Digital Turbine (APPS) Risk Analysis

Our intellectual property is an essential element of our business. We rely on a combination of copyright, trademark, trade secret, patent, and other intellectual property rights. We face risks associated with our trademarks. For example, there is a risk that our international trademark applications may be considered too generic or that the words "Digital" or "Turbine" could be separately or compositely trademarked by third parties with competitive products who may try and block our applications or sue us for trademark dilution, which could have adverse effects on our financial status and operations. We also seek to maintain certain intellectual property as trade secrets. The secrecy could be compromised by third parties or by our employees, which could cause us to lose the competitive advantage resulting from these trade secrets. Despite our efforts to protect our intellectual property rights, unauthorized parties may attempt to copy or otherwise to obtain and use our intellectual property. Monitoring unauthorized use of our intellectual property, and enforcing our rights, is difficult and costly, and we cannot be certain the steps we have taken will prevent infringement, piracy, and other unauthorized uses of our intellectual property, particularly internationally where the laws may not protect our intellectual property rights as fully as in the U.S., or where our intellectual property is not registered. We may have to resort to litigation to enforce our intellectual property rights, which could result in substantial costs and diversion of our management and resources. In addition, although we require third parties to sign agreements not to disclose or improperly use our intellectual property, it may still be possible for third parties to obtain and improperly use our intellectual properties without our consent.

Third parties may sue us for intellectual property infringement or initiate proceedings to invalidate our intellectual property, either of which, if successful, could prevent or limit our use of the intellectual property and disrupt the conduct of our business, cause us to pay significant damage awards or require us to pay licensing fees. In the event of a successful claim against us, we might be enjoined from using such intellectual property, we might incur significant licensing fees, and we might be forced to develop alternative technologies. Our failure or inability to develop non-infringing technology or software or to license the infringed or similar technology or software on a timely basis could force us to withdraw products and services from the market or prevent us from introducing new products and services, and consequently may materially affect our ability to fulfill our contractual obligations towards carriers and customers, as well as limit our expansion efforts. In addition, even if we are able to license the infringed or similar technology or software, license fees could be substantial and the terms of these licenses could be burdensome, which might adversely affect our operating results. We might also incur substantial expenses in defending against third-party infringement claims, regardless of their merit. Successful infringement or licensing claims against us might result in substantial monetary liabilities and might materially disrupt the conduct of our business.

Our products, services, and systems rely on software, including software developed or maintained internally and/or by third parties, including through the use of AI, which is highly technical and complex. In addition, our products, services, and systems depend on the ability of such software to transfer, store, retrieve, process, and manage large amounts of data. The software on which we rely has contained, and may now or in the future contain, undetected errors, bugs, or vulnerabilities. Some errors may only be discovered after the code has been released for external or internal use. Errors or other design defects within the software on which we rely may result in a negative experience for customers and marketers who use our products, delay product introductions or enhancements, result in measurement or billing errors, or compromise our ability to protect the data of our users and/or our intellectual property. Any errors, bugs, vulnerabilities, or defects discovered in the software on which we rely could result in damage to our reputation, loss of users, loss of revenue, or liability for damages, any of which could adversely affect our business and financial results.

We and our products are dependent on complex information technology systems and could be exposed to information technology system failures or network disruptions caused by natural disasters, accidents, power disruptions, telecommunications failures, acts of terrorism or war, computer viruses, physical or electronic break-ins, ransomware or other cybersecurity incidents, or other events or disruptions. System upgrades, redundancy, and other continuity measures may be ineffective or inadequate, and our or our vendors' business continuity and disaster recovery planning may not be sufficient for all eventualities. Such failures or disruptions can adversely impact our business by, among other things, preventing access to our online services, interfering with customer transactions, or impeding the development of our products. These events could materially adversely affect our business, reputation, results of operations, and financial condition.

Our business depends on the continued proliferation of mobile connected devices, such as smartphones and tablets, which can connect to the internet over a cellular, wireless, or other network, as well as the increased consumption of content through those devices. Consumer usage of these mobile connected devices may be inhibited for a number of reasons, such as: - inadequate network infrastructure to support advanced features beyond just mobile web access;- users' concerns about the security of these devices;- inconsistent quality of cellular or wireless connections;- unavailability of cost-effective, high-speed Internet service;- changes in network carrier pricing plans that charge device users based on the amount of data consumed; and - new technology which is not compatible with our products and offerings. For any of these or other reasons, users of mobile connected devices may limit the amount of time they spend on these devices and the number of applications or amount of content they download on these devices. If user adoption of mobile connected devices and consumer consumption of content on those devices do not continue to grow, our total addressable market size may be significantly limited, which could compromise our ability to increase our revenue and our ability to become profitable.

