Advantage Solutions (ADV) Risk Analysis

Our five largest clients generated approximately 22% of our revenues, none of which individually generated more than 10%, in the fiscal year ended December 31, 2025. These clients are generally able to reduce or cancel spending on our services on short notice for any reason. A significant reduction in spending on our services by our largest clients, or the loss of one or more of our largest clients, if not replaced by new clients or an increase in business from existing clients, would adversely affect our business and results of operations. In addition, when large retailers suspend or reduce in-store demonstration services, such as in response to pandemic, our business and results of operations can be adversely affected.

Our ability to acquire new clients and to retain existing clients, whether by expansion of our own operations or through an acquired business may in some cases be limited by the other parties' perceptions of, or policies concerning, perceived competitive conflicts arising from our other relationships. Some of our contracts expressly restrict our ability to represent competitors of the counterparty. These perceived competitive conflicts may also become more challenging to avoid or manage as a result of continued consolidation in the CPG and retail industries and our own acquisitions. If we are unable to avoid or manage business conflicts among competing manufacturers and retailers, we may be unable to acquire new clients or be forced to terminate existing client relationships, and in either case, our business and results of operations may be adversely affected.

We have obtained licenses that give us rights to third party intellectual property that is necessary or useful to our business. These license agreements may impose various royalty and other obligations on us. One or more of our licensors may allege that we have breached our license agreement with them, and could seek to terminate our license, which could adversely affect our competitive business position and harm our business prospects. In addition, any claims brought against us by our licensors could be costly, time-consuming and divert the attention of our management and key personnel from our business operations.

Changes to practices and policies of operating systems, websites and other digital platforms, including, without limitation, Apple's or Android's transparency policies, may reduce the quantity and quality of the data and metrics that can be collected or used by us and our clients or reduce the value of our digital services. These limitations may adversely affect both our and our clients' ability to effectively target and measure the performance of our digital services. In addition, our clients and third-party vendors routinely evaluate their digital practices and policies, and if in the future they determine to modify such practices and policies for any reasons, including, without limitation, privacy, targeting, age or content concerns, this could decrease the desire for our digital services as compared to other alternatives. If we are unable to timely or effectively respond to changes in digital practices and policies, or if our clients do not believe that our digital services will generate a competitive return on investment relative to alternatives, then our business, financial condition or results of operations could be adversely affected.

Our ability to meet our workforce needs, while controlling teammate-related costs, including salaries, wages and benefits, is subject to numerous external factors, including the availability of talented persons in the workforce in the local markets in which we operate, prevailing unemployment rates and competitive wage rates in such markets. We may find that there is an insufficient number of qualified individuals to fill our positions with the qualifications we seek. Competition in these communities for qualified staff could require us to pay higher wages and provide greater benefits, especially if there is significant improvement in regional or national economic conditions. We must also train and, in some circumstances, certify these teammates under our policies and practices and any applicable legal requirements. If we are unable to hire, timely train or retain talented individuals we may face higher turnover and increased labor costs, which could compromise the quality of our service, and could adversely affect our business.

We rely on third parties to provide certain data for use in connection with the provision of our services. For example, we contract with third parties to obtain the raw data on retail product sales and inventories. These suppliers of data may impose restrictions on our use of such data, fail to adhere to our quality control standards, increase the price they charge us for this data or refuse altogether to license the data to us. If we are unable to use such third-party data or if we are unable to contract with third parties, when necessary, our business, financial condition or our results of operations could be adversely affected. In the event that such data are unavailable for our use or the cost of acquiring such data increases, our business could be adversely affected.

Consumer goods manufacturers and retailers are subject to a broad range of federal, state, local and international laws and regulations governing, among other things, the research, development, manufacture, distribution, marketing and post-market reporting of consumer products. These include laws administered by the U.S. Food and Drug Administration (the "FDA"), the U.S. Drug Enforcement Administration, the U.S. Federal Trade Commission, the U.S. Department of Agriculture and other federal, state, local and international regulatory authorities. For example, certain of our clients market and sell products containing cannabidiol ("CBD"). CBD products are subject to a number of federal, state, local and international laws and regulations restricting their use in certain categories of products and in certain jurisdictions. In particular, the FDA has publicly stated it is prohibited to sell into interstate commerce food, beverages or dietary supplements that contain CBD. These laws are broad in scope and subject to evolving interpretations, which could require us to incur costs associated with new or modified compliance requirements or require us or our clients to alter or limit our activities, including marketing and promotion, of such products, or to remove them from the market altogether. If a regulatory authority determines that we or our current or future clients have not complied with the applicable regulatory requirements, our business may be materially impacted, and we or our clients could be subject to enforcement actions or loss of business. We cannot predict the nature of any future laws, regulations, interpretations or applications of the laws, nor can we determine what effect additional laws, regulations or administrative policies and procedures, if and when enacted, promulgated and implemented, could have on our business.

