MediaAlpha (MAX) Risk Analysis

Small text files (referred to as "cookies") placed on internet browsers by certain websites are used to gather data regarding a user's web browsing activity. For example, cookie data allows us to collect data about the websites and webpages that users may visit or to identify users on other websites who have previously visited our partners' websites. This information helps us to recognize prior users and to gather accurate conversion data from our partners. The availability of cookie data may be limited by numerous potential factors, including general trends among internet users to refuse to accept cookies on their web browsers, web browsers blocking third-party cookies by default or otherwise transitioning away from using cookies, other laws or regulations limiting the transferability or use of information gathered using cookies, or the refusal of providers of such information to provide it to us or to provide it to us on favorable terms. If we are not able to obtain this information on the terms we anticipate, our product offerings may be affected, which may cause a reduction in revenue or a reduction in revenue growth.

On February 21, 2023, we received a civil investigative demand from the Federal Trade Commission (FTC) regarding compliance with the FTC Act and the Telemarketing Sales Rule, as they relate to the advertising, marketing, promotion, offering for sale, or sale of healthcare-related products, the collection, sale, transfer or provision to third parties of consumer data, telemarketing practices, and/or consumer privacy or data security. On October 30, 2024, following our earnings call for the quarter ended September 30, 2024, we received an initial settlement demand from the staff of the FTC (FTC Staff) stating that the FTC Staff is prepared to recommend that the FTC approve the filing of a complaint against the Company for violations of Section 5(a) of the FTC Act, the FTC's Telemarketing Sales Rule ("TSR") and the Government and Business Impersonation Rule (the "Impersonation Rule"). We are engaged in settlement discussions with the FTC Staff in an effort to reach a mutually acceptable resolution. The FTC Staff alleges that, in connection with our lead generation and telemarketing activities, we have represented ourselves as affiliated with government entities, made misleading claims (in particular regarding health insurance products and our use of consumers' personal information) and utilized deceptive advertising, in violation of Section 5(a) of the FTC Act. The FTC Staff further alleges that we have violated the Impersonation Rule in representing ourselves to be affiliated with government entities and the TSR in connection with telemarketing activities. The FTC Staff proposes to seek injunctive and monetary relief and civil penalties. If obtained in whole or in part, the monetary relief and penalties proposed by the FTC Staff would have an adverse, and potentially material, effect on our liquidity, financial condition, and results of operations. The total amount of these proposed items significantly exceeds our existing liquidity and financial resources. Any such costs above our existing resources would require the Company to seek additional capital, incur debt or otherwise take significant actions in order to satisfy the claims, and there can be no assurances that such financing could be obtained on acceptable terms, or at all. In addition, the proposed injunctive terms, if obtained in whole or in part, could adversely, and potentially materially, affect our ability to operate business in our Health insurance vertical, including by restricting how we conduct our marketing activities and by requiring enhancements to our compliance program. Our Health insurance vertical accounted for $270.3 million, or 18%, of our Transaction Value in fiscal 2024 at a 14% take rate, of which roughly two-thirds was from under-65 health insurance at a slightly higher take rate. Finally, the Company is aware of efforts by private law firms to solicit clients in regard to potential securities class action or derivative litigation. These matters could result in us incurring additional costs and liabilities. For more information about the FTC Matter, see "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations--Liquidity and capital resources" and "Item 8. Financial Statements and Supplementary Data--Note 8. Commitments and contingencies--FTC matter".

We are subject to income taxes in the United States, various state and local jurisdictions and foreign jurisdictions. Our effective tax rate and profitability could be subject to volatility or adversely affected by a number of factors, including: - changes in applicable tax laws and regulations, or their interpretation and application, including the possibility of retroactive effect;- changes in accounting and tax standards or practice;- changes in the valuation of deferred tax assets and liabilities; and - our operating results before taxes. In addition, we have in the past been, and may in the future be subject to audits of our income, sales, and other taxes by U.S. federal, state and local taxing authorities, and foreign authorities. Outcomes from these audits could have a material and adverse effect on our business, financial condition, operating results, cash flows, and prospects.