Technology changes in the wireless industry require us to anticipate, sometimes years in advance, which technologies we must implement and take advantage of to make our products and services, and other mobile entertainment products, competitive in the market. Further, policy changes or restrictions applied to mobile operating systems might affect our ability to implement our products and services. We usually start our product development with a range of technical development goals that we hope to be able to achieve. We may not be able to achieve these goals, or our competitors may be able to achieve them more quickly and effectively than we can. In either case, our products and services may be technologically inferior to those of our competitors, less appealing to customers or end users, or both. If we cannot achieve our technology goals within our original development schedule, then we may delay their release until these technology goals can be achieved, which may delay or reduce our revenue, increase our development expenses, and harm our reputation. Alternatively, we may increase our product development resources in an attempt either to preserve our product launch schedule or to keep up with our competition. In either case, our business, operating results, and financial condition could be materially affected.

To reach large numbers of wireless subscribers, application developers, and wireless carriers, we must support numerous mobile devices and technologies. Keeping pace with the rapid innovation of mobile device technologies together with the continuous introduction of new, and often incompatible, mobile device models by wireless carriers requires us to make continuous investments in product development and maintenance, including talent, technologies, and equipment. In the future, we may be required to make substantial investments in our development if the number of different types of mobile device models continues to proliferate. In addition, as more advanced mobile devices are introduced that enable more complex, feature-rich products and services, we anticipate our product development and maintenance costs will increase.

We operate in a developing industry. Our success depends on growth in the number of wireless subscribers who use their mobile devices to access data services we develop and distribute. New or different mobile content applications developed by our current or future competitors may be preferred by subscribers to our offerings. In addition, other mobile platforms may become widespread, and end users may choose to switch to these platforms. If the market for our products and services does not continue to grow or we are unable to acquire new customers or end users, our business growth and future revenue could be adversely affected. If customers or end users switch their advertising or entertainment spending away from the kinds of offerings that we provide, or switch to platforms or distribution where we do not have comparative strengths, our revenue would likely decline and our business, operating results and financial condition would suffer.

Mobile devices require multimedia capabilities enabled by operating systems capable of running applications, products, and services such as ours. Our development resources are concentrated in today's most popular operating systems, and we have experience developing applications for these operating systems. If these operating systems fall out of favor with mobile device manufacturers and wireless carriers and there is a rapid shift to a new technology where we do not have development experience or resources, the development period for our products and services may be lengthened, increasing our costs, and the resulting products and services may be of lower quality and may be published later than anticipated. In such an event, our reputation, business, operating results, and financial condition might suffer.

The governments of some countries have sought to regulate the methods and manner in which certain of our products and services may be marketed to potential end users. Furthermore, government actions or legislative, regulatory, or other legal developments relating to AI or advertising may impact our ability to deliver, target, or measure the effectiveness of advertising. Regulation aimed at prohibiting, limiting, or restricting various forms of advertising and promotion we use to market our products and services could also increase our cost of operations or preclude the ability to offer our products and services altogether.

