Townsquare Media (TSQ) Risk Factors

A security breach or cyber-attack of our computer systems could interrupt or damage our operations or harm our reputation. A security breach could occur both from external sources, including malicious attacks and third-party service provider vulnerabilities, as well as internal sources, such as employee error, failures in our security measures or vulnerabilities in our networks or code base. Any security breaches of our computer systems, including repeated or sustained attacks or disruptions, could interrupt delivery of services to customers, potentially increasing costs and reducing revenue. If third parties or our employees are able to penetrate our network security or otherwise misappropriate personal information or contact information of our customers, audience, business partners or advertisers, or if we give third parties or our employees improper access to such data, we could be subject to liability. This liability could include identity theft or other similar fraud-related claims. This liability could also include claims for other misuses or losses of personal information, including for unauthorized marketing purposes. Even in the absence of bad actors, unidentified vulnerabilities or glitches in our systems could result in loss of business-critical data or otherwise compromise the confidentiality, integrity or availability of such data. Other liabilities could include claims alleging misrepresentation of our privacy and data security practices. We could also be subject to regulatory or private rights of action in certain jurisdictions. The number and scale of cyber-attacks causing significant business disruptions, such as global ransomware attacks, are increasing and could pose a risk to our ability to deliver our services and operate our business. Any future ransomware or other cyber-attack could disrupt our service delivery for an indeterminate period of time, as well as compromise or destroy personal and business-critical data and information within our control. Recovering from such an attack may require significant resources to restore business operations and our services, including personnel time and capital costs. In some cases, recovery of such data may not be possible. If a security breach results in the exposure or unauthorized disclosure of personal information, we could incur additional costs associated with data breach notification and remediation expenses, investigation costs, regulatory penalties and fines, and legal proceedings. Our insurance coverage may not be adequate to cover all the costs related to such breaches or attacks. We rely on encryption and authentication technology licensed from third parties to provide the security and authentication necessary to effect secure online transmission of confidential consumer information. Advances in computer capabilities, new discoveries in the field of cryptography or other events or developments may result in a compromise or breach of the algorithms that we use to protect sensitive customer transaction data. A party who is able to circumvent our security measures could misappropriate proprietary information or cause interruptions in our operations. We may be required to expend capital and other resources to protect against such security breaches or cyber-attacks or to alleviate problems caused by such breaches or attacks. Our security measures are designed to protect against security breaches and cyber-attacks but may not be adequate, implemented properly, or appropriately complied with internally to prevent a security breach or cyber-attack. No network or system can ever be completely secure. Our failure to prevent such security breaches and cyber-attacks could subject us to liability, adversely affect our results of operations and damage our reputation.

Technologies have been developed that can block the display of our ads and that provide tools to users to opt out of our advertising products. Most of our revenue from our digital advertising businesses are derived from fees paid to us by advertisers in connection with the display of ads on web pages for our users. As a result, such technologies and tools could adversely affect our operating results. In order to effectively target digital advertising campaigns, we use a combination of first and third-party data. Any restrictions that limit the use of third-party cookies could impact our ability to deliver effective digital advertising results which could adversely affect our operating results.

The radio industry is subject to extensive regulation by the FCC under the Communications Act. Our radio stations depend upon maintaining their broadcasting licenses issued by the FCC, which are currently issued for a maximum term of eight years and are renewable. Interested parties may challenge a renewal application. On rare occasions, the FCC has revoked licenses, not renewed them, or renewed them with significant qualifications, including renewals for less than a full term of eight years. In the last renewal cycle, the FCC granted all of the license renewal applications that were filed for our radio stations for full eight-year terms. The next license renewal cycle begins in 2027. We cannot be certain that our future license renewal applications will be approved, or that the renewals will not include conditions or qualifications that could adversely affect our business, financial condition and results of operations, result in material impairment or adversely affect our liquidity and financial condition. If any of our FCC licenses are not renewed, it would prevent us from operating the affected radio station and generating revenue from it. Further, the FCC has a general policy restricting the transferability of a radio station license while a renewal application for that radio station is pending. In addition, we must comply with extensive FCC regulations and policies governing the ownership and operation of our radio stations. FCC regulations limit the number of radio stations that a licensee can own in a market, which could restrict our ability to consummate future transactions. The FCC's rules governing our radio station operations impose costs on our operations and changes in those rules could have an adverse effect on our business. The FCC also requires radio stations to comply with certain technical requirements to limit interference between two or more radio stations. If the FCC relaxes these technical requirements, it could impair the signals transmitted by our radio stations and could have a material adverse effect on our business. Moreover, governmental regulations and policies may change over time, and the changes may have a material adverse impact upon our business, financial condition and results of operations. For further details on federal regulation of radio broadcasting, see "Business-Federal Regulation of Radio Broadcasting."

