iHeartMedia (IHRT) Risk Factors

The Communications Act and FCC regulations prohibit foreign entities or individuals from indirectly (i.e., through a parent company) owning or voting more than 25 percent of the equity in a corporation controlling the licensee of a radio broadcast station unless the FCC determines greater indirect foreign ownership is in the public. The FCC generally will not make such a determination absent favorable executive branch review. The FCC calculates foreign voting rights separately from equity ownership, and both must be at or below the 25 percent threshold absent a foreign ownership declaratory ruling. To the extent that our aggregate foreign ownership or voting percentages exceeds 25 percent, any individual foreign holder of our common stock whose ownership or voting percentage would exceed 5 percent or 10 percent (with the applicable percentage determined pursuant to FCC rules) will additionally be required to obtain the FCC's specific approval.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business ("IT Systems"). We own and operate some of these IT Systems ourselves, but we also rely on third-party providers for various IT Systems and related products and services, including but not limited to cloud computing services, across both our internal and external-facing operations. We and certain of our third-party providers collect, maintain and process data about customers, employees, business partners and others, including personal information, as well as proprietary information belonging to our business such as trade secrets (collectively, "Confidential Information"). We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information. Cyberattacks are expected to accelerate on a global basis in frequency and magnitude and, as a result, we may be unable to anticipate, investigate, remediate, or recover from future cyberattacks and other security incidents, or to avoid a material adverse impact to our IT Systems, Confidential Information, or business. We and certain of our third-party providers have experienced from time to time in the past cyberattacks and other incidents, and we expect to experience these in the future. Our IT Systems and Confidential Information are vulnerable to a range of cybersecurity risks and threats, including software bugs, computer viruses, internet worms, break-ins, phishing and social engineering attacks, attempts to overload servers with denial-of-service, or other attacks and similar disruptions (for example, due to ransomware), any of which could lead to system interruptions, delays, shutdowns, or theft or loss of Confidential Information. Our remote and hybrid working arrangements for employees (and employees of third-party providers) also present additional risks due to the prevalence of social engineering and other cyberattacks that are launched in relation to non-corporate and home networking environments and remote access into our computer networks. A security breach could occur due to the actions of outside parties, employee error, malfeasance or a combination of these or other actions. Any failure to maintain performance, reliability, security, and availability of our services and technical infrastructure to the satisfaction of our listeners may harm our reputation and our ability to retain existing listeners and attract new listeners. We or third parties we rely on may not be able to implement security controls as intended for various reasons, including if we do not recognize or underestimate a particular risk. We cannot assure you that our cybersecurity risk management program or the policies, controls, and/or processes that we or our third-party providers have designed to protect our Confidential Information and IT Systems will be effective. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, when detected by security tools or third parties, may not always be immediately understood or acted upon. Cyberattacks that disrupt or result in unauthorized access to third party IT Systems can materially impact our operations and financial results. If there is an actual or perceived adverse impact to the availability, integrity, or confidentiality of our IT Systems or Confidential Information, we may incur significant response and remediation costs in protecting against or remediating cyber-attacks and we may face regulatory or civil liability, lose Confidential Information, personal information, or suffer disruptions to our business operations, information processes and internal controls. In addition, the public perception of the effectiveness of our security measures or services could be harmed and we could lose listeners, consumers, business partners and advertisers. In the event of a security breach, we could suffer financial exposure in connection with penalties, remediation and restoration efforts, investigations and legal proceedings (such as class action lawsuits) and changes in our security and system protection measures. We may be subject to rapidly evolving data security frameworks and/or laws that require us to maintain a certain level of security. For example, the Federal Trade Commission expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. In the event a domestic or EU/UK regulator or court were to determine we had not adequately complied with the security requirements under state privacy laws, the EU/UK General Data Protection Regulation ("GDPR"), and/or other data privacy, cybersecurity, consumer protection or related rules or regulations, we may be subject to regulatory and litigation proceedings, financial fines and penalties, injunctive requirements that negatively affect our business model, and/or costly remediation requirements. We may also be required to notify affected individuals and authorities in the event of a personal information breach. In addition, the California Consumer Privacy Act and the California Privacy Rights Act provide a private right of action to individuals and statutory damages for certain types of data breaches, and the GDPR provides potential fines up to EUR 20 million or 4% of worldwide annual turnover of the preceding financial year, whichever is greater. We expect these and other developing rules and regulations to both increase upfront compliance costs and liability exposure in the event of a cyberattack or security incident. Additionally, as we accept debit and credit cards for payment, we are subject to the Payment Card Industry Data Security Standard ("PCI-DSS"), issued by the Payment Card Industry Security Standards Council. PCI-DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing and transmission of cardholder data. If we or our service providers are unable to comply with the security standards established by banks and the payment card industry, we may be subject to fines, restrictions and expulsion from card acceptance programs, which could materially and adversely affect our business. Furthermore, any losses, costs and/or liabilities directly or indirectly related to cyberattacks or other security incidents may not be covered by, or may exceed the coverage limits of, any of our insurance policies.

There are no uniform methods by which our advertiser-clients measure advertising effectiveness. As a result, new methods are regularly created and used by different advertiser-clients. We cannot integrate with all possible technological standards to measure advertising effectiveness and there is no guarantee that the standards with which we choose to integrate will be the standards ultimately selected by the majority of our advertiser-clients. There is also no guarantee that such standards will accurately reflect the true effectiveness of our advertising. Finally, as discussed in "Compliance with ever evolving regulations, third-party restrictions, and consumer concerns or litigation regarding data privacy and data protection involves significant expenditure and resources, and any failure by us or our vendors to comply may result in significant liability, negative publicity, and/or an erosion of trust, which could materially adversely affect our business, operations, and financial condition", our ability to integrate with technological standards may be limited by both emerging laws and third parties. If we fail to integrate with the technological standards preferred by our clients, or if those methodologies are inaccurate, our revenue may be adversely affected.

Our business is dependent upon the performance of our management team and other key individuals. Although we have entered into agreements with members of our senior management team and certain other key individuals, we can give no assurance that any or all of them will remain with us, or that we will not continue to make changes to the composition of, and the roles and responsibilities of, our management team. Competition for these individuals is intense and many of our key employees are at-will employees who are under no obligation to remain with us, and may decide to leave for a variety of personal or other reasons beyond our control. If members of our management or key individuals decide to leave us in the future, if we decide to make further changes to the composition of, or the roles and responsibilities of, these individuals, or if we are not successful in attracting, motivating and retaining other key employees, our business could be adversely affected.