Our platform relies on our ability to process the information of our customers and end users. These activities are regulated by a variety of federal, state, local, and international privacy, data governance, and data security laws and regulations, which have become increasingly stringent in recent years. Most jurisdictions in which we or our customers operate have enacted or are in the process of enacting privacy, data governance, and data security laws and regulations. In this regard, it is important to highlight the EU's General Data Protection Regulation ("GDPR") and UK GDPR that regulate the processing of personal data in the European Economic Area ("EEA") member states and in the UK. Both impose a strict data protection compliance regime. We are subject to the supervision of local data protection and data governance authorities in those EEA and UK jurisdictions where we are established or otherwise subject to the GDPR and the UK GDPR. Fines for certain breaches of the GDPR are significant. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease or change our processing of personal data, enforcement notices, or assessment notices for a compulsory audit. We may also face civil claims including representative actions and other class action type litigation, potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm. This private right of action may increase the likelihood of, and risks associated with data breach litigation. In addition to increasing our compliance costs and potential liability, the CCPA created restrictions on "sales" of personal information that may restrict the disclosure of personal information for advertising purposes. Our advertising business relies, in part, on such disclosure and could be materially and adversely affected by the CCPA's restrictions. Data privacy legislation imposes restrictions on cross-border personal data transfers, with some countries enacting data localization laws. Notably, the GDPR, UK GDPR, and other EU and UK data protection statutes generally bar personal data transfer from the EEA, UK, and Switzerland to the U.S. and many other nations, except to entities in countries offering adequate protection or with specific safeguards in place. When transferring personal data outside the EEA or UK to non-adequate countries, we ensure compliance with relevant laws, potentially utilizing derogation or implementing standard contractual clauses. Since November 2023, we have participated in the EU-U.S. Data Privacy Framework ("EU-U.S. DPF"), UK Extension to the EU-U.S. DPF ("UK Extension"), and Swiss-US Data Privacy Framework per the U.S. Department of Commerce. We have certified adherence to the EU-U.S. DPF Principles for data received from the EU and UK (including Gibraltar) and to the Swiss-U.S. DPF Principles for data received from Switzerland. Should the DPF be invalidated by the Court of Justice of the European Union ("CJEU") in the future, we may face challenges in EU-U.S. data transfers, necessitating the implementation of a CJEU-approved framework. Children's online privacy has been a focus of recent enforcement activity under longstanding privacy laws as well as privacy and data protection laws enacted in recent years worldwide. With increased enforcement of children's online privacy in the EU and the UK, the U.S. Federal Trade Commission and state attorneys general have also, in recent years, increased enforcement of the Children's Online Privacy Protection Act, and other U.S. State laws that restrict the processing of children's personal information without a parental consent. Recent and evolving age verification and online safety laws enacted in certain U.S. states and other jurisdictions may require additional compliance measures and technical changes, which could increase operating costs, affect user onboarding and engagement, or limit certain product features or business initiatives in some jurisdictions. We are also subject to the Digital Services Act ("DSA") (Regulation (EU) 2022/2065) effective as of November 2022 and was fully implemented on February 17, 2024, which is a comprehensive piece of legislation for consumer protection. The DSA focuses on content governance and moderation and applies to various online services. The DSA addresses several critical aspects related to online services, including providing a consistent framework for digital services offered in the EU, preventing illegal and harmful online activities, and protecting service recipients' fundamental rights. Additionally, certain privacy and data security laws extend rights to consumers and regulate automated decision making in ways that may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to litigation or regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, delete our models, or prevent or limit our use of AI/ML. For example, the Federal Trade Commission has required other companies to delete algorithms and models derived from or trained on allegedly unlawfully collected data, where it has alleged the company has violated privacy or consumer protection laws. Apart from the requirements of privacy, data governance, and data security laws, we have obligations relating to privacy, data governance and data security under our published policies, contracts, and applicable industry standards. Although we endeavor to comply with these obligations, we may have failed to do so in the past and may be subject to allegations that we have failed to do so or have otherwise processed data improperly. Additionally, our or our customers' sensitive, proprietary, or confidential information could be leaked, disclosed, or revealed as a result of or in connection with our employees', personnel's, or vendors' use of generative AI technologies. Any such information that we input into a third-party generative AI or ML platform could be revealed to others, including if information is used to train the third party's AI/ML models. Additionally, where an AI and/or ML model ingests personal information and makes connections using such data, those technologies may reveal other sensitive, proprietary, or confidential information generated by the model. As a result, we could face adverse consequences, including exposure to reputational and competitive harm, customer loss, and legal liability. We could be subject to enforcement action or litigation alleging that our methods of data collection or our other data processing practices violate our published policies, federal or state laws prohibiting unfair or deceptive business practices or other privacy laws. In response to the increasing restrictions of global privacy and data security laws, our customers have sought and may continue to seek increasingly stringent contractual assurances regarding our handling of personal information and may adopt internal policies that limit their use of our platform. In addition, privacy advocates and industry groups have regularly proposed, and may propose in the future, self-regulatory standards upon which we may be legally or contractually bound. If we fail to comply with these contractual obligations or standards, we may face substantial contractual liability or fines. Various jurisdictions around the world continue to propose new laws that regulate the privacy, data governance, and/or security of certain types of data or information. Complying with these laws, if enacted, would require significant resources, and leave us vulnerable to possible fines and penalties if we are unable to comply. Our obligations under privacy and data security laws, our contracts and applicable industry standards (including requirements by operating system platforms or app stores) are increasing, becoming more complex, and changing rapidly, which has increased and may continue to increase the cost and effort required to comply with them. The privacy and data security compliance challenges we and our customers face in the EU, the UK, the U.S., and other jurisdictions may also limit our ability to operate, or offer certain product features, in those jurisdictions, which could reduce demand for our solutions from customers subject to their laws. We may also be required to adapt our solutions to comply with changing regulations. Despite our efforts, we may not be successful in achieving compliance with these rapidly evolving requirements. We could be perceived to be in non-compliance with applicable privacy laws, especially when acquiring new companies and before we have completed our gap analysis and remediation. Any actual or perceived non-compliance could result in litigation and proceedings against us by governmental entities, customers, individuals, or others; fines and civil, criminal, or administrative penalties for us or company officials; obligations to cease offering or to substantially modify our solutions in ways that make them less effective in certain jurisdictions; negative publicity; harm to our brand and reputation and reduced overall demand for our solutions or reduced revenue. Such occurrences could materially and adversely affect our business, financial condition, and results of operations.