In November 2021, our board of directors authorized a share repurchase program, under which we may repurchase up to $100.0 million of our outstanding Class A common stock (the "2021 Share Repurchase Program"). As of December 31, 2025, the remaining amount available for repurchase pursuant to the 2021 Share Repurchase Program is $46.2 million. However, we are not obligated to make any further purchases under the 2021 Share Repurchase Program and we may suspend or permanently discontinue this program at any time or significantly reduce the amount of repurchases under the program. Any announcement of a suspension, discontinuance or reduction of this program may negatively impact our reputation and investor confidence.

A variety of federal, state, and foreign laws and regulations govern the collection, use, retention, sharing, and security of personal information. The requirements imposed by such laws and regulations relating to privacy and data protection are increasingly demanding, quickly evolving, and may be subject to differing interpretations. Further, given their patchwork status, these requirements often cannot be harmonized and may be applied in a manner that is inconsistent from one jurisdiction to another. As a result, our practices may not have complied or may not comply in the future with all such laws, regulations, requirements, and obligations. Our actual or perceived failure to comply with such laws and regulations could result in fines, investigations, enforcement actions, penalties, sanctions, claims for damages by affected individuals, and damage to our reputation, among other negative consequences, any of which could have a material adverse effect on its financial performance. We and certain of our third-party providers collect, maintain and process data about consumer, employees, business partners and others, including personally identifiable information, as well as proprietary information belonging to our business such as trade secrets (collectively, "Confidential Information"). Our business model does not require a significant amount of consumer personal information to sustain operations or create additional business opportunities. The largest area of privacy exposure relates to the collection and use of personal information of our employees. As such, we are subject to the California Consumer Protection Act of 2018, as well as its amendment, the California Privacy Rights Act of 2020 (the "CPRA") and accompanying regulations, the California Consumer Privacy Act Regulations (collectively, the "CCPA"). The CCPA regulates the collection, use, and processing of personal information relating to California residents, which includes our employees. It grants certain privacy rights to California residents, including the right to access, correct, and delete personal information relating to such individuals under certain circumstances. Compliance with obligations imposed by the CCPA depends in part on how its requirements are interpreted and applied by the California attorney general, courts, and the California Privacy Protection Agency. In 2026, violations of the CCPA may result in substantial civil penalties or statutory damages of approximately $2,700 per violation or approximately $8,000 per intentional violation of any CCPA requirement, which may be applied on a per-person or per-record basis. The CCPA also establishes a private right of action if certain personal information of individuals is breached as a result of a business's violation of the duty to implement and maintain reasonable security procedures and practices. This violation authorizes statutory damages of approximately $100 to $800 per person per incident even if there is no actual harm or damage to plaintiffs. This private right of action may increase the likelihood of, and risks associated with, general data breach litigation. By the end of 2026, laws similar to CCPA are expected to be in effect in 18 states, and this number may increase as 14 additional states have active legislation under consideration. Like the CCPA, these laws regulate the collection, use and processing of personal information relating to residents of the respective states, and grants certain privacy rights to those residents. Similarly, the U.S. Federal Trade Commission continues to actively investigate and enforce privacy violations by its authority under the FTC Act Section 5, with recent enforcement actions focusing on various types of personal data that the FTC considers to be sensitive. As with the state privacy laws discussed above, however, this authority generally does not extend to employment-related uses of personal information. We may also, but on a much more limited extent, be subject to international privacy laws and regulations, such as the General Data Privacy Regulation in the European Union, Canada's Personal Information Protection and Electronic Documents Act, and other related privacy laws in the countries where we have employees or obtain third party services. While these laws are generally more stringent than those currently enforced in the United States, we have very limited operations in international jurisdictions, and none of those operations are customer-facing, thus further reducing our risk. However, we continue to comply with all applicable laws in these international locations, with specific assurance that we are meeting all requirements concerning the protection and use of employee personal information. Although we make reasonable efforts to comply with all applicable laws and regulations and have invested and continue to invest human and technological resources into data privacy compliance efforts, there can be no assurance that we will not be subject to regulatory action, including fines, in the event of an incident or other claim. We, or our third-party service providers, could be adversely affected if legislation or regulations are expanded or interpreted to require changes to business practices. Further, any inability to adequately address privacy concerns in connection with our solutions, or comply with applicable privacy or data protection laws, regulations, and policies, could result in additional cost and liability