iHeartMedia (IHRT) Risk Analysis

The Communications Act and FCC regulations prohibit foreign entities or individuals from indirectly (i.e., through a parent company) owning or voting more than 25 percent of the equity in a corporation controlling the licensee of a radio broadcast station unless the FCC determines greater indirect foreign ownership is in the public interest. The FCC generally will not make such a determination absent favorable executive branch review. The FCC calculates foreign voting rights separately from equity ownership, and both must be at or below the 25 percent threshold absent a foreign ownership declaratory ruling. To the extent that our aggregate foreign ownership or voting percentages exceed 25 percent, any individual foreign holder of our common stock whose ownership or voting percentage would exceed 5 percent or 10 percent (with the applicable percentage determined pursuant to FCC rules) will additionally be required to obtain the FCC's specific approval. The FCC has issued declaratory rulings that permit us to be up to 100% foreign-owned and specifically approve certain of our foreign shareholders, subject to certain conditions. The acquisition of a significant amount of our stock by a new foreign holder could require us to request additional or modified declaratory rulings from the FCC and to take actions under our certificate of incorporation to ensure our compliance with the Communications Act and FCC regulations until such rulings are granted.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business ("IT Systems"). We own and operate some of these IT Systems ourselves, but we also rely on third-party providers for various IT Systems and related products and services, including but not limited to cloud computing services, across both our internal and external-facing operations. We and certain of our third-party providers collect, maintain and process data about customers, employees, business partners and others, including personal information, as well as proprietary information belonging to our business such as trade secrets (collectively, "Confidential Information"). We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information. Cyberattacks are expected to accelerate on a global basis in frequency and magnitude and, as a result, we may be unable to anticipate, investigate, remediate, or recover from future cyberattacks and other security incidents, or to avoid a material adverse impact to our IT Systems, Confidential Information, or business. We and certain of our third-party providers have experienced from time to time in the past cyberattacks and other incidents, and we expect to experience these in the future. Our IT Systems and Confidential Information are vulnerable to a range of cybersecurity risks and threats, including software bugs, computer viruses, internet worms, break-ins, phishing and social engineering attacks, attempts to overload servers with denial-of-service, or other attacks and similar disruptions (for example, due to ransomware), any of which could lead to system interruptions, delays, shutdowns, or theft or loss of Confidential Information. Our remote and hybrid working arrangements for employees (and employees of third-party providers) also present additional risks due to the prevalence of social engineering and other cyberattacks that are launched in relation to non-corporate and home networking environments and remote access into our computer networks. A security breach could occur due to the actions of outside parties, employee error, malfeasance or a combination of these or other actions. Any failure to maintain performance, reliability, security, and availability of our services and technical infrastructure to the satisfaction of our listeners may harm our reputation and our ability to retain existing listeners and attract new listeners. We or third parties we rely on may not be able to implement security controls as intended for various reasons, including if we do not recognize or underestimate a particular risk. We cannot assure you that our cybersecurity risk management program or the policies, controls, and/or processes that we or our third-party providers have designed to protect our Confidential Information and IT Systems will be effective. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, when detected by security tools or third parties, may not always be immediately understood or acted upon. Cyberattacks that disrupt or result in unauthorized access to third party IT Systems can materially impact our operations and financial results. If there is an actual or perceived adverse impact to the availability, integrity, or confidentiality of our IT Systems or Confidential Information, we may incur significant response and remediation costs in protecting against or remediating cyber-attacks and we may face regulatory or civil liability, lose Confidential Information, personal information, or suffer disruptions to our business operations, information processes and internal controls. In addition, the public perception of the effectiveness of our security measures or services could be harmed and we could lose listeners, consumers, business partners and advertisers. In the event of a security breach, we could suffer financial exposure in connection with penalties, remediation and restoration efforts, investigations and legal proceedings (such as class action lawsuits) and changes in our security and system protection measures. We may be subject to rapidly evolving data security frameworks and/or laws that require us to maintain a certain level of security. For example, the Federal Trade Commission expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. In the event a domestic or EU/UK regulator or court were to determine we had not adequately complied with the security requirements under state privacy laws, the EU/UK General Data Protection Regulation ("GDPR"), and/or other data privacy, cybersecurity, consumer protection or related rules or regulations, we may be subject to regulatory and litigation proceedings, financial fines and penalties, injunctive requirements that negatively affect our business model, and/or costly remediation requirements. We may also be required to notify affected individuals and authorities in the event of a personal information breach. For example, the California Consumer Privacy Act and California Privacy Rights Act provide a private right of action to individuals and statutory damages for certain types of data breaches, and the GDPR provides potential fines up to EUR 20 million or 4% of worldwide annual turnover of the preceding financial year, whichever is greater. We expect these and other developing rules and regulations to increase both upfront compliance costs and liability exposure in the event of a cyberattack or security incident. Additionally, as we accept debit and credit cards for payment, we are subject to the Payment Card Industry Data Security Standard ("PCI DSS"), issued by the Payment Card Industry Security Standards Council. PCI DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing and transmission of cardholder data. If we or our service providers are unable to comply with the security standards established by banks and the payment card industry, we may be subject to fines, restrictions and expulsion from card acceptance programs, which could materially and adversely affect our business. Furthermore, any losses, costs and/or liabilities directly or indirectly related to cyberattacks or other security incidents may not be covered by, or may exceed the coverage limits of, any of our insurance policies.

The audio entertainment industry is characterized by rapid technological change, frequent product and feature innovations, changes in customer requirements and expectations, evolving standards and new entrants offering products and services. Our terrestrial radio broadcasting and digital operations face increasing competition from alternative media and entertainment platforms and technologies, such as broadband wireless, satellite radio, television and streaming services, other podcast platforms, internet-based music streaming services, and social media, as well as mobile and other connected devices, such as portable digital audio players, smart phones, wearable devices, tablets, gaming consoles, in-home entertainment and enhanced automotive platforms. These technologies and alternative media and entertainment platforms, including those used by us, compete with our platforms and content for listeners and advertising revenues. We are unable to predict the long-term effect that such technologies and related services and products will have on our broadcasting and digital operations. The capital expenditures necessary to implement these or other technologies could be substantial, and we cannot assure you that we will continue to have the resources to acquire new technologies or to introduce new services to compete with other new technologies or services, or that our investments in new technologies or services will provide the desired returns. Other companies employing new technologies or services could more successfully implement such new technologies or services or otherwise increase competition with our businesses and make our products less competitive in the marketplace.

Our business is dependent upon the performance of our management team and other key individuals. Although we have entered into agreements with members of our senior management team and certain other key individuals, we can give no assurance that any or all of them will remain with us, or that we will not continue to make changes to the composition of, and the roles and responsibilities of, our management team. Competition for these individuals is intense and many of our key employees are at-will employees who are under no obligation to remain with us, and may decide to leave for a variety of personal or other reasons beyond our control. If members of our management or key individuals decide to leave us in the future, if we decide to make further changes to the composition of, or the roles and responsibilities of, these individuals, or if we are not successful in attracting, motivating and retaining other key employees, our business could be adversely affected.