privacy and data security compliance challenges we and our customers face in the EU, the UK, the U.S., and other jurisdictions may also limit our ability to operate, or offer certain product features, in those jurisdictions, which could reduce demand for our solutions from customers subject to their laws. We may also be required to adapt our solutions to comply with changing regulations. Despite our efforts, we may not be successful in achieving compliance with these rapidly evolving requirements. We could be perceived to be in non-compliance with applicable privacy laws, especially when acquiring new companies and before we have completed our gap analysis and remediation. Any actual or perceived non-compliance could result in litigation and proceedings against us by governmental entities, customers, individuals, or others; fines and civil, criminal, or administrative penalties for us or company officials; obligations to cease offering or to substantially modify our solutions in ways that make them less effective in certain jurisdictions; negative publicity; harm to our brand and reputation and reduced overall demand for our solutions or reduced revenue. Such occurrences could materially and adversely affect our business, financial condition, and results of operations.

On February 24, 2022, Russia launched an invasion of Ukraine that has resulted in an ongoing military conflict between the two countries (the "Russia-Ukraine Conflict"). The Russia-Ukraine Conflict has caused, and is currently expected to continue to cause, political, economic, and social instability, significant disruptions to the regional and the global economy, financial system, international trade, and the transportation and energy sectors, among others. In addition, the Russia-Ukraine Conflict has displaced millions of people, causing an acute refugee crisis in Europe, and has increased the threat of nuclear accidents or attacks, cyberattacks, and further regional or global conflicts (including a potential expansion of the Russia-Ukraine Conflict to other countries as well as other unrelated potential conflicts), among other potentially dire consequences. In response to Russia's actions, multiple countries and governing bodies, including the U.S. and the European Union, have put in place global sanctions and other severe restrictions or prohibitions on the activities of certain individuals and businesses connected to Russia and/or Belarus. Companies have also implemented restrictions that severely limit, and in some cases, reverse or cancel, business transactions in or involving certain individuals and/or businesses connected to or associated with Russia and/or Belarus. Further, some companies have moved to divest of Russia-based subsidiaries and assets. In addition, the impacts of the Russia-Ukraine Conflict on the supply chain and commodity prices are expected to be profound and may result in substantial inflation in one or more countries (or globally). The ultimate impact of the Russia-Ukraine Conflict and its effect on the geopolitical environment and global economic and commercial activity and conditions, and on our operations, financial condition, and performance, and the duration and severity of those effects, is impossible to predict.

The U.S. and other countries have experienced, and may experience in the future, outbreaks of contagious diseases that affect public health and public perception of health risk. In December 2019, a novel coronavirus (COVID-19) emerged and subsequently spread worldwide. A future major epidemic or pandemic could result in foreign, federal, state, and local governments and private entities mandating various restrictions, requiring closure of non-essential businesses and recommendations that people remain at home. Such an event may come with significant uncertainty regarding the extent to which and how long it disrupts the U.S. and/or global economy.

In our ODS business, we rely on wireless carriers and OEMs to distribute our products and services. A significant portion of our ODS business is derived from a limited number of wireless carriers. Our failure to maintain our relationships with these carriers, establish relationships with new carriers, or a loss or change of terms could materially reduce our revenue and thus harm our business, operating results, and financial condition. Our contracts with advertiser and publisher customers do not generally include long-term obligations requiring them to purchase our services and are cancellable upon short or no notice and without penalty. We have both exclusive and non-exclusive carrier and OEM agreements. Historically, our carrier and OEM agreements have had terms of one or two years with automatic renewal provisions upon expiration of the initial term, absent a contrary notice from either party, but going forward terms in carrier and OEM agreements may vary. In addition, some carrier and OEM agreements provide that the parties can terminate the agreement early and, in some instances, at any time without cause, which could give them the ability to renegotiate economic or other terms. The agreements generally do not obligate the carriers and OEMs to market or distribute any of our products or services. We cannot give any assurance that our advertiser and publisher customers will continue to use our services or that we will be able to replace, in a timely or effective manner, departing customers with new customers that generate comparable revenue. A significant portion of our revenue is also impacted by the level of advertising spend. If advertising spend is lower than our expectations -- a factor over which we have no control as we do not determine our customers' advertising budgets -- our revenue will be impacted negatively. From time-to-time, we expect that a limited number of our advertising customers will account for a significant share of our advertising revenue. This customer concentration increases the risk of quarterly fluctuations in our revenue and operating results. Our advertiser customers may reduce or terminate their business with us at any time for any reason, including changing economic conditions, changes in their financial condition or other business circumstances. If a large advertising customer representing a substantial portion of our business decided to materially reduce or discontinue its use of our platform, it could cause an immediate and significant decline in our revenue and negatively affect our results of operations and financial condition.

In October 2024, the Company began a transformation program intended to improve various measures across the organization. These measures include but are not limited to current and future operating expenses, cash flows, and personnel costs. Additionally, the initiatives intend to simplify and streamline business operations, including product optimization, procurement and cost optimization, and team restructuring. The charges and expenditures that we expect to incur in connection with the transformation program and reduction in force, and timing thereof, are subject to a number of assumptions, including local law requirements in various jurisdictions, and we may incur costs that are greater than we currently expect in connection with the transformation program and reduction in force. The transformation program and reduction in force may yield unintended consequences and costs, such as the loss of institutional knowledge and expertise, employee attrition beyond our intended reductions in force, a reduction in morale among our remaining employees, greater-than-anticipated costs incurred in connection with implementing the transformation program and reduction in force and the risk that we may not achieve the benefits from the transformation program and reduction in force to the extent or as quickly as we anticipate, all of which may have a material adverse effect on our results of operations or financial condition. These restructuring initiatives could place substantial demands on our management and employees, which could lead to the diversion of our management's and employees' attention from other business priorities. In addition, while we eliminated certain positions in connection with the transformation program and reduction in force, certain functions necessary to our reduced operations remain, and we may be unsuccessful in distributing the duties and obligations of departed employees among our remaining employees or to external service providers, which could result in disruptions to our operations. We may also discover that the workforce reductions and other restructuring efforts will make it difficult for us to pursue new opportunities and initiatives and require us to hire qualified replacement personnel, which may require us to incur additional and unanticipated costs and expenses. We may further discover that, despite the implementation of our transformation program and reduction in force, we may require additional capital to continue expanding our business, and we may be unable to obtain such capital on acceptable terms, if at all. Our failure to successfully accomplish any of the above activities and goals may have a material adverse impact on our business, financial condition and results of operations.