What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-03-12 compared with 2024-03-14 · 120 added, 136 removed, 608 unchanged (30% of the section changed)

5 unchanged sentences

Unfavorable conditions, including inflationary pressure, in the global economy or the industries we serve could limit our ability to grow our business and negatively affect our operating results.

General worldwide economic conditions have created significant instability in recent years.

For example, inflation rates have fluctuated significantly in recent periods, and increased inflation may result in decreased demand for our products and solutions, increases in our operating costs (including our labor costs), reduced liquidity and limitations on our ability to access credit or otherwise raise capital.

In addition, the Federal Reserve has raised, and may again raise, interest rates in response to concerns about inflation, which coupled with reduced government spending and volatility in financial markets may have the effect of further increasing economic uncertainty and heightening these risks.

Additionally, financial markets around the world experienced volatility following the invasion of Ukraine by Russia in February 2022 and escalating conflicts in the Middle East in late 2023.

Further, concerns have recently arisen with respect to the financial condition of a number of banking organizations in the United States, in particular those with exposure to certain types of depositors and large portfolios of investment securities.

While we do not have any exposure to banking organizations that have entered receivership or become insolvent, we do maintain our cash at financial institutions, at times in balances that exceed the current insurance limits set forth by the Federal Deposit Insurance Corporation (the "FDIC").

If other banks and financial institutions enter receivership or become insolvent in the future due to financial conditions affecting the banking system and financial markets, our ability to access our cash, cash equivalents and investments, including our ability to transfer funds, make payments or receive funds, may be threatened and could have a material adverse effect on our business and financial condition.

Our operating results may vary based on the impact of unfavorable changes in our industry or the global economy on us or our customers and potential customers.

Negative or unstable conditions in the general economy, including conditions resulting from resulting from a global or domestic recession or the fear thereof, the imposition of tariffs in the United States and abroad, fluctuations in inflation and interest rates, changes in gross domestic product growth, financial and credit market fluctuations, political turmoil and regulatory changes, natural catastrophes, lower corporate earnings, reduction in business confidence and activity, warfare, including the Russia-Ukraine war and conflict in the Middle East, and terrorist attacks on the United States, Europe, the Asia-Pacific region, or elsewhere could cause a decrease in business and consumer spending and negatively affect the growth of our business and our results of operations.

These conditions make it extremely difficult for marketers and us to accurately forecast and plan future business activities and could cause marketers to begin or continue to reduce or delay their marketing spending.

2 unchanged sentences

In addition, our business may be materially and adversely affected by weak economic conditions in the industries that we serve.

We have historically generated a substantial majority of our revenue from marketers in the restaurant, brick and mortar retail, telecommunications and cable industries, and have expanded into new industries such as everyday spend, specialty retail, restaurant, travel and entertainment.

All of these industries have been negatively impacted by inflationary pressure and certain precautions taken to control inflationary pressure.

4 unchanged sentences

Period-to-period comparisons of our operating results should not be relied upon as an indication of our future performance.

Given our relatively short operating history and the rapidly evolving purchase intelligence industry, our historical operating results may not be useful in predicting our future operating results.

Given our relatively short operating history and the rapidly evolving nature of our industry, our historical operating results may not be useful in predicting our future operating results.

Factors that may impact our quarterly operating results include the factors set forth in this "Risk Factors" section, as well as the following:

1 unchanged sentence

• the amount and timing of revenue, operating costs and capital expenditures related to the operations and expansion of our business, particularly with respect to our efforts to attract new marketers and partners to our network;

• the revenue mix revenue generated from our operations in the U.S.

• the revenue mix generated from our operations in the U.S.

• the revenue mix generated from the operations of Cardlytics and its subsidiaries;

• decisions made by our FI partners to increase Consumer Incentives or use their Partner Share to fund their Consumer Incentives;

• decisions made by our FI partners to not allow certain offers to appear in some or all of their channels;

• changes in the economic prospects of marketers, the industries that we primarily serve, or the economy generally, which could alter marketers' spending priorities or budgets;

15 unchanged sentences

If we fail to meet or exceed expectations for our operating results for these or any other reasons, the market price of our stock could fall and we could face costly lawsuits, including securities class action suits.

We may not be able to sustain our revenue and billings growth rate in the future.

Our revenue increased 4% to $309.2 million in 2023 from $298.5 million in 2022 and increased 12% to $298.5 million in 2022 from $267.1 million in 2021.

Our billings increased 2% to $453.4 million in 2023 from $442.5 million in 2022 and increased 12% to $442.5 million in 2022 from $394.1 million in 2021.

We may not be able to maintain year-over-year revenue and billings growth in the near term or at all, and you should not consider our revenue and billings growth in any specific historical periods as indicative of our future performance.

Our revenue and billings may be negatively impacted in future periods due to a number of factors, including slowing demand for our solutions, increasing competition, decreasing growth of our overall market, inflationary pressure, our inability to engage and retain a sufficient number of marketers or partners, or our failure, for any reason, to capitalize on growth opportunities.

We may not achieve or sustain revenue and billings growth in the future.

Our revenue decreased 10.0% to $278.3 million in 2024 from $309.2 million in 2023.

Our billings decreased 2.1% to $443.8 million in 2024 from $453.4 million in 2023.

We may not be able to achieve or maintain year-over-year billings growth and may not see revenue growth in the near term or at all, and you should not consider our revenue and billings growth in any specific historical periods as indicative of our future performance.

Our revenue and billings may be negatively impacted in future periods due to a number of factors, including, but not limited to, slowing demand for our solutions, increasing competition, decreasing growth of our overall market, inflationary pressure, our inability to engage and retain a sufficient number of marketers or partners, or our failure, for any reason, to capitalize on growth opportunities.

If we are unable to maintain consistent revenue, revenue growth or billings growth, our stock price could be volatile, and it may be difficult for us to achieve and maintain profitability.

