MediaAlpha (MAX) Risk Factors

We are subject to a wide variety of laws and regulations. Laws, regulations, and standards governing issues such as internet communications, advertising, e-commerce, worker classification, employment, payments, worker confidentiality obligations, intellectual property, consumer protection, taxation, privacy, antitrust and data security are often complex and subject to varying interpretations, in many cases due to their lack of specificity and, as a result, their application in practice may change or develop over time through judicial decisions or as new guidance or interpretations are provided by regulatory and governing bodies, such as federal and state administrative agencies. Many of these laws were adopted prior to the advent of the internet, mobile and related technologies and, as a result, do not contemplate or address the unique issues of the internet, mobile and related technologies. Other laws and regulations may be adopted in response to internet, mobile and related technologies. New and existing laws and regulations (or changes in interpretation of existing laws and regulations) may also be adopted, implemented, or interpreted to apply to us and other online platforms. As our platform's scope expands, regulatory agencies or courts may claim that we, or our users, are subject to additional requirements or that we are prohibited from conducting our business in or with certain verticals or jurisdictions. It is also possible that certain provisions in agreements with our buyers, sellers, and service providers may be found to be unenforceable or not compliant with applicable law. Recent financial, political, and other events may increase the level of regulatory scrutiny on larger companies and technology companies in general. The effects of recently imposed and proposed governmental antitrust actions are uncertain because of the dynamic nature of such actions. Scrutiny and regulation of the technology industry may increase, which could require us to devote significant legal and other resources to addressing such scrutiny and regulation. The growth and development of the technology industry in general may prompt calls for greater enforcement of U.S. and/or state antitrust laws, which may impose additional burdens on companies such as ours. Regulatory agencies may also enact new laws or promulgate new regulations that are adverse to our business, or they may view matters or interpret laws and regulations differently than they have in the past or in a manner adverse to our business. Such regulatory scrutiny or action may create different or conflicting obligations on us from one jurisdiction to another. On February 21, 2023, we received a civil investigative demand from the Federal Trade Commission (FTC) regarding compliance with the FTC Act and the Telemarketing Sales Rule, as they relate to the advertising, marketing, promotion, offering for sale, or sale of healthcare-related products, the collection, sale, transfer or provision to third parties of consumer data, telemarketing practices, and/or consumer privacy or data security. We are cooperating with the FTC. If, as a result of the FTC's request, proceedings are initiated and we are found to have violated one or more applicable laws, we may be subject to monetary penalties and/or required to change one or more of our related business practices, any of which could have a material adverse effect on our business, results of operations or financial condition.

On February 21, 2023, we received a civil investigative demand from the Federal Trade Commission (FTC) regarding compliance with the FTC Act and the Telemarketing Sales Rule, as they relate to the advertising, marketing, promotion, offering for sale, or sale of healthcare-related products, the collection, sale, transfer or provision to third parties of consumer data, telemarketing practices, and/or consumer privacy or data security. On October 30, 2024, following our earnings call, we received an initial settlement demand from the staff of the FTC (the "FTC Staff") stating that the FTC Staff is prepared to recommend that the FTC approve the filing of a complaint against the Company for violations of Section 5(a) of the FTC Act, the FTC's Telemarketing Sales Rule ("TSR") and the Government and Business Impersonation Rule (the "Impersonation Rule"). The FTC Staff alleges that, in connection with our lead generation and telemarketing activities, we have represented ourselves as affiliated with government entities, made misleading claims (in particular regarding health insurance products and our use of consumers' personal information) and utilized deceptive advertising, in violation of Section 5(a) of the FTC Act. The FTC Staff further alleges that we have violated the Impersonation Rule in representing ourselves to be affiliated with government entities and the TSR in connection with telemarketing activities. The FTC Staff proposes to seek injunctive and monetary relief and civil penalties. If obtained in whole or in part, the monetary relief and penalties proposed by the FTC Staff would have an adverse, and potentially material, effect on our liquidity, financial condition, and results of operations. The total amount of these proposed items significantly exceeds our existing liquidity and financial resources. Any such costs above our existing resources would require the Company to seek additional capital, incur debt or otherwise take significant actions in order to satisfy the claims, and there can be no assurances that such financing could be obtained on acceptable terms, or at all. In addition, the proposed injunctive terms, if obtained in whole or in part, could adversely, and potentially materially, affect our ability to operate business in our Health insurance vertical, including by restricting how we conduct our marketing activities and by requiring enhancements to our compliance program.

We are subject to income taxes in the United States, various state and local jurisdictions and foreign jurisdictions. Our effective tax rate and profitability could be subject to volatility or adversely affected by a number of factors, including: - changes in applicable tax laws and regulations, or their interpretation and application, including the possibility of retroactive effect;- changes in accounting and tax standards or practice;- changes in the valuation of deferred tax assets and liabilities; and - our operating results before taxes. In addition, we have in the past been, and may in the future be subject to audits of our income, sales, and other taxes by U.S. federal, state and local taxing authorities, and foreign authorities. Outcomes from these audits could have a material and adverse effect on our business, financial condition, operating results, cash flows, and prospects.