We are subject to a variety of federal, state, local, and international laws, directives, and regulations, as well as contractual obligations, relating to privacy and the collection, protection, use, retention, security, disclosure, transfer, and other processing of personal information and other data, including the California Online Privacy Protection Act, the California Consumer Privacy Act (the "CCPA"), the California Privacy Rights Act (the "CPRA") and other state privacy laws, the Personal Information Protection and Electronic Documents Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act (the "CAN-SPAM Act"), Canada's Anti-Spam Law, the Telephone Consumer Protection Act of 1991 (the "TCPA"), the U.S. Federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Section 5(c) of the Federal Trade Commission Act, the TSR, the EU's General Data Protection Regulation, supplemented by national laws (such as, in the United Kingdom, the Data Protection Act 2018) and further implemented through binding guidance from the European Data Protection Board. These laws, rules and regulations evolve frequently and their scope may continually change, through new, or amendments to existing, legislation or regulations and changes in enforcement, and may be inconsistent from one jurisdiction to another. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. Although we endeavor to comply with our published policies and documentation and ensure their compliance with current laws, rules and regulations, we (and other parties with whom we do business) may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policy and other documentation that provide promises and assurances about privacy and security can subject us to potential state and federal action in the U.S. if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Any failure by us or other parties with whom we do business to comply with this documentation or with federal, state, local or international regulations could result in proceedings against us by governmental entities, private parties or others (including, without limitation, the FTC Matter, where the FTC Staff has alleged that certain of our conduct and business practices violate Section 5(a) of the FTC Act and the TSR). In many jurisdictions, enforcement actions and consequences for non-compliance are rising. In the U.S., these include enforcement actions in response to rules and regulations promulgated under the authority of federal agencies and state attorneys general and legislatures and consumer protection agencies. A number of federal and state laws and regulations relating to privacy affect and apply to the insurance industry specifically, including those imposed by the New York Department of Financial Services. In addition, privacy advocates and industry groups have proposed and may propose new and different self-regulatory standards that either legally or contractually apply to us. If we fail to follow these security standards even if no customer information is compromised, we may incur significant fines or experience a significant increase in costs. Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal framework with which we or our customers must comply, including, but not limited to the EU. Complying with these regulations may cause us to incur substantial operational costs or require us to change our business practices. Despite our efforts, we may not be successful in our efforts to achieve compliance either due to internal or external factors such as resource allocation limitations or a lack of vendor cooperation. Non-compliance could result in proceedings against us by governmental entities, customers, data subjects or others. We may also experience difficulty retaining or obtaining new European or multi-national customers due to the legal requirements, compliance cost, potential risk exposure, and uncertainty for these entities, and we may experience significantly increased liability with respect to these customers pursuant to the terms set forth in our engagements with them. Domestic laws in this area are also complex and developing rapidly. Many state legislatures have adopted or are currently considering legislation that regulates how businesses operate online, including measures relating to privacy, data security, and data breaches. Laws in all 50 states require businesses to provide notice to consumers whose personally identifiable information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly. States are also frequently amending existing laws, requiring attention to frequently changing regulatory requirements. For example, the CCPA (as amended by the CPRA), among other things, requires new disclosures to California consumers and affords such consumers new abilities to access and delete their personal information, opt-out of certain sales of personal information and receive detailed information about how their personal information is used. The CCPA provides for fines of up to $7,500 per violation, as well as a private right of action for data breaches that is expected to increase the frequency of data breach litigation. The CCPA has already been amended multiple times, and it is unclear whether this legislation will be further modified or how it will be interpreted. The effects of this legislation potentially are far-reaching, however, and may require us to modify our data processing practices and policies and incur substantial compliance-related costs and expenses. The CCPA, CPRA and other changes in laws or regulations relating to privacy, data protection and information security, particularly any new or modified laws or regulations that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer or disclosure, could greatly increase the cost of providing our offerings, limit our ability to collect and/or use certain types of data or otherwise require significant changes to our operations or even prevent us from providing certain offerings in jurisdictions in which we currently operate and in which we may operate in the future. Further, as we continue to expand our platform offerings and user base, we may become subject to additional privacy-related laws and regulations. For example, the collection and storage of healthcare data by health insurance carriers subject them to compliance requirements under HIPAA. HIPAA and its implementing regulations contain substantial restrictions and requirements regarding the use, collection, security, storage, and disclosure of individuals' protected health information. In 2009, HIPAA was amended by the HITECH Act to impose certain of HIPAA's privacy and security requirements directly upon business associates of covered entities. Health insurance carriers are covered entities under HIPAA. In the event we are deemed to be a business associate of such carriers, we may be bound by compliance obligations under HIPAA, including security breach notification obligations, and subject to increased liability as a possible liable party. In such instance, if we knowingly breach the HITECH Act's requirements, we could be exposed to criminal liability. A breach of our safeguards and processes could expose us to civil penalties up to $1.5 million for identical incidences and the possibility of civil litigation. Additionally, we have incurred, and may continue to incur, significant expenses in an effort to comply with privacy, data protection and information security standards and protocols imposed by law, regulation, industry standards or contractual obligations. Despite our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection, and information security, it is possible that our practices, offerings or platform could be inconsistent with, or fail or be alleged to fail to meet all requirements of, such laws, regulations or obligations. Our failure, or the failure by our third-party providers or partners, to comply with applicable laws or regulations or any other obligations relating to privacy, data protection or information security, or any compromise of security that results in unauthorized access to, or use or release of personally identifiable information or other data, or the perception that any of the foregoing types of failure or compromise has occurred, could damage our reputation, discourage new and existing partners from using our platform, delay planned uses, and disclosures of data or result in fines or proceedings by governmental agencies and private claims and litigation, any of which could materially and adversely affect our business, financial condition, operating results, cash flows, and prospects. Even if not subject to legal challenge, the perception of privacy concerns, whether or not valid, may harm our reputation and brand and materially and adversely affect our business, financial condition, operating results, cash flows, and prospects.