In the course of our ordinary business operations, we may collect personal information and non-personal information that is critical or commercially-useful to our business, including personal information related to our employees, audience, advertisers, contractors, and customers. As a result of our digital expansion efforts and third-party partnerships, the volume, sensitivity, and business importance of the information we collect and use is increasing. We collect this information directly from individuals, through passive tracking technology such as "cookies" and indirectly through third parties engaged to provide services on our behalf. In addition to the risk that a security breach may compromise this information, this information may include personal information such as names, contact information, credit card information, geolocation and demographic information that is subject to specific data protection and privacy laws. We are subject to federal and state data protection and privacy laws and regulations that require us to comply with specific consumer protection, information security and data protection and privacy requirements. The legal and regulatory landscape continues to evolve, with new laws being enacted or coming into force. Additionally, we are required to comply with the CCPA, which requires us to update both our internal and external policies and procedures to meet our compliance obligations under CCPA. Compliance with CCPA may require that we change or amend activities that involve personal information, which may impact business operations or our ability to effectively use personal information in our control. Furthermore, as mentioned under "Our engagement of third-party service providers increases our exposure to security and data privacy risks" above, such requirements include allowing consumers to limit our use of their personal information, or delete it entirely. Regulatory enforcement actions and interpretations of new data protection and privacy laws and regulations may change how these requirements apply to our business and collection, use, storage, and disclosure of personal information, creating uncertainty regarding the continued viability of information-reliant business activities. Certain interpretations or implementation of new data protection and privacy laws, as well as the evolving legal and regulatory landscape, could harm our business, including negatively impacting the cost of doing business or our ability to engage in certain business practices. Furthermore, recent disclosures of major data breaches and company data collection, use and disclosure practices to which large segments of the consumer population have objected may result in both increased interest in U.S. federal data privacy legislation as well as changes to consumer privacy expectations and demands. Such shifts may restrict our ability to collect and/or process personal information in a particular way or derive economic value from personal, and even non-personal, information. We have implemented and are implementing policies and procedures to comply with applicable data protection and privacy laws and regulations, but such measures may not always be effective, particularly as the legal landscape continues to evolve, and regulatory guidance is often ambiguous or inconsistent. Some of our internal processes are manual and rely on employees to follow and adhere to our policies and procedures, which can result in employee error and internal compliance failures. Any failure or perceived failure by us to comply with our policies or applicable data protection and privacy laws and regulations could result in regulatory enforcement actions against us, proceedings by governmental entities, consumers or others (including our contractual third parties), and loss in brand value and reputation. Such results could possibly require us to incur costs for defending against proceedings or paying regulatory fines or penalties and responding to such outcomes could consume considerable management focus and internal resources, decrease demand for our services, or increase the costs of, or otherwise limit, our ability to do business.

We invest significant capital and employee resources in our digital businesses, including our subscription digital marketing solutions business, Townsquare Interactive, and our programmatic digital advertising business. These digital business lines are subject to significant competition, rapidly changing technology, and evolving standards. As we continue to grow these lines of business and expand into new markets, we will also face new sources of competition, including, in certain of these markets, from companies with longer operating histories, established customer bases, greater brand recognition and more financial, technical, marketing, and related resources. We will need to cultivate new relationships with customers, third party providers and other partners in each of these markets. We may not be able to compete successfully against current and future competitors, and our business, results of operations and financial condition will be harmed if we fail to meet these competitive pressures. In addition, there can be no assurance that our digital technologies we use or develop will be adequate, or that we will be able to establish our proprietary right to the technologies we rely upon. The ability to grow Townsquare Interactive depends in large part on maintaining and expanding our subscriber base. To do so, we must convince prospective subscribers of the benefits of our technology platform and existing subscribers of the continuing value of our products and services. Most of our contracts with subscribers are terminable upon short or no notice. The digital marketing solutions sector is highly competitive. We believe our solutions are well positioned to serve the SMBs in markets outside the top 50 upon which we focus. However, if our net subscriber base decreases, our business, financial condition and operating results will be adversely affected.

Approximately 0.6% and 1.6% of our net revenue for the years ended December 31, 2023 and 2022, respectively, consisted of political advertising revenue. Political advertising revenue from elections, which is generally greater in even-numbered years and especially the years in which the U.S. President is elected, has the potential to create fluctuations in our operating results on a year-to-year basis. For example, we had political advertising revenue of $2.9 million and $7.5 million, during 2023 and 2022, respectively. In addition, political advertising revenue is dependent on the level of political ad spend and competitiveness of local, state and national elections within each local market.