2 unchanged sentences

Our operating results could suffer due to:

• lack of continued participation by FI partners in our network or our failure to attract new FI partners;

• lack of continued participation by FI partners in our network, in whole or in part, or our failure to attract new FI partners;

• any decline in demand for the Cardlytics platform by marketers or their agencies;

3 unchanged sentences

• the introduction by competitors of products and technologies that serve as a replacement or substitute for, or represent an improvement over, the Cardlytics platform, or an FI partner’s decision to implement any existing or future product or technology of a competitor alongside, or in lieu, of the Cardlytics platform;

• FI partners developing, or acquiring, their own technology to support purchase intelligence marketing or other incentive programs;

• FI partners developing, or acquiring, their own products, technology, or lines of business to support transaction-based marketing or other incentive programs;

• technological innovations or new standards that the Cardlytics platform does not address;

6 unchanged sentences

We must have FI partners with a sufficient number of customers and levels of customer engagement to ensure that we have robust purchase data and marketing space to support a broad array of incentive programs for marketers.

In addition, we pay most of our FI partners a Partner Share, which is a negotiated and fixed percentage of our billings less certain costs.

During the years ended December 31, 2024, 2023 and 2022, our top three FI partners combined to account for over 85%, 85% and 80%, respectively, of the total Partner Share we paid to all partners.

During 2023, the top FI partner represented over 50% and the second and third largest FI partners represented over 10% of Partner Share.

During 2022 and 2021 the top two FI partners represented over 20% and 25%, respectively, and the third largest FI partner represented over 10%, of Partner Share for each period.

During 2024 and 2023 the top FI partner represented over 50% and the second and third largest FI partners each represented over 10% of Partner Share.

During 2022, the top two FI partners represented over 20% and 25%, respectively, and the third largest FI partner representing over 10% of Partner Share for each period.

No other partner accounted for over 10% of Partner Share during these periods.

Our agreements with a substantial majority of our FI partners have three- to seven-year terms, but are generally terminable by the FI partner on 90 days or more prior notice.

Additionally, our agreements with our FI partners generally do not require us to serve as their sole offer provider, or require our FI partners to publish any given offer on their channels, and they could therefore, reduce their reliance on our solutions during the term of the applicable agreement.

If an FI partner terminates its agreement with us, we would lose that FI partner as a source of purchase data and online banking customers.

6 unchanged sentences

• if legislation is passed restricting the dissemination, or our use, of the data that is currently provided to us, or if judicial interpretations result in similar limitations.

To the extent that we breach or are alleged to have breached the terms of our agreement with any FI partner, or a disagreement arises with an FI partner regarding the interpretation of our contractual arrangements, which has occurred in the past and may occur again in the future, such an FI partner may be more likely to cease providing us data or to terminate its agreement with us.

The loss of Chase, Bank of America, Wells Fargo or any other significant FI partner would significantly harm our business, results of operations and financial conditions.

To the extent that we breach or are alleged to have breached the terms of our agreement with any FI partner, or a disagreement arises with an FI partner regarding the interpretation of our contractual arrangements, which has occurred in the past and may occur again in the future, such FI partner may be more likely to cease providing us data, reduce its reliance on us, or terminate its agreement with us.

The loss of any of Chase, Bank of America, Wells Fargo or any other significant FI partner, or their reduced reliance on us or our solutions, would significantly harm our business, results of operations and financial conditions.

We may fail to meet our publicly announced guidance or other expectations about our business and future operating results, which would cause our stock price to decline.

6 unchanged sentences

If we fail to maintain our relationships with current FI partners or attract new FI partners, we may not be able to sufficiently grow our revenue, which could significantly harm our business, results of operations and financial condition.

Our ability to grow our revenue depends on our ability to maintain our relationships with current FI partners and attract new FI partners.

Our ability to grow our revenue depends on our ability to maintain our relationships with current FI partners, both holistically and at the current level of service we provide them, and attract new FI partners.

A significant percentage of consumer credit and debit card spending is concentrated with the 10 largest FIs in the U.S., five of which are currently part of our network, while the balance of card spending is spread across thousands of smaller FIs.

3 unchanged sentences

Our future success will depend, in part, on our ability to expand into new industries.

We have historically generated a substantial majority of our revenue from marketers in the restaurant, brick and mortar retail, telecommunications and cable industries, and have expanded into new industries such as travel and entertainment, direct-to-consumer, grocery and gas, and believe that our future success will depend, in part, on our ability to expand adoption of our solutions in new industries.

We have historically generated a substantial majority of our revenue from marketers in the restaurant, brick and mortar retail, telecommunications and cable industries, and have expanded into the gas, grocery, travel and entertainment industries, and believe that our future success will depend, in part, on our ability to expand adoption of our solutions in new industries.

As we market to a wider group of potential marketers and their agencies, we will need to adapt our marketing strategies to meet the concerns and expectations of customers in these new industries.

4 unchanged sentences

If we are unable to successfully market our solutions to appeal to marketers and their agencies in new industries, we may not be able to achieve our growth or business objectives.

An actual or perceived breach of the security of our systems, or those of third parties upon which we rely, could result in adverse consequences resulting from such breach, including but not limited to a disruption of our operations, reputational harm, loss of revenue or profits, loss of customers, regulatory investigations or actions, litigation, fines and penalties and other adverse consequences.

An actual or perceived breach of the security of our systems, or those of third parties with whom we work, could result in adverse consequences resulting from such breach, including but not limited to a disruption of our operations, reputational harm, loss of revenue or profits, loss of customers, regulatory investigations or actions, litigation, fines and penalties and other adverse consequences.

We leverage our FI partners' purchase data and infrastructures to deliver our Cardlytics platform.

We do not currently receive or have access to any PII from our FI partners, although we may obtain or have access to PII from our FI partners in the future as our business evolves.