Our continued improvement of our product and service offerings is critical to our continued growth. Accordingly, we must continually invest resources in product, technology, and development in order to further enhance the capabilities, effectiveness and competitive differentiation of our platform, including by improving upon and expanding the tools we offer to our partners for customer acquisition cost management and optimization. As we develop and introduce new products and services, including those incorporating or utilizing artificial intelligence and machine learning and new processing of personal information, including identifiable information, they may raise new, or heighten existing, technological, security, legal and other risks and challenges, that may cause unintended consequences and may not function properly or may be misused by our clients. If we fail to adapt to our rapidly changing industry or to evolving client needs or expectations, or we provide new or updated products and services that exacerbate technological, security, legal or other challenges, the reputation of and demand for our platform or related offerings could decrease and our business, financial condition and operations may be adversely affected. In addition, while we have historically concentrated our efforts on the property & casualty insurance, health insurance, and life insurance markets, we may in the future seek to opportunistically penetrate other vertical markets, such as consumer finance, education, and home services. In order to penetrate new vertical markets successfully, it will be necessary to develop an understanding of those new markets and the associated risks, which may require substantial investments of time and resources, and even then we may not be successful. In such event, our revenue may grow at a slower rate than we anticipate and our business, financial condition, operating results, cash flows, and prospects could be materially and adversely affected.

