Outbrain (OB) Risk Factors

Our revenue, cash flow, operating results and other key operating and performance metrics may vary from quarter to quarter due to the seasonal nature of our advertisers' spending. For example, advertisers tend to devote more of their advertising budgets to the fourth calendar quarter to coincide with user holiday spending. Moreover, advertising inventory in the fourth quarter may be more expensive due to increased demand. Other large cyclical events that attract advertisers, such as elections, the Olympics and other sporting events, the Oscars, or other large entertainment events, also could cause our revenue to increase during certain periods and decrease in other periods.

Our revenue growth depends on our success in expanding and deepening our relationships with existing advertisers. Our growth strategy is premised in part on increasing spend from existing advertisers. In order to do so, we must be able to demonstrate better results for our advertisers with increased user engagement and ROAS, among other things. We do not have long-term commitments from our advertisers. We also seek to increase the number of advertisers and to reach new advertisers, both directly and through their media agencies. Attracting new advertisers and expanding existing relationships with our advertisers requires substantial effort and expense. In particular, large advertisers with well-established brands may require us to spend significant time educating them about our platform and solutions. It may be difficult and time consuming to identify, sell and market to potential advertisers who already allocate their budgets to large competitors and who expect to see a similar return on investment before diversifying or allocating a portion of their advertising budgets to us. As we expand the application of our solutions, we increasingly depend on media agencies who assist advertisers in planning and purchasing advertising for brand marketing objectives, such as preference shift and brand awareness. Media agencies may require platforms like ours to be added to preferred partners programs, connect to designated intermediaries or make various commitments. It may be difficult, costly or time-consuming to meet media agency requirements and may not result in revenue growth. If we are unsuccessful in developing new advertiser and agency relationships and maintaining and expanding our existing relationships, our results of operations and prospects will be adversely affected.

Our platform depends on users continuing to consume content on media owners' digital properties. Media owners face challenges growing and maintaining their audiences a result of the proliferation of new and innovative content distribution methods such as social media platforms. The overall decline in media owner audiences limits available advertising inventory creating financial pressure on media owners who rely on advertising to operate their business. As a result of these evolving trends, we have seen and may continue to see media owners consolidating or ceasing to operate. In addition, some media partners, typically those that participate in both print and digital publishing, charge their users a subscription fee for online access by implementing a paywall. Our business may be negatively impacted by media partners shifting from open access to paywalls or generating less user interest because it may decrease our access to consumers and advertising inventory. If media partners consolidate, cease to operate, or shift their revenue models from advertising, this could negatively affect our business, results of operations, and financial condition. To the extent we have long-term commitments with our media partners, and they are adversely impacted by the evolving media owner landscape, we may not be able to recoup our investment in our media partners.

Our intellectual property rights are important to our business. We rely on a combination of confidentiality clauses, trade secrets, copyrights, patents and trademarks to protect our intellectual property and know-how. However, the steps we take to protect our intellectual property may be inadequate. We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property. Despite our precautions, it may be possible for unauthorized third parties, including our employees, consultants, service providers, media partners or advertisers, to copy our products and/or obtain and use information that we regard as proprietary to create solutions and services that compete with ours. We cannot assure you that the steps taken by us will prevent misappropriation of our trade secrets or technology or infringement of our intellectual property. In addition, the laws of some foreign countries where we operate do not protect our proprietary rights to as great an extent as the laws of the United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States. Our policy is to enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances. No assurance can be given that these agreements will be effective in controlling access to our proprietary information and other intellectual property. Further, these agreements do not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our solutions. We may from time to time be subject to claims of prior use, opposition or similar proceedings with respect to applications for registrations of our intellectual property, including but not limited to our trademarks and patent applications. The process of seeking patent protection can be lengthy and expensive, and any of our pending or future patent or trademark applications, whether or not challenged, may not be issued with the scope of the claims we seek, if at all. We are unable to guarantee that patents or trademarks will issue from pending or future applications or that, if patents or trademarks issue, they will not be challenged, invalidated or circumvented, or that the rights granted under the patents will provide us with meaningful protection or any commercial advantage. We rely on our brand and trademarks to identify our solutions to our media partners and advertisers and to differentiate our solutions from those of our competitors. If we are unable to adequately protect our trademarks, third parties may use our brand names or trademarks similar to ours in a manner that may cause confusion to our users or confusion in the market, or dilute our brand names or trademarks, which could decrease the value of our brand. From time to time, we may discover that third parties are infringing, misappropriating or otherwise violating our intellectual property rights. However, policing unauthorized use of our intellectual property and misappropriation of our technology is difficult and we may therefore not always be aware of such unauthorized use or misappropriation. Despite our efforts to protect our intellectual property rights, unauthorized third parties may attempt to use, copy or otherwise obtain and market or distribute our intellectual property rights or technology or otherwise develop solutions with the same or similar functionality as our solutions. If competitors infringe, misappropriate or otherwise misuse our intellectual property rights and we are not adequately protected, or if such competitors are able to develop solutions with the same or similar functionality as ours without infringing our intellectual property, our competitive position and results of operations could be harmed and our legal costs could increase.