We do not currently receive or have access to any personal data from our FI partners, although we may obtain or have access to personal data from our FI partners in the future as our business evolves.

Additionally, we receive, collect, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and have access to personal data as a result of other aspects of our business.

1 unchanged sentence

There is a risk that actors may attempt to gain access to our systems, for the purpose of stealing personal data, sensitive or proprietary data, accessing sensitive information on our network, or disrupting our or their respective operations.

Cyberattacks, malicious internet-based activity and online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information systems, and those of the third parties upon which we rely.

Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a

variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, and ability to provide our service.

In addition to traditional computer "hackers," we and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), threat actors, software bugs, malicious code (such as viruses and worms), employee theft or misuse, denial-of-service attacks, credential attacks, credential harvesting, and ransomware attacks, sophisticated nation-state and nation-state supported actors now engage in attacks (including advanced persistent threat intrusions).

During times of war and other major conflicts, we, the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, and ability to provide our service.

In addition to traditional computer "hackers," we and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), threat actors, software bugs, malicious code (such as viruses and worms), malware (including:

as a result of advanced persistent threat intrusions), employee theft or misuse, denial-of-service attacks, credential attacks, credential harvesting, and ransomware attacks, sophisticated nation-state and nation-state supported actors now engage in attacks (including advanced persistent threat intrusions).

We also may be the subject of viruses, malware installation, server malfunction, software or hardware failures, loss of data or other computer assets, adware, malicious or unintentional actions or in actions by employees or others with authorized access to our network that create or expose vulnerabilities, attacks enhanced or facilitated by artificial intelligence ("AI"), and other similar threats or other similar issues.

2 unchanged sentences

Current or future criminal capabilities, discovery of existing or new vulnerabilities in our systems and attempts to exploit those vulnerabilities or other developments may compromise the technology protecting our systems.

Due to a variety of both internal and external factors, including defects or misconfigurations of our technology, our services could become vulnerable to security incidents (both from intentional attacks and accidental causes) that cause them to fail to secure networks and detect and block attacks.

Due to a variety of both internal and external factors, including defects or misconfigurations of our technology, our services have in the past and may in the future become vulnerable to security incidents (both from intentional attacks and accidental causes) that cause them to fail to secure networks and detect and block attacks.

In the event that our protection efforts are unsuccessful, and our systems are compromised such that a third party gains entry to our or any of our FI partners' systems, we could suffer substantial harm.

In addition, many of our employees work remotely, which may make us more vulnerable to cyberattacks and has increased risks to our systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations.

In addition, many of our employees work remotely, which makes us more vulnerable to cyberattacks and has increased risks to our systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations.

A security breach could result in operational or administrative disruptions, or impair our ability to meet our marketers' requirements, which could result in decreased revenue.

Also, our reputation could suffer irreparable harm, causing our current and prospective marketers and FI partners to decline to use our solutions in the future.

We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and other functions.

Future or past business transactions (such as acquisitions or integrations) could expose us to additional

cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies.

Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

We utilize third parties to operate critical business systems and to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and other functions.

Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place.

If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences.

While we may be entitled to damages if our third-party service providers fail to satisfy their data privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences.

While we may be entitled to damages if the third parties fail to satisfy their data privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners' supply chains have not been compromised.

5 unchanged sentences

Vulnerabilities could be exploited and result in a security incident.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely.

A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform.

technologies, dealing with regulatory scrutiny, and litigating and resolving legal claims, all of which could divert resources and the attention of our management and key personnel away from our business operations.

Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents.

Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

In any event, an actual or perceived breach of the security of our, or the third parties on which we rely, systems or data could materially harm our business, financial condition and operating results.

Certain of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties with whom we work.

A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our platform.

Further, we could expend significant financial and operational resources to protect against or in response to a security incident, including repairing system damage, increasing cybersecurity protection costs by deploying additional personnel and protection technologies, dealing with regulatory scrutiny, and litigating and resolving legal claims, all of which could divert resources and the attention of our management and key personnel away from our business operations.

Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services.

Such disclosures and related actions are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

In any event, an actual or perceived breach of the security of our, or the third parties with whom we work, systems or data could materially harm our business, financial condition and operating results.

Security incidents and associated consequences may prevent or cause customers to stop using our platform, deter new customers from using our platform, and negatively impact our ability to grow and operate our business.

3 unchanged sentences

The successful assertion of one or more large claims against us that exceeds available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results and reputation.

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Additionally, sensitive information of the Company could be leaked, disclosed, or revealed as a result of or in connection with our employees', personnel's, or vendors' use of generative AI technologies.

Our business could be adversely affected if marketers or their agencies are not satisfied with our solutions or our systems and infrastructure fail to meet their needs.

14 unchanged sentences

If we are unable to respond to these changes or fully and effectively implement them in a cost-effective and timely manner, our solutions may become ineffective, we may lose marketers and/or partners, and our business, financial condition and operating results may be negatively impacted.

If we fail to generate sufficient revenue to offset our contractual commitments to FIs, our business, results of operations and financial conditions could be harmed.

We had a minimum Partner Share commitment to a certain FI partner totaling $10.0 million over a 12-month period which ended on March 31, 2023.

The Partner Share shortfall totaled $4.5 million, which is included within Partner Share liability on our condensed consolidated balance sheet.

We have paid, or are paying, this shortfall on a quarterly basis from October 1, 2023 through June 30, 2024.

During the years ended December 31, 2023 and 2022, we recognized $1.3 million and $3.2 million, respectively, of expected minimum Partner Share commitment shortfalls within Partner Share and other third-party costs on our condensed consolidated statements of operations.

As of December 31, 2023, we paid $1.2 million of our shortfall.

To the extent that we are unable to generate revenue from marketers sufficient to offset our Partner Share commitments and other obligations, our business, results of operations and financial conditions could be harmed.