Our success depends, in part, on our ability to develop and commercialize our products and services without infringing, misappropriating or otherwise violating the intellectual property rights of third parties. However, we may not be aware that our products or services are infringing, misappropriating or otherwise violating third-party intellectual property rights and such third parties may bring claims alleging such infringement, misappropriation or violation. Third parties may be able to successfully challenge, oppose, invalidate, render unenforceable, dilute, misappropriate or circumvent our trademarks, copyrights, and other intellectual property rights. Additionally, companies in the internet, technology, and media industries own large numbers of patents, copyrights, trademarks, and trade secrets and frequently enter into litigation based on allegations of infringement or other violations of intellectual property rights. As we face increasing competition and become increasingly high profile, the possibility of receiving a larger number of intellectual property claims against us grows. In addition, various "non-practicing entities," and other intellectual property rights holders may in the future attempt to assert intellectual property claims against us or seek to monetize the intellectual property rights they own to extract value through licensing or other settlements. Any claim of infringement or other proceeding involving our intellectual property rights by a third party, even those without merit, against us or for which we are required to provide indemnification could cause us to incur substantial costs defending against the claim, could distract our management from our business, and could require us to cease use of such intellectual property. Further, because of the substantial amount of discovery required in connection with intellectual property litigation, we risk compromising our confidential information during this type of litigation. We may be required to make substantial payments for legal fees, settlement fees, damages, royalties, or other fees in connection with a claimant securing a judgment against us. If a third party is able to obtain an injunction preventing us from accessing such third party's intellectual property rights, or if we cannot license or develop alternative technology for any infringing aspect of our business, we would be forced to limit or stop sales of our products and platform capabilities or cease business activities related to such intellectual property. We may be required to spend significant resources in order to monitor and protect our intellectual property rights, and some violations may be difficult or impossible to detect. Actions we may take to enforce our intellectual property rights may be expensive and divert management's attention away from the ordinary operation of our business and could result in the impairment or loss of portions of our intellectual property. Our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights, and, if such defenses, counterclaims, and countersuits are successful, we could lose valuable intellectual property rights. Our inability to secure and protect our intellectual property rights could impair the functionality of our platform, delay introductions of enhancements to our platform, result in our substituting inferior or more costly technologies into our platform, or harm our reputation and brand, and could materially and adversely affect our brand and business, financial condition, operating results, cash flows, and prospects. Furthermore, such enforcement actions, even if successful, may not result in an adequate remedy. In addition, many companies have the capability to dedicate greater resources to enforce their intellectual property rights and to defend claims that may be brought against them. Although we carry general liability insurance, our insurance may not cover potential claims of this type or may not be adequate to indemnify us for all liability that may be imposed. We cannot predict the outcome of lawsuits and cannot ensure that the results of any such actions will not have an adverse effect on our business, financial condition, operating results, cash flows, and prospects. Such claims could subject us to significant liability for damages and could result in our having to stop using technology found to be in violation of a third party's rights. Further, we might be required to seek a license for third-party intellectual property, which may not be available on commercially reasonable terms (if at all) and may significantly increase our operating expenses. Some licenses may be non-exclusive, and therefore our competitors may have access to the same technology licensed to us. If a third party does not offer us a license to its intellectual property on commercially reasonable terms, or at all, we could be required to develop alternative non-infringing technology, which could require significant time, effort and expense, and may ultimately not be successful. If we cannot license or develop technology for any infringing aspect of our business, we would be forced to limit our services, which could affect our ability to compete effectively. Any of these results would harm our business, financial condition, operating results, cash flows, and prospects.