Our platform utilizes software licensed to us by third-party authors under "open source" licenses and we expect to continue to utilize open source software in the future. The use of open source software may entail greater risks than the use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code. To the extent that our platform depends upon the successful operation of the open source software we use, any undetected errors or defects in this open source software could prevent the deployment or impair the functionality of our platform, delay new solutions introductions, result in a failure of our platform, and injure our reputation. For example, undetected errors or defects in open source software could render it vulnerable to breaches or security attacks, and, in conjunction, make our systems more vulnerable to data breaches. Furthermore, some open source licenses contain requirements that we make available source code for modifications or derivative works we create based upon the type of open source software we use. If we combine our proprietary software with open source software in a specific manner, we could, under some open source licenses, be required to release the source code of our proprietary software to the public. This would allow our competitors to create similar solutions with lower development effort and time and ultimately put us at a competitive disadvantage. Although we monitor our use of open source software to avoid subjecting our platform to conditions we do not intend, we cannot assure you that our processes for controlling our use of open source software in our platform will be effective. If we are held to have breached the terms of an open source software license, we could be required to seek licenses from third parties to continue operating using our solution on terms that are not economically feasible, to re-engineer our solution or the supporting computational infrastructure to discontinue use of code, or to make generally available, in source code form, portions of our proprietary code.

Our business is subject to regulation, which is rapidly evolving, and the business and regulatory environment in each of the international markets in which we operate may differ. For example, regulations relating to our business, including our employees, our arrangements with media partners and advertisers, stricter rules relating to content running through our network, and privacy related regulations affect how we conduct our business. The following are some of the political and regulatory risks and challenges we face across jurisdictions: - greater difficulty in enforcing contracts;- higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations;- risks associated with trade restrictions and foreign legal requirements, including any certification and localization of our platform that may be required in foreign countries;- organizing or similar activity by workers, local unions, work councils, or other labor organizations;- our ability to respond to competitive developments and other market and technological dynamics, such as the emergence of generative AI;- greater risk of unexpected changes in regulatory practices, tariffs, and tax laws and treaties;- compliance with anti-bribery laws, including, without limitation, compliance with the U.S. Foreign Corrupt Practices Act and the UK Bribery Act;- compliance with data protection and privacy law regimes of various countries, especially as our business relates to consumer online privacy and interested-based advertising;- heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;- the uncertainty of protection for intellectual property rights in some countries;- general economic and political conditions in these foreign markets, including political and economic instability in some countries;- the potential for heightened regulation relating to content curation or discovery as a result of concerns relating to the spread of disinformation through technology platforms; and - double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the United States or the foreign jurisdictions in which we operate.