We derive a material portion of our revenue from a limited number of marketers, and the loss of one or more of these marketers could adversely impact our business, results of operations and financial conditions.

Our revenue and accounts receivable are diversified among a large number of marketers segregated by both geography and industry.

During the years ended December 31, 2023 and 2022 our top five marketers accounted for 15% of our revenue for each period, with no marketer representing over 10% during each of 2023 and 2022.

During the year ended December 31, 2021 our top five marketers accounted for 27% of our revenue, with one marketer accounting for over 10% during 2021.

During the years ended December 31, 2024, December 31, 2023 and December 31, 2022, our top five marketers accounted for 16%, 15% and 15% of our revenue, respectively, with no marketer accounting for over 10% during each period.

As of December 31, 2024 and 2023, our top five marketers accounted for 17% and 19% of our accounts receivable, respectively, with no individual marketer representing over 10% as of the end of each period.

21 unchanged sentences

We have spent the last several years and significant resources building out technology integrations with our partners to facilitate the delivery of incentive programs to our partners' customers and measure those customers subsequent in-store or digital spending.

We are also reliant on our network of partners to promote their digital incentive programs, increase customer awareness and leverage additional customer outreach channels like email, all of which can increase customer engagement.

We believe that key factors in the success and effectiveness of our incentive program include the level of accessibility and prominence of the program on the partners' website and mobile applications, as well as the user interface through which a customer is presented with marketing content.

We are also reliant on our network of partners to promote their digital incentive programs and our offers that appear on these programs, increase customer awareness and leverage additional customer outreach channels like email, all of which can increase customer engagement.

We believe that key factors in the success and effectiveness of our incentive program include the level of accessibility and prominence of the program on the partners' website and mobile applications and the accessibility and prominence of our offers within these programs, as well as the user interface through which a customer is presented with marketing content.

In certain cases, we have little control over the prominence of the incentive program and design of the user interface that our partners choose to use.

To the extent that our partners de-emphasize incentive programs, make incentive programs difficult to locate on their website or mobile applications or fail to provide a user interface that is appealing to partners' customers, partners' customers may be less likely to engage with the incentive programs, which could negatively impact the amount of fees that we are able to charge our marketer customers in connection with marketing campaigns, and, therefore, our revenue.

To the extent that our partners de-emphasize incentive programs or our offers that appear on these programs, make incentive programs difficult to locate on their website or mobile applications or fail to provide a user interface that is appealing to partners' customers, partners' customers may be less likely to engage with the incentive programs or our offers that appear on these programs, which could negatively impact the amount of fees that we are able to charge our marketer customers in connection with marketing campaigns, and, therefore, our revenue.

In addition, a failure by our partners to properly deliver or sufficiently promote marketing campaigns may reduce the efficacy of our solutions and impair our ability to attract and retain marketers and their agencies.

4 unchanged sentences

Further, we believe that there is, and will continue to be, significant competition for sales personnel with the skills and technical knowledge that we require.

Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, integrating and retaining sufficient numbers of sales personnel to support our growth.

New hires require significant training, and it may take significant time before they achieve full productivity.

29 unchanged sentences

We operate in an emerging industry and future demand and market acceptance for our solutions is uncertain.

We believe that our future success will depend in large part on the growth, if any, of the market for purchase intelligence.

We believe that our future success will depend in large part on the growth, if any, of the market for transaction-based marketing solutions.

Utilization of consumer purchase data to inform marketing is an emerging industry and future demand and market acceptance for this type of marketing is uncertain.

If the market for purchase intelligence does not continue to develop or develops more slowly than we expect, our business, financial condition and operating results could be harmed.

If the market in which we participate does not continue to develop or develops more slowly than we expect, our business, financial condition and operating results could be harmed.

The market in which we participate is competitive and we may not be able to compete successfully with our current or future competitors.

The market for purchase intelligence is nascent and we believe that there is no one company with which we compete directly across our range of solutions.

The market for transaction-based marketing and analytics is nascent and we believe that there is no one company with which we compete directly across our range of solutions.

With respect to the Cardlytics platform, we believe that we are the only company that enables marketing through FI channels at scale, although we believe we currently have competition from other companies that deliver similar solutions on a smaller scale.

In the future, we may face competition from online retailers, credit card companies, established enterprise software companies, advertising and marketing companies and agencies, digital publishers and mobile pay providers with access to a substantial amount of consumer purchase data.

While we may successfully partner with a wide range of companies that are only moderately competitive to us, these companies may become more competitive to us in the future.

2 unchanged sentences

In addition, our industry is evolving rapidly and is becoming increasingly competitive.

Larger and more established companies may focus on purchase intelligence marketing and could directly compete with us.

Larger and more established companies may focus on transaction-based marketing and could directly compete with us.

Smaller companies could also launch new products and services that we do not offer and that could gain market acceptance quickly.

7 unchanged sentences

To attract, retain and increase new marketers and partners, we will need to expand and enhance our solutions to meet changing needs, add functionality and address technological advancements.

Specifically, we have largely migrated to a cloud-based solution hosted by Amazon Web Services.

If we are unable to adapt our solutions to evolving trends in the marketing industry, if we are unable to properly identify and prioritize appropriate solution development projects or if we fail to develop and effectively market new solutions or enhance existing solutions to address the needs of existing and new marketers and partners, we may not be able to achieve or maintain adequate market acceptance and penetration of our solutions, or our solutions may become less competitive or obsolete.

14 unchanged sentences

We rely on several third parties to assist us in matching our anonymized identifiers with third-party identifiers.

This matching process enables us to, among other things, use purchase intelligence to measure in-store and online campaign sales impact or provide marketers with valuable visibility into the behaviors of current or prospective customers both within and outside the context of their marketing efforts.

This matching process enables us to, among other things, use transaction data to measure in-store and online campaign sales impact or provide marketers with valuable visibility into the behaviors of current or prospective customers both within and outside the context of their marketing efforts.