We are subject to a variety of federal, state, local, and international laws, directives, and regulations, as well as contractual obligations, relating to privacy and the collection, protection, use, retention, security, disclosure, transfer, and other processing of personal information and other data, including the California Online Privacy Protection Act, the California Consumer Privacy Act (the "CCPA"), the California Privacy Rights Act (the "CPRA") and other state privacy laws, the Personal Information Protection and Electronic Documents Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act (the "CAN-SPAM Act"), Canada's Anti-Spam Law, the Telephone Consumer Protection Act of 1991 (the "TCPA"), the U.S. Federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Section 5(c) of the Federal Trade Commission Act, the TSR, the EU's General Data Protection Regulation, supplemented by national laws (such as, in the United Kingdom, the Data Protection Act 2018) and further implemented through binding guidance from the European Data Protection Board. These laws, rules and regulations evolve frequently and their scope may continually change, through new, or amendments to existing, legislation or regulations and changes in enforcement, and may be inconsistent from one jurisdiction to another. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. Although we endeavor to comply with our published policies and documentation and ensure their compliance with current laws, rules and regulations, we (and other parties with whom we do business) may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policy and other documentation that provide promises and assurances about privacy and security can subject us to potential state and federal action in the U.S. if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Any failure by us or other parties with whom we do business to comply with this documentation or with federal, state, local or international regulations could result in proceedings against us by governmental entities, private parties or others (including, without limitation, the FTC Matter, where the FTC Staff has alleged that certain of our conduct and business practices violate Section 5(a) of the FTC Act and the TSR). In many jurisdictions, enforcement actions and consequences for non-compliance are rising. In the U.S., these include enforcement actions in response to rules and regulations promulgated under the authority of federal agencies and state attorneys general and legislatures and consumer protection agencies. A number of federal and state laws and regulations relating to privacy affect and apply to the insurance industry specifically, including those imposed by the New York Department of Financial Services. In addition, privacy advocates and industry groups have proposed and may propose new and different self-regulatory standards that either legally or contractually apply to us. If we fail to follow these security standards even if no customer information is compromised, we may incur significant fines or experience a significant increase in costs. Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal framework with which we or our customers must comply, including, but not limited to the EU. Complying with these regulations may cause us to incur substantial operational costs or require us to change our business practices. Despite our efforts, we may not be successful in our efforts to achieve compliance either due to internal or external factors such as resource allocation limitations or a lack of vendor cooperation. Non-compliance could result in proceedings against us by governmental entities, customers, data subjects or others. We may also experience difficulty retaining or obtaining new European or multi-national customers due to the legal requirements, compliance cost, potential risk exposure, and uncertainty for these entities, and we may experience significantly increased liability with respect to these customers pursuant to the terms set forth in our engagements with them. Domestic laws in this area are also complex and developing rapidly. Many state legislatures have adopted or are currently considering legislation that regulates how businesses operate online, including measures relating to privacy, data security, and data breaches. Laws in all 50 states require businesses to provide notice to customers whose personally identifiable information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly. States are also frequently amending existing laws, requiring attention to frequently changing regulatory requirements. For example, the CCPA, among other things, requires new disclosures to California consumers and affords such consumers new abilities to access and delete their personal information, opt-out of certain sales of personal information and receive detailed information about how their personal information is used. The CCPA provides for fines of up to $7,500 per violation, as well as a private right of action for data breaches that is expected to increase the frequency of data breach litigation. While the CCPA has already been amended multiple times, it is unclear how this legislation will be further modified or how it will be interpreted. The effects of this legislation potentially are far-reaching, however, and may require us to modify our data processing practices and policies and incur substantial compliance-related costs and expenses. Additionally, the CPRA, which became effective in most material respects on January 1, 2023, modifies the CCPA significantly, including by expanding consumers' rights with respect to certain sensitive personal information and creating a new state agency to oversee implementation and enforcement efforts, which may result in further uncertainty and require us to incur additional costs and expenses in an effort to comply. The CCPA, CPRA and other changes in laws or regulations relating to privacy, data protection and information security, particularly any new or modified laws or regulations that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer or disclosure, could greatly increase the cost of providing our offerings, require significant changes to our operations or even prevent us from providing certain offerings in jurisdictions in which we currently operate and in which we may operate in the future. Further, as we continue to expand our platform offerings and user base, we may become subject to additional privacy-related laws and regulations. For example, the collection and storage of healthcare data by health insurance carriers subject them to compliance requirements under HIPAA. HIPAA and its implementing regulations contain substantial restrictions and requirements regarding the use, collection, security, storage, and disclosure of individuals' protected health information. In 2009, HIPAA was amended by the HITECH Act to impose certain of HIPAA's privacy and security requirements directly upon business associates of covered entities. Health insurance carriers are covered entities under HIPAA. In the event we are deemed to be a business associate of such carriers, we may be bound by compliance obligations under HIPAA, including security breach notification obligations, and subject to increased liability as a possible liable party. In such instance, if we knowingly breach the HITECH Act's requirements, we could be exposed to criminal liability. A breach of our safeguards and processes could expose us to civil penalties up to $1.5 million for identical incidences and the possibility of civil litigation. Additionally, we have incurred, and may continue to incur, significant expenses in an effort to comply with privacy, data protection and information security standards and protocols imposed by law, regulation, industry standards or contractual obligations. Despite our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection, and information security, it is possible that our practices, offerings or platform could be inconsistent with, or fail or be alleged to fail to meet all requirements of, such laws, regulations or obligations. Our failure, or the failure by our third-party providers or partners, to comply with applicable laws or regulations or any other obligations relating to privacy, data protection or information security, or any compromise of security that results in unauthorized access to, or use or release of personally identifiable information or other data, or the perception that any of the foregoing types of failure or compromise has occurred, could damage our reputation, discourage new and existing partners from using our platform, delay planned uses, and disclosures of data or result in fines or proceedings by governmental agencies and private claims and litigation, any of which could materially and adversely affect our business, financial condition, operating results, cash flows, and prospects. Even if not subject to legal challenge, the perception of privacy concerns, whether or not valid, may harm our reputation and brand and materially and adversely affect our business, financial condition, operating results, cash flows, and prospects.