We are subject to anti-bribery and similar laws, such as the U.S. Foreign Corrupt Practices Act ("FCPA") of 1977, as amended, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the USA PATRIOT Act, U.S. Travel Act, the UK Bribery Act 2010 and Proceeds of Crime Act 2002, and possibly other anti-corruption, anti-bribery and anti-money laundering laws in countries in which we conduct business. Anti-corruption laws have been enforced with great rigor in recent years and are interpreted broadly. Such laws prohibit companies and their employees and their agents from making or offering improper payments or other benefits to government officials and others in the private sector. We have operations, deal with carriers, and make sales in countries known to experience corruption, particularly certain emerging countries in Eastern Europe, Latin America, and Asia. Further international expansion may involve more of these countries. Our activities in these countries create the risk of unauthorized payments or offers of payments by one of our employees, consultants, sales agents, or distributors that could be in violation of various laws including the FCPA, even though these parties are not always subject to our control. As we increase our international sales and business, particularly in countries with a low score on Transparency International's Corruption Perceptions Index and increase our use of third parties such as sales agents, distributors, resellers or consultants, our risks under these laws will increase. We adopt appropriate policies and procedures and conduct training, but cannot guarantee that improprieties will not occur. Noncompliance with these laws could subject us to investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, suspension and/or debarment from contracting with specified persons, the loss of export privileges, reputational harm, adverse media coverage, and other collateral consequences. Any investigations, actions and/or sanctions could have a material negative impact on our business, financial condition, and results of operations.

We maintain a significant business presence in Israel. Our operations, which include our product development, sales and marketing, and administrative functions, and personnel in Israel are directly affected by the ongoing hostilities and geopolitical instability in the Middle East, including the conflicts involving Israel, Gaza, Lebanon, Syria, and Iran. Israel has been and is currently involved in armed conflicts with multiple parties and remains the target of terrorist and military activity, including from Iranian-backed forces. The region has experienced periods of significant escalation, including direct hostilities between Israel and Iran, rocket and missile attacks from Hezbollah in Lebanon and militia forces in Syria, and other security threats. At this time, it is unknown whether hostilities in these regions will escalate into an even larger conflict. While our offices are open worldwide, including in Israel, and, to date, we have not had disruptions to our ability to operate and deliver products to customers, a prolonged conflict, further escalation, or expansion of hostilities could adversely affect our business.

On February 24, 2022, Russia launched an invasion of Ukraine that has resulted in an ongoing military conflict between the two countries (the "Russia-Ukraine Conflict"). The Russia-Ukraine Conflict has caused, and is currently expected to continue to cause, political, economic, and social instability, significant disruptions to the regional and the global economy, financial system, international trade, and the transportation and energy sectors, among others. In addition, the Russia-Ukraine Conflict has displaced millions of people, causing an acute refugee crisis in Europe, and has increased the threat of nuclear accidents or attacks, cyberattacks, and further regional or global conflicts (including a potential expansion of the Russia-Ukraine Conflict to other countries as well as other unrelated potential conflicts), among other potentially dire consequences. In response to Russia's actions, multiple countries and governing bodies, including the U.S. and the EU, have put in place global sanctions and other severe restrictions or prohibitions on the activities of certain individuals and businesses connected to Russia and/or Belarus. Companies have also implemented restrictions that severely limit, and in some cases, reverse or cancel, business transactions in or involving certain individuals and/or businesses connected to or associated with Russia and/or Belarus. Further, some companies have moved to divest of Russia-based subsidiaries and assets. In addition, the impacts of the Russia-Ukraine Conflict on the supply chain and commodity prices have been profound and resulted in substantial inflation in one or more countries (or globally). The ultimate impact of the Russia-Ukraine Conflict and its continued effect on the geopolitical environment and global economic and commercial activity and conditions, and on our operations, financial condition, and performance, and the duration and severity of those effects, is impossible to predict.