If any of these key data providers were to withdraw or withhold their identifiers from us, our ability to provide our solutions could be adversely affected, and certain marketers may severely limit their spending on our solutions or stop spending with us entirely.

22 unchanged sentences

As of December 31, 2024, we had 454 full-time employees.

We intend to further expand our overall headcount and operations, with no assurance that we will be able to do so while effectively maintaining our corporate culture.

We may further expand our overall headcount and operations, with no assurance that we will be able to do so while effectively maintaining our corporate culture.

We believe our corporate culture is one of our fundamental strengths as it enables us to attract and retain top talent and deliver superior results for our customers.

22 unchanged sentences

Our international sales and operations subject us to additional risks that can adversely affect our business, operating results and financial condition.

During the years ended 2023, 2022 and 2021, we derived 5.8%, 7.8% and 7.8%, respectively, of our revenue from outside the U.S.

During 2024 and 2023, we derived 8.7% and 5.8%, respectively, of our revenue from outside the U.S.

While substantially all of our operations are located in the U.S., we have an office in the U.K.

11 unchanged sentences

• the global economic uncertainty and financial market conditions;

• reduction in billings associated with the U.K as well as issues related to foreign currency exchange rates and trade with the,U.K.;

• reduction in billings associated with the U.K.

as well as issues related to foreign currency exchange rates and trade with foreign jurisdictions;

• contractual and legislative restrictions or changes;

3 unchanged sentences

Bribery Act, import and export control laws, tariffs, trade barriers, economic sanctions and other regulatory or contractual limitations on our ability to sell our products in certain foreign markets, and the risks and costs of non-compliance;

• potential changes in a specific country's or region's political or economic climate, including the current hostilities between Russia and Ukraine and conflict in the Middle East;

• potential changes in a specific country's or region's political or economic climate, including ongoing international tension and conflict;

• heightened risks of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results, which may also result in restatements of financial statements or irregularities in financial statements;

17 unchanged sentences

Due to our international operations, we may be exposed to the effects of fluctuations in currency exchange rates, including inflationary pressure.

We generate revenue and incur expenses for employee compensation and other operating expenses at our U.K.

office in the local currency.

We generate revenue and incur expenses for employee compensation and other operating expenses at our foreign offices in the local currency.

Fluctuations in the exchange rates between the U.S.

dollar and British pound could result in the dollar equivalent of such revenue and expenses being lower, which could have a negative net impact on our reported operating results.

dollar and foreign currencies could result in the dollar equivalent of such revenue and expenses being lower, which could have a negative net impact on our reported operating results.

Although we may in the future decide to undertake foreign exchange hedging transactions to cover a portion of our foreign currency exchange exposure, we currently do not hedge our exposure to foreign currency exchange risks.

53 unchanged sentences

If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support our business growth, service our indebtedness and respond to business challenges could be significantly impaired, and our business may be adversely affected.

Through our consumer application, users accumulate rewards that could be deemed subject to abandoned property laws and/or could be deemed to constitute stored value subject to certain legal requirements under applicable state and federal laws and regulations.

The Dosh application enables consumers to accumulate non-monetary rewards ("Dosh Rewards") within the application, which may be converted to U.S.

dollars only when certain requirements are met.

Dosh Rewards have no cash value but users are able to receive U.S.

dollar payouts from Dosh based on Dosh Rewards provided that certain requirements are met.

State regulators could deem that Dosh Rewards constitute property that is subject to state property laws, which could potentially create a large liability for us as well as legal and related compliance obligations and costs to manage escheatment of any Dosh Rewards constituting abandoned property.

Additionally, state and/or federal regulators could conclude that Dosh Rewards constitute monetary value or money and therefore subject to regulation pursuant to laws regulating the issuance, sale, redemption, and maintenance of stored value, prepaid access, or gift cards (or similar terminology).

Such laws and regulations may include, but are not necessarily limited to, U.S.

state money-transmitter licensing laws and the federal Bank Secrecy Act (including registration requirements), and our failure to comply with applicable laws could expose us to monetary penalties or damages and adversely affect our ability to operate our business in its current form.

Bringing new FI partners into our network can require considerable time and expense and can be long and unpredictable.

Bringing new FI partners into our network may require considerable time and expense and can be long and unpredictable.

Our FI partners and FI partner prospects engage in highly regulated businesses, are often slow to adopt technological innovation and have rigorous standards with respect to providing third parties, like us, with access to their data.

6 unchanged sentences

Ultimately, if additions to our FI partner's network are not realized in the time period expected or not realized at all, or if an FI partner terminates its agreement with us, our business, financial condition and operating results could be adversely affected.

Bringing new FI partners into our network may impede our ability to accurately forecast the performance of our network.

Bringing new FI partners into our network may impede our ability to accurately predict how certain marketing campaigns will perform, and thus may impede our ability to accurately forecast the performance of our network.

Bringing new FI partners into our network, or changes made by our existing FI partners, may impede our ability to accurately forecast the performance of our network.

Bringing new FI partners into our network, or changes made by our existing FI partners, may impede our ability to accurately predict how certain marketing campaigns will perform, and thus may impede our ability to accurately forecast the performance of our network.

Such inaccurate predictions could result in marketing campaigns underperforming, which impacts the total fees we can collect from marketers, or over performing, which may result in us paying certain Consumer Incentives to consumers without adequate compensation from the marketers.

The amount of time it will take us to be able to understand the impact of a new FI partner on our network is uncertain and difficult to predict.

The amount of time it will take us to be able to understand the impact of a new FI partner on our network or changes made by an existing FI partner is uncertain and difficult to predict.

Additionally, our understanding of the impact of any given FI partner is subject to change at any time, as such understanding can be impacted by factors such as changes to an FI partner's business strategy, changes to an FI partner's user interface, or changes in the behavior or makeup of an FI partner's consumer base.