The digital customer acquisition services market is relatively new and rapidly evolving, and it uses different measurements than traditional media to gauge its effectiveness. Some of our current or potential partners have little or no experience using the internet for customer acquisition purposes and have historically allocated only limited portions of their customer acquisition budgets to the internet. The adoption of digital customer acquisition, particularly by those companies that have historically relied upon traditional media for customer acquisition, requires the acceptance of a new way of conducting business, exchanging information, and evaluating new customer acquisition technologies and services. In addition, we may experience resistance from traditional advertising agencies that may be advising our partners. We cannot assure you that the market for digital customer acquisition services will continue to grow. If the market for digital customer acquisition services fails to continue to develop or develops more slowly than we anticipate, the success of our business may be limited, and our revenue may stop growing or decrease.

Our ability to compete effectively depends upon our ability to obtain, maintain, protect, and enforce our intellectual property rights, proprietary systems, technology and brand. We rely on a combination of trade secret, trademark and copyright law, confidentiality agreements, and technical measures to establish, maintain and protect our intellectual property rights and technology. These laws are subject to change at any time and could further limit our ability to protect our intellectual property rights. Additionally, there is uncertainty concerning the scope of intellectual property protection for software and business methods, which are fields in which we rely on intellectual property laws to protect our rights. Despite our efforts to obtain, maintain, protect, and enforce our intellectual property rights, these efforts may not be sufficient to effectively prevent unauthorized disclosure or unauthorized use of our trade secrets or other confidential information or to prevent third parties from infringing, misappropriating, diluting or otherwise violating our intellectual property rights and offering similar or superior functionality. To the extent we are able to obtain enforceable intellectual property rights, such intellectual property rights may not prevent third parties from reverse engineering our proprietary information or independently developing product and service technology offerings and services similar to or duplicative of our product and service offerings. For example, monitoring and protecting our intellectual property rights can be challenging and costly and we may not be effective in policing or prosecuting such unauthorized use or disclosure. We also may fail to maintain or be unable to obtain adequate protections for certain of our intellectual property rights in the U.S. or certain foreign countries, and our intellectual property rights may not receive the same degree of protection in foreign countries as they would in the U.S. because of the differences in foreign patent, trademark, copyright, and other laws concerning proprietary rights. Any of our intellectual property rights may be challenged or circumvented by others or invalidated or held unenforceable through administrative process or litigation in the U.S. or in foreign jurisdictions. Furthermore, legal standards relating to the validity, enforceability, and scope of protection of intellectual property rights are uncertain. In addition, our competitors may attempt to copy unprotected aspects of our product design or independently develop similar technology or design around our intellectual property rights. Third parties also may take actions that diminish the value of our proprietary rights or our reputation or cause partner confusion through the use of similar service names or domain names. Litigation regarding any intellectual property disputes may be costly and disruptive to us. Any of these results would harm our business, financial condition, operating results, cash flows, and prospects. Additionally, we rely, in part, on trade secrets, proprietary know-how, and other confidential information to maintain our competitive position. We enter into confidentiality and invention assignment agreements with our employees and enter into confidentiality agreements with third parties, including our partners. However, we cannot guarantee that we have entered into such agreements with each party that has or may have had access to our proprietary information, know-how and trade secrets. Moreover, no assurance can be given that these agreements will be effective in controlling access to, distribution, use, misuse, misappropriation, reverse engineering or disclosure of our proprietary information, know-how and trade secrets. Further, these agreements may not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our products and platform capabilities. These agreements may be breached, and we may not have adequate remedies for any such breach. Enforcing a claim that a party illegally disclosed or misappropriated a trade secret or know-how is difficult, expensive, and time-consuming, and the outcome is unpredictable. In addition, trade secrets and know-how can be difficult to protect and some courts inside and outside the U.S. are less willing or unwilling to protect trade secrets and know-how. If any of our trade secrets were to be lawfully obtained or independently developed by a competitor or other third party, we would have no right to prevent them from using that technology or information to compete with us. If any of our trade secrets were to be disclosed to or independently developed by a competitor or other third party, our competitive position would be materially and adversely harmed. We currently hold various domain names relating to our brand, including mediaalpha.com, quotelab.com, and healthplans.com. Failure to maintain our domain names could adversely affect our reputation and brand and make it more difficult for current and future partners to find our website and our platform. We may be unable, without significant cost or at all, to prevent third parties from acquiring domain names that are similar to, infringe upon or otherwise decrease the value of our trademarks and other proprietary rights.