to us, and adversely affect our ability to offer our solutions. Privacy laws and regulations, as well as any associated inquiries or investigations or any other government actions, may be costly to comply with, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to remedies that may harm our business, including fines, or demands or orders that we modify or cease existing business practices, including data deletion and algorithmic disgorgement. We expect that new industry standards, laws, and regulations will continue to be proposed regarding privacy, data protection, and information security in many jurisdictions. Specifically, data processing associated with emerging technologies, and data sets utilizing sensitive personal information, are coming under increased regulatory scrutiny, such as those related to biometrics, AI, and automated decision-making. These evolutionary areas of privacy concern may create additional requirements for compliance, including privacy impact assessments, which aim to have companies document the risks associated with the processing of high-risk data are now essential but create additional work. We also suspect that compliance with AI-related legal obligations will be our greatest challenge, as we continue to stretch our business and operating models to utilize AI to increase efficiency and reduce workload strain. Such obligations may include modified and expanded governance programs, outcome-based testing, pre-use notices, end user rights such as access and opt-out rights, human monitoring, and intervention controls, and regulatory reporting. Ongoing monitoring of these laws and compliance with their evolving requirements will be challenging, time consuming, and expensive, and federal regulators, state attorneys general, and plaintiff's attorneys have been, and will likely continue to be, active in this space. Additionally, nuanced legal arguments related to consumer protection online, continue to require awareness. Specifically, the selling and sharing of personal information by businesses for digital advertising and marketing purposes remains a priority of regulators, including the FTC and California Attorney General. Further, recent years have seen a dramatic proliferation of plaintiff's attorney-driven class action litigation, individual litigation, arbitrations, and demand letters related to Internet-based technologies such as website cookies and pixels, tracking technologies, chatbots, and AI tools, and there is little sign that this trend will abate in the near-term. To the contrary, we expect both regulators and plaintiff's attorneys to continue to seek to apply these legal theories to an ever-expanding list of technologies and data processing activities. Collectively, this stresses the importance of proper cataloging of websites and a governance structure for the deployment of third party technologies, including cookies, pixels, and other tracking technologies, by business teams and third parties. Relatedly, website owners and operators have seen a wave of putative class actions, individual civil actions, single and mass arbitration demands, and demand letters filed against them in recent years, under the California Invasion of Privacy Act and similar federal and state surveillance and wiretapping laws, with claims centering on companies' deployment of web- and app-based tracking technologies (including cookies, pixels, scripts, and software development kits), session monitoring, key logging, chatbots, and other tracking and monitoring technologies. These legal claims, based on the reemergence of old laws retrofitted for a modern society, create novel issues of law and fact that may require extended litigation to resolve, as inconsistency among court rulings, rendering the likelihood and dollar amount of potential liability and/or settlement value difficult to accurately quantify. In sum, a data breach or any failure to comply with any applicable privacy or consumer protection-related laws, regulations, or other principles could adversely affect our reputation, brand, and business, and may result in fines, enforcement actions, sanctions, claims (including claims for damages by affected individuals), investigations, proceedings, or actions against us by governmental entities or others. This could have a material adverse effect on our business as we spend time tending to these issues and/or are forced to change our operations. Moreover, the proliferation of vendor security incidents increases these potential risks and costs even in cases where the attack did not target us, occur on our IT Systems, or result from any action or inaction by us. Depending on the nature of the information compromised, we may also have obligations to notify users, law enforcement, regulators, business partners or payment companies about the incident and provide some form of remedy, such as refunds or identity theft monitoring services, for the individuals affected by the incident.

The COVID-19 pandemic, including the measures taken to mitigate its spread, had adverse effects on our business and operations. A future pandemic or health epidemic, could adversely impact our business and results of operations in a number of ways. For example, the COVID-19 pandemic and measures taken to mitigate the spread of COVID-19 had far-reaching direct and indirect impacts on many aspects of our operations, including termination of in-store demonstration services and certain other services, as well as on consumer behavior and purchasing patterns. In particular, our Experiential Services segment experienced a significant decline in revenues, primarily due to the temporary suspension or reduction of certain in-store demonstration services and decreased demand in our digital marketing services, both of which we believe were caused by the COVID-19 pandemic and the various governmental and private responses to the pandemic. We cannot predict the full extent to which a future pandemic or health epidemic, may have similar or other adverse effects on our business, financial condition, results of operations and liquidity, and the degree to which it may impact other risk factors described in this Annual Report.