6 unchanged sentences

If we fail to successfully promote and maintain our brand or incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract enough new marketers or partners or retain our existing marketers or partners and our business could suffer.

Risks Related to our Outstanding Convertible Senior Notes

Risks Related to our Indebtedness

Servicing our debt may require a significant amount of cash.

We may not have sufficient cash flow from our business to pay our indebtedness, and we may not have the ability to raise the funds necessary to settle for cash conversions of the Notes or to repurchase the Notes for cash upon a fundamental change, which could adversely affect our business and results of operations.

In September 2020, we issued convertible senior notes with an aggregate principal amount of $230.0 million bearing an interest rate of 1.00% due on September 15, 2025 (the "Notes").

The interest rate is fixed at 1.00% per annum and is payable semi-annually in arrears on March 15 and September 15 of each year, beginning on March 15, 2021.

Our ability to make scheduled payments of the principal of, to pay interest on or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control.

In September 2020, we issued convertible senior notes with an aggregate principal amount of $230.0 million bearing an interest rate of 1.00% due on September 15, 2025 (the "2020 Convertible Senior Notes").

The interest rate for the 2020 Convertible Senior Notes is fixed at 1.00% per annum and is payable semi-annually in arrears on March 15 and September 15 of each year, beginning on March 15, 2021.

In April 2024, we issued of $172.5 million principal amount of our 4.25% Convertible Senior Notes due 2029 (the "2024 Convertible Senior Notes", and together with the 2020 Convertible Senior Notes, the "Notes"), and used $169.3 million, consisting of the net proceeds from the offering, together with cash on hand, to repurchase for cash $183.9 million in aggregate principal amount of the 2020 Convertible Senior Notes.

The interest rate for the 2024 Convertible Senior Notes is fixed at 4.25% per annum and is payable semi-annually in arrears on April 1 and October 1 of each year, beginning on October 1, 2024.

Additionally, we had $60.0 million of unused available borrowings under our 2018 Line of Credit.

Borrowings under our 2018 Line of Credit bear an interest rate equal to the prime rate plus 0.125%.

Our ability to make scheduled payments of the principal of, to pay interest on or to refinance our indebtedness, including the Notes and any borrowings under our 2018 Line of Credit, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control.

Our business may not generate cash flows from operations in the future that are sufficient to service our debt.

If we are unable to generate such cash flows, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive.

Our ability to refinance any future indebtedness will depend on the capital markets and our financial condition at such time.

Our ability to refinance any existing or future indebtedness will depend on the capital markets and our financial condition at such time.

We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations.

In addition, any of our future debt agreements may contain restrictive covenants that may prohibit us from adopting any of these alternatives.

In addition, our 2018 Line of Credit contains and our future debt agreements may contain restrictive covenants that may limit our ability to or prohibit us from adopting any of these alternatives.

Our failure to comply with these covenants could result in an event of default which, if not cured or waived, could result in the acceleration of our debt.

Holders of the Notes have the right to require us to repurchase their Notes upon the occurrence of a fundamental change (as defined in the indenture governing the Notes) at a repurchase price equal to 100% of the principal amount of the Notes to be repurchased, plus accrued and unpaid interest, if any.

Holders of the Notes have the right to require us to repurchase their Notes upon the occurrence of a fundamental change (as defined in the indentures governing the 2020 Convertible Senior Notes and 2024 Convertible Senior Notes, respectively) at a repurchase price equal to 100% of the principal amount of the Notes to be repurchased, as applicable, plus accrued and unpaid interest, if any.

Upon conversion, unless we elect to deliver solely shares of our common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the Notes being converted.

We may not have enough available cash or be able to obtain financing at the time we are required to make repurchases in connection with such conversion and our ability to pay may additionally be limited by law, by regulatory authority or by agreements governing our existing and future indebtedness.

Our failure to repurchase the Notes at a time when the repurchase is required by the indenture governing the Notes or to pay any cash payable on future conversions as required by such indenture would constitute a default under such indenture.

A default under the indenture or the fundamental change itself could also lead to a default under agreements governing our existing and future indebtedness.

Our failure to repurchase the Notes at a time when the repurchase is required by the indentures governing the Notes, as applicable, or to pay any cash payable on future conversions as required by such indenture would constitute a default under such indenture.

A default under an indenture or the fundamental change itself could also lead to a default under agreements governing our existing and future indebtedness.

If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions thereof.

10 unchanged sentences

In addition, if we incur additional indebtedness, the risks related to our business and our ability to service or repay our indebtedness would increase.

The conditional conversion feature of the Notes, if triggered, may adversely affect our financial condition and results of operations.

In the event the conditional conversion feature of the Notes is triggered, holders of Notes will be entitled to convert the Notes at any time during specified periods at their option.

If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity.

In addition, even if holders do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The conditional conversion feature of either series of Notes, if triggered, may adversely affect our financial condition and results of operations.

In the event the conditional conversion feature of either series of Notes is triggered, holders of such Notes will be entitled to convert their Notes at any time during specified periods at their option.

If one or more holders elect to convert their Notes, as applicable, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity.

In addition, even if holders do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the applicable series of Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

Transactions relating to our Notes may affect the value of our common stock.

2 unchanged sentences

If holders of our Notes elect to convert their Notes, we may settle our conversion obligation by delivering to them a significant number of shares of our common stock, which would cause dilution to our existing stockholders.

In addition, in connection with the pricing of the Notes, we entered into capped call transactions (the "Capped Calls") with certain financial institutions (the "Option Counterparties").

The Capped Calls are expected generally to reduce the potential dilution to our common stock upon any conversion or settlement of the Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted Notes, as the case may be, with such reduction and/or offset subject to a cap.

In connection with establishing their initial hedges of the Capped Calls, the Option Counterparties or their respective affiliates entered into various derivative transactions with respect to our common stock and/or purchased shares of our common stock concurrently with or shortly after the pricing of the Notes.