Our ability to service partners depends on the reliable performance of our technological infrastructure, including the cloud computing platforms we use. Interruptions, delays or failures in these systems, whether due to our cloud computing and other vendors, adverse weather conditions, natural disasters, power loss, computer viruses, cybersecurity attacks, physical break-ins, terrorism, errors in our software or otherwise, could be prolonged and could affect the security or availability of our platform. Our systems or those of third parties may also contain undetected errors or other performance problems or may fail due to human error. The reliability and security of our systems, and those of our partners and vendors, is important not only to maintaining our platform, but also to maintaining our reputation and ensuring the proper protection of our confidential and proprietary information. If we experience operational failures or prolonged disruptions or delays in the availability of our systems, we could lose current and potential partners, which could harm our business, financial condition, operating results, cash flows, and prospects. Any errors, defects, or disruptions in our platform or services we rely on from third parties, or other performance problems with our platform or services we rely on from third parties could harm our brand and may damage the businesses of our partners. Our online systems, including our platform, could contain undetected errors, or "bugs," that could adversely affect their performance. Additionally, we update our platform and our other online systems. These updates may contain undetected errors when first introduced or released, which may cause disruptions in our services and may, as a result, cause us to lose current and potential partners, which could harm our business, financial condition, operating results, cash flows, and prospects. We rely on third-party service providers for many aspects of our business, including the hosting of our platform, and any disruption of service experienced by a third-party service provider or our failure to manage and maintain existing relationships or identify other high-quality, third-party service providers could harm our business, financial condition, operating results, cash flows, and prospects.

Many of the terms of our agreements with our partners, including our platform fees, are specifically negotiated with each partner. Our partners may negotiate with us to reduce our platform fees. The outcome of such negotiations could result in terms that are less favorable to us than those contained in our existing agreements or those obtained by our competitors, which could impact our relationship with our partners and could harm our business, financial condition, operating results, cash flows, and prospects. In addition, the net revenue generated from transactions in our Open Marketplace is higher than the net revenue from transactions in our Private Marketplaces. In the past, certain of our supply and demand partners have switched their transactions with each other from our Open Marketplace to a Private Marketplace once they have reached a significant level of Transaction Value, and this may occur with other supply and demand partners in the future. Such transitions may occur with minimal notice, and may cause our operating results for a given period to fail to meet our expectations or those of any analysts that cover us or investors, which could cause the market price of our Class A common stock to fall substantially.

Our business has been, and may in the future be, adversely impacted by the effects of public health crises, such as the global COVID-19 pandemic. The impacts of the COVID-19 pandemic, including supply chain constraints and labor shortages, have contributed to higher-than-expected inflation in insurance claims costs, which has driven significant reductions in P&C insurance carrier profitability, leading our P&C insurance carrier partners to reduce their customer acquisition spending. The timing and slope of a recovery in this vertical are difficult to predict. In addition, in our travel vertical, COVID-19 has led to a dramatic decline in consumers shopping for travel-related products, which has led to a significant decline in our revenue from the travel vertical, and there is uncertainty about whether our business in this vertical will return to pre-pandemic levels and the timing of any such recovery. In addition, future outbreaks of COVID-19 or other widespread diseases may occur in the future, any of which could negatively affect customer acquisition spend by our demand partners or on consumer insurance product search activity (and, in turn, Consumer Referral availability), or require changes to our business operations, any of which could have a material and adverse effect on our business, financial condition, operating results, cash flows, and prospects.