Our success depends on our suppliers' ability to attract online visitors to their websites and our ability to attract online visitors to our proprietary websites, and to convert them into Consumer Referrals for our partners in a cost-effective manner. We depend on internet search companies to direct a substantial share of visitors to our suppliers' websites and our proprietary websites. Search companies offer two types of search results: organic and paid listings. Organic listings are displayed based solely on formulas designed by the search companies. Paid listings are displayed based on a combination of the buyer's bid price for particular keywords and the search engines' assessment of the website's relevance and quality. If one or more of the search engines or other online sources on which we or our suppliers rely for purchased listings modifies or terminates its relationship with us or decides to decrease its rating of the relevance and quality of our suppliers' or our proprietary websites, our traffic acquisition cost could rise, we could lose consumers, and traffic to our suppliers' websites and our proprietary websites could decrease, which could in turn decrease the amount and quality of Consumer Referrals made available for sale on our platform. Any of the foregoing could have a material and adverse effect on our business, financial condition, operating results, cash flows and prospects. The ability to maintain or grow the number of visitors to our suppliers' websites and our proprietary websites from search companies is not entirely within our control. Search companies frequently revise their algorithms and changes in their algorithms have in the past caused or could in the future cause our suppliers' websites and our proprietary websites to receive less favorable placements. There have been fluctuations in organic rankings for a number of our suppliers' websites and some of the paid listing campaigns have also been harmed by search engine algorithmic changes. Search companies could also determine that the content of our suppliers' websites or our proprietary websites is either not relevant or is of poor quality. In addition, search engine companies periodically change their advertising policies, or implement new policies, which can affect the placement of our paid search results in listings (or even our ability to participate in paid search result listing at all), reducing the number of visitors to our owned and operated and third-party publishers' websites. For example, in April 2021, Google implemented a new policy requiring paid search advertisers to be licensed health insurance brokers to bid on health insurance-related keywords, which required us to become a licensed health insurance broker in all 50 states and the District of Columbia to be able to continue bidding on such keywords. Any such new or revised policies implemented in the future, or the loss of insurance licenses in particular states, could have a material adverse impact on our or our suppliers' ability to drive traffic to our respective websites, which could result in a smaller supply of Consumer Referrals available on our platform to our Demand Partners and thus lower revenue, which would have an adverse effect on our business, financial condition, operating results, cash flows, and prospects. We or our Supply Partners may also fail to optimally manage our paid listings, or our proprietary bid management technologies may fail, or higher bids by our competitors may increase the cost of Consumer Referrals, any of which may lead to a decrease in the number of visits to our Supply Partners' websites or our proprietary websites. As a result, we may need to use more costly sources to replace lost visitors who could have contributed to our supply of Consumer Referrals, and such increased expense could adversely affect our business, financial condition, operating results, cash flows, and prospects. Even if we and our suppliers succeed in driving traffic to our respective websites, we may not be able to effectively monetize this traffic or otherwise retain users. Failure to do so could result in a smaller supply of Consumer Referrals available on our platform to our Demand Partners and thus lower revenue, which would have an adverse effect on our business, financial condition, operating results, cash flows, and prospects.

Many of the terms of our agreements with our partners, including our platform fees, are specifically negotiated with each partner. Our partners may negotiate with us to reduce our platform fees. The outcome of such negotiations could result in terms that are less favorable to us than those contained in our existing agreements or those obtained by our competitors, which could impact our relationship with our partners and could harm our business, financial condition, operating results, cash flows, and prospects. In addition, the net revenue generated from transactions in our Open Marketplace is higher than the net revenue from transactions in our Private Marketplaces. In the past, certain of our Supply and Demand Partners have switched their transactions with each other from our Open Marketplace to a Private Marketplace once they have reached a significant level of Transaction Value, and this may occur with other Supply and Demand Partners in the future. Such transitions may occur with minimal notice, and may cause our operating results for a given period to fail to meet our expectations or those of any analysts that cover us or investors, which could cause the market price of our Class A common stock to fall substantially.

A significant natural disaster, such as an earthquake, fire, hurricane, tornado, flood or significant power outage, could disrupt our operations, platform, the internet or the operations of our third-party technology providers. In particular, our corporate headquarters are located in Los Angeles, California, a region known for seismic activity. In addition, any unforeseen political crises, terrorist attacks, war, political instability, or other catastrophic events, whether in the United States or abroad, could adversely affect our operations or the economy as a whole. Any natural disaster, act of terrorism or other disruption to us or our third-party providers' abilities could materially interfere with or prevent us from conducting our business for a period of time, which impact may be further increased if our disaster recovery plans prove to be inadequate. In addition, if insurance carriers experience large or unexpected underwriting losses due to a natural disaster or act of terrorism, these carriers may decrease the amount of money they spend on customer acquisition spending until they can obtain regulatory approval to raise premiums. Any of these risks could adversely affect our business, financial condition, operating results, cash flows, and prospects.