From time to time, the Option Counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivative transactions with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the Notes (and are likely to do so following any conversion of the Notes, any repurchase of the Notes by us on any fundamental change repurchase date, any redemption date, or any other date on which the Notes are retired by us, in each case, if we exercise our option to terminate the relevant portion of the Capped Calls).

This activity could cause a decrease and/or increased volatility in the market price of our common stock.

We do not make any representation or prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the price of the Notes or our common stock.

In addition, we do not make any representation that the Option Counterparties will engage in these transactions or that these transactions, once commenced, will not be discontinued without notice.

We are subject to counterparty risk with respect to the Capped Calls.

The Option Counterparties are financial institutions, and we will be subject to the risk that any or all of them might default under the Capped Calls.

Our exposure to the credit risk of the Option Counterparties will not be secured by any collateral.

Past global economic conditions have resulted in the actual or perceived failure or financial difficulties of many financial institutions.

If an Option Counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at that time under the Capped Calls with such Option Counterparty.

Our exposure will depend on many factors but, generally, an increase in our exposure will be correlated to an increase in the market price and in the volatility of our common stock.

In addition, upon a default by an Option Counterparty, we may suffer adverse tax consequences and more dilution than we currently anticipate with respect to our common stock.

We can provide no assurances as to the financial stability or viability of the Option Counterparties.

Risks Related to Regulatory and Intellectual Property Matters

1 unchanged sentence

and foreign privacy and data security laws, rules, contractual obligations, regulation, industry standards, policies and other obligations related to data privacy and security.

The actual or perceived failure by us, our partners, or other third parties whom we rely upon to comply with such obligations could lead to regulatory investigations or actions, litigation (including class claims), mass arbitration demands, disruptions of our business operations, or loss of customers or sales, harm our reputation, result in significant expense or loss of revenue or profits, subject us to significant fines and liability or otherwise adversely affect our business.

The actual or perceived failure by us, our partners, or other third parties with whom we work to comply with such obligations could lead to regulatory investigations or actions, litigation (including class action claims), mass arbitration demands, disruptions of our business operations, or loss of customers or sales, harm our reputation, result in significant expense or loss of revenue or profits, subject us to significant fines and liability or otherwise adversely affect our business.

In the ordinary course of business, we collect, receive, store, process, use, generate, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share personal data and other sensitive information including proprietary and confidential business data, trade secrets, and intellectual property ("process" or "processing") necessary to operate our business, for legal and marketing purposes, and for other business-related purposes.

We, our FI partners, our marketers and other third parties whom we rely upon are subject to a number of data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy policies, contractual requirements, and other obligations relating to data privacy and security as well as laws and regulations regarding online services and the Internet generally.

In the U.S., the rules and regulations to which we, directly or contractually through our partners, or our marketers may be subject, include but are not limited to those promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act and state cybersecurity, privacy and breach notification laws, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents.

We, our FI partners, our marketers and other third parties with whom we work are subject to a number of data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy policies, contractual requirements, and other obligations relating to data privacy and security as well as laws and regulations regarding online services and the Internet generally.

In the U.S., the rules and regulations to which we, directly or contractually through our partners, or our marketers are or may be subject, include but are not limited to those promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act and state cybersecurity, privacy and breach notification laws, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents.

The regulatory framework for online services and data privacy and security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future.

2 unchanged sentences

A number of existing bills are pending in the U.S.

Congress that contain provisions that would regulate how companies can use various tracking technologies to collect and utilize user information.

federal and state legislatures that contain provisions that would regulate how companies can use various tracking technologies to collect and utilize user information.

Additionally, new legislation proposed or enacted in various states will continue to shape the data privacy environment nationally.

The California Consumer Privacy Act ("CCPA"), which took effect on January 1, 2020, is an example of the trend towards increasingly comprehensive privacy legislation being introduced in the United States.

The California Consumer Privacy Act ("CCPA") is an example of the trend towards increasingly comprehensive privacy legislation being introduced in the U.S.

The CCPA gives California residents expanded rights to request access to and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is used.

The CCPA also increases the data privacy and security obligations on entities handling personal data, which is broadly defined under the law.

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches, and includes statutorily defined damages of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages, which is expected to increase data breach litigation.

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches, and includes statutorily defined damages for intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages, which is expected to increase data breach litigation.

The CCPA also imposes requirements on businesses that "sell" information (which is defined broadly under the CCPA);

there is significant ambiguity regarding what constitutes a sale and many of our or our partner's business practices may qualify.

Further the California Privacy Rights Act ("CPRA"), which took effect on January 1, 2023, significantly modifies the CCPA, including by expanding consumers' rights with respect to certain sensitive personal data.

Further the California Privacy Rights Act ("CPRA") significantly modifies the CCPA, including by expanding consumers' rights with respect to certain sensitive personal data.

The CPRA also created a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA.

In the past few years, other states, including Virginia, Colorado, Utah, Iowa, Montana, Indiana, Tennessee, Oregon, Texas, Delaware, New Jersey, New Hampshire and Connecticut, have also passed comprehensive privacy laws that impose certain obligations on covered businesses, including requiring covered businesses to provide specific disclosures in privacy notices and to afford residents with certain rights concerning their personal data.

In the past few years, numerous states have also passed comprehensive privacy laws that impose certain obligations on covered businesses, including requiring covered businesses to provide specific disclosures in privacy notices and to afford residents with certain rights concerning their personal data.

Similar laws are being considered in several other states, as well as at the federal and local levels.

These developments may further complicate compliance efforts, and may increase legal risk and compliance costs for us and the third parties upon whom we rely.

Outside of the United States, an increasing number of laws, regulations, and industry standards may govern data privacy and security.

These developments may further complicate compliance efforts, and may increase legal risk and compliance costs for us and the third parties with whom we work.