The U.S. and non-U.S. tax laws applicable to our business activities are subject to interpretation and are changing. We are subject to audit by the U.S. Internal Revenue Service and by taxing authorities of the state, local and foreign jurisdictions in which we operate. Our tax obligations are based in part on our corporate operating structure, including the manner in which we develop, value, use and hold our intellectual property, the jurisdictions in which we operate, how tax authorities assess revenue-based taxes such as sales and use taxes, the scope of our international operations, and the value we ascribe to our intercompany transactions. Taxing authorities may challenge, and have challenged, our tax positions and methodologies for valuing developed technology or intercompany arrangements, positions regarding the collection of sales and use taxes, and the jurisdictions in which we are subject to taxes, which could expose us to additional taxes. Any adverse outcomes of such challenges to our tax positions could result in additional taxes for prior periods, interest and penalties, as well as higher future taxes. In addition, our future tax expense could increase as a result of changes in tax laws, regulations or accounting principles, or as a result of earning income in jurisdictions that have higher tax rates. For example, the European Commission has proposed, and various jurisdictions have enacted or are considering enacting laws that impose separate taxes on specified digital services, which may increase our tax obligations in such jurisdictions. Digital services or other similar taxes could, among other things, increase our tax expense, create significant administrative burdens for us, discourage potential customers from subscribing to our platform due to the incremental cost of any such sales or other related taxes, or otherwise have a negative effect on our financial condition and results of operations. In addition, the Organization for Economic Cooperation and Development is progressing on a Base Erosion and Profit Shifting Project that, if implemented, would change various aspects of the existing framework under which our tax obligations are determined in many of the countries in which we do business. More than 140 countries tentatively signed on to a framework that imposes a minimum tax rate of 15%, among other provisions, and the European Union has adopted a Council Directive which requires these provisions to be transposed into member states' national laws. As this framework is subject to further negotiation and implementation by each member country, the timing and ultimate impact of any such changes on our tax obligations are uncertain. Moreover, the determination of our provision for income taxes and other tax liabilities requires significant estimates and judgment by management, and the tax treatment of certain transactions is uncertain. The income tax benefit/expense we record may vary significantly in future periods based on factors outside of our control, such as the uncertainty with respect to the current macroeconomic environment on our operations and our stock price. For example, in periods in which our stock price varies from the grant price of the share-based compensation vesting in that period, we will recognize excess tax benefits or shortfalls that will impact our effective tax rate. Any changes, ambiguity, or uncertainty in taxing jurisdictions' administrative interpretations, decisions, policies and positions, including the position of taxing authorities with respect to revenue generated by reference to certain digital services, could also materially impact our income tax liabilities. Although we believe that our estimates and judgments are reasonable, the ultimate outcome of any particular issue may differ from the amounts previously recorded in our financial statements and any such occurrence could adversely affect our business, results of operations, and financial condition.

We receive, store, and process data about or related to users in addition to our media partners, advertisers, services providers and employees. Our handling of this data is subject to a variety of federal, state, and foreign laws and regulations and is subject to regulation by various government authorities. Our data handling is also subject to contractual obligations and industry standards. The U.S. federal and various state and foreign governments have adopted or proposed limitations on the collection, distribution, use, and storage of data relating to individuals, including the use of contact information and online identifiers, advertising and other communications with individuals and businesses. Additionally, the Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the online collection, use, dissemination, and security of data and issuing separate guidance in this area. If we fail to comply with any such laws or regulations, we may be subject to enforcement actions that may not only expose us to litigation, fines, and civil and/or criminal penalties, but also require us to change our business practices as well as have an adverse effect on our business, results of operations, and financial condition. The regulatory framework for online privacy issues is continuously evolving and is likely to receive global scrutiny for the foreseeable future. Restrictions could be placed upon the collection, management, aggregation, and use of information, which could result in a material increase in the cost of collecting or otherwise obtaining certain kinds of data and could limit the ways in which we may use or disclose information. In particular the use of data to draw inferences about a user's interests and deliver relevant advertising to that user, and similar or related practices (sometimes referred to as interest-based advertising, behavioral advertising or personalized advertising), has come under increasing scrutiny by legislative, regulatory, and self-regulatory bodies in the United States and abroad that focus on consumer protection or online privacy. Much of this scrutiny has focused on the use of cookies and other technologies to collect information about Internet users' online browsing activity on web browsers, mobile devices, and other devices, to associate such data with user or device identifiers or de-identified identities across devices and channels. As we rely upon large volumes of data collected primarily through cookies and similar technologies, it is possible that these legislative and technical changes may have a substantial impact on our ability to collect and use the data of Internet users. It is essential that we monitor global privacy developments and engage in responsible privacy practices, including providing users with notice of the types of data we collect and how we use that data to provide our services. In the United States, the U.S. Congress and state legislatures, along with federal regulatory authorities have recently increased their attention on matters concerning the collection and use of consumer data. For example, California enacted the California Consumer Privacy Act, along with related regulations (together, the "CCPA"), which was subsequently updated by the California Privacy Rights Act ("CPRA"). The CCPA creates individual privacy rights for California residents and increases the privacy and security obligations of businesses handling personal data and the CPRA imposes additional data protection obligations including limitation on the use and processing of sensitive personal data. The CCPA and CPRA are enforceable by the California Attorney General and there is also a private right of action relating to certain data security incidents. The CCPA generally requires covered businesses to, among other things, provide disclosures to California consumers and afford California consumers abilities to opt-out of the sharing of personal data between parties, a concept that is defined broadly, with behavioral advertising triggering such requirements under the CCPA. The CCPA and CPRA or subsequent guidance may require us to further modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. Other states across the country have been implementing similar privacy laws, such as Virginia, Colorado, Connecticut and Utah. Any disparity between federal and state laws may add additional complexity, including a variation in requirements, restrictions, and potential legal risk, and may require additional investment in compliance programs, result in disjointed internal approaches to the collection and use of data as a result of state-based differences or impact strategies and availability of previously useful data. In Europe, the General Data Protection Regulation (EU) 2016/679 ("GDPR") took effect on May 25, 2018 and applies to products and services that we provide in Europe, as well as the processing of personal data of European Economic Area ("EEA") residents, wherever that processing occurs. The GDPR includes operational requirements for companies that receive or process personal data of residents of the EEA that are different from those that were in place in the EEA prior to the GDPR. Failure to comply with GDPR, or its implementation in the United Kingdom through the Data Protection Act 2018 ("UK GDPR"), may result in significant penalties for non-compliance, in the United Kingdom, the greater of £17.5 million or 4% of the total worldwide turnover in the preceding financial year or, in the case of the GDPR, whichever is greater €20 million or 4% of an enterprise's global annual revenue. In addition to the foregoing, a breach of the GDPR or the UK GDPR could result in regulatory investigations, reputational damage, orders to cease/change our processing of our data, enforcement notices, and/or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm. In addition, there is increased focus on the self-regulatory mechanisms created to further compliance with these regulations. For example, the Internet Advertising Bureau ("IAB") Transparency & Consent Framework ("TCF") has been criticized for being inherently incompatible with GDPR. As a result, loss of confidence in such mechanisms and slow adoption rates create may undermine the viability of the TCF such that there is no industry standard for requesting and obtaining consent, all of which could negatively affect our business, results of operations, and financial condition. In addition, the UK Information Commissioner's Office ("ICO"), the Irish Data Protection Commission and the French Commission Nationale de l'Informatique et de Libertés ("CNIL") continue to investigate the ad tech industry and the use of cookies. Further, in the European Union, current national laws that implement the ePrivacy Directive (2002/58/EC) will be replaced by the ePrivacy Regulation, which will significantly increase fines for non-compliance and impose burdensome requirements around placing cookies. While the text of the ePrivacy Regulation is still under development, the CJEU Fashion ID, Planet 49, Wirtschaftsakademie cases are driving increased attention to cookies and tracking technologies and impacting compliance requirements across the ecosystem. As regulators start to enforce a strict approach regarding the use of cookies, we expect further system changes, limitations on the effectiveness of our advertising activities, and compliance requirements, which may adversely affect our margins, increase costs, and subject us to additional liabilities. Though GDPR intended to harmonize the privacy laws across the EEA, member state interpretations of the law continue to vary making compliance increasingly complex. For example, France and Germany, have adopted a strict approach to the dropping of any cookies without consent, even if cookies are used strictly for technical delivery and not for personalization. Although we developed technical solutions to comply with such cookie limitations, evolving interpretations of required limitations may result in unintended consequences with respect to our operations, such as fraud identification or user experience. It is possible that CCPA (and other U.S. privacy laws), GDPR, UK GDPR and the ePrivacy Regulation in Europe and related standards may be interpreted and applied in manners that are, or are asserted to be, inconsistent with our data management practices or the technological features of our solutions, and any failure to achieve required data protection standards may result in lawsuits, regulatory fines, or other actions or liability, all of which may harm our results of operations. In addition to government regulation, privacy advocacy and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us, our media partners or our advertisers, such as the IAB U.S. Global Privacy Platform and Multi-State Privacy Agreement. We are members of self-regulatory bodies that impose additional requirements related to the collection, use, and disclosure of consumer data, such as the right to opt out of the sharing or the sale of their personal information for interest-based advertising purposes. Some of these self-regulatory bodies might refer violations of their requirements to the Federal Trade Commission or other regulatory bodies. If we were to be found responsible for such a violation, it could adversely affect our reputation, as well as our business, our compliance with self-regulatory frameworks, results of operations, and financial condition. In Europe, the Digital Services Act (EU) 2022/2065 ("DSA") will be enforceable from February 2024 and applies to digital services that connect consumers to goods, services, or content in the EEA. Although we have not been classified as a "very large online platform" under the DSA, we may still be required to comply with the provisions of the DSA or support our partners' compliance with the provisions of the DSA. The DSA imposes stricter obligations on curbing harmful or unlawful content, such as implementing tools to automatically monitor, detect and take down illegal online content; implementing a mechanism for users to easily flag content and to cooperate with "trusted flaggers" (such as NGOs); reinforcing traceability of our customers; implementing a mechanism for the public and businesses to challenge content moderation decisions and seek redress; providing access to vetted researchers to the key data and provision of access to NGOs to public data; increased transparency on the algorithms used for recommending content to users; implementing risk-based controls to prevent the misuse of our tools and independent audits of our risk management systems; implementing mechanisms to adapt swiftly and efficiently in reaction to crises affecting public security or public health; preventing the use of targeted advertising with respect to children targeting and sensitive personal data. Sanctions under the DSA include fines of up to 6% of global turnover in the event of non-compliance and can lead to a ban on operating in the EU in cases of repeated serious breaches. A similar piece of legislation, the Online Safety Bill, is currently being discussed in the UK. In addition to the foregoing, a breach of the DSA could result in regulatory investigations, reputational damage, orders to cease/change our services, enforcement notices, and/or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm. In addition, we may be required to indemnify media partners against claims with respect to our advertising content. Our advertisers may not have the ability to satisfy their indemnification obligations to us, in whole or in part, and pursuing any claims for indemnification may be costly or unsuccessful. As a result, we may be required to satisfy indemnification obligations to media partners, or claims against us, with our own assets.

We have attempted to control our operating expenses by utilizing lower cost labor in foreign countries, such as India, and we may in the future expand our reliance on off-shore labor. Countries outside of the United States may be subject to relatively higher degrees of political and social instability and may lack the infrastructure to withstand political unrest, natural disasters, pandemics or other instability, which could interfere with work performed by these labor sources or could result in our having to replace or reduce these labor sources. Moreover, we may have difficulty in successfully staffing, transitioning knowledge of systems and controls, and managing our foreign operations, which could impact our business, financial condition or results of operations. Doing business outside of the U.S. also increases our risk exposure to anti-corruption laws and regulations such as the Foreign Corrupt Practices Act, any violation of which could expose us to significant financial penalties or consent orders that may curtail our business.