Outside of the U.S., an increasing number of laws, regulations, and industry standards govern data privacy and security.

For example, the European Union's General Data Protection Regulation ("EU GDPR") and the United Kingdom's GDPR ("U.K.

5 unchanged sentences

Additional European Union member state laws of this type may follow.

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries.

In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the U.S.

or other countries.

Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries.

2 unchanged sentences

and other countries whose privacy laws it believes are inadequate.

Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.

Other jurisdictions may adopt, or have already adopted, similarly stringent data localization and cross-border data transfer laws.

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and U.K.

1 unchanged sentence

Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S.

If there is no lawful manner for us to transfer personal data from the EEA, the U.K., or other jurisdictions to the U.S., or if the requirements for a legally compliant transfer are

too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business.

If there is no lawful manner for us to transfer personal data from the EEA, the U.K., or other jurisdictions to the U.S., or if the requirements for a legally compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business.

Additionally, companies that transfer personal data out of the EEA and U.K.

1 unchanged sentence

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of the EEA for allegedly violating GDPR's cross-border data transfer limitations.

Our employees and personnel may use generative AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations.

Furthermore, our business relies on the acquisition and sale of personal data, including data obtained from third-party data suppliers.

The acquisition and sale of personal data from or to third parties has become subject to increased regulatory scrutiny.

For example, California's Delete Act requires the CPPA to establish, by January 1, 2026, a mechanism to allow California consumers to submit a single, verifiable request to delete all of their personal information held by all registered data brokers and their service providers.

Moreover, third-party data suppliers have recently been subject to increased litigation under various claims of violating certain state privacy laws.

Obtaining and selling personal data from third parties carries risk to us.

These challenges may make it so difficult for us and our suppliers to provide the data and the costs associated with the data materially increase or may materially decrease the availability of data that we or our data suppliers can provide.

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations.

Governments have passed and are likely to pass additional laws regulating generative AI.

2 unchanged sentences

In addition to data privacy and security laws, we are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful.

We publish privacy policies, marketing materials and other statements regarding data privacy and security.

If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresent our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Obligations related to data privacy and security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty.

We publish privacy policies, marketing materials, white papers and other statements, such as statements related to compliance with certain certifications or self-regulatory principles concerning data privacy and security.

Regulators in the U.S.

are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresent our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Our business is materially reliant on revenue from behavioral, interest-based, or tailored advertising (collectively, "targeted advertising"), but delivering targeted advertisements is becoming increasingly difficult due to changes to our ability to gather information about user behavior through third-party platforms, new laws and regulations, and consumer resistance.

Major technology platforms on which we rely to gather information about consumers have adopted or proposed measures to provide consumers with additional control over the collection, use, and sharing of their personal data for targeted advertising purposes.

In addition, legislative proposals and present laws and regulations regulate the use of cookies and other tracking technologies, electronic communications, and marketing.

Partially as a result of these developments, individuals are becoming increasingly resistant to the collection, use, and sharing of personal data to deliver targeted advertising.

Individuals are now more aware of options related to consent, "do not track" mechanisms (such as browser signals from the Global Privacy Control), and "ad-blocking" software to prevent the collection of their personal data for targeted advertising purposes.

As a result, we may be required to change the way we market our products, and any of these developments or changes could materially impair our ability to reach new or existing customers or otherwise negatively affect our operations.

Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty.

Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions.

4 unchanged sentences

We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations.

Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations.

If we or the third parties which we rely upon fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including, but not limited to:

Moreover, despite our efforts, our personnel or third with whom we work may fail to comply with such obligations, which could negatively impact our business operations.

If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including, but not limited to:

government enforcement actions (which could result in investigations, fines, penalties, audits and inspections), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal data and orders to destroy or not use personal data.

6 unchanged sentences

and other jurisdictions, all of which provide only limited protection and may not now or in the future provide us with a competitive advantage.

As of the date of filing, we had sixteen issued patents relating to our software.

As of the date of filing, we had seventeen issued patents relating to our software.

We cannot assure you that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated or circumvented.

Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringements.

We have registered, or are registering, the "Cardlytics," "Dosh," "Bridg" and "Rippl" names and logos in the U.S.

We have registered, or are in the process of attempting to register, the "Cardlytics," "Dosh," "Bridg" and "Rippl" names and logos in the U.S.

and certain other countries.

60 unchanged sentences

sanctions or export control laws, it could result in substantial fines and penalties for us and for the individuals working for us.

Changes in export or import laws or corresponding sanctions may delay the introduction and sale of our products in international markets, or, in some cases, prevent the export or import of our products to certain countries, regions, governments, persons or entities altogether, which could adversely affect our business, financial condition and

results of operations.

countries, regions, governments, persons or entities altogether, which could adversely affect our business, financial condition and results of operations.

We are also subject to various domestic and international anti-corruption laws, such as the U.S.

1 unchanged sentence

Bribery Act, as well as other similar anti-bribery and anti-kickback laws and regulations.

These laws and regulations generally prohibit companies and their employees and intermediaries from authorizing, offering or providing improper payments or benefits to officials and other recipients for improper purposes.

These laws and regulations generally prohibit companies and their employees and intermediaries from directly or indirectly authorizing, offering or providing improper payments or benefits to officials and other recipients for improper purposes.

We rely on certain third parties to support our sales and regulatory compliance efforts and can be held liable for their corrupt or other illegal activities, even if we do not explicitly authorize or have actual knowledge of such activities.

77 unchanged sentences

Our business and operations could be negatively affected if we become subject to any securities litigation or stockholder activism, which could cause us to incur significant expenses, hinder the execution of our business and growth strategy and impact the price of our common stock.

We have been the subject of a putative securities class action lawsuit and stockholder activism in the past and may again in the future.

In the past, securities class action litigation often has been brought against companies following a decline in the market price of such companies